PT-2015-5717

Name of the Vulnerable Software and Affected Versions PCRE versions prior to 8.36 Description The issue is related to the handling of certain internal recursive back references in regular expressions. Specifically, patterns like /a2|ag/ can cause a denial of service segmentation fault or possibly...

PT-2015-7786

Name of the Vulnerable Software and Affected Versions PCRE versions prior to 8.38 Description The issue concerns a denial of service buffer overflow that can be caused by remote attackers through crafted regular expressions. This can potentially have other unspecified impacts. The problem is...

CVE-2015-8135

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-7265. Reason: This candidate is a reservation duplicate of CVE-2015-7265. Notes: All CVE users should reference CVE-2015-7265 instead of this candidate. All references and descriptions in this candidate have been removed to...

Radancy: RC4 cipher suites detected

A group of researchers Nadhem AlFardan, Dan Bernstein, Kenny Paterson, Bertram Poettering and Jacob Schuldt have found new attacks against TLS that allows an attacker to recover a limited amount of plaintext from a TLS connection when RC4 encryption is used. The attacks arise from statistical fla...

pcre: infinite recursion compiling pattern with zero-repeated groups that include recursive back reference (8.36/19)

PCRE before 8.36 mishandles the /a\2|a\g/ pattern and related patterns with certain internal recursive back references, which allows remote attackers to cause a denial of service segmentation fault or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a...

CVE-2015-7808

creationtimestamp| type| source ---|---|--- 2015-11-05 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/38629 2015-11-23 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/38790 2017-07-11 02:04:41+00:00| published-proof-of-concept| https://t.me/HackingPublicoficial/162...

Revive Adserver: Login page password-guessing attack

Vulnerability description not provided...

USN-2776-1 linux vulnerabilities

It was discovered that the Linux kernel did not check if a new IPv6 MTU set by a user space application was valid. A remote attacker could forge a route advertisement with an invalid MTU that a user space daemon like NetworkManager would honor and apply to the kernel, causing a denial of service...

PicketLink: XXE via insecure DocumentBuilderFactory usage

It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the...

CVE-2015-5881

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-7760, CVE-2015-7761. Reason: this ID was intended for one issue, but was associated with two issues. Notes: All CVE users should consult CVE-2015-7760 and CVE-2015-7761 to identify the ID or IDs of interest. All references an...

Golang 1.4.3 CVE Fixes | Cloud Foundry

Golang 1.4.3 CVE Fixes Low Vendor Google Versions Affected Golang v1.4.2 and lower Description Several security issues were fixed in Go’s net / http package. The CVE issue descriptions and fixes are linked below: CVE-2015-5739 – ‘Content Length’ treated as valid header:...

ZeusCart 4 信息泄漏漏洞

No description provided by source. !/usr/bin/env python coding: utf-8 from urlparse import urljoin from pocsuite.net import req from pocsuite.poc import POCBase, Output from pocsuite.utils import register class TestPOCPOCBase: vulID = '11111 ' vul ID version = '1' author = 'Disorder' vulDate =...

Apple iOS Same Origin Policy Bypass Vulnerability

Apple iOS is an operating system for handheld devices developed by Apple Inc. Apple iOS suffers from a same-origin policy bypass vulnerability. It allows remote attackers to bypass the same-origin policy and obtain object references via customized event messages...

openSUSE Security Update : python-django (openSUSE-2015-598)

python Django was updated to fix a remote denial of service resource exhaustion possibility in the auth views module. bsc941587, CVE-2015-5963 Also issafeurl was made to reject URLs that start with control characters to mitigate possible XSS attack via user-supplied redirect URLs bnc923176,...

PT-2015-2085

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 9 Description The issue is related to a lack of protection for internal data in the WebKit component of the iOS operating system. This can be exploited by a remote attacker to bypass existing access restriction rule...

CVE-2015-6947

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-6946. Reason: This issue was MERGED into CVE-2015-6946 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions. Notes: All CVE users should reference CVE-2015-6946...

CVE-2015-1641

creationtimestamp| type| source ---|---|--- 2015-09-07 12:16:06+00:00| seen| MISP/55d34355-a218-49d2-9f4e-40bd950d210b 2015-09-08 14:44:42+00:00| seen| MISP/55eef158-bf34-4bd4-8933-4938950d210b 2016-02-08 10:35:40+00:00| seen| MISP/56b86d69-3b0c-465d-8eb3-0e57bce2ab96 2016-04-12 20:22:17+00:00|...

Mantis Bug Tracker 1.2.19 - Host Header

Mantis Bug Tracker 1.2.19 - Host Header Exploit Title: MantisBT 1.2.19 - Host header attack vulnerability Date: 07-09-2015 Exploit Author: Pier-Luc Maltais Centre opérationnel de sécurité informatique gouvernemental COSIG Vendor Homepage: https://www.mantisbt.org/ Software Link:...

RedHat Update for jakarta-taglibs-standard RHSA-2015:1695-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2014-2332

CheckMK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allows remote authenticated users to delete arbitrary files via a request to an unspecified link, related to "Insecure Direct Object References." NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2330...