Archive
November 2015
Vulnerabilities first published in this month (UTC), newest first.
361 results · Feed
-
Unscored —
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote a…
-
Unscored —
Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x befor…
-
Unscored —
The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it st…
-
Unscored —
libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial …
-
Unscored —
The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-de…
-
Unscored —
The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x befo…
-
Medium —
Improper Access Control in Apache CXF
The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote authenticated users to bypass authentication via a crafted SAML response with a valid signed assertion, related to a "wrapping attack."
-
Unscored —CVE-2015-5999 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DIR-816L Wireless Router with firmware before …
-
Critical 9.8
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers…
KEV Nov 3, 2021 -
Unscored —
Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Firepower Extensible Operating …
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower …
-
Unscored —
The default configuration of EMC VPLEX GeoSynchrony 5.4 SP1 before P3 stores cleartext NAVISPHERE GUI passwords in a lo…
-
Unscored —CVE-2015-6357 Public exploit
The rule-update feature in Cisco FireSIGHT Management Center (MC) 5.2 through 5.4.0.1 does not verify the X.509 certifi…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Cisco Prime Collaboration Assurance 10.5(1) and 10.6 allows remote a…
-
Unscored —
GNOME NetworkManager allows remote attackers to cause a denial of service (IPv6 traffic disruption) via a crafted MTU v…
-
Unscored —
The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not check if the parent node is an element, which …
-
Unscored —
The Nitro API in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 133.9, …
-
Unscored —
The administration UI in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build…
-
Unscored —
The hypercall_create_continuation function in arch/arm/domain.c in Xen 4.4.x through 4.6.x allows local guest users to …
-
Unscored —
Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex va…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the Nitro API in Citrix NetScaler Application Delivery Controlle…
-
Unscored —
The lxd-unix.socket systemd unit file in the Ubuntu lxd package before 0.20-0ubuntu4.1 uses world-readable permissions …
-
Unscored —
Integer overflow in Google Picasa before 3.9.140 Build 259 allows remote attackers to execute arbitrary code via the CA…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the MAYO theme 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.6 for Drupal…
-
Unscored —
Stack-based buffer overflow in the URI handler in DWRCC.exe in SolarWinds DameWare Mini Remote Control before 12.0 HotF…
-
Unscored —
The UC Profile module 6.x-1.x before 6.x-1.3 for Drupal does not properly check access to profiles in certain circumsta…
-
Unscored —CVE-2015-5311 EPSS 67%
PowerDNS (aka pdns) Authoritative Server 3.4.4 before 3.4.7 allows remote attackers to cause a denial of service (asser…
-
Unscored —
The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handl…
-
Unscored —CVE-2015-5602 Public exploit
sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is …
-
Medium —
Ipsilon denial of service via a duplicate SP name
providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly check permissions to update the SAML2 Service Provider (SP) owner, which allows remote authenticated users to cause a denial of service via a duplic…
-
Medium —
Ipsilon denial of service by deleting a SAML2 Service Provider (SP)
providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider …
-
Unscored —
The init_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.2 does not enforce minimum-value and maximum-va…
-
Unscored —
The decode_uncompressed function in libavcodec/faxcompr.c in FFmpeg before 2.8.2 does not validate uncompressed runs, w…
-
Unscored —
The ljpeg_decode_yuv_scan function in libavcodec/mjpegdec.c in FFmpeg before 2.8.2 omits certain width and height check…
-
Unscored —
The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in FFmpeg before 2.8.2 does not validate the Chroma Format Indic…
-
Unscored —
The receive_ra function in rdisc/nm-lndp-rdisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 sta…
-
Unscored —
net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel before 4.0 does not validate attempted changes to the MTU val…
-
Unscored —CVE-2015-7897 Public exploit
The media scanning functionality in the face recognition library in android.media.process in Samsung Galaxy S6 Edge bef…
-
Unscored —
Multiple eval injection vulnerabilities in mods/_standard/gradebook/edit_marks.php in ATutor 2.2 and earlier allow remo…
-
Unscored —
Directory traversal vulnerability in core/ViewDataTable/Factory.php in Piwik before 2.15.0 allows remote attackers to i…