Skip to content
OpenAdvisories

Archive

February 2015

Vulnerabilities first published in this month (UTC), newest first.

← January 2015 2015 / February March 2015 →
  1. 115
  2. 227
  3. 336
  4. 422
  5. 5 
  6. 639
  7. 711
  8. 820
  9. 98
  10. 1012
  11. 1165
  12. 1218
  13. 1320
  14. 148
  15. 153
  16. 1620
  17. 1713
  18. 188
  19. 1932
  20. 2018
  21. 214
  22. 221
  23. 2313
  24. 2422
  25. 2523
  26. 266
  27. 2713
  28. 289
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Medium —
    CVE-2015-0886

    Integer Overflow or Wraparound in JBCrypt

    Integer overflow in the crypt_raw method in the key-stretching implementation in jBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum expon…

    org.mindrot:jbcrypt libjbcrypt-java Debian Maven
  • Medium —
    CVE-2015-2067 Public exploit EPSS 38%

    MAGMI plugin for Magento Server Directory Traversal

    Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.

    dweeves/magmi Packagist
  • Medium —
    CVE-2015-2068 Public exploit EPSS 14%

    MAGMI cross-site scripting (XSS)

    Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allow remote attackers to inject arbitrary web script or HTML via the (1) profile parameter to web/magmi.php or (2) QUERY_STRING to web/magm…

    dweeves/magmi Packagist
  • Medium 6.5
    CVE-2014-9684

    OpenStack Glance Denial of service by creating a large number of images

    OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API …

    glance PyPI
  • Medium —
    CVE-2014-8114

    UberFire Framework Improperly Restricts Paths

    The UberFire Framework 0.3.x does not properly restrict paths, which allows remote attackers to (1) execute arbitrary code by uploading crafted content to FileUploadServlet or (2) read arbitrary files via vectors involving FileDownloadServlet.

    org.uberfire:uberfire-parent Maven
  • Medium —
    CVE-2014-3578

    Improper Limitation of a Pathname to a Restricted Directory in Spring Framework

    Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL.

    libspring-java libspring-java org.springframework:spring-core Debian Ubuntu Maven
  • Medium —
    CVE-2015-1585

    Fat Free CRM Cross-Site Request Forgery vulnerability

    Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the authenticity_token, as demonstrated by a crafted HTML page that creates a new administrator account.

    fat_free_crm RubyGems
  • Medium 5.5
    CVE-2015-0260

    RhodeCode and Kallithea are vulnerable to sensitive information disclosure

    RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_repo API method.

    kallithea rhodecode PyPI
  • Medium —
    CVE-2014-0227 EPSS 21%

    Improper Input Validation in Apache Tomcat

    java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to …

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • Medium —
    CVE-2013-2027

    Jython Improper Access Restrictions vulnerability

    Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors.

    jython jython org.python:jython-standalone Debian Ubuntu Maven
  • Medium —
    CVE-2014-8122

    Information disclosure in JBoss Weld

    Race condition in JBoss Weld before 2.2.8 and 3.x before 3.0.0 Alpha3 allows remote attackers to obtain information from a previous conversation via vectors related to a stale thread state.

    org.jboss.weld:weld-core-bom Maven
  • Medium —
    CVE-2015-0227

    Improper Access Control in Apache WSS4J

    Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."

    wss4j org.apache.ws.security:wss4j wss4j:wss4j Debian Maven
  • Medium —
    CVE-2014-8110 Public exploit

    Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ

    Multiple cross-site scripting (XSS) vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    org.apache.activemq:activemq-client Maven
  • Medium 6.5
    CVE-2015-0071 Exploited EPSS 34%

    Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted …

    KEV May 25, 2022
  • Medium —
    CVE-2015-1566

    Moderate severity vulnerability that affects DotNetNuke.Core

    Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    DotNetNuke.Core NuGet