Skip to content
OpenAdvisories

Archive

February 2016

Vulnerabilities first published in this month (UTC), newest first.

← January 2016 2016 / February March 2016 →
  1. 121
  2. 2 
  3. 312
  4. 42
  5. 52
  6. 66
  7. 720
  8. 827
  9. 94
  10. 1071
  11. 111
  12. 1214
  13. 1314
  14. 146
  15. 1530
  16. 1613
  17. 1727
  18. 1814
  19. 196
  20. 209
  21. 214
  22. 2227
  23. 236
  24. 243
  25. 257
  26. 262
  27. 278
  28. 2812
  29. 2912
All Critical High Medium Low Exploited only Public exploit

34 results · Clear filters · Feed

  • Medium 4.3
    CVE-2015-5174 EPSS 13%

    Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

    Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash d…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • Medium 5.3
    CVE-2015-5345 EPSS 18%

    Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

    The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a direc…

    org.apache.tomcat:tomcat tomcat9 tomcat7 tomcat6 Ubuntu Maven
  • Medium 4.3
    CVE-2016-0706

    Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

    Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticate…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • Medium 6.3
    CVE-2016-0763 EPSS 11%

    Improper Verification of Source of a Communication Channel in Apache Tomcat

    The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allow…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • Medium 6.1
    CVE-2015-3275

    Moodle multiple cross-site scripting (XSS) vulnerabilities

    Multiple cross-site scripting (XSS) vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allow remote attackers to inject arbitrary web script or HTML via a crafted organization name to (…

    moodle/moodle Packagist
  • Medium 6.1
    CVE-2015-3274

    Moodle cross-site scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to inject arbitrary web script or HTML by leveragin…

    moodle/moodle Packagist
  • Medium 4.3
    CVE-2015-5265

    Moodle allows attackers to delete files

    The wiki component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 does not consider the mod/wiki:managefiles capability before authorizing file management, which allows remote authenticated users to delete arbitrary …

    moodle/moodle Packagist
  • Medium 4.3
    CVE-2015-5342

    Moodle allows attackers to bypass intended access restrictions

    The choice module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote authenticated users to bypass intended access restrictions by visiting a URL to add or delete responses in the closed state.

    moodle/moodle Packagist
  • Medium 4.3
    CVE-2015-5268

    Moodle mishandles group-based authorization checks

    The rating component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 mishandles group-based authorization checks, which allows remote authenticated users to obtain sensitive information by reading a rating value.

    moodle/moodle Packagist
  • Medium 6.8
    CVE-2015-5266

    Moodle allows attackers to obtain manager privileges

    The enrol_meta_sync function in enrol/meta/locallib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to obtain manager privileges in opportunistic circumstances by leveraging incor…

    moodle/moodle Packagist
  • Medium 5.4
    CVE-2015-5264

    Moodle allows attackers to enter additional answer attempts

    The lesson module in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to bypass intended access restrictions and enter additional answer attempts by leveraging the student role.

    moodle/moodle Packagist
  • Medium 5.4
    CVE-2015-5269

    Moodle cross-site scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in group/overview.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to inject arbitrary web script or HTML via a modified grouping descripti…

    moodle/moodle Packagist
  • Medium 5.4
    CVE-2015-5336

    Moodle multiple cross-site scripting (XSS) vulnerabilities

    Multiple cross-site scripting (XSS) vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the studen…

    moodle/moodle Packagist
  • Medium 4.3
    CVE-2015-5339

    Moodle does not properly implement group-based access restrictions

    The core_enrol_get_enrolled_users web service in enrol/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly implement group-based access restrictions, which allows remote authenticated use…

    moodle/moodle Packagist
  • Medium 4.3
    CVE-2015-5331

    Moodle improper access control

    Moodle 2.9.x before 2.9.3 does not properly check the contact list before authorizing message transmission, which allows remote authenticated users to bypass intended access restrictions and conduct spam attacks via the messaging API.

    moodle/moodle Packagist
  • Medium 4.3
    CVE-2015-5341

    Moodle allows attackers to read SCORM contents

    mod_scorm in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 mishandles availability dates, which allows remote authenticated users to bypass intended access restrictions and read SCORM contents via unspecified vectors.

