Search

Expected end of text, found '/' (at char 40), (line:1, col:41)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (336892 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2015-9289 2 Linux, Redhat 3 Linux Kernel, Enterprise Linux, Rhel Extras Rt 2024-11-21 5.5 Medium
In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows larger values such as 23.
CVE-2015-9288 1 Unity 1 Web Player 2024-11-21 N/A
The Unity Web Player plugin before 4.6.6f2 and 5.x before 5.0.3f2 allows attackers to read messages or access online services via a victim's credentials
CVE-2015-9287 1 Cam 1 The University Of Cambridge Web Authentication System Apache Authentication Agent 2024-11-21 N/A
Directory Traversal was discovered in University of Cambridge mod_ucam_webauth before 2.0.2. The key identification field ("kid") of the IdP's HTTP response message ("WLS-Response") can be manipulated by an attacker. The "kid" field is not signed like the rest of the message, and manipulation is therefore trivial. The "kid" field should only ever represent an integer. However, it is possible to provide any string value. An attacker could use this to their advantage to force the application agent to load the RSA public key required for message integrity checking from an unintended location.
CVE-2015-9286 1 Nodebb 1 Nodebb 2024-11-21 N/A
Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.
CVE-2015-9285 1 Esotalk 1 Esotalk 2024-11-21 N/A
esoTalk 1.0.0g4 has XSS via the PATH_INFO to the conversations/ URI.
CVE-2015-9284 1 Omniauth 1 Omniauth 2024-11-21 8.8 High
The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into the web application as the primary account.
CVE-2015-9282 1 Grafana 1 Piechart-panel 2024-11-21 N/A
The Pie Chart Panel plugin through 2019-01-02 for Grafana is vulnerable to XSS via legend data or tooltip data. When a chart is included in a Grafana dashboard, this vulnerability could allow an attacker to gain remote unauthenticated access to the dashboard.
CVE-2015-9281 6 Hpe, Ibm, Linux and 3 more 6 Hp-ux Ipfilter, Aix, Linux Kernel and 3 more 2024-11-21 N/A
Logon Manager in SAS Web Infrastructure Platform before 9.4M3 allows reflected XSS on the Timeout page.
CVE-2015-9280 1 Mailenable 1 Mailenable 2024-11-21 10.0 Critical
MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter.
CVE-2015-9279 1 Mailenable 1 Mailenable 2024-11-21 N/A
MailEnable before 8.60 allows Stored XSS via malformed use of "<img/src" with no ">" character in the body of an e-mail message.
CVE-2015-9278 1 Mailenable 1 Mailenable 2024-11-21 N/A
MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB after a password-change request.
CVE-2015-9277 1 Mailenable 1 Mailenable 2024-11-21 N/A
MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/.. /" are mishandled.
CVE-2015-9276 1 Smartertools 1 Smartermail 2024-11-21 N/A
SmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS by bypassing the anti-XSS mechanisms. It was possible to run JavaScript code when a victim user opens or replies to the attacker's email, which contained a malicious payload. Therefore, users' passwords could be reset by using an XSS attack, as the password reset page did not need the current password.
CVE-2015-9275 1 Arc Project 1 Arc 2024-11-21 N/A
ARC 5.21q allows directory traversal via a full pathname in an archive file.
CVE-2015-9274 1 Harfbuzz Project 1 Harfbuzz 2024-11-21 N/A
HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service (invalid read of two bytes and application crash) because of GPOS and GSUB table mishandling, related to hb-ot-layout-gpos-table.hh, hb-ot-layout-gsub-table.hh, and hb-ot-layout-gsubgpos-private.hh.
CVE-2015-9273 1 Wp-slimstat 1 Slimstat Analytics 2024-11-21 N/A
The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-based Referer tracking.
CVE-2015-9272 1 Videowhisper 1 Video Presentation 2024-11-21 N/A
The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code.
CVE-2015-9271 1 Videowhisper 1 Video Conference 2024-11-21 N/A
The VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress allows remote attackers to execute arbitrary code because vc/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code, a different vulnerability than CVE-2014-1905.
CVE-2015-9270 1 Theholidaycalendar 1 Holiday Calendar 2024-11-21 N/A
XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter.
CVE-2015-9269 1 Wpmobilepack 1 Wordpress Mobile Pack 2024-11-21 N/A
The export/content.php exportarticle feature in the wordpress-mobile-pack plugin before 2.1.3 2015-06-03 for WordPress allows remote attackers to obtain sensitive information because the content of a privately published post is sent in JSON format.