CVE-2015-4864

mysql: unspecified vulnerability related to Server:Security:Privileges (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Privileges.

CVSS 2.0 · 3.5 Low EPSS 2.4% KEV · Not listed

Vendors

Canonical Mariadb Oracle and 1 more

Products

Ubuntu Linux Mariadb Mysql and 9 more

CVE-2015-4890

mysql: unspecified vulnerability related to Server:Replication (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Replication.

CVSS 2.0 · 3.5 Low EPSS 1.9% KEV · Not listed

Vendors

Oracle Redhat

Products

Mysql Enterprise Linux Rhel Software Collections

CVE-2015-4906

JDK: unspecified vulnerability fixed in 8u65 (JavaFX)

Unspecified vulnerability in Oracle Java SE 8u60 and JavaFX 2.2.85 allows remote attackers to affect confidentiality via unknown vectors related to JavaFX, a different vulnerability than CVE-2015-4908 and CVE-2015-4916.

CVSS 2.0 · 5.0 Medium EPSS 3.0% KEV · Not listed

Vendors

Oracle Redhat

Products

Javafx Jdk Jre and 1 more

CVE-2015-4910

mysql: unspecified vulnerability related to Server:Memcached (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Memcached.

CVSS 2.0 · 2.1 Low EPSS 2.0% KEV · Not listed

Vendors

Oracle Redhat

Products

Mysql Enterprise Linux Rhel Software Collections

CVE-2015-4913

mysql: unspecified vulnerability related to Server:DML (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML, a different vulnerability than CVE-2015-4858.

CVSS 2.0 · 3.5 Low EPSS 3.5% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 14 more

CVE-2010-2236

Proxy: Improper monitoring probes input sanitization (ACE)

The monitoring probe display in spacewalk-java before 2.1.148-1 and Red Hat Network (RHN) Satellite 4.0.0 through 4.2.0 and 5.1.0 through 5.3.0, and Proxy 5.3.0, allows remote authenticated users with permissions to administer monitoring probes to execute arbitrary code via unspecified vectors, related to backticks.

CVSS 2.0 · 6.0 Medium EPSS 3.1% KEV · Not listed

Vendors

Redhat

Products

Network Proxy Satellite Spacewalk-java

CVE-2016-2100

foreman: Unprivileged user can access private bookmarks of other users

Foreman before 1.10.3 and 1.11.0 before 1.11.0-RC2 allow remote authenticated users to read, modify, or delete private bookmarks by leveraging the (1) edit_bookmarks or (2) destroy_bookmarks permission.

CVSS 3.0 · 5.4 Medium EPSS 1.2% KEV · Not listed

Vendors

Redhat Theforeman

Products

Satellite Satellite Capsule Foreman

CVE-2015-8812

kernel: CXGB3: Logic bug in return code handling prematurely frees key structures causing Use after free or kernel panic.

drivers/infiniband/hw/cxgb3/iwch_cm.c in the Linux kernel before 4.5 does not properly identify error conditions, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted packets.

CVSS 3.1 · 9.8 Critical EPSS 14.5% KEV · Not listed

Vendors

Canonical Linux Novell and 1 more

Products

Ubuntu Linux Linux Kernel Suse Linux Enterprise Real Time Extension and 2 more

CVE-2015-8822

flash-plugin: multiple code execution issues fixed in APSB15-32

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via crafted MPEG-4 data, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, CVE-2015-8454, CVE-2015-8653, CVE-2015-8655, and CVE-2015-8821.

CVSS 3.1 · 8.8 High EPSS 6.5% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Air Air Desktop Runtime Air Sdk and 13 more

CVE-2015-5127

flash-plugin: multiple code execution flaws (APSB15-19)

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.

CVSS 2.0 · 10.0 Critical EPSS 50.3% KEV · Not listed

Vendors

Adobe Apple Linux and 3 more

Products

Air Air Sdk Air Sdk \& Compiler and 6 more

CVE-2015-5129

flash-plugin: multiple code execution flaws (APSB15-19)

Heap-based buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5541.

CVSS 2.0 · 10.0 Critical EPSS 10.3% KEV · Not listed

Vendors

Adobe Apple Linux and 3 more

Products

Air Air Sdk Air Sdk \& Compiler and 6 more

CVE-2015-5133

flash-plugin: multiple code execution flaws (APSB15-19)

Buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5131 and CVE-2015-5132.

CVSS 2.0 · 10.0 Critical EPSS 50.7% KEV · Not listed

Vendors

Adobe Apple Linux and 3 more

Products

Air Air Sdk Air Sdk \& Compiler and 6 more

CVE-2015-5143

Django: possible DoS by filling session store

The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys.

CVSS 2.0 · 7.8 High EPSS 7.2% KEV · Not listed

Vendors

Canonical Debian Djangoproject and 2 more

Products

Ubuntu Linux Debian Linux Django and 2 more

CVE-2015-8873

php: Stack consumption vulnerability in Zend/zend_exceptions.c

Stack consumption vulnerability in Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to cause a denial of service (segmentation fault) via recursive method calls.

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed

Vendors

Opensuse Php Redhat

Products

Leap Php Rhel Software Collections

CVE-2015-5178

AS/WildFly: missing X-Frame-Options header leading to clickjacking

The Management Console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.

CVSS 2.0 · 4.3 Medium EPSS 1.7% KEV · Not listed

Vendors

Redhat

Products

Jboss Enterprise Application Platform Jboss Wildfly Application Server

CVE-2015-8879

php: odbc_bindcols function mishandles driver behavior for SQL_WVARCHAR columns

The odbc_bindcols function in ext/odbc/php_odbc.c in PHP before 5.6.12 mishandles driver behavior for SQL_WVARCHAR columns, which allows remote attackers to cause a denial of service (application crash) in opportunistic circumstances by leveraging use of the odbc_fetch_array function to access a certain type of Microsoft SQL Server table.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed

Vendors

Php Redhat

Products

Php Rhel Software Collections

CVE-2015-5190

pcs: Command injection with root privileges.

The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL.

CVSS 2.0 · 8.5 High EPSS 2.5% KEV · Not listed

Vendors

Pacemaker\/corosync Configuration System Project Redhat

Products

Pacemaker\/corosync Configuration System Enterprise Linux

CVE-2015-5212

libreoffice: Integer underflow in PrinterSetup length

Integer underflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2, when the configuration setting "Load printer settings with the document" is enabled, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via crafted PrinterSetup data in an ODF document.

CVSS 2.0 · 6.8 Medium EPSS 8.7% KEV · Not listed

Vendors

Apache Canonical Debian and 2 more

Products

Openoffice Ubuntu Linux Debian Linux and 2 more

CVE-2016-3587

OpenJDK: insufficient protection of MethodHandle.invokeBasic() (Hotspot, 8154475)

Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot.

CVSS 3.0 · 9.6 Critical EPSS 5.9% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Linux and 2 more

CVE-2014-8177

gluster-swift metadata constraints are not correctly enforced

The Red Hat gluster-swift package, as used in Red Hat Gluster Storage (formerly Red Hat Storage Server), allows remote authenticated users to bypass the max_meta_count constraint via multiple crafted requests which exceed the limit when combined.

CVSS 3.0 · 6.5 Medium EPSS 1.7% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Gluster Storage Management Console Gluster Storage Server and 2 more