PT-2017-6830 · Spring +1 · Spring Framework +1

Name of the Vulnerable Software and Affected Versions: Spring Framework versions 3.2.0 through 3.2.14 Spring Framework versions 4.0.0 through 4.1.7 Spring Framework versions 4.2.0 through 4.2.1 Description: The issue allows a malicious user to craft a URL that results in a response being download...

Open-Xchange (OX) App Suite Email Configuration Information Disclosure Vulnerability

Open-Xchange OX App Suite is prone to an information disclosure vulnerability. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program ...

Gentoo Security Advisory GLSA 201411-05

Gentoo Linux Local Security Checks GLSA 201411-05 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

PT-2015-6396

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions prior to 12.0.0 Enterprise Manager versions 3.0.0 through 3.1.1 Description A directory traversal issue exists in the configuration utility, allowing remote authenticated users to access arbitrary files in the web root...

KLA10668 File access vulnerability in QlikTech QlikView

XML external entity vulnerability was found in QlikView at AccessPoint.aspx. By exploiting this vulnerability malicious users can read arbitrary files. This vulnerability can be exploited remotely via a specially designed xml data. Original advisories - Exploitation Public exploits exist for this...

MantisBT 1.1.2 - 1.2.17 XSS Vulnerability - Windows

MantisBT is prone to a cross-site scripting XSS vulnerability. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software...

PT-2020-1448 · Mysql Server +8 · Mysql Client +8

Name of the Vulnerable Software and Affected Versions: MySQL Client versions 5.6.46 and prior MySQL Client versions 5.7.28 and prior MySQL Client versions 8.0.18 and prior Description: The issue is related to errors in resource release in the C API component of the MySQL Client product. It allows...

Wolf CMS - Arbitrary File Upload / Execution

Exploit Title : Wolf CMS 0.8.2 Arbitrary File Upload To Command Execution Reported Date : 05-May-2015 Fixed Date : 10-August-2015 Exploit Author : Narendra Bhati CVE ID : CVE-2015-6567 , CVE-2015-6568 Contact: Facebook : https://facebook.com/narendradewsoft Twitter :...

Cisco TelePresence Video Communication Server Expressway Information Disclosure Vulnerability (Cisco-SA-20150812-CVE-2015-4314)

A vulnerability in the System Snapshot of Cisco TelePresence Video Communication Server VCS Expressway could allow an authenticated, remote attacker to view sensitive data. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

Apache HTTP Server Denial Of Service Vulnerability (Aug 2015) - Windows

Apache HTTP Server is prone to a denial of service vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Gazou BBS plus vulnerability in file upload processing

Overview Gazou BBS plus provided by LEMON-S PHP contains a vulnerability in the processing of file uploads. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An image file may be specially crafted t...

Wedge Networks WedgeOS <= 4.0.4 Multiple Vulnerabilities

Wedge Networks WedgeOS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Cross-Site Scripting in 3rd party library Flowplayer

It has been discovered, that editors could change, create or delete metadata of files without permission. Component Type: TYPO3 CMS Release Date: July 1, 2015 Vulnerable subcomponent: Backend Vulnerability Type: Cross-Site Scripting Affected Versions: Versions 6.2.0 to 6.2.13, 7.0.0 to 7.3.0...

PT-2015-6672 · Linux +5 · Libwmf +5

Name of the Vulnerable Software and Affected Versions: libwmf version 0.2.8.4 Description: The issue allows remote attackers to cause a denial of service, specifically an out-of-bounds read, by using a crafted WMF file. Recommendations: For libwmf version 0.2.8.4, update to a newer version that...

KLA10621 Multiple vulnerabilities in Apple QuickTime

Memory corruption vulnerabilities were found in Apple QuickTime. By exploiting these vulnerabilities malicious users can cause denial of service or execute arbitrary code. These vulnerabilities can be exploited remotely via a specially designed file. Original advisories Apple advisory Related...

PT-2015-6655 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 5.2-5565 Update 1 Description: The issue is related to a cross-site scripting XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML. This is achieved via the...

PT-2015-6092 · Unknown · Thermostat

Name of the Vulnerable Software and Affected Versions: Thermostat versions prior to 2.0.0 Description: The issue allows local users to obtain user credentials by reading the web.xml configuration file due to world-readable permissions. Recommendations: For versions prior to 2.0.0, update to versi...

PT-2015-6385 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions through 4.0.5 Description: The issue allows remote attackers to obtain sensitive information from kernel memory or cause a denial of service via a crafted packet. This is due to the OZWPAN driver relying on an untrusted...

WordPress eShop Magic Plugin <= 0.1 - Local File Inclusion

This plugin is prone to eshop-magic/download.php file parameter traversal arbitrary file access vulnerability. It allows attackers to disclose sensitive information. Solution Update the plugin...

PT-2015-6336 · Dave Coffin +2 · Dcraw +2

Name of the Vulnerable Software and Affected Versions: dcraw versions 7.00 and earlier Description: The issue is related to an integer overflow in the ljpeg start function, which can be triggered by a crafted image. This overflow is associated with the len variable and can cause a denial of servi...