2015

The guest portal in Cisco Identity Services Engine (ISE) 3300 1.2(0.899) does not restrict access to uploaded HTML docum

The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 provide inappropriate -EAGAIN retur

Basware Banking (Maksuliikenne) 8.90.07.X does not properly prevent access to private keys, which allows remote attacker

The Special:Contributions page in MediaWiki before 1.22.0 allows remote attackers to determine if an IP is autoblocked v

The Special:DeletedContributions page in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows

GeSHi, as used in the SyntaxHighlight_GeSHi extension and MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x bef

The reset functionality in the TimedMediaHandler extension for MediaWiki does not create a new transcode, which allows r

The Quiz extension for MediaWiki allows remote attackers to cause a denial of service via regex metacharacters in a regu

The IPv4 implementation on Cisco ASR 1000 devices with software 15.5(3)S allows remote attackers to cause a denial of se

The NavigatorServiceWorker::serviceWorker function in modules/serviceworkers/NavigatorServiceWorker.cpp in Blink, as use

The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not pr

The FrameFetchContext::updateTimingInfoForIFrameNavigation function in core/loader/FrameFetchContext.cpp in Blink, as us

Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read

Cisco TelePresence IX5000 8.0.3 stores a private key associated with an X.509 certificate under the web root with insuff

Microsoft Internet Explorer 10 and 11 allows remote attackers to obtain sensitive information from process memory via a

Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to

Microsoft .NET Framework 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to cause a denial of service to an ASP.NET w

The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a de

IBM WebSphere MQ 7.0.1 before 7.0.1.13 allows remote attackers to cause a denial of service (channel-agent abend and pro

Cisco Web Security Appliance (WSA) 8.0.6-078 and 8.0.6-115 allows remote attackers to cause a denial of service (service

Cisco Content Security Management Appliance (SMA) 7.8.0-000 does not properly validate credentials, which allows remote

libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allo

The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of serv

The Administration Views module 7.x-1.x before 7.x-1.5 for Drupal checks access permissions based on the router path fro

The RESTful module 7.x-1.x before 7.x-1.3 for Drupal does not properly cache pages of authenticated users when using non

The Commerce Commonwealth (CBA) module 7.x-1.x before 7.x-1.5 for Drupal does not properly validate payments, which allo

The document.cookie API implementation in the CFNetwork Cookies subsystem in WebKit in Apple iOS before 9 allows remote

WebKit in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain an object reference via

NetworkExtension in the kernel in Apple iOS before 9 does not properly initialize an unspecified data structure, which a

dyld in Apple iOS before 9 allows attackers to bypass a code-signing protection mechanism via an app that places a craft

The checkint division routines in removefile in Apple iOS before 9 allow attackers to cause a denial of service (overflo

The CFNetwork Proxies component in Apple iOS before 9 does not properly handle a Set-Cookie header within a response to

Mail in Apple iOS before 9 allows remote attackers to use an address-book contact as a spoofed e-mail sender address via

The CFNetwork HTTPProtocol component in Apple iOS before 9 allows remote attackers to bypass the HSTS protection mechani

The CFNetwork HTTPProtocol component in Apple iOS before 9 mishandles HSTS state, which allows remote attackers to bypas

XNU in the kernel in Apple iOS before 9 does not properly validate the headers of TCP packets, which allows remote attac

The CFNetwork Cookies component in Apple iOS before 9 allows remote attackers to track users via vectors involving a coo

Safari in Apple iOS before 9 allows remote attackers to spoof the relationship between URLs and web content via a crafte

The HTML form implementation in WebKit in Apple iOS before 9 does not prevent QuickType access to the final character of

IDE Xcode Server in Apple Xcode before 7.0 does not properly restrict access to repository e-mail lists, which allows re

The CFNetwork FTPProtocol component in Apple iOS before 9 allows remote FTP proxy servers to trigger TCP connection atte

The FastL4 virtual server in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and PEM 11.3.0 through

Directory traversal vulnerability in the remote log viewing functionality in McAfee Agent (MA) 5.x before 5.0.2 allows r

Schneider Electric StruxureWare Building Expert MPM before 2.15 does not use encryption for the client-server data strea

The DHCPv6 server in Cisco IOS on ASR 9000 devices with software 5.2.0 Base allows remote attackers to cause a denial of

The DHCPv6 server in Cisco IOS on ASR 9000 devices with software 5.2.0 Base allows remote attackers to cause a denial of

Retrospect and Retrospect Client before 10.0.2.119 on Windows, before 12.0.2.116 on OS X, and before 10.0.2.104 on Linux

Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R08

The Scald module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to fields, which allows remote atta

Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Ad