Skip to content
OpenAdvisories

Archive

May 2015

Vulnerabilities first published in this month (UTC), newest first.

← April 2015 2015 / May June 2015 →
  1. 118
  2. 21
  3. 3 
  4. 4 
  5. 5 
  6. 6 
  7. 76
  8. 813
  9. 9 
  10. 10 
  11. 11 
  12. 1228
  13. 1395
  14. 1429
  15. 159
  16. 167
  17. 173
  18. 1813
  19. 199
  20. 2035
  21. 219
  22. 223
  23. 231
  24. 24 
  25. 2543
  26. 2616
  27. 2715
  28. 2813
  29. 2924
  30. 3015
  31. 315
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium —
    CVE-2015-1833 Public exploit EPSS 56%

    Improper Input Validation in Apache Jackrabbit

    XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet …

    jackrabbit jackrabbit org.apache.jackrabbit:jackrabbit-core Debian Ubuntu Maven
  • Medium 5.1
    CVE-2015-3631

    Arbitrary File Override in Docker Engine

    Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc.

    docker.io docker.io github.com/docker/docker Debian Ubuntu Go
  • Medium —
    CVE-2015-3627

    Symlink Attack in Libcontainer and Docker Engine

    Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.

    docker.io docker.io github.com/docker/docker Debian Ubuntu Go
  • Medium —
    CVE-2015-3397

    Yii Framework Cross-site Scripting Vulnerability

    Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6 or 7.

    yiisoft/yii2 Packagist
  • Medium —
    CVE-2015-3646

    OpenStack Keystone Logs Passwords

    OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.

    keystone keystone Debian PyPI
  • Medium —
    CVE-2015-3337 Public exploit EPSS 33%

    Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch

    Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.

    org.elasticsearch:elasticsearch Maven