CVE-2015-6968: Undefined Security Weakness

Multiple incomplete blacklist vulnerabilities in the serendipityisActiveFile function in include/functionsimages.inc.php in Serendipity before 2.0.2 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a 1 .pht or 2 .phtml extension...

CVE-2015-6466: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Diagnosis Ping feature in the administrative web interface on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote attackers to inject arbitrary web script or HTML via an unspecified field...

CVE-2015-5629: Undefined Security Weakness

The NTT Broadband Platform Japan Connected-free Wi-Fi application 1.6.0 and earlier for Android and 1.0.2 and earlier for iOS allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors...

CVE-2015-2984: Undefined Security Weakness

I-O DATA DEVICE WN-G54/R2 routers with firmware before 1.03 and NP-BBRS routers allow remote attackers to cause a denial of service SSDP reflection via UPnP requests...

CVE-2015-2137: Undefined Security Weakness

Unspecified vulnerability in HP Operations Manager i OMi 9.22, 9.23, 9.24, 9.25, 10.00, and 10.01 allows remote attackers to execute arbitrary code via unknown vectors...

CVE-2015-4328: Improper Input Validation

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, as demonstrated by read or write operations on the Unified...

CVE-2015-4535: Undefined Security Weakness

Java Method Server JMS in EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02, when debugtrace is configured, allows remote authenticated users to gain super-user privileges by leveraging the ability to read a log file containing ...

CVE-2015-1805: Undefined Security Weakness

The 1 piperead and 2 pipewrite implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed copytouserinatomic and copyfromuserinatomic calls, which allows local users to cause a denial of service system crash or possibly gain privileges via a...

CVE-2015-0547: Improper Input Validation

The D2CenterstageService.getComments service method in EMC Documentum D2 4.1 and 4.2 before 4.2 P16 and 4.5 before P03 allows remote authenticated users to conduct Documentum Query Language DQL injection attacks and bypass intended read-access restrictions via unspecified vectors...

CVE-2015-1951: Exposure of Sensitive Information to an Unauthorized Actor

IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX001, and 7.6.0 before 7.6.0.0 IFIX005 does not prevent caching of HTTPS responses, which allows physically proximate attackers to obtain sensitive local-cache information by leveraging an unattended workstation...

CVE-2015-4195: Undefined Security Weakness

Cisco IOS XR 5.1.1.K9SEC allows remote authenticated users to cause a denial of service vty error, and SSH and TELNET outage via a crafted disconnect action within an SSH session, aka Bug ID CSCul63127...

CVE-2015-4080: Undefined Security Weakness

The Kankun Smart Socket device and mobile application uses a hardcoded AES 256 bit key, which makes it easier for remote attackers to 1 obtain sensitive information by sniffing the network and 2 obtain access to the device by encrypting messages...

CVE-2015-0752: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Cisco TelePresence Video Communication Server VCS X8.5.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut27635...

CVE-2015-1392: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Aruba Networks ClearPass Policy Manager CPPM before 6.4.5 allow remote administrators to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-2248: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the user portal in Dell SonicWALL Secure Remote Access SRA products with firmware before 7.5.1.0-38sv and 8.x before 8.0.0.1-16sv allows remote attackers to hijack the authentication of users for requests that create bookmarks via a crafted request...

CVE-2015-3457: Improper Authentication

Magento Community Edition CE 1.9.1.0 and Enterprise Edition EE 1.14.1.0 allow remote attackers to bypass authentication via the forwarded parameter...

CVE-2015-1484: Undefined Security Weakness

Unquoted Windows search path vulnerability in the agent in Symantec Workspace Streaming SWS 6.1 before SP8 MP2 HF7 and 7.5 before SP1 HF4, when AppMgrService.exe is configured as a service, allows local users to gain privileges via a Trojan horse executable file in the %SYSTEMDRIVE% directory, as...

CVE-2015-0691: Improper Neutralization of Special Elements used in an OS Command

A certain Cisco JAR file, as distributed in Cache Cleaner in Cisco Secure Desktop CSD, allows remote attackers to execute arbitrary commands via a crafted web site, aka Bug ID CSCup83001...

CVE-2015-0447: Undefined Security Weakness

Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality via vectors related to Configurator DMZ rules...

CVE-2015-0656: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the login page in Cisco Network Analysis Module NAM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCum81269...

CVE-2010-5319: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Kandidat CMS 1.4.2 allow remote attackers to hijack the authentication of administrators for requests that 1 modify settings via a validate action to admin/settings.php, 2 modify pages via the what parameter to admin/edit.php, or 3 modif...

CVE-2014-8015: Undefined Security Weakness

The Sponsor Portal in Cisco Identity Services Engine ISE allows remote authenticated users to obtain access to an arbitrary sponsor's guest account via a modified HTTP request, aka Bug ID CSCur64400...

CVE-2014-7252: Undefined Security Weakness

Multiple unspecified vulnerabilities in the Syslink driver for Texas Instruments OMAP mobile processor, as used on NTT DOCOMO ARROWS Tab LTE F-01D, ARROWS X LTE F-05D, Disney Mobile on docomo F-08D, REGZA Phone T-01D, and PRADA phone by LG L-02D; and SoftBank SHARP handsets 102SH allow local user...

CVE-2014-4832: Exposure of Sensitive Information to an Unauthorized Actor

IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allow remote attackers to obtain sensitive cookie information by sniffing the network during an HTTP session...

CVE-2014-6150: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM Tivoli Application Dependency Discovery Manager TADDM 7.2.1.0 through 7.2.1.6 and 7.2.2.0 through 7.2.2.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-4427: Undefined Security Weakness

App Sandbox in Apple OS X before 10.10 allows attackers to bypass a sandbox protection mechanism via the accessibility API...

