Search
Total
3359 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2015-7776 | 1 Cybozu | 1 Garoon | 2016-06-21 | 4.3 MEDIUM | 4.3 MEDIUM |
| Cybozu Garoon 3.x and 4.x before 4.2.0 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail message, a different vulnerability than CVE-2016-1196. | |||||
| CVE-2016-4816 | 1 Buffalo | 68 Bhr-4grv, Bhr-4grv Firmware, Dwr-hp-g300nh and 65 more | 2016-06-21 | 4.3 MEDIUM | 6.5 MEDIUM |
| BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices allow remote attackers to discover credentials and other sensitive information via unspecified vectors. | |||||
| CVE-2016-2500 | 1 Google | 1 Android | 2016-06-15 | 4.3 MEDIUM | 5.5 MEDIUM |
| Activity Manager in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not properly terminate process groups, which allows attackers to obtain sensitive information via a crafted application, aka internal bug 19285814. | |||||
| CVE-2015-7528 | 2 Kubernetes, Redhat | 2 Kubernetes, Openshift | 2016-06-15 | 5.0 MEDIUM | 5.3 MEDIUM |
| Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name. | |||||
| CVE-2016-2498 | 1 Google | 2 Android, Nexus 7 | 2016-06-14 | 4.3 MEDIUM | 5.5 MEDIUM |
| The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 7 (2013) devices allows attackers to bypass intended data-access restrictions via a crafted application, aka internal bug 27777162. | |||||
| CVE-2016-2499 | 1 Google | 1 Android | 2016-06-14 | 4.3 MEDIUM | 5.5 MEDIUM |
| AudioSource.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not initialize certain data, which allows attackers to obtain sensitive information via a crafted application, aka internal bug 27855172. | |||||
| CVE-2016-1582 | 1 Canonical | 2 Lxd, Ubuntu Linux | 2016-06-10 | 2.1 LOW | 5.5 MEDIUM |
| LXD before 2.0.2 does not properly set permissions when switching an unprivileged container into privileged mode, which allows local users to access arbitrary world readable paths in the container directory via unspecified vectors. | |||||
| CVE-2016-2142 | 1 Redhat | 1 Openshift | 2016-06-09 | 2.1 LOW | 5.5 MEDIUM |
| Red Hat OpenShift Enterprise 3.1 uses world-readable permissions on the /etc/origin/master/master-config.yaml configuration file, which allows local users to obtain Active Directory credentials by reading the file. | |||||
| CVE-2016-2149 | 1 Redhat | 1 Openshift | 2016-06-09 | 4.0 MEDIUM | 6.5 MEDIUM |
| Red Hat OpenShift Enterprise 3.2 allows remote authenticated users to read log files from another namespace by using the same name as a previously deleted namespace when creating a new namespace. | |||||
| CVE-2016-4536 | 1 Openafs | 1 Openafs | 2016-05-19 | 5.0 MEDIUM | 5.3 MEDIUM |
| The client in OpenAFS before 1.6.17 does not properly initialize the (1) AFSStoreStatus, (2) AFSStoreVolumeStatus, (3) VldbListByAttributes, and (4) ListAddrByAttributes structures, which might allow remote attackers to obtain sensitive memory information by leveraging access to RPC call traffic. | |||||
| CVE-2016-1206 | 1 Iodata | 5 Wn-gdn\/r3, Wn-gdn\/r3-c, Wn-gdn\/r3-s and 2 more | 2016-05-18 | 3.3 LOW | 4.3 MEDIUM |
| The WPS implementation on I-O DATA DEVICE WN-GDN/R3, WN-GDN/R3-C, WN-GDN/R3-S, and WN-GDN/R3-U devices does not limit PIN guesses, which allows remote attackers to obtain network access via a brute-force attack. | |||||
| CVE-2016-2458 | 1 Google | 1 Android | 2016-05-10 | 4.3 MEDIUM | 5.5 MEDIUM |
| The compose functionality in AOSP Mail in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly restrict attachments, which allows attackers to obtain sensitive information via a crafted application, related to ComposeActivity.java and ComposeActivityEmail.java, aka internal bug 27335139. | |||||
| CVE-2016-2459 | 1 Google | 10 Android, Android One, Nexus 5 and 7 more | 2016-05-09 | 4.3 MEDIUM | 5.5 MEDIUM |
| mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not initialize certain data structures, which allows attackers to obtain sensitive information via a crafted application, related to IGraphicBufferConsumer.cpp and IGraphicBufferProducer.cpp, aka internal bug 27556038. | |||||
