CVE-2015-2999

CVE-2015-2999: SysAid Help Desk prior to 15.2 contains multiple SQL injection vulnerabilities. The injected vectors include (1) groupFilter in AssetDetails via /genericreport, (2) customSQL in TopAdministratorsByAverageTimer and (3) ActiveRequests via /genericreport, (4) dir parameter to HelpDesk...

Aruba Networks CPPM Remote Code Execution Vulnerability

Aruba Networks ClearPass Policy Manager is an advanced policy management platform for role- and device-based network access control. A security vulnerability exists in Aruba Networks ClearPass Policy Manager CPPM, which can be exploited by remote administrators to execute arbitrary code...

CVE-2015-4132

Multiple cross-site scripting XSS vulnerabilities in Aruba Networks ClearPass Policy Manager CPPM before 6.4.5 allow remote administrators to inject arbitrary web script or HTML via unspecified vectors...

Directory traversal

Directory traversal vulnerability in Aruba Networks ClearPass Policy Manager CPPM before 6.4.5 allows remote administrators to execute arbitrary files via unspecified vectors...

Sql injection

Multiple SQL injection vulnerabilities in Aruba Networks ClearPass Policy Manager CPPM before 6.4.5 allow remote administrators to execute arbitrary SQL commands via unspecified vectors...

Directory traversal

Directory traversal vulnerability in Aruba Networks ClearPass Policy Manager CPPM before 6.4.4 allows remote administrators to read arbitrary files via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Aruba Networks ClearPass Policy Manager CPPM before 6.4.5 allow remote administrators to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-1392

Multiple SQL injection vulnerabilities in Aruba Networks ClearPass Policy Manager CPPM before 6.4.5 allow remote administrators to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-1550

The vulnerability affects Aruba Networks ClearPass Policy Manager (CPPM). CPPM versions before 6.4.5 are vulnerable to a directory traversal flaw that allows remote administrators to execute arbitrary files via unspecified vectors. Root cause is a directory traversal vulnerability in CPPM, leadin...

CVE-2015-1551

CVE-2015-1551 affects Aruba Networks ClearPass Policy Manager (CPPM). It is a directory traversal vulnerability that allows remote administrators to read arbitrary files via unspecified vectors. The NVD entry specifies CPPM versions before 6.4.4. Related connected documents corroborate the vulner...

CVE-2015-1550

Directory traversal vulnerability in Aruba Networks ClearPass Policy Manager CPPM before 6.4.5 allows remote administrators to execute arbitrary files via unspecified vectors...

IBM WebSphere MQ Denial of Service Vulnerability (CNVD-2015-03364)

IBM WebSphere MQ is a messaging middleware product from IBM, USA. The product focuses on providing reliable and proven messaging for Service Oriented Architecture SOA. A denial of service vulnerability exists in IBM WebSphere MQ version 7.5 prior to 7.5.0.5 and version 8.0 prior to 8.0.0.2, which...

Sql injection

Multiple SQL injection vulnerabilities in the admin panel in osCMax before 2.5.1 allow 1 remote attackers to execute arbitrary SQL commands via the username parameter in a process action to admin/login.php or 2 remote administrators to execute arbitrary SQL commands via the status parameter to...

CVE-2012-1665

Multiple SQL injection vulnerabilities in the admin panel in osCMax before 2.5.1 allow 1 remote attackers to execute arbitrary SQL commands via the username parameter in a process action to admin/login.php or 2 remote administrators to execute arbitrary SQL commands via the status parameter to...

CVE-2015-0189

The cluster repository manager in IBM WebSphere MQ 7.5 before 7.5.0.5 and 8.0 before 8.0.0.2 allows remote authenticated administrators to cause a denial of service memory overwrite and daemon outage by triggering multiple transmit-queue records...

CVE-2015-3301

Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allows remote administrators to read arbitrary files via a .. dot dot in the tcpboxpath parameter in the checkouteditorsettings page to...

Directory traversal

Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allows remote administrators to read arbitrary files via a .. dot dot in the tcpboxpath parameter in the checkouteditorsettings page to...

CVE-2015-1397

SQL injection vulnerability in the getCsvFile function in the MageAdminhtmlBlockWidgetGrid class in Magento Community Edition CE 1.9.1.0 and Enterprise Edition EE 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularityfieldexpr parameter when the popularityfrom ...

CVE-2015-3458

The fetchView function in the MageCoreBlockTemplateZend class in Magento Community Edition CE 1.9.1.0 and Enterprise Edition EE 1.14.1.0 does not restrict the stream wrapper used in a template path, which allows remote administrators to include and execute arbitrary PHP files via the phar:// stre...

CVE-2015-1397

SQL injection vulnerability in the getCsvFile function in the MageAdminhtmlBlockWidgetGrid class in Magento Community Edition CE 1.9.1.0 and Enterprise Edition EE 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularityfieldexpr parameter when the popularityfrom ...