CVE Vulnerability Catalog

CVE-2015-7393 affects BIG-IP products, including LTM, APM, ASM, and others, allowing local users with advanced shell (bash) access to gain privileges via unspecified vectors.

The HTTPS fallback implementation in Shell In A Box before version 2.19 makes it easier for remote attackers to conduct DNS rebinding attacks via the '/plain' URL.

Buffer overflow in the HIFI driver in Huawei P8 phones before specified software versions may lead to system crashes or arbitrary code execution by attackers.

There is a heap-based buffer overflow in the HIFI driver in Huawei Mate 7 and P8 phones, which may lead to a denial of service or execution of arbitrary code via a crafted application.

The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service via a large websocket payload or HTTP headers section.

The Operation and Maintenance Unit (OMU) in Huawei VCN500 with software before V100R002C00SPC200 allows remote authenticated users to change the IP address of the media server via crafted packets.

The Operation and Maintenance Unit (OMU) in Huawei VCN500 with software before V100R002C00SPC200 does not properly invalidate the session ID when an 'abnormal exit' occurs, allowing remote attackers to conduct replay attacks via the session ID.

Huawei eSpace 7910 and 7950 IP phones with software before V200R002C00SPC800 are vulnerable to remote attacks that can lead to denial of service via unspecified packets, resulting in device restart.

A memory leak in Huawei eSpace 8950 IP phones with software before V200R003C00SPC300 can be exploited by remote attackers. Attackers can cause a denial of service by sending a large number of crafted ARP packets.

CVE-2015-6566 vulnerability in Zarafa Collaboration Platform (ZCP) before version 7.2.1 allows local users to gain privileges via a symlink attack on /tmp/zarafa-vacation-* files.

Directory Utility in Apple OS X before 10.11.1 mishandles authentication for new sessions, which allows local users to gain privileges via unspecified vectors.

CSRF vulnerability in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service (JRS) 6.0 before version 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.

Multiple open redirect vulnerabilities in the Aurora starter store in IBM WebSphere Commerce 7.0 through Feature Pack 8 allow remote attackers to redirect users to arbitrary web sites.

ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allow remote authenticated users to obtain sensitive information from a directory listing and possibly cause a denial of service (CPU consumption) via the force parameter to index.php/apps/files/ajax/scan.php.

The vulnerability in Intel McAfee ePolicy Orchestrator (ePO) allows remote attackers to execute arbitrary code via a crafted serialized Java object. It affects versions 4.6.9 and earlier, 5.0.x, 5.1.x before 5.1.3 Hotfix 1106041, and 5.3.x before 5.3.1 Hotfix 1106041.

The Zip Attachments plugin before version 1.5.1 for WordPress has a directory traversal vulnerability in download.php, allowing remote attackers to read arbitrary files via a .. (dot dot) in the za_file parameter.

AVM FRITZ!OS before version 6.30 extracts the contents of firmware updates before verifying their cryptographic signature, allowing remote attackers to create symlinks or overwrite critical files, and consequently execute arbitrary code.

The Mollom module 6.x-2.7 before 6.x-2.15 for Drupal allows remote attackers to bypass intended access restrictions and modify the mollom blacklist via unspecified vectors.

The EnableNetwork method in the Network class in Blueman before version 2.0.3 allows local users to gain privileges via the dhcp_handler argument.

An open redirect vulnerability exists in Blue Coat ProxySG versions 6.5 before 6.5.8.8 and 6.6, as well as in Advanced Secure Gateway (ASG) 6.6, which may allow remote attackers to redirect users to arbitrary websites.