Skip to content
OpenAdvisories

Archive

August 2015

Vulnerabilities first published in this month (UTC), newest first.

← July 2015 2015 / August September 2015 →
  1. 118
  2. 2 
  3. 318
  4. 432
  5. 53
  6. 61
  7. 71
  8. 810
  9. 9 
  10. 10 
  11. 1113
  12. 1220
  13. 138
  14. 1455
  15. 1540
  16. 16132
  17. 174
  18. 1850
  19. 1919
  20. 2029
  21. 21 
  22. 2215
  23. 2314
  24. 2445
  25. 258
  26. 2612
  27. 2716
  28. 284
  29. 295
  30. 303
  31. 3144
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Medium —
    CVE-2015-3158

    PicketLink does not properly check role based authorization

    The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application r…

    org.picketlink:picketlink-tomcat-common Maven
  • Medium —
    CVE-2015-3221 Public exploit EPSS 11%

    OpenStack Neutron Improper Input Validation vulnerability

    OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using the IPTables firewall driver, allows remote authenticated users to cause a denial of service (L2 agent crash) by adding an address pair that is rejected by the ipset tool.

    neutron neutron Debian PyPI
  • Medium —
    CVE-2015-4020

    RubyGems Improper Input Validation vulnerability

    RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a doma…

    rubygems-update RubyGems
  • Medium —
    CVE-2015-5161 Public exploit

    ZendXml and Zend Framework contain XXE and XEE Vulnerabilities

    The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external e…

    zendframework/zendframework1 zendframework/zendframework zendframework/zendxml Packagist
  • Medium —
    CVE-2015-6524

    Improper Input Validation in Apache ActiveMQ

    The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: thi…

    activemq activemq org.apache.activemq:activemq-broker org.apache.activemq:activemq-jaas Debian Ubuntu Maven
  • Medium 6.4
    CVE-2015-6563

    The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITO…

    openssh openssh Debian Ubuntu
  • Medium 6.1
    CVE-2015-3219

    OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a …

    horizon horizon Debian PyPI
  • Medium —
    CVE-2015-1830 Public exploit EPSS 84%

    Improper Limitation of a Pathname to a Restricted Directory in Apache ActiveMQ

    Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.

    org.apache.activemq:activemq-client Maven
  • Medium 6.5
    CVE-2015-5163

    OpenStack Image Service (Glance) allows remote authenticated users to read arbitrary file

    The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image.

    glance glance Debian PyPI
  • Medium —
    CVE-2015-5531 Public exploit EPSS 95%

    Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch

    Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.

    org.elasticsearch:elasticsearch Maven
  • Medium 6.6
    CVE-2015-1769 Exploited Public exploit

    Mount Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1…

    KEV May 25, 2022
  • Medium —
    CVE-2015-1819

    Nokogiri vulnerable to libxml XML Entity Expansion

    The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.

    libxml2 libxml2 nokogiri Debian Ubuntu RubyGems