The vulnerability of the application interface of the IBM WebSphere Portal server allows a hacker to circumvent existing access restrictions.

The vulnerability of the IBM WebSphere Portal application server’s user interface is related to deficiencies in access control for certain functions. Exploiting this vulnerability could allow a malicious actor to bypass existing access restrictions by using a specially crafted request...

krb5: unauthenticated denial of service in recvauth_common() and others

It was found that the krb5readmessage function of MIT Kerberos did not correctly sanitize input, and could create invalid krb5data objects. A remote, unauthenticated attacker could use this flaw to crash a Kerberos child process via a specially crafted request...

OpenStack ironic-discoverd remote code execution vulnerability

OpenStack is a cloud platform management project. ironic-discoverd is one of the components that provides hardware internal self-testing service functionality. A security vulnerability exists in OpenStack ironic-discovered that allows remote attackers to exploit the vulnerability by submitting a...

IBM QRadar Security Information and Event Manager Denial of Service Vulnerability

IBM QRadar Security Information and Event Manager is a solution that consolidates log-sourced event data from thousands of devices and applications dispersed throughout the network. A security vulnerability exists in IBM QRadar Security Information and Event Manager, which can be exploited by...

The vulnerability of the Junos operating system, which allows a hacker to trigger a service failure

The vulnerability of the PFE daemon in the Junos operating system exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to trigger a service failure through a specially crafted request...

VMware ESXi 'SLPDProcessMessage()' function remote code execution vulnerability

VMware ESXi is a bare-metal virtualization hypervisor that is installed directly on a physical server and divides the physical server into multiple virtual machines. The program features less disk space, higher reliability and security. A remote code execution vulnerability exists in VMware ESXi,...

Avast Antivirus X.509 Certificate Remote Code Execution Vulnerability

Avast Antivirus is a suite of antivirus programs. Avast Antivirus handles X.509 certificates with a security vulnerability that allows remote attackers to exploit the vulnerability to submit a special request to execute arbitrary code...

PHP PHAR Denial of Service Vulnerability

PHP is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community. A denial-of-service vulnerability exists in PHP PHAR, which allows an attacker to submit a special request to crash an application, resulting in a denial of service...

Allen-Bradley MicroLogix Denial of Service Vulnerability

Allen-Bradley MicroLogix is a programmable logic controller PLC from Rockwell Automation. A denial of service vulnerability exists in the Allen-Bradley MicroLogix 1100 prior to B FRN 15.000 and 1400 prior to B FRN 15.003. Allows a remote attacker, via a crafted HTTP request, to launch a denial of...

Cross site request forgery (csrf)

IBM WebSphere Portal 8.5.0 before CF08 allows remote attackers to bypass intended access restrictions via a crafted request...

CVE-2015-4997

IBM WebSphere Portal 8.5.0 before CF08 allows remote attackers to bypass intended access restrictions via a crafted request...

ManageEngine Applications Manager CommonAPIUtil moveSubGroup haid tohaid SQL Injection

An SQL injection vulnerability exists in ManageEngine Applications Manager. This vulnerability is due to insufficient validation of the haid and tohaid parameters when processing requests using the moveSubGroup method of the CommonAPIUtil class. By sending crafted request messages, a remote...

Security update for haproxy (important)

haproxy was updated to fix two security issues. These security issues were fixed: - CVE-2015-3281: The bufferslowrealign function in HAProxy did not properly realign a buffer that is used for pending outgoing data, which allowed remote attackers to obtain sensitive information uninitialized memor...

Null pointer dereference

3S-Smart CODESYS Gateway Server before 2.3.9.48 allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted 1 GET or 2 POST request...

DEBIAN-CVE-2015-0275

The ext4zerorange function in fs/ext4/extents.c in the Linux kernel before 4.1 allows local users to cause a denial of service BUG via a crafted fallocate zero-range request...

Null pointer dereference

Runtime Toolkit before 2.4.7.48 in 3S-Smart CODESYS before 2.3.9.48 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted request...

CVE-2015-5640

baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request...

CVE-2015-5640

CVE-2015-5640 relates to baserCMS prior to 3.0.8. Multiple connected sources confirm a vulnerability where a logged-in, authenticated user can modify arbitrary user settings by sending a specially crafted request, effectively an access-control bypass. The impact described across advisories is tha...

Devellion CubeCart Password Reset Vulnerability

Devellion CubeCart is a free and open source e-commerce shopping cart software. The classes/admin.class.php script in Devellion CubeCart fails to properly validate that a password reset request is occurring, allowing a remote attacker to change the administrator password by sending a specially...

CVE-2015-5075

Cross-site request forgery CSRF vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of administrators for requests that create an administrative account via a crafted request to index.php/users/create...