CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In February 2015 (CVSS score >= 7)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2015-2102 89 1 Exec Code Sql 2015-02-27 2018-10-09
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in view_item.php in ClipBucket 2.7 RC3 (2.7.0.4.v2929-rc3) allows remote attackers to execute arbitrary SQL commands via the item parameter.
2 CVE-2015-2090 89 1 Exec Code Sql 2015-02-26 2016-11-30
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the ajax_survey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 for Wordpress allows remote attackers to execute arbitrary SQL commands via the survey_id parameter in an ajax_survey action to wp-admin/admin-ajax.php.
3 CVE-2015-2070 89 1 Exec Code Sql 2015-02-24 2016-11-30
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote attackers to execute arbitrary SQL commands via the catId parameter to cm/blogrss/feed.
4 CVE-2015-2066 89 Exec Code Sql 2015-02-24 2016-12-31
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in DLGuard 4.5 allows remote attackers to execute arbitrary SQL commands via the c parameter to index.php.
5 CVE-2015-2065 89 1 Exec Code Sql 2015-02-24 2016-11-30
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery (contus-video-gallery) plugin before 2.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the vid parameter in a rss action to wp-admin/admin-ajax.php.
6 CVE-2015-2055 20 1 DoS 2015-02-23 2016-11-30
7.8
None Remote Low Not required None None Complete
Zhone GPON 2520 with firmware R4.0.2.566b allows remote attackers to cause a denial of service via a long string in the oldpassword parameter.
7 CVE-2015-2052 119 Exec Code Overflow 2015-02-23 2016-12-31
10.0
None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in the DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary code via a long string in a GetDeviceSettings action to the HNAP interface.
8 CVE-2015-2051 77 Exec Code 2015-02-23 2016-12-31
10.0
None Remote Low Not required Complete Complete Complete
The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.
9 CVE-2015-2050 Exec Code 2015-02-23 2017-03-24
10.0
None Remote Low Not required Complete Complete Complete
D-Link DAP-1320 Rev Ax with firmware before 1.21b05 allows attackers to execute arbitrary commands via unspecified vectors.
10 CVE-2015-2049 Exec Code 2015-02-23 2017-09-10
9.0
None Remote Low ??? Complete Complete Complete
Unrestricted file upload vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension.
11 CVE-2015-2033 287 Exec Code 2015-02-20 2016-11-30
10.0
None Remote Low Not required Complete Complete Complete
Anyterm Daemon in Infoblox Network Automation NetMRI before NETMRI-23483 allows remote attackers to execute arbitrary commands with root privileges via a crafted terminal/anyterm-module request.
12 CVE-2015-1605 89 Exec Code Sql 2015-02-24 2015-02-25
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Dell ScriptLogic Asset Manager (aka Quest Workspace Asset Manager) before 9.5 allow remote attackers to execute arbitrary SQL commands via unspecified vectors to (1) GetClientPackage.aspx or (2) GetProcessedPackage.aspx.
13 CVE-2015-1592 74 Exec Code 2015-02-19 2019-10-09
7.5
None Remote Low Not required Partial Partial Partial
Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::thaw function, which allows remote attackers to include and execute arbitrary local Perl files and possibly execute arbitrary code via unspecified vectors.
14 CVE-2015-1587 1 Exec Code 2015-02-19 2015-02-21
7.5
None Remote Low Not required Partial Partial Partial
Unrestricted file upload vulnerability in file_to_index.php in Maarch LetterBox 2.8 and earlier and GEC/GED 1.4 and earlier allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a request to a predictable filename in tmp/.
15 CVE-2015-1576 89 Exec Code Sql 2015-02-11 2015-02-12
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in u5CMS before 3.9.4 allow remote attackers to execute arbitrary SQL commands via the name parameter to (1) copy2.php, (2) localize.php, (3) metai.php, (4) nc.php, (5) new2.php, or (6) rename2.php in u5admin/; (7) c parameter to u5admin/editor.php; (8) typ parameter to u5admin/meta2.php; or (9) newname parameter to u5admin/rename2.php.
16 CVE-2015-1518 89 1 Exec Code Sql 2015-02-11 2018-10-09
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the search_post function in includes/search.php in Redaxscript before 2.3.0 allows remote attackers to execute arbitrary SQL commands via the search_terms parameter.
17 CVE-2015-1515 264 1 +Priv 2015-02-19 2015-02-21
7.2
None Local Low Not required Complete Complete Complete
The dwall.sys driver in SoftSphere DefenseWall Personal Firewall 3.24 allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted 0x00222000, 0x00222004, 0x00222008, 0x0022200c, or 0x00222010 IOCTL call.