| CVE-2016-0864 | 1 Tollgrade | 1 Smartgrid Lighthouse Sensor Management System | 2016-05-09 | 5.0 MEDIUM | 5.3 MEDIUM |
| Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, and 4.1.0 Build 16, allows remote attackers to obtain sensitive report and username information via unspecified vectors. | |||||
| CVE-2016-1199 | 1 Lockon | 1 Ec-cube | 2016-05-06 | 5.0 MEDIUM | 5.3 MEDIUM |
| The login page in the management screen in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to bypass intended IP address restrictions via unspecified vectors, a different vulnerability than CVE-2016-1200. | |||||
| CVE-2015-4176 | 1 Linux | 1 Linux Kernel | 2016-05-05 | 2.1 LOW | 5.5 MEDIUM |
| fs/namespace.c in the Linux kernel before 4.0.2 does not properly support mount connectivity, which allows local users to read arbitrary files by leveraging user-namespace root access for deletion of a file or directory. | |||||
| CVE-2016-2304 | 1 Ecava | 1 Integraxor | 2016-04-28 | 4.3 MEDIUM | 4.3 MEDIUM |
| Ecava IntegraXor before 5.0 build 4522 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. | |||||
| CVE-2016-3688 | 1 Dotcms | 1 Dotcms | 2016-04-28 | 4.0 MEDIUM | 6.5 MEDIUM |
| SQL injection vulnerability in dotCMS before 3.5 allows remote administrators to execute arbitrary SQL commands via the c0-e3 parameter to dwr/call/plaincall/UserAjax.getUsersList.dwr. | |||||
| CVE-2016-2302 | 1 Ecava | 1 Integraxor | 2016-04-27 | 5.0 MEDIUM | 5.3 MEDIUM |
| Ecava IntegraXor before 5.0 build 4522 allows remote attackers to obtain sensitive information by reading detailed error messages. | |||||
| CVE-2016-2425 | 1 Google | 1 Android | 2016-04-25 | 4.3 MEDIUM | 5.5 MEDIUM |
| mail/compose/ComposeActivity.java in AOSP Mail in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 supports file:///data attachments, which allows attackers to obtain sensitive information via a crafted application, aka internal bugs 7154234 and 26989185. | |||||
| CVE-2016-2426 | 1 Google | 1 Android | 2016-04-25 | 4.3 MEDIUM | 5.5 MEDIUM |
| server/content/ContentService.java in the Framework component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for a GET_ACCOUNTS permission, which allows attackers to obtain sensitive information via a crafted application, aka internal bug 26094635. | |||||
| CVE-2016-2415 | 1 Google | 1 Android | 2016-04-21 | 7.1 HIGH | 5.5 MEDIUM |
| exchange/eas/EasAutoDiscover.java in the Autodiscover implementation in Exchange ActiveSync in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to obtain sensitive information via a crafted application that triggers a spoofed response to a GET request, aka internal bug 26488455. | |||||
| CVE-2015-8537 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2016-04-20 | 5.0 MEDIUM | 5.3 MEDIUM |
| app/views/journals/index.builder in Redmine before 2.6.9, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote attackers to obtain sensitive information by viewing an Atom feed. | |||||
| CVE-2015-8473 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2016-04-20 | 4.0 MEDIUM | 4.3 MEDIUM |
| The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote authenticated users to obtain sensitive information in changeset messages by leveraging permission to read issues with related changesets from other projects. | |||||
| CVE-2016-3686 | 1 F5 | 2 Big-ip Access Policy Manager, Big-ip Edge Gateway | 2016-04-18 | 4.3 MEDIUM | 5.9 MEDIUM |
| The Single Sign-On (SSO) feature in F5 BIG-IP APM 11.x before 11.6.0 HF6 and BIG-IP Edge Gateway 11.0.0 through 11.3.0 might allow remote attackers to obtain sensitive SessionId information by leveraging access to the Location HTTP header in a redirect. | |||||
| CVE-2015-7502 | 1 Redhat | 2 Cloudforms, Cloudforms Management Engine | 2016-04-18 | 1.9 LOW | 5.1 MEDIUM |
| Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the backend PostgreSQL database, which might allow local users to obtain sensitive data and consequently gain privileges by leveraging access to (1) database exports or (2) log files. | |||||
| CVE-2016-3170 | 2 Debian, Drupal | 2 Debian Linux, Drupal | 2016-04-14 | 5.0 MEDIUM | 5.3 MEDIUM |
| The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive username information by leveraging a configuration that permits using an email address to login and a module that permits logging in. | |||||
| CVE-2016-2509 | 1 Belden | 6 Hirschmann Firmware, Hirschmann L2b, Hirschmann L2e and 3 more | 2016-03-23 | 2.9 LOW | 5.3 MEDIUM |
| The password-sync feature on Belden Hirschmann Classic Platform switches L2B before 05.3.07 and L2E, L2P, L3E, and L3P before 09.0.06 sets an SNMP community to the same string as the administrator password, which allows remote attackers to obtain sensitive information by sniffing the network. | |||||
| CVE-2015-2286 | 1 Edx | 1 Open Edx | 2016-03-22 | 4.3 MEDIUM | 6.5 MEDIUM |
| lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assisted remote attackers to discover password-reset tokens by reading a referer log after a victim navigates from this page to a social-sharing site. | |||||
| CVE-2016-1562 | 1 Dte Energy | 1 Insight | 2016-03-19 | 4.0 MEDIUM | 4.3 MEDIUM |
| The REST API in the DTE Energy Insight application before 1.7.8 for Android allows remote authenticated users to obtain unspecified customer information via a SQL expression in the filter parameter. | |||||
| CVE-2016-1357 | 1 Cisco | 1 Cisco Policy Suite | 2016-03-14 | 5.0 MEDIUM | 5.3 MEDIUM |
| The password-management administration component in Cisco Policy Suite (CPS) 7.0.1.3, 7.0.2, 7.0.2-att, 7.0.3-att, 7.0.4-att, and 7.5.0 allows remote attackers to bypass intended RBAC restrictions and read unspecified data via unknown vectors, aka Bug ID CSCut85211. | |||||
| CVE-2016-0232 | 1 Ibm | 1 Financial Transaction Manager | 2016-03-10 | 4.0 MEDIUM | 4.3 MEDIUM |
| IBM Financial Transaction Manager (FTM) for ACH Services, Check Services and Corporate Payment Services (CPS) 3.0.0 before FP12 allows remote authenticated users to obtain sensitive information by reading README files. | |||||
| CVE-2016-0231 | 1 Ibm | 1 Financial Transaction Manager | 2016-03-10 | 4.0 MEDIUM | 4.3 MEDIUM |
| IBM Financial Transaction Manager (FTM) for ACH Services, Check Services and Corporate Payment Services (CPS) 3.0.0 before FP12 allows remote authenticated users to obtain sensitive information by reading exception details in error logs. | |||||
| CVE-2015-4991 | 1 Ibm | 1 Spss Modeler | 2016-03-10 | 2.1 LOW | 4.0 MEDIUM |
| IBM SPSS Modeler 14.2 through FP3 IF027, 15 through FP3 IF015, 16 through FP2 IF012, 17 through FP1 IF018, and 17.1 through IF008 includes unspecified cleartext data in memory dumps, which allows local users to obtain sensitive information by reading a dump file. | |||||
| CVE-2016-1342 | 1 Cisco | 1 Firepower Management Center | 2016-03-04 | 5.0 MEDIUM | 5.3 MEDIUM |
| The device login page in Cisco FirePOWER Management Center 5.3 through 6.0.0.1 allows remote attackers to obtain potentially sensitive software-version information by reading help files, aka Bug ID CSCuy36654. | |||||
| CVE-2015-7444 | 1 Ibm | 1 Websphere Commerce | 2016-03-02 | 5.0 MEDIUM | 5.3 MEDIUM |
| The Update Installer in IBM WebSphere Commerce Enterprise 7.0.0.8 and 7.0.0.9 does not properly replicate the search index, which allows attackers to obtain sensitive information via unspecified vectors. | |||||
| CVE-2016-1323 | 1 Cisco | 1 Spark | 2016-02-29 | 4.0 MEDIUM | 4.3 MEDIUM |
| The REST interface in Cisco Spark 2015-06 allows remote authenticated users to obtain sensitive information via a request for an unspecified file, aka Bug ID CSCuv84048. | |||||
| CVE-2015-8488 | 1 Cybozu | 1 Office | 2016-02-22 | 4.3 MEDIUM | 4.3 MEDIUM |
| Cybozu Office 10.3.0 allows remote attackers to read image files via a crafted e-mail message, a different vulnerability than CVE-2015-8487. | |||||
