Skip to content
OpenAdvisories

Archive

March 2015

Vulnerabilities first published in this month (UTC), newest first.

← February 2015 2015 / March April 2015 →
  1. 1 
  2. 25
  3. 310
  4. 45
  5. 59
  6. 611
  7. 710
  8. 87
  9. 952
  10. 108
  11. 1148
  12. 1220
  13. 1325
  14. 1412
  15. 151
  16. 1610
  17. 177
  18. 1837
  19. 1918
  20. 208
  21. 213
  22. 221
  23. 238
  24. 2422
  25. 2512
  26. 2624
  27. 2722
  28. 283
  29. 2912
  30. 3023
  31. 3120
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.1
    CVE-2015-2317

    Django cross-site scripting (XSS) attack via user-supplied redirect URLs

    The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control char…

    python-django django python-django Debian Ubuntu PyPI
  • Medium —
    CVE-2015-0250 EPSS 17%

    Improper Input Validation in Apache Batik

    XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.

    batik batik org.apache.xmlgraphics:batik Debian Ubuntu Maven
  • Medium —
    CVE-2015-2296

    Python Requests Session Fixation

    The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.

    requests requests requests Debian Ubuntu PyPI
  • Medium 6.4
    CVE-2014-5409

    GE Hydran M2 Predictable Value Range from Previous Values

    The 17046 Ethernet card before 94450214LFMT100SEM-L.R3-CL for the GE Digital Energy Hydran M2 does not properly generate random values for TCP Initial Sequence Numbers (ISNs), which makes it easier for remote attackers to spoof packets by predicting these val…

    GE Hydran M2, containing the 17046 Ethernet option
  • Medium 6.1
    CVE-2015-2241

    Django Cross-site Scripting Vulnerability

    Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrat…

    python-django django Debian PyPI
  • Medium —
    CVE-2015-0201

    Moderate severity vulnerability that affects org.springframework:spring-core

    The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors.

    org.springframework:spring-core Maven