18 CVE-2015-1514 89 Exec Code Sql 2015-02-06 2018-10-09
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in FancyFon FAMOC before 3.17.4 allow (1) remote attackers to execute arbitrary SQL commands via the device ID REST parameter (PATH_INFO) to /ajax.php or (2) remote authenticated users to execute arbitrary SQL commands via the order parameter to index.php.
19 CVE-2015-1513 89 Exec Code Sql 2015-02-06 2017-09-08
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in SIPhone Enterprise PBX allows remote attackers to execute arbitrary SQL commands via the Username.
20 CVE-2015-1499 264 DoS 2015-02-16 2017-09-08
8.5
None Remote Low Not required None Partial Complete
The ActiveMQ Broker in Samsung Security Manager (SSM) before 1.31 allows remote attackers to delete arbitrary files, and consequently cause a denial of service, via a DELETE request.
21 CVE-2015-1498 264 2015-02-16 2016-05-18
10.0
None Remote Low Not required Complete Complete Complete
Persistent Systems Radia Client Automation does not properly restrict access to certain request, which allows remote attackers to (1) enumerate user accounts via a getUsers request, (2) assign a role to a user account via an addAssigneesToRole request, (3) remove a role from a user account via a removeAssigneesFromRole request, or (4) have other unspecified impact.
22 CVE-2015-1497 94 2 Exec Code 2015-02-16 2017-09-03
10.0
None Remote Low Not required Complete Complete Complete
radexecd.exe in Persistent Systems Radia Client Automation (RCA) 7.9, 8.1, 9.0, and 9.1 allows remote attackers to execute arbitrary commands via a crafted request to TCP port 3465.
23 CVE-2015-1496 264 +Priv 2015-02-16 2015-02-17
7.2
None Local Low Not required Complete Complete Complete
Motorola Scanner SDK uses weak permissions for (1) CoreScanner.exe, (2) rsmdriverproviderservice.exe, and (3) ScannerService.exe, which allows local users to gain privileges via unspecified vectors.
24 CVE-2015-1477 89 1 Exec Code Sql 2015-02-04 2015-02-04
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the CMSJunkie J-ClassifiedsManager component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewad task to classifieds/offerring-ads.
25 CVE-2015-1476 89 1 Exec Code Sql 2015-02-04 2015-02-04
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in xlinkerz ecommerceMajor allow remote attackers to execute arbitrary SQL commands via the (1) productbycat parameter to product.php, or (2) username or (3) password parameter to __admin/index.php.
26 CVE-2015-1474 189 DoS Overflow +Priv Mem. Corr. 2015-02-16 2017-09-29
10.0
None Remote Low Not required Complete Complete Complete
Multiple integer overflows in the GraphicBuffer::unflatten function in platform/frameworks/native/libs/ui/GraphicBuffer.cpp in Android through 5.0 allow attackers to gain privileges or cause a denial of service (memory corruption) via vectors that trigger a large number of (1) file descriptors or (2) integer values.
27 CVE-2015-1471 89 Exec Code Sql 2015-02-12 2015-02-13
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in userprofile.lib.php in Pragyan CMS 3.0 allows remote attackers to execute arbitrary SQL commands via the user parameter to the default URI.
28 CVE-2015-1469 264 +Priv 2015-02-03 2015-02-04
9.0
None Remote Low ??? Complete Complete Complete
time.htm in the web interface on SerVision HVG Video Gateway devices with firmware through 2.2.26a100 allows remote authenticated users to gain privileges by leveraging a cookie received in an HTTP response, a different vulnerability than CVE-2015-0929 and CVE-2015-0930.
29 CVE-2015-1467 89 Exec Code Sql 2015-02-06 2018-10-09
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Translations in Fork CMS before 3.8.6 allow remote authenticated users to execute arbitrary SQL commands via the (1) language[] or (2) type[] parameter to private/en/locale/index.
30 CVE-2015-1462 119 Overflow 2015-02-03 2016-12-07
7.5
None Remote Low Not required Partial Partial Partial
ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upx packer file, related to a "heap out of bounds condition."
31 CVE-2015-1461 119 Overflow 2015-02-03 2016-12-07
7.5
None Remote Low Not required Partial Partial Partial
ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted (1) Yoda's crypter or (2) mew packer file, related to a "heap out of bounds condition."
32 CVE-2015-1460 264 +Priv 2015-02-03 2015-02-04
7.5
None Remote Low Not required Partial Partial Partial
Huawei Quidway switches with firmware before V200R005C00SPC300 allows remote attackers to gain privileges via a crafted packet.
