CVE-2015-4666

CVE-2015-4666 affects Xceedium Xsuite 2.4.4.5 and earlier, exposing a directory-traversal flaw in the opm/read_sessionlog.php script. The vulnerability allows unauthenticated users to read arbitrary files via the logFile parameter using a quadruple dot and slash pattern (....//), potentially expo...

CVE-2015-4669

The CVE-2015-4669 entry pertains to Xceedium Xsuite 2.x where the MySQL root user has no password set, allowing Local access to the databases. The connected documents corroborate that this vulnerability enables local users to access databases and, in combination with other issues (e.g., command i...

CVE-2015-4664

CVE-2015-4664 affects CA Privileged Access Manager (PAM) 2.4.4.4 and earlier. The vulnerability is an improper input validation that enables an unauthenticated attacker to perform command injection through the login interface, potentially executing arbitrary commands. The OpenVAS/Modzero/OpenVAS ...

CVE-2015-4665

CVE-2015-4665 concerns a cross-site scripting (XSS) vulnerability in Xceedium Xsuite. The flaw resides in ajax_cmd.php, affecting Xsuite versions 2.4.4.1 and earlier, where a malicious value supplied via the fileName parameter can inject arbitrary script/HTML in a user’s browser. Public documenta...

CVE-2015-4668

CVE-2015-4668 describes an open redirect in Xsuite 2.4.4.5 and earlier, exploitable via a malicious redirurl parameter to redirect users to arbitrary sites and enable phishing. The NVD entry and multiple connected sources confirm the affected product as Xsuite, with the component/entry point bein...

CVE-2015-4667

CVE-2015-4667 affects Xceedium Xsuite 2.x (notably versions 2.3.0 and 2.4.3.0). The connected documents describe multiple hardcoded credentials vulnerabilities, including a hard-coded database password (n1b2dy) and broader issues in Xsuite 2.x that enable remote/ local access. Additional related ...