Skip to content
OpenAdvisories

Archive

11 April 2016

Vulnerabilities first published on this day (UTC), newest first.

← March 2016 2016 / April /11 May 2016 →
  1. 16
  2. 2 
  3. 3 
  4. 46
  5. 56
  6. 622
  7. 736
  8. 831
  9. 923
  10. 10 
  11. 1140
  12. 1275
  13. 1354
  14. 1421
  15. 1519
  16. 162
  17. 17 
  18. 1855
  19. 1914
  20. 2010
  21. 21118
  22. 2229
  23. 23 
  24. 24 
  25. 2529
  26. 265
  27. 2728
  28. 285
  29. 29 
  30. 3019
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.5
    CVE-2015-5303

    OpenStack TripleO Heat templates spoof metadata requests

    The TripleO Heat templates (tripleo-heat-templates), when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret param…

    tripleo-heat-templates tripleo-heat-templates Ubuntu PyPI
  • High 7.8
    CVE-2015-5349

    Apache Directory Studio Command Injection

    The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does not properly escape field values, which might allow attackers to execute arbitrary commands by leveraging a crafted LDAP entry that is interpreted as a formula when importe…

    org.apache.directory.studio:org.apache.directory.studio.ldapbrowser.core Maven
  • High 7.1
    CVE-2015-0266

    Apache Ranger allows users to bypass intended access restrictions via direct access to module URLs

    The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs.

    org.apache.ranger:ranger Maven
  • High 8.8
    CVE-2016-0735

    Apache Ranger Access Restriction Bypass

    Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy.

    org.apache.ranger:ranger Maven
  • High 8.8
    CVE-2016-0710 Public exploit EPSS 52%

    Apache Jetspeed vulnerable to SQL Injection

    Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.

    org.apache.portals.jetspeed-2:jetspeed Maven
  • High 7.2
    CVE-2016-0709 Public exploit EPSS 77%

    Path Traversal in Apache Jetspeed

    Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. (dot dot) in a…

    org.apache.portals.jetspeed-2:jetspeed Maven
  • High 7.5
    CVE-2016-2164

    Apache OpenMeetings allows remote attackers to read arbitrary files by attempting to upload a file

    The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL class without checking the specified protocol handler, which allows remote attackers to read arbitra…

    org.apache.openmeetings:openmeetings-parent Maven