Filtered by vendor Subscriptions
Total 323571 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2015-1780 1 Redhat 2 Ovirt-engine, Virtualization 2024-11-21 6.5 Medium
oVirt users with MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data-center
CVE-2015-1777 1 Redhat 3 Enterprise Linux, Gluster Storage, Rhn-client-tools 2024-11-21 N/A
rhnreg_ks in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Gluster Storage 2.1 and Enterprise Linux (RHEL) 5, 6, and 7 does not properly validate hostnames in X.509 certificates from SSL servers, which allows remote attackers to prevent system registration via a man-in-the-middle attack.
CVE-2015-1607 2 Canonical, Gnupg 2 Ubuntu Linux, Gnupg 2024-11-21 5.5 Medium
kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not properly handle bitwise left-shifts, which allows remote attackers to cause a denial of service (invalid read operation) via a crafted keyring file, related to sign extensions and "memcpy with overlapping ranges."
CVE-2015-1606 2 Debian, Gnupg 2 Debian Linux, Gnupg 2024-11-21 5.5 Medium
The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a denial of service (invalid read and use-after-free) via a crafted keyring file.
CVE-2015-1583 1 Atutor 1 Atutor 2024-11-21 8.8 High
Multiple cross-site request forgery (CSRF) vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account via a request to mods/_core/users/admins/create.php or (2) create a user account via a request to mods/_core/users/create_user.php.
CVE-2015-1530 1 Google 1 Android 2024-11-21 7.8 High
media/libmedia/IAudioPolicyService.cpp in Android before 5.1 allows attackers to execute arbitrary code with media_server privileges or cause a denial of service (integer overflow) via a crafted application that provides an invalid array size.
CVE-2015-1525 1 Google 1 Android 2024-11-21 5.5 Medium
audio/AudioPolicyManagerBase.cpp in Android before 5.1 allows attackers to cause a denial of service (audio_policy application outage) via a crafted application that provides a NULL device address.
CVE-2015-1503 1 Icewarp 1 Mail Server 2024-11-21 N/A
Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the file parameter to a webmail/client/skins/default/css/css.php page or .../. (dot dot dot slash dot) in the (2) script or (3) style parameter to webmail/old/calendar/minimizer/index.php.
CVE-2015-1425 1 Jakweb 1 Gecko Cms 2024-11-21 9.8 Critical
JAKWEB Gecko CMS has Multiple Input Validation Vulnerabilities
CVE-2015-1418 1 Freebsd 1 Freebsd 2024-11-21 N/A
The do_ed_script function in pch.c in GNU patch through 2.7.6, and patch in FreeBSD 10.1 before 10.1-RELEASE-p17, 10.2 before 10.2-BETA2-p3, 10.2-RC1 before 10.2-RC1-p2, and 0.2-RC2 before 10.2-RC2-p1, allows remote attackers to execute arbitrary commands via a crafted patch file, because a '!' character can be passed to the ed program.
CVE-2015-1416 1 Freebsd 1 Freebsd 2024-11-21 N/A
Larry Wall's patch; patch in FreeBSD 10.2-RC1 before 10.2-RC1-p1, 10.2 before 10.2-BETA2-p2, and 10.1 before 10.1-RELEASE-p16; Bitrig; GNU patch before 2.2.5; and possibly other patch variants allow remote attackers to execute arbitrary shell commands via a crafted patch file.
CVE-2015-1396 2 Debian, Gnu 2 Debian Linux, Patch 2024-11-21 7.5 High
A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file. NOTE: this issue exists because of an incomplete fix for CVE-2015-1196.
CVE-2015-1394 1 10web 1 Photo Gallery 2024-11-21 5.4 Medium
Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) sort_by, (2) sort_order, (3) items_view, (4) dir, (5) clipboard_task, (6) clipboard_files, (7) clipboard_src, or (8) clipboard_dest parameters in an addImages action to wp-admin/admin-ajax.php.
CVE-2015-1391 1 Hp 1 Airwave 2024-11-21 8.8 High
Aruba AirWave before 8.0.7 allows bypass of a CSRF protection mechanism.
CVE-2015-1390 1 Hp 1 Airwave 2024-11-21 6.1 Medium
Aruba AirWave before 8.0.7 allows XSS attacks agsinat an administrator.
CVE-2015-1343 1 Canonical 1 Ubuntu Linux 2024-11-21 N/A
All versions of unity-scope-gdrive logs search terms to syslog.
CVE-2015-1341 1 Canonical 2 Apport, Ubuntu Linux 2024-11-21 N/A
Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport before 2.19.2 function _python_module_path.
CVE-2015-1340 1 Linuxcontainers 1 Lxd 2024-11-21 N/A
LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.
CVE-2015-1327 1 Canonical 1 Ubuntu Linux 2024-11-21 N/A
Content Hub before version 0.0+15.04.20150331-0ubuntu1.0 DBUS API only requires a file path for a content item, it doesn't actually require the confined app have access to the file to create a transfer. This could allow a malicious application using the DBUS API to export file:///etc/passwd which would then send a copy of that file to another app.
CVE-2015-1326 1 Python-dbusmock Project 1 Python-dbusmock 2024-11-21 N/A
python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious code if an attacker supplies a .pyc file.