Skip to content
OpenAdvisories

Archive

December 2015

Vulnerabilities first published in this month (UTC), newest first.

← November 2015 2015 / December January 2016 →
  1. 12
  2. 219
  3. 38
  4. 4 
  5. 56
  6. 632
  7. 717
  8. 822
  9. 958
  10. 1079
  11. 1172
  12. 125
  13. 139
  14. 1411
  15. 1523
  16. 1638
  17. 1715
  18. 185
  19. 193
  20. 20 
  21. 2116
  22. 221
  23. 2313
  24. 2410
  25. 25 
  26. 262
  27. 2711
  28. 2830
  29. 299
  30. 3016
  31. 3133
All Critical High Medium Low Exploited only Public exploit

565 results · Feed

  • Unscored —
    CVE-2015-1947

    Untrusted search path vulnerability in IBM InfoSphere BigInsights 3.0, 3.0.0.1, 3.0.0.2, and 4.0, when a DB2 database i…

  • Unscored —
    CVE-2015-5987

    Belkin F9K1102 2 devices with firmware 2.10.17 use an improper algorithm for selecting the ID value in the header of a …

  • Unscored —
    CVE-2015-5990

    Cross-site request forgery (CSRF) vulnerability on Belkin F9K1102 2 devices with firmware 2.10.17 allows remote attacke…

  • Unscored —
    CVE-2015-5989

    Belkin F9K1102 2 devices with firmware 2.10.17 rely on client-side JavaScript code for authorization, which allows remo…

  • Unscored —
    CVE-2015-5988

    The web management interface on Belkin F9K1102 2 devices with firmware 2.10.17 has a blank password, which allows remot…

  • Unscored —
    CVE-2015-7279

    Amped Wireless R10000 devices with firmware 2.5.2.11 use an improper algorithm for selecting the ID value in the header…

  • Unscored —
    CVE-2015-7278

    Cross-site request forgery (CSRF) vulnerability on Amped Wireless R10000 devices with firmware 2.5.2.11 allows remote a…

  • Unscored —
    CVE-2015-7284

    Cross-site request forgery (CSRF) vulnerability on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 allows remote at…

  • Unscored —
    CVE-2015-7280

    The web administration interface on ReadyNet WRT300N-DD devices with firmware 1.0.26 has a default password of admin fo…

  • Unscored —
    CVE-2015-7281

    Cross-site request forgery (CSRF) vulnerability on ReadyNet WRT300N-DD devices with firmware 1.0.26 allows remote attac…

  • Unscored —
    CVE-2015-7277

    The web administration interface on Amped Wireless R10000 devices with firmware 2.5.2.11 has a default password of admi…

  • Unscored —
    CVE-2015-7282

    ReadyNet WRT300N-DD devices with firmware 1.0.26 use the same source port number for every DNS query, which makes it ea…

  • Unscored —
    CVE-2015-7283

    The web administration interface on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 has a default password of 1234 …

  • Unscored —
    CVE-2015-7447

    IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8…

  • Unscored —
    CVE-2015-6016

    ZyXEL P-660HW-T1 2 devices with ZyNOS firmware 3.40(AXH.0), PMG5318-B20A devices with firmware 1.00AANC0b5, and NBG-418…

  • Unscored —
    CVE-2015-6018 Public exploit EPSS 21%

    The diagnostic-ping implementation on ZyXEL PMG5318-B20A devices with firmware before 1.00(AANC.2)C0 allows remote atta…

  • Unscored —
    CVE-2015-6017

    Multiple cross-site scripting (XSS) vulnerabilities in Forms/rpAuth_1 on ZyXEL P-660HW-T1 2 devices with ZyNOS firmware…

  • Unscored —
    CVE-2015-6020

    ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 allow remote authenticated users to obtain administrative privileg…

  • Unscored —
    CVE-2015-6019

    The management portal on ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 does not terminate sessions upon a logout…

  • Unscored —
    CVE-2015-2875

    Absolute path traversal vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Pl…

  • Medium 5.9
    CVE-2015-2913

    OrientDB Server Community Edition uses insufficiently random values to generate session IDs

    server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values, which makes it …

    com.orientechnologies:orientdb-server Maven
  • Unscored —
    CVE-2015-2876

    Unrestricted file upload vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless P…

  • Unscored —
    CVE-2015-2896

    The up.time client in Idera Uptime Infrastructure Monitor through 7.6 allows remote attackers to obtain potentially sen…

  • Unscored —
    CVE-2015-2894

    Format string vulnerability in the up.time client in Idera Uptime Infrastructure Monitor 6.0 and 7.2 allows remote atta…

  • Unscored —
    CVE-2015-2895

    Buffer overflow in the up.time client in Idera Uptime Infrastructure Monitor 7.4 might allow remote attackers to execut…

  • Medium 6.1
    CVE-2015-2918

    OrientDB Studio web management interface is vulnerable to clickjacking attacks

    The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.

    com.orientechnologies:orientdb-studio Maven
  • High 8.8
    CVE-2015-2912

    OrientDB-Server vulnerable to Cross-Site Request Forgery

    The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sen…

    com.orientechnologies:orientdb-studio Maven
  • Unscored —
    CVE-2015-2874

    Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices…

  • Unscored —
    CVE-2015-5994

    The web management interface on Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 has a default password…

  • Unscored —
    CVE-2015-5996 Public exploit

    Cross-site request forgery (CSRF) vulnerability on Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 all…

  • Unscored —
    CVE-2015-5995 Public exploit EPSS 19%

    Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 and Tenda N3 Wireless N150 devices allow remote attack…

  • Unscored —
    CVE-2014-4876

    Toshiba 4690 Operating System 6 Release 3, when the ADXSITCF logical name is not properly restricted, allows remote att…

  • Unscored —
    CVE-2014-3260

    Pacom 1000 CCU and RTU GMS devices allow remote attackers to spoof the controller-to-base data stream by leveraging imp…

  • Unscored —
    CVE-2015-7787

    ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to discover the WPA2-PSK passphrase v…

  • Unscored —
    CVE-2015-7792

    Corega CG-WLBARGS devices allow remote attackers to perform administrative operations via unspecified vectors.

  • Unscored —
    CVE-2015-7789

    ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to cause a denial of service via unsp…

  • Unscored —
    CVE-2015-7251 Public exploit EPSS 11%

    ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE have a hardcoded password of root for the root account, whi…

  • Unscored —
    CVE-2015-7250 Public exploit EPSS 16%

    Absolute path traversal vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE…

  • Unscored —
    CVE-2015-7252 Public exploit

    Cross-site scripting (XSS) vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k…

  • Unscored —
    CVE-2015-7794

    Corega CG-WLNCM4G devices provide an open DNS resolver, which allows remote attackers to cause a denial of service (tra…