Camel: XXE in via SAXSource expansion

It was found that Apache Camel's XML converter performed XML External Entity XXE expansion. A remote attacker able to submit an SAXSource containing an XXE declaration could use this flaw to read files accessible to the user running the application server, and potentially perform other more...

libxml2: CPU exhaustion when processing specially crafted XML input

A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU...

libxml2: Out-of-bounds memory access

A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash...

libxml2: Out-of-bounds memory access

A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash...

libxml2: Out-of-bounds heap read when parsing file with unfinished xml declaration

A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information...

Cisco Adaptive Security Appliance Software Denial of Service Vulnerability (CNVD-2015-07836)

Cisco Adaptive Security Appliance Software is a modular platform that provides security and VPN services from Cisco. A denial of service vulnerability exists in Cisco Adaptive Security Appliance Software 8.4 that could allow an authenticated remote user to cause a denial of service via a crafted...

CVE-2015-6380

An unspecified script in the web interface in Cisco Firepower Extensible Operating System 1.11.160 on Firepower 9000 devices allows remote authenticated users to execute arbitrary OS commands via crafted parameters, aka Bug ID CSCux10622...

CVE-2015-6380: Improper Neutralization of Special Elements used in an OS Command

An unspecified script in the web interface in Cisco Firepower Extensible Operating System 1.11.160 on Firepower 9000 devices allows remote authenticated users to execute arbitrary OS commands via crafted parameters, aka Bug ID CSCux10622...

Cisco Firepower 9000 Firepower Extensible Operating System File Read Vulnerability

The Cisco Firepower Extensible Operating System on Firepower 9000 is an operating system from Cisco that runs in the 9000 series firewall appliances. A security vulnerability in Cisco Firepower Extensible Operating System 1.1 1.160 on Cisco Firepower 9000 devices allows remote attackers to read...

grub2: modules built in on EFI builds that allow loading arbitrary code, circumventing secure boot

It was discovered that grub2 builds for EFI systems contained modules that were not suitable to be loaded in a Secure Boot environment. An attacker could use this flaw to circumvent the Secure Boot mechanisms and load non-verified code. Attacks could use the boot menu if no password was set, or t...

CVE-2015-6369

The USB driver in Cisco Firepower Extensible Operating System 1.11.160 on Firepower 9000 devices allows physically proximate attackers to cause a denial of service via a crafted USB device that triggers invalid USB commands, aka Bug ID CSCux10531...

CVE-2015-6371

CVE-2015-6371 affects Cisco Firepower Extensible Operating System (FSO) 1.1(1.160) on Firepower 9000 devices. The issue arises from lack of input validation in parameters passed to certain user scripts, enabling remote authenticated users to read arbitrary files on the device via crafted script i...

CVE-2015-6369

The CVE-2015-6369 issue affects Cisco Firepower Extensible Operating System on Firepower 9000 devices (1.1(1.160)) via the USB driver. Root cause: insufficient sanitization of USB input parameters that allows a crafted USB device to trigger invalid kernel commands, enabling a local, unauthenticat...

CVE-2015-6370

The CVE-2015-6370 entry describes a local command-injection vulnerability in the Management I/O (MIO) CLI of Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices. The root cause is insufficient sanitization of user-supplied input in the CLI, allowing an authenticated l...

CVE-2015-6369: Improper Input Validation

The USB driver in Cisco Firepower Extensible Operating System 1.11.160 on Firepower 9000 devices allows physically proximate attackers to cause a denial of service via a crafted USB device that triggers invalid USB commands, aka Bug ID CSCux10531...

CVE-2015-6370: Improper Neutralization of Special Elements used in an OS Command

The Management I/O MIO component in Cisco Firepower Extensible Operating System 1.11.160 on Firepower 9000 devices allows local users to execute arbitrary OS commands as root via crafted CLI input, aka Bug ID CSCux10578...

CVE-2015-6371: Exposure of Sensitive Information to an Unauthorized Actor

Cisco Firepower Extensible Operating System 1.11.160 on Firepower 9000 devices allows remote authenticated users to read arbitrary files via crafted parameters to unspecified scripts, aka Bug ID CSCux10621...

CVE-2015-6368: Exposure of Sensitive Information to an Unauthorized Actor

Cisco Firepower Extensible Operating System 1.11.160 on Firepower 9000 devices allows remote attackers to read files via a crafted HTTP request, aka Bug ID CSCux10608...

CVE-2015-6374: Improper Input Validation

The web interface in Cisco Firepower Extensible Operating System 1.11.160 on Firepower 9000 devices does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, aka Bug ID...

DEBIAN-CVE-2015-8023

The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message...