Archive
February 2015
Vulnerabilities first published in this month (UTC), newest first.
71 results · Clear filters · Feed
-
Unscored —CVE-2015-2102 Public exploit
SQL injection vulnerability in view_item.php in ClipBucket 2.7 RC3 (2.7.0.4.v2929-rc3) allows remote attackers to execu…
-
Unscored —CVE-2015-2090 Public exploit
SQL injection vulnerability in the ajax_survey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 f…
-
Unscored —CVE-2015-2084 Public exploit
Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remot…
-
Unscored —CVE-2015-2071 Public exploit
Directory traversal vulnerability in cm/newui/blog/export.jsp in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows …
-
Unscored —
SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery (contus-video-gallery) plugin …
-
Unscored —CVE-2015-2070 Public exploit
SQL injection vulnerability in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote attackers to execute arbitr…
-
Medium —
MAGMI plugin for Magento Server Directory Traversal
Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
-
Medium —
MAGMI cross-site scripting (XSS)
Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allow remote attackers to inject arbitrary web script or HTML via the (1) profile parameter to web/magmi.php or (2) QUERY_STRING to web/magm…
-
Unscored —CVE-2015-0555 Public exploit
Buffer overflow in the XnsSdkDeviceIpInstaller.ocx ActiveX control in Samsung iPOLiS Device Manager 1.12.2 allows remot…
-
Unscored —
The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.…
-
High 8.8
The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute a…
KEV Feb 10, 2022 -
Unscored —CVE-2015-2055 Public exploit
Zhone GPON 2520 with firmware R4.0.2.566b allows remote attackers to cause a denial of service via a long string in the…
-
Unscored —
Unrestricted file upload vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote authenticated us…
-
Unscored —CVE-2015-1517 Public exploit
SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users t…
-
Unscored —CVE-2015-1515 Public exploit
The dwall.sys driver in SoftSphere DefenseWall Personal Firewall 3.24 allows local users to write data to arbitrary mem…
-
Unscored —
Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use…
-
Unscored —
Unrestricted file upload vulnerability in file_to_index.php in Maarch LetterBox 2.8 and earlier and GEC/GED 1.4 and ear…
-
Unscored —CVE-2014-8690 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, a…
-
Critical 9.8
Improper Access Control in Elasticsearch
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
KEV Mar 25, 2022 -
Unscored —CVE-2015-1494 Public exploit
The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote att…
-
Unscored —CVE-2014-8757 Public exploit
LG On-Screen Phone (OSP) before 4.3.010 allows remote attackers to bypass authorization via a crafted request.
-
Unscored —
radexecd.exe in Persistent Systems Radia Client Automation (RCA) 7.9, 8.1, 9.0, and 9.1 allows remote attackers to exec…
-
Unscored —CVE-2015-1474 Public exploit
Multiple integer overflows in the GraphicBuffer::unflatten function in platform/frameworks/native/libs/ui/GraphicBuffer…
-
Unscored —CVE-2014-6137 Public exploit
Cross-site scripting (XSS) vulnerability in the Relay Diagnostic page in IBM Tivoli Endpoint Manager 9.1 before 9.1.122…
-
Unscored —
HP Universal CMDB (UCMDB) Probe 9.05, 10.01, and 10.11 enables the HTTP TRACE method, which allows remote attackers to …
-
Unscored —
The ContentBlockEx method in Workarea/ServerControlWS.asmx in Ektron Content Management System (CMS) 8.5 and 8.7 before…
-
Unscored —CVE-2015-1471 Public exploit
SQL injection vulnerability in userprofile.lib.php in Pragyan CMS 3.0 allows remote attackers to execute arbitrary SQL …
-
Medium —CVE-2014-8110 Public exploit
Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ
Multiple cross-site scripting (XSS) vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
-
Unscored —
Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitr…
-
Unscored —CVE-2015-1518 Public exploit
SQL injection vulnerability in the search_post function in includes/search.php in Redaxscript before 2.3.0 allows remot…
-
Unscored —
Unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme (aka holding_pattern) 0.6 …
-
Unscored —CVE-2015-1576 Public exploit
Multiple SQL injection vulnerabilities in u5CMS before 3.9.4 allow remote attackers to execute arbitrary SQL commands v…
-
Unscored —CVE-2015-1575 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in u5CMS before 3.9.4 allow remote attackers to inject arbitrary we…
-
Unscored —CVE-2015-1578 Public exploit
Multiple open redirect vulnerabilities in u5CMS before 3.9.4 allow remote attackers to redirect users to arbitrary web …
-
Unscored —CVE-2015-1577 Public exploit
Directory traversal vulnerability in u5admin/deletefile.php in u5CMS before 3.9.4 allows remote attackers to write to a…
-
Unscored —CVE-2015-0009 Public exploit
The Group Policy Security Configuration policy implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, …
-
Unscored —CVE-2015-0010 Public exploit
The CryptProtectMemory function in cng.sys (aka the Cryptography Next Generation driver) in the kernel-mode drivers in …
-
Unscored —
The UNC implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Win…
-
Unscored —
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, W…
-
Unscored —
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 …