Archive
May 2015
Vulnerabilities first published in this month (UTC), newest first.
410 results · Feed
-
Unscored —
ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted y0da cryptor fi…
-
Unscored —
Unrestricted file upload vulnerability in go_audiostore.php in the audiostore (Voice Files) upload functionality in GoA…
-
Unscored —CVE-2015-2219 Public exploit
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which all…
-
Unscored —
Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.5 Build 53.9 through 55.8 and 10…
-
Unscored —
The upx decoder in ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted file.
-
Unscored —
Race condition in Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses world-writable permi…
-
Unscored —
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 does not properly validate CA chains during…
-
Unscored —
ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted xz archive file.
-
Unscored —
Cross-site scripting (XSS) vulnerability in the autolearn configuration page in Fortinet FortiWeb 5.1.2 through 5.3.4 a…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiOS 5.2.x before 5.2.3 allow remote attackers to in…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the theme login page in Fortinet FortiADC D models before 4.2 allows remote…
-
Unscored —
The automatic signature update functionality in the (1) Phone Home feature in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in WebODF before 0.5.5, as used in ownCloud, allow remote attackers…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the contacts application in ownCloud Server Community Edition be…
-
Unscored —
The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply functio…
-
Unscored —
ownCloud Server before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allows remote authenticated users to bypass the f…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote attackers t…
-
Unscored —
Cross-site scripting (XSS) vulnerability in WebODF before 0.5.4 allows remote attackers to inject arbitrary web script …
-
Unscored —
The Administration and Reporting Tool in IBM Rational License Key Server (RLKS) 8.1.4 before 8.1.4.7 allows remote auth…
-
Unscored —
IBM DB2 9.5 through 10.5 on Linux, UNIX, and Windows stores passwords during the processing of certain SQL statements b…
-
Unscored —
WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to execut…
-
Unscored —
WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to execut…
-
Unscored —
WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to execut…
-
Unscored —
The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, all…
-
Unscored —
The page-loading implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6…
-
Unscored —
The Siemens HomeControl for Room Automation application before 2.0.1 for Android does not verify X.509 certificates fro…
-
Unscored —
SQL injection vulnerability in the administrative web interface in Cisco Unified Communications Manager 11.0(0.98000.22…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in the CUCReports page in Cisco Unity Connection 11.0(0.98000.225) and …
-
Unscored —
Cisco UCS Central Software before 1.3(1a) allows remote attackers to execute arbitrary commands via a crafted HTTP requ…
-
Unscored —
ftagent.exe in EMC AutoStart 5.4.x and 5.5.x before 5.5.0.508 HF4 allows remote attackers to execute arbitrary commands…
-
Unscored —
EMC SourceOne Email Management before 7.2 does not have a lockout mechanism for invalid login attempts, which makes it …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Cisco Finesse Server 10.0(1), 10.5(1), 10.6(1), and 11.0(1) allo…
-
Unscored —
Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 uses weak permissions on the directories shared by the ov…
-
Unscored —
Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 ignores the permission to deny snapshot creation during l…
-
Unscored —
The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destinatio…
-
Unscored —
Foxit Reader, Enterprise Reader, and PhantomPDF before 7.1.5 allow remote attackers to cause a denial of service (memor…
-
Unscored —
The Framework Daemon in AlienVault Unified Security Management before 4.15 allows remote attackers to execute arbitrary…
-
Medium —
Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.
-
Unscored —CVE-2015-3435 EPSS 10%
Samsung Security Manager (SSM) before 1.31 allows remote attackers to execute arbitrary code by uploading a file with a…
-
Unscored —CVE-2015-3632 Public exploit
Foxit Reader, Enterprise Reader, and PhantomPDF before 7.1.5 allow remote attackers to cause a denial of service (memor…