| CVE-2015-8487 | 1 Cybozu | 1 Office | 2016-02-22 | 2.6 LOW | 4.3 MEDIUM |
| Cybozu Office 9.0.0 through 10.3 allows remote attackers to discover CSRF tokens via unspecified vectors, a different vulnerability than CVE-2015-8488. | |||||
| CVE-2015-7680 | 1 Ipswitch | 1 Moveit Dmz | 2016-02-18 | 5.0 MEDIUM | 5.3 MEDIUM |
| Ipswitch MOVEit DMZ before 8.2 provides different error messages for authentication attempts depending on whether the user account exists, which allows remote attackers to enumerate usernames via a series of SOAP requests to machine.aspx. | |||||
| CVE-2015-7675 | 1 Ipswitch | 2 Moveit Dmz, Moveit Mobile | 2016-02-18 | 4.0 MEDIUM | 6.5 MEDIUM |
| The "Send as attachment" feature in Ipswitch MOVEit DMZ before 8.2 and MOVEit Mobile before 1.2.2 allow remote authenticated users to bypass authorization and read uploaded files via a valid FileID in the (1) serverFileIds parameter to mobile/sendMsg or (2) arg01 parameter to human.aspx. | |||||
| CVE-2015-2005 | 1 Ibm | 1 Qradar Security Information And Event Manager | 2016-02-18 | 5.0 MEDIUM | 5.3 MEDIUM |
| IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 and 7.2.x before 7.2.5 Patch 6 does not properly expire sessions, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation. | |||||
| CVE-2015-7677 | 1 Ipswitch | 1 Moveit Dmz | 2016-02-12 | 4.0 MEDIUM | 4.3 MEDIUM |
| The MOVEitISAPI service in Ipswitch MOVEit DMZ before 8.2 provides different error messages depending on whether a FileID exists, which allows remote authenticated users to enumerate FileIDs via the X-siLock-FileID parameter in a download action to MOVEitISAPI/MOVEitISAPI.dll. | |||||
| CVE-2015-7487 | 1 Ibm | 13 Change And Configuration Management Database, Maximo Asset Management, Maximo Asset Management Essentials and 10 more | 2016-01-28 | 4.9 MEDIUM | 4.1 MEDIUM |
| IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 IFIX002, and 7.6.0 before 7.6.0.3 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9 IFIX002, 7.5.1, and 7.6.0 before 7.6.0.3 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allow local users to obtain sensitive information by leveraging administrative privileges and reading log files. | |||||
| CVE-2015-7488 | 1 Ibm | 1 Spectrum Scale | 2016-01-28 | 2.1 LOW | 5.9 MEDIUM |
| IBM Spectrum Scale 4.1.1.x before 4.1.1.4 and 4.2.x before 4.2.0.1, in certain LDAP File protocol configurations, allows remote attackers to discover an LDAP password via unspecified vectors. | |||||
| CVE-2015-3943 | 1 Advantech | 1 Webaccess | 2016-01-18 | 5.0 MEDIUM | 5.3 MEDIUM |
| Advantech WebAccess before 8.1 allows remote attackers to read sensitive cleartext information about e-mail project accounts via unspecified vectors. | |||||
| CVE-2015-8303 | 1 Huawei | 1 Document Security Management | 2016-01-13 | 2.1 LOW | 4.0 MEDIUM |
| Huawei Document Security Management (DSM) with software before V100R002C05SPC661 does not clear the clipboard when closing a secure file, which allows local users to obtain sensitive information by pasting the contents to another file. | |||||
| CVE-2016-1501 | 1 Owncloud | 1 Owncloud | 2016-01-12 | 4.0 MEDIUM | 4.3 MEDIUM |
| ownCloud Server before 8.0.9 and 8.1.x before 8.1.4 allow remote authenticated users to obtain sensitive information via unspecified vectors, which reveals the installation path in the resulting exception messages. | |||||
| CVE-2015-8335 | 1 Huawei | 1 Vcn500 | 2016-01-11 | 4.0 MEDIUM | 6.5 MEDIUM |
| Huawei VCN500 with software before V100R002C00SPC201 logs passwords in cleartext, which allows remote authenticated users to obtain sensitive information by triggering log generation and then reading the log. | |||||
| CVE-2015-7437 | 1 Ibm | 1 Sterling B2b Integrator | 2016-01-07 | 2.1 LOW | 5.5 MEDIUM |
| Queue Watcher in IBM Sterling B2B Integrator 5.2 allows local users to obtain sensitive information via unspecified vectors. | |||||