Design/Logic Flaw

An unspecified action handler in the management console in Symantec Endpoint Protection Manager SEPM 12.1 before 12.1-RU6-MP1 allows remote authenticated users to read arbitrary files via unknown vectors...

WordPress < 3.7.9 / 3.8.9 / 3.9.7 / 4.1.6 / 4.2.3 Multiple Vulnerabilities

According to its version number, the WordPress application running on the remote web server is either version 3.7.x prior to 3.7.9, 3.8.x prior to 3.8.9, 3.9.x prior to 3.9.7, 4.1.x prior to 4.1.6, or 4.2.x prior to 4.2.3. It is, therefore, potentially affected by the following vulnerabilities : ...

HP System Management Homepage Cross-Site Request Forgery Vulnerability

HP System Management Homepage is a Web-based interface released by Hewlett-Packard HP. The interface consolidates and simplifies the single system management process SMH for HP servers running HP-UX, Linux and Microsoft Windows operating systems. A cross-site request forgery vulnerability exists ...

CVE-2015-1944

Cross-site scripting XSS vulnerability in IBM WebSphere Portal 8.0.0 before 8.0.0.1 CF17 and 8.5.0 before CF06 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-1961

The REST API in IBM Business Process Manager BPM 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to bypass intended access restrictions and execute arbitrary JavaScript code on the server via a...

Alcatel-Lucent CellPipe 7130 RG 5Ae.M2013 HOL Cross-Site Request Forgery Vulnerability

The Alcatel-Lucent CellPipe 7130 RG 5Ae.M2013 HOL is a router product from Alcatel-Lucent, France. A cross-site request forgery vulnerability in the Alcatel-Lucent CellPipe 7130 RG 5Ae.M2013 HOL using firmware version 1.0.0.20h.HOL allows remote attackers to construct malicious URIs, trick users...

Cisco IOS XR SSH Link Termination Denial of Service Vulnerability

Cisco IOS XR is a member of the Cisco IOS software family and uses a microkernel-based distribution operating system architecture. A security vulnerability in Cisco IOS XR SSH handling allows a remote authenticated user to disconnect the SSH link making the vty unstable and subsequent SSH or Teln...

Code injection

The WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain administrator privileges via an ivmembershipupdateusersettings action to wp-admin/admin-ajax.php...

FTP Media Server 3.0 - Authentication Bypass Denial of Service

FTP Media Server 3.0 - Authentication Bypass Denial of Service !/usr/bin/env python ================================================================================== Exploit Title: FTP Media Server 3.0 - Authentication Bypass and Denial of Service Date: 2015-05-25 Exploit Author: Wh1t3Rh1n0...

Cisco TelePresence Authentication Bypass Elevation of Privilege Vulnerability

Cisco TelePresence is a telepresence conferencing solution developed by Cisco. A security vulnerability exists in Cisco TelePresence TC and TE that allows a remote user in a broadcast or collision domain or a local user with physical access to bypass authentication and gain ROOT privileges...

[SECURITY] [DSA 3238-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3238-1 [email protected] http://www.debian.org/security/ Michael Gilbert April 26, 2015 http://www.debian.org/security/faq -...

CVE-2015-3143

cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015...

Design/Logic Flaw

Unspecified vulnerability in the XDK and XDB - XML Database component in Oracle Database Server 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote authenticated users to affect availability via unknown vectors...

CVE-2015-0673

Cisco Mobility Services Engine MSE 8.0110.0 allows remote authenticated users to discover the passwords of arbitrary users by 1 reading log files or 2 using an unspecified GUI feature, aka Bug ID CSCut24792...

IBM API Management Information Disclosure Vulnerability (CNVD-2015-01840)

IBM API Management is IBM's complete solution to help organizations securely create, manage and connect application program interfaces APIs to extend their products and services to a variety of mobile channels. IBM API Management 3.0.4.1 A vulnerability exists in the previous version 3.0 that...

IBM Maximo Asset Management Catalog Traversal Vulnerability

IBM Maximo Asset Management is a suite of IT asset management solutions from IBM USA. A directory traversal vulnerability exists in IBM Maximo Asset Management that could allow an authenticated remote user to read arbitrary files via a pathname...

KIE Workbench Arbitrary File Execution Vulnerability

KIE Workbench is a set of JAVA-based development of open source BPM business process management of the complete release , including all the BPM and rules module . An arbitrary file execution vulnerability exists in KIE Workbench 6.0.x that could allow an authenticated remote user to read or write...

IBM Maximo Asset Management Cross-Site Scripting Vulnerability

IBM Maximo Asset Management is a suite of IT asset management solutions from IBM USA. A cross-site scripting vulnerability exists in IBM Maximo Asset Management that allows a remote, authenticated user to inject arbitrary web script or HTML via unspecified vector 7...

PYSEC-2015-38

OpenStack Image Registry and Delivery Service Glance 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service disk consumption by creating a large number of images using the task v2 API and then deleting them, a different...

PYSEC-2015-37

OpenStack Image Registry and Delivery Service Glance 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service disk consumption by creating a large number of images using the task v2 API and then deleting them before the uploads...