Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (322822 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2015-2320 2 Debian, Mono-project 2 Debian Linux, Mono 2024-11-21 N/A
The TLS stack in Mono before 3.12.1 allows remote attackers to have unspecified impact via vectors related to client-side SSLv2 fallback.
CVE-2015-2319 1 Mono-project 1 Mono 2024-11-21 N/A
The TLS stack in Mono before 3.12.1 makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204.
CVE-2015-2318 2 Debian, Mono-project 2 Debian Linux, Mono 2024-11-21 N/A
The TLS stack in Mono before 3.12.1 allows man-in-the-middle attackers to conduct message skipping attacks and consequently impersonate clients by leveraging missing handshake state validation, aka a "SMACK SKIP-TLS" issue.
CVE-2015-2298 1 Etherpad 1 Etherpad 2024-11-21 N/A
node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive information by leveraging an improper substring check when exporting a padID.
CVE-2015-2254 1 Huawei 2 Oceanstor Uds, Oceanstor Uds Firmware 2024-11-21 N/A
Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to capture and change patch loading information resulting in the deletion of directory files and compromise of system functions when loading a patch.
CVE-2015-2249 1 Synacor 1 Zimbra Collaboration Server 2024-11-21 5.4 Medium
Zimbra Collaboration before 8.6.0 patch5 has XSS.
CVE-2015-2230 1 Synacor 1 Zimbra Collaboration Server 2024-11-21 6.1 Medium
Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console.
CVE-2015-2207 1 Netcracker 1 Resource Management System 2024-11-21 5.4 Medium
Multiple cross-site scripting (XSS) vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) ctrl, (2) t90001_0_theform_selection, (3) _scroll, (4) tableName, (5) parent, (6) circuit, (7) return, (8) xname, or (9) mpTransactionId parameter.
CVE-2015-2204 1 Evergreen-ils 1 Evergreen 2024-11-21 N/A
Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to bypass an intended access restriction and obtain sensitive information about org unit settings by leveraging failure of open-ils.actor.ou_setting.ancestor_default to enforce view_perm when no auth token is provided.
CVE-2015-2203 1 Evergreen-ils 1 Evergreen 2024-11-21 N/A
Evergreen 2.5.9, 2.6.7, and 2.7.4 allows remote authenticated users with STAFF_LOGIN permission to obtain sensitive settings history information by leveraging listing of open-ils.pcrud as a controller in the IDL.
CVE-2015-2202 2 Arubanetworks, Hp 2 Airwave, Airwave 2024-11-21 7.2 High
Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows administrative users to escalate privileges to root on the underlying OS.
CVE-2015-2201 2 Arubanetworks, Hp 2 Airwave, Airwave 2024-11-21 7.2 High
Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and file disclosure by administrative users.
CVE-2015-2186 1 Edx 2 Configuration, Edx-platform 2024-11-21 N/A
The Ansible edxapp role in the Configuration Repo in edX allows remote websites to spoof edX accounts by leveraging use of the string literal "False" instead of a boolean False for the CORS_ORIGIN_ALLOW_ALL setting. Note: this vulnerability was fixed on 2015-03-06, but the version number was not changed.
CVE-2015-2179 1 Xaviershay-dm-rails Porject 1 Xaviershay-dm-rails 2024-11-21 5.5 Medium
The xaviershay-dm-rails gem 0.10.3.8 for Ruby allows local users to discover MySQL credentials by listing a process and its arguments.
CVE-2015-2100 1 Webgate 2 Control Center, Edvr Manager 2024-11-21 8.8 High
Multiple stack-based buffer overflows in WebGate eDVR Manager and Control Center allow remote attackers to execute arbitrary code via unspecified vectors to the (1) TCPDiscover or (2) TCPDiscover2 function in the WESPDiscovery.WESPDiscoveryCtrl.1 control.
CVE-2015-2099 1 Webgateinc 1 Control Center 2024-11-21 8.8 High
Multiple buffer overflows in WebGate Control Center allow remote attackers to execute arbitrary code via unspecified vectors to the (1) GetRecFileInfo function in the FileConverter.FileConverterCtrl.1 control, (2) Login function in the LoginContoller.LoginControllerCtrl.1 control, or (3) GetThumbnail function in the WESPPlayback.WESPPlaybackCtrl.1 control.
CVE-2015-2098 1 Webgateinc 1 Edvr Manager 2024-11-21 8.8 High
Multiple stack-based buffer overflows in WebGate eDVR Manager allow remote attackers to execute arbitrary code via unspecified vectors to the (1) Connect, (2) ConnectEx, or (3) ConnectEx2 function in the WESPEvent.WESPEventCtrl.1 control; (4) AudioOnlySiteChannel function in the WESPPlayback.WESPPlaybackCtrl.1 control; (5) Connect or (6) ConnectEx function in the WESPPTZ.WESPPTZCtrl.1 control; (7) SiteChannel property in the WESPPlayback.WESPPlaybackCtrl.1 control; (8) SiteName property in the WESPPlayback.WESPPlaybackCtrl.1 control; or (9) OpenDVrSSite function in the WESPPTZ.WESPPTZCtrl.1 control.
CVE-2015-2081 1 Datto 16 Alto 2, Alto 2 Firmware, Alto 3 and 13 more 2024-11-21 N/A
Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts.
CVE-2015-2074 1 Sap 1 Businessobjects Edge 2024-11-21 7.5 High
The File Repository Server (FRS) CORBA listener in SAP BussinessObjects Edge 4.0 allows remote attackers to write to arbitrary files via a full pathname, aka SAP Note 2018681.
CVE-2015-2073 1 Sap 1 Businessobjects Edge 2024-11-21 7.5 High
The File RepositoRy Server (FRS) CORBA listener in SAP BussinessObjects Edge 4.0 allows remote attackers to read arbitrary files via a full pathname, aka SAP Note 2018682.