24 June 2015

27 results · Feed

• Medium —
  CVE-2013-7397

  Insufficient Verification of Data Authenticity in Async Http Client

  Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an a…

  async-http-client async-http-client com.ning:async-http-client Debian Ubuntu Maven
  Jun 24, 2015
• Medium —
  CVE-2013-7398

  Insufficient Verification of Data Authenticity in Async Http Client

  main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS ser…

  com.ning:async-http-client Maven
  Jun 24, 2015
• Unscored —
  CVE-2015-4413

  Cross-site scripting (XSS) vulnerability in the new_fb_sign_button function in nextend-facebook-connect.php in Nextend …

  Jun 24, 2015
• High —
  CVE-2015-3900

  RubyGems vulnerable to DNS hijack attack

  RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS…

  jruby rubygems-update Debian RubyGems
  Jun 24, 2015
• Unscored —
  CVE-2015-2169 Public exploit

  Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 allows remote attacke…

  Jun 24, 2015
• Unscored —
  CVE-2015-5066 Public exploit

  Multiple cross-site scripting (XSS) vulnerabilities in the MetalGenix GeniXCMS 0.0.3 allow remote attackers to inject a…

  Jun 24, 2015
• Unscored —
  CVE-2015-5061

  Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 and earlier allows re…

  Jun 24, 2015
• Unscored —
  CVE-2015-5065 Public exploit EPSS 16%

  Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic…

  Jun 24, 2015
• Unscored —
  CVE-2015-5063

  Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework 3.1.13 allow remote attackers to in…

  Jun 24, 2015
• Unscored —
  CVE-2015-5068

  XML external entity (XXE) vulnerability in SAP Mobile Platform 3 allows remote attackers to read arbitrary files or pos…

  Jun 24, 2015
• Medium —
  CVE-2015-5062

  Silverstripe CMS Open Redirect

  Open redirect vulnerability in SilverStripe CMS & Framework 3.1.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the returnURL parameter to dev/build.

  silverstripe/framework silverstripe/cms Packagist
  Jun 24, 2015
• Unscored —
  CVE-2015-5067

  The (1) Cross-System Tools and (2) Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, which allows re…

  Jun 24, 2015
• Unscored —
  CVE-2015-5064

  Multiple cross-site scripting (XSS) vulnerabilities in MySql Lite Administrator (mysql-lite-administrator) beta-1 allow…

  Jun 24, 2015
• Unscored —
  CVE-2015-4208

  Cisco WebEx Meeting Center does not properly restrict the content of URLs in GET requests, which allows remote attacker…

  Jun 24, 2015
• Unscored —
  CVE-2015-4211

  Cisco AnyConnect Secure Mobility Client 3.1(60) on Windows does not properly validate pathnames, which allows local use…

  Jun 24, 2015
• Unscored —
  CVE-2015-4214

  Cisco Unified MeetingPlace 8.6(1.2) and 8.6(1.9) allows remote authenticated users to discover cleartext passwords by r…

  Jun 24, 2015
• Unscored —
  CVE-2015-4218

  The web-based user interface in Cisco Jabber through 9.6(3) and 9.7 through 9.7(5) on Windows allows remote attackers t…

  Jun 24, 2015
• Unscored —
  CVE-2015-4215

  Cisco Wireless LAN Controller (WLC) devices with software 7.5(102.0) and 7.6(1.62) allow remote attackers to cause a de…

  Jun 24, 2015
• Unscored —
  CVE-2015-4219

  Cisco Secure Access Control System before 5.4(0.46.2) and 5.5 before 5.5(0.46) and Cisco Identity Services Engine 1.0(4…

  Jun 24, 2015
• Unscored —
  CVE-2015-4213

  Cisco NX-OS 1.1(1g) on Nexus 9000 devices allows remote authenticated users to discover cleartext passwords by leveragi…

  Jun 24, 2015
• Unscored —
  CVE-2015-4212

  Cisco WebEx Meeting Center allows remote attackers to obtain sensitive information via unspecified vectors, as demonstr…

  Jun 24, 2015
• Unscored —
  CVE-2015-3109

  Adobe Photoshop CC before 16.0 (aka 2015.0.0) allows attackers to execute arbitrary code or cause a denial of service (…

  Jun 24, 2015
• Unscored —
  CVE-2015-3110 Public exploit EPSS 17%

  Integer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attackers to e…

  Jun 24, 2015
• Unscored —
  CVE-2015-3111 Public exploit EPSS 19%

  Heap-based buffer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows atta…

  Jun 24, 2015
• Unscored —
  CVE-2015-3112 Public exploit EPSS 14%

  Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allow attackers to execute arbitrary code…

  Jun 24, 2015
• Medium —
  CVE-2015-2308

  Symfony Vulnerable to PHP Eval Injection

  Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a language="php" attribute of a SCRIPT element.

  symfony/symfony symfony symfony/http-kernel Debian Packagist
  Jun 24, 2015
• Unscored —
  CVE-2014-4875

  CreateBossCredentials.jar in Toshiba CHEC before 6.6 build 4014 and 6.7 before build 4329 contains a hardcoded AES key,…

  Jun 24, 2015