Allen-Bradley MicroLogix SQL Injection Vulnerability

Allen-Bradley MicroLogix is a programmable logic controller PLC from Rockwell Automation. An SQL injection vulnerability exists in Allen-Bradley MicroLogix 1100 prior to B FRN 15.000 and 1400 prior to B FRN 15.003. It allows an authenticated remote user to execute arbitrary SQL commands via...

UBUNTU-CVE-2015-5292

Memory leak in the Privilege Attribute Certificate PAC responder plugin sssdpacplugin.so in System Security Services Daemon SSSD 1.10 before 1.13.1 allows remote authenticated users to cause a denial of service memory consumption via a large number of logins that trigger parsing of PAC blobs duri...

DEBIAN-CVE-2015-5292

Memory leak in the Privilege Attribute Certificate PAC responder plugin sssdpacplugin.so in System Security Services Daemon SSSD 1.10 before 1.13.1 allows remote authenticated users to cause a denial of service memory consumption via a large number of logins that trigger parsing of PAC blobs duri...

CVE-2015-5292

The CVE-2015-5292 issue affects SSSD PAC responder (sssd_pac_plugin.so) in SSSD 1.10 up to, but not including, 1.13.1. The vulnerability permits remote authenticated users to trigger a denial of service via memory consumption by issuing many logins that parse PAC blobs during Kerberos authenticat...

CVE-2015-5669

Techno Project Japan Enisys Gw before 1.4.1 allows remote authenticated users to write to arbitrary files and consequently execute arbitrary code via unspecified vectors...

CVE-2015-6493

Cross-site request forgery CSRF vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors...

CVE-2015-5712

Spotfire Parsing Library and Spotfire Security Filter in TIBCO Spotfire Server 5.5.x before 5.5.4, 6.0.x before 6.0.5, 6.5.x before 6.5.4, and 7.0.x before 7.0.1 and Spotfire Analytics Platform before 7.0.2 for AWS Marketplace allow remote authenticated users to obtain sensitive system informatio...

CVE-2015-6491

Rockwell Automation MicroLogix 1100 and 1400 PLCs are affected by CVE-2015-6491. Specifically, MicroLogix 1100 controllers (Series B) with firmware version 14.000 and earlier are mitigated by updating to 15.000, while MicroLogix 1400 controllers (Series B) with firmware 15.003 and earlier require...

CVE-2015-6493

CVE-2015-6493 affects Infinite Automation Mango Automation versions 2.5.x through 2.6.x (up to 2.6.0 build 430). It is a Cross-Site Request Forgery (CSRF) vulnerability that can allow an authenticated remote attacker to hijack the victim’s session, with unspecified vectors. Public exploitation ev...

CVE-2015-5240

Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2, when using the ML2 plugin or the security groups AMQP API, allows remote authenticated users to bypass IP anti-spoofing controls by changing the device owner of a port to start with network: before the security group...

DEBIAN-CVE-2015-5251

OpenStack Image Service Glance before 2014.2.4 juno and 2015.1.x before 2015.1.2 kilo allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/...

CVE-2015-5286

OpenStack Image Service (Glance) is vulnerable in versions prior to 2014.2.4 (juno) and 2015.1.x prior to 2015.1.2 (kilo). A remote authenticated user can bypass storage quotas and cause a denial of service by deleting images that are being uploaded with a token that expires during the process. R...

CVE-2015-5251

CVE-2015-5251 affects OpenStack Image Service (Glance) prior to 2014.2.4 (juno) and 2015.1.x prior to 2015.1.2 (kilo). The issue allows remote authenticated users to bypass access restrictions and change the status of their images by sending HTTP header x-image-meta-status to images/*, enabling m...

CVE-2015-7699

The filesexternal app in ownCloud Server before 7.0.9, 8.0.x before 8.0.7, and 8.1.x before 8.1.2 allows remote authenticated users to instantiate arbitrary classes and possibly execute arbitrary code via a crafted mount point option, related to "objectstore."...

CVE-2015-5286

OpenStack Image Service Glance before 2014.2.4 juno and 2015.1.x before 2015.1.2 kilo allows remote authenticated users to bypass the storage quota and cause a denial of service disk consumption by deleting images that are being uploaded using a token that expires during the process. NOTE: this...

CVE-2015-6335

The policy implementation in Cisco FireSIGHT Management Center 5.3.1.7, 5.4.0.4, and 6.0.0 for VMware allows remote authenticated administrators to bypass intended policy restrictions and execute Linux commands as root via unspecified vectors, aka Bug ID CSCuw12839...

Unspecified Vulnerability in Oracle PeopleSoft Products (CNVD-2015-06954)

Oracle PeopleSoft Products is a suite of enterprise human capital management solutions from Oracle. An unspecified vulnerability exists in Oracle PeopleSoft Products 8.54. It allows a remote authenticated user to affect confidentiality and integrity by vectoring about PIA core technology...

Design/Logic Flaw

Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 10.1.3.5, 11.1.1.7, 11.1.1.9, 12.1.2.0, and 12.1.3.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Web Listener...

Unspecified Vulnerability in Oracle MySQL Server (CNVD-2015-06822)

Oracle MySQL Server is an open source relational database management system from Oracle. This database system is characterized by high performance, low cost, good reliability and so on. An unspecified vulnerability exists in Oracle MySQL Server version 5.6.23 and earlier. It allows an authenticat...

ownCloud Server Arbitrary SMB Command Execution Vulnerability

ownCloud Server is a free and open source personal cloud storage solution created by German KDE developer Frank Karlitschek; ownCloud Server is a server edition. An arbitrary SMB command execution vulnerability exists in ownCloud Server versions prior to 6.0.8, 8.0.4 prior to 8.0.x, and 7.0.6 pri...