CVE-2015-4355

Cross-site request forgery CSRF vulnerability in the Watchdog Aggregator module for Drupal allows remote attackers to hijack the authentication of administrators for requests that enable or disable monitoring sites via unspecified vectors...

CVE-2015-4353

Cross-site request forgery CSRF vulnerability in the Custom Sitemap module for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete sitemaps via unspecified vectors...

CVE-2015-4349

CVE-2015-4349 affects the Drupal Spider Contacts module. It is a Cross-Site Request Forgery (CSRF) vulnerability that enables an attacker to hijack administrator actions for requests that delete contact categories. The issue is tied to the Spider Contacts module (not Drupal core) and is mitigated...

CVE-2015-4353

The CVE-2015-4353 entry concerns Drupal’s Custom Sitemap contributed module, which is vulnerable to Cross-Site Request Forgery (CSRF). The issue allows an attacker to induce an administrator’s browser to perform actions that delete sitemaps, effectively hijacking admin actions via CSRF. Affected ...

CVE-2015-4350

The CVE-2015-4350 entry concerns Drupal’s Spider Catalog contributed module, which has CSRF vulnerabilities. The root cause is insufficient CSRF protection on certain URLs, allowing remote attackers to trigger administrator actions that delete products, ratings, or categories. The issue is tied t...

CVE-2015-4350

Multiple cross-site request forgery CSRF vulnerabilities in the Spider Catalog module for Drupal allow remote attackers to hijack the authentication of administrators for requests that delete 1 products, 2 ratings, or 3 categories via unspecified vectors...

xen-kernel -- vulnerability in the iret hypercall handler

The Xen Project reports: A buggy loop in Xen's compatiret function iterates the wrong way around a 32-bit index. Any 32-bit PV guest kernel can trigger this vulnerability by attempting a hypercalliret with EFLAGS.VM set. Given the use of get/putuser, and that the virtual addresses in question are...

Directory traversal

Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a .. dot dot in the file parameter in a jsonreturn action in the xclonershow page to wp-admin/admin-ajax.php...

CVE-2015-4108

Multiple cross-site request forgery CSRF vulnerabilities in Wing FTP Server before 4.4.7 allow remote attackers to hijack the authentication of administrators for requests that 1 execute arbitrary code via a crafted request to adminluascript.html or 2 add a domain administrator via a crafted...

CVE-2014-8606

Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a .. dot dot in the file parameter in a jsonreturn action in the xclonershow page to wp-admin/admin-ajax.php...

abrt: default abrt event scripts lead to information disclosure

It was found that the ABRT event scripts created a user-readable copy of an sosreport file in ABRT problem directories, and included excerpts of /var/log/messages selected by the user-controlled process name, leading to an information disclosure. The fix for this issue prevents non-privileged use...

CVE-2015-4010

Cross-site request forgery CSRF vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the iframeurl parameter in an Update Page action in the...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Test/WorkArea/DmsMenu/menuActions/MenuActions.aspx in Ektron Content Management System CMS before 9.10 SP1 Build 9.1.0.184.1.120 allows remote attackers to hijack the authentication of content administrators for requests that delete content via a...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the iframeurl parameter in an Update Page action in the...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to hijack the authentication of administrators...

VMWare Releases Security Updates for Multiple Products

VMWare has released four updates to address vulnerabilities in VMWare Workstation, Player, Fusion, and Horizon Client. Exploitation of some of these vulnerabilities could allow denial-of-service condition or remote code execution on the Windows OS running these programs. Users and administrators...

Microsoft Releases June 2015 Security Bulletin

Microsoft has released eight updates to address vulnerabilities in Microsoft Windows. Exploitation of some of these vulnerabilities could allow remote code execution or elevation of privileges. US-CERT encourages users and administrators to review Microsoft Security Bulletins MS15-056 through...

CVE-2015-2961

Cross-site request forgery CSRF vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to hijack the authentication of administrators...

CVE-2015-2999

Multiple SQL injection vulnerabilities in SysAid Help Desk before 15.2 allow remote administrators to execute arbitrary SQL commands via the 1 groupFilter parameter in an AssetDetails report to /genericreport, customSQL parameter in a 2 TopAdministratorsByAverageTimer report or an 3 ActiveRequest...

Unrestricted file upload

Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute arbitrary code by uploading a file with a .jsp extension, then accessing it via a direct request to the file in icons/userphoto/...