CVE-2014-0351: Undefined Security Weakness

The FortiManager protocol service in Fortinet FortiOS before 4.3.16 and 5.x before 5.0.8 on FortiGate devices does not prevent use of anonymous ciphersuites, which makes it easier for man-in-the-middle attackers to obtain sensitive information or interfere with communications by modifying the...

CVE-2014-3093: Undefined Security Weakness

IBM PowerVC 1.2.0 before FP3 and 1.2.1 before FP2 uses cleartext passwords in 1 api-paste.ini, 2 debug logs, 3 the installation process, 4 environment checks, 5 powervc-ldap-config, 6 powervc-restore, and 7 powervc-diag, which allows local users to obtain sensitive information by entering a ps...

CVE-2014-4767: Improper Control of Generation of Code

IBM WebSphere Application Server WAS Liberty Profile 8.5.x before 8.5.5.3 does not properly use the Liberty Repository for feature installation, which allows remote authenticated users to execute arbitrary code via unspecified vectors...

CVE-2014-5100: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the authentication of administrators for requests that 1 add a new super user account via a request to admin/users/add, 2 insert cross-site scripting XSS sequences via the apikeylabel...

CVE-2014-4682: Exposure of Sensitive Information to an Unauthorized Actor

The WebNavigator server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote attackers to obtain sensitive information via an HTTP request...

CVE-2014-0865: Improper Input Validation

RICOS in IBM Algo Credit Limits aka ACLM 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validation, which allows remote authenticated users to bypass intended dual-control restrictions and modify data via crafted serialized objects, as demonstrated by limi...

CVE-2013-3004: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in BIRT-Report Viewer in IBM Tivoli Application Dependency Discovery Manager TADDM 7.1.x and 7.2.x before 7.2.1.5 allows remote authenticated users to read arbitrary files via unspecified vectors...

CVE-2012-5056: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ownCloud Server before 4.0.8 allow remote attackers to inject arbitrary web script or HTML via the 1 readyCallback parameter to apps/filesodfviewer/src/webodf/webodf/flashput/PUT.swf, the 2 root parameter to apps/gallery/templates/index.php, or...

CVE-2013-6766: Improper Authentication

OpenVAS Administrator 1.2 before 1.2.2 and 1.3 before 1.3.2 allows remote attackers to bypass the OAP authentication restrictions and execute OAP commands via a crafted OAP request for version information, which causes the state to be set to CLIENTAUTHENTIC...

CVE-2013-4772: Improper Authentication

D-Link DIR-505L SharePort Mobile Companion 1.01 and DIR-826L Wireless N600 Cloud Router 1.02 allows remote attackers to bypass authentication via a direct request when an authorized session is active...

CVE-2013-7259: Improper Neutralization of Special Elements used in an OS Command

Multiple cross-site request forgery CSRF vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to 1 db/data/ext/GremlinPlugin/graphdb/executescript or 2 db/manage/server/console/...

CVE-2014-2842: Undefined Security Weakness

Juniper ScreenOS 6.3 and earlier allows remote attackers to cause a denial of service crash and restart or failover via a malformed SSL/TLS packet...

CVE-2014-1297: Improper Input Validation

WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, does not properly validate WebProcess IPC messages, which allows remote attackers to bypass a sandbox protection mechanism and read arbitrary files by leveraging WebProcess access...

CVE-2014-1912: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the socket.recvfrominto function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remote attackers to execute arbitrary code via a crafted string...

CVE-2014-1256: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in Apple Type Services ATS in Apple OS X before 10.9.2 allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages...

CVE-2013-5400: Undefined Security Weakness

An unspecified servlet in IBM Platform Symphony Developer Edition DE 5.2 and 6.1.x through 6.1.1 has hardcoded credentials, which allows remote attackers to bypass authentication and obtain "local environment" access via unknown vectors...

CVE-2011-3344: Improper Neutralization of Input During Web Page Generation

A flaw was found in Spacewalk. A remote attacker can exploit a cross-site scripting XSS vulnerability in the Lookup Login/Password form by injecting arbitrary web script or HTML via the URI. This can lead to information disclosure or unauthorized actions within the user's browser session...

CVE-2013-5409: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2013-4044: Exposure of Sensitive Information to an Unauthorized Actor

IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote authenticated users to read application log files via a direct HTTP request...

CVE-2013-7103: Improper Neutralization of Special Elements used in an OS Command

McAfee Email Gateway 7.6 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the value attribute in a 1 TestFile XML element or the 2 hostname. NOTE: this issue can be combined with CVE-2013-7092 to allow remote attackers to execute commands...

CVE-2013-6284: Undefined Security Weakness

Unspecified vulnerability in the Statutory Reporting for Insurance FSSR component in the Financial Services module for SAP ERP Central Component ECC allows attackers to execute arbitrary code via unspecified vectors, related to a "code injection vulnerability."...

CVE-2013-5536: Improper Input Validation

Cisco Secure Access Control System ACS does not properly implement an incoming-packet firewall rule, which allows remote attackers to cause a denial of service process crash via a flood of crafted packets, aka Bug ID CSCui51521...

CVE-2013-0692: Undefined Security Weakness

The kernel in ENEA OSE on the Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier allows remote attackers to execute arbitrary code by connecting to the debug service...

CVE-2013-1066: Undefined Security Weakness

language-selector 0.110.x before 0.110.1, 0.90.x before 0.90.1, and 0.79.x before 0.79.4 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1...