    moodle/moodle Packagist
  • Medium 4.3
    CVE-2015-5335

    Moodle cross-site request forgery (CSRF) vulnerability

    Cross-site request forgery (CSRF) vulnerability in admin/registration/register.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote attackers to hijack the authentication of administrators for requests th…

    moodle/moodle Packagist
  • Medium 6.1
    CVE-2015-5337

    Moodle XSS Vulnerability

    Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly restrict the availability of Flowplayer, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted .swf file.

    moodle/moodle Packagist
  • Medium 4.3
    CVE-2015-5340

    Moodle sensitive information disclosure

    Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not consider the moodle/badges:viewbadges capability, which allows remote authenticated users to obtain sensitive badge information via a request involving (1) badges/…

    moodle/moodle Packagist
  • Medium 4.3
    CVE-2016-0724

    Moodle sensitive information disclosure

    The (1) core_enrol_get_course_enrolment_methods and (2) enrol_self_get_instance_info web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 do not consider the moodle/course:viewhiddencourse…

    moodle/moodle Packagist
  • Medium 6.1
    CVE-2016-0725

    Moodle Cross-site scripting (XSS) vulnerability in course management search

    Cross-site scripting (XSS) vulnerability in the search_pagination function in course/classes/management_renderer.php in Moodle 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via a…

    moodle/moodle Packagist
  • Medium 5.4
    CVE-2016-2040

    phpMyAdmin XSS Vulnerability

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) table name, (2) SET value, (3) search que…

    phpmyadmin phpmyadmin phpmyadmin/phpmyadmin Debian Ubuntu Packagist
  • Medium 5.3
    CVE-2016-2388 Exploited Public exploit EPSS 52%

    The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user info…

    KEV Jun 9, 2022
  • Medium 6.1
    CVE-2015-7578

    rails-html-sanitizer Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.

    rails-html-sanitizer ruby-rails-html-sanitizer Debian RubyGems
  • Medium 6.1
    CVE-2015-7579

    rails-html-sanitizer Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class.

    rails-html-sanitizer ruby-rails-html-sanitizer Debian RubyGems
  • Medium 5.3
    CVE-2015-7577

    Active Record Improper Access Control

    activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly implement a certain destroy option, wh…

    rails activerecord Debian RubyGems
  • Medium 6.1
    CVE-2015-7580

    rails-html-sanitizer Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.

    rails-html-sanitizer ruby-rails-html-sanitizer Debian RubyGems
  • Medium 5.3
    CVE-2016-0753

    activemodel contains Improper Input Validation

    Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

    rails activemodel Debian RubyGems
  • Medium 6.1
    CVE-2015-8795

    Improper Neutralization of Input During Web Page Generation in Apache Solr

    Multiple cross-site scripting (XSS) vulnerabilities in the Admin UI in Apache Solr before 5.1 allow remote attackers to inject arbitrary web script or HTML via crafted fields that are mishandled during the rendering of the (1) Analysis page, related to webapp…

    org.apache.solr:solr-core Maven
  • Medium 6.1
    CVE-2015-8797

    Improper Neutralization of Input During Web Page Generation in Apache Solr

    Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/plugins.js in the stats page in the Admin UI in Apache Solr before 5.3.1 allows remote attackers to inject arbitrary web script or HTML via the entry parameter to a plugins/cache URI.

    org.apache.solr:solr-core Maven
  • Medium 6.1
    CVE-2015-8796

    Apache Solr Cross-site scripting Vulnerability

    Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/schema-browser.js in the Admin UI in Apache Solr before 5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted schema-browse URL.

    org.apache.solr:solr Maven
  • Medium 5.5
    CVE-2016-2048

    Django Access Restrictions Bypass

    Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission.

    python-django django Debian PyPI
  • Medium 5.4
    CVE-2015-7536

    Improper Neutralization of Input During Web Page Generation in Jenkins

    Cross-site scripting (XSS) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to workspaces and archived artifacts.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 5.3
    CVE-2015-8748

    Radicale regex metacharacters injection in the user name

    Radicale before 1.1 allows remote authenticated users to bypass owner_write and owner_only limitations via regex metacharacters in the user name, as demonstrated by ".*".

    radicale radicale Debian PyPI