33 CVE-2015-1455 255 2015-02-03 2015-02-19
7.5
None Remote Low Not required Partial Partial Partial
Fortinet FortiAuthenticator 3.0.0 has a password of (1) slony for the slony PostgreSQL user and (2) www-data for the www-data PostgreSQL user, which makes it easier for remote attackers to obtain access via unspecified vectors.
34 CVE-2015-1454 310 2015-02-02 2019-02-05
7.1
None Remote Medium Not required None Complete None
Blue Coat ProxyClient before 3.3.3.3 and 3.4.x before 3.4.4.10 and Unified Agent before 4.1.3.151952 does not properly validate certain certificates, which allows man-in-the-middle attackers to spoof ProxySG Client Managers, and consequently modify configurations and execute arbitrary software updates, via a crafted certificate.
35 CVE-2015-1452 17 DoS 2015-02-02 2015-02-19
7.8
None Remote Low Not required None None Complete
The Control and Provisioning of Wireless Access Points (CAPWAP) daemon in Fortinet FortiOS 5.0 Patch 7 build 4457 allows remote attackers to cause a denial of service (locked CAPWAP Access Controller) via a large number of ClientHello DTLS messages.
36 CVE-2015-1450 89 Exec Code Sql 2015-02-02 2015-02-04
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Restaurant Biller allows remote attackers to execute arbitrary SQL commands via the cid parameter in a category action to index.php.
37 CVE-2015-1449 119 Exec Code Overflow 2015-02-02 2015-02-04
10.0
None Remote Low Not required Complete Complete Complete
Buffer overflow in the integrated web server on Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware before SS4.4.4624.35, WIN70xx devices with firmware before BS4.4.4621.32, and WIN72xx devices with firmware before BS4.4.4621.32 allows remote attackers to execute arbitrary code via unspecified vectors.
38 CVE-2015-1448 264 Bypass 2015-02-02 2015-02-04
10.0
None Remote Low Not required Complete Complete Complete
The integrated management service on Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware before SS4.4.4624.35, WIN70xx devices with firmware before BS4.4.4621.32, and WIN72xx devices with firmware before BS4.4.4621.32 allows remote attackers to bypass authentication and perform administrative actions via unspecified vectors.
39 CVE-2015-1442 89 Exec Code Sql 2015-02-06 2015-02-09
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in views/zero_transact_user.php in the administrative backend in ZeroCMS 1.3.3, 1.3.2, and earlier allows remote authenticated users to execute arbitrary SQL commands via the user_id parameter in a Modify Account action. NOTE: The article_id parameter to zero_view_article.php vector is already covered by CVE-2014-4034.
40 CVE-2015-1441 89 Exec Code Sql 2015-02-03 2015-02-04
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Piwigo before 2.5.6, 2.6.x before 2.6.5, and 2.7.x before 2.7.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
41 CVE-2015-1428 89 1 Exec Code Sql 2015-02-03 2018-10-09
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1) remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or (2) remote authenticated users to execute arbitrary SQL commands via the value_id parameter in a save_value action to backend/main.php.
42 CVE-2015-1427 284 Exec Code Bypass 2015-02-17 2018-10-09
7.5
None Remote Low Not required Partial Partial Partial
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
43 CVE-2015-1414 DoS Overflow 2015-02-27 2019-05-30
7.8
None Remote Low Not required None None Complete
Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of insufficient memory.
44 CVE-2015-1405 89 Exec Code Sql 2015-02-03 2015-02-04
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
45 CVE-2015-1403 89 Exec Code Sql 2015-02-03 2015-02-04
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
46 CVE-2015-1400 89 Exec Code Sql 2015-02-03 2015-02-04
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in search.php in NPDS Revolution 13 allows remote attackers to execute arbitrary SQL commands via the query parameter.
47 CVE-2015-1348 119 DoS Overflow 2015-02-03 2015-02-04
7.8
None Remote Low Not required None None Complete
Heap-based buffer overflow in Aruba Instant (IAP) with firmware before 4.0.0.7 and 4.1.x before 4.1.1.2 allows remote attackers to cause a denial of service (crash or reset to factory default) via a malformed frame to the wireless interface.
48 CVE-2015-1315 119 Exec Code Overflow 2015-02-23 2015-02-24
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in the charset_to_intern function in unix/unix.c in Info-Zip UnZip 6.10b allows remote attackers to execute arbitrary code via a crafted string, as demonstrated by converting a string from CP866 to UTF-8.
49 CVE-2015-1212 DoS 2015-02-06 2021-09-08
7.5
None Remote Low Not required Partial Partial Partial
Multiple unspecified vulnerabilities in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
50 CVE-2015-1211 +Priv 2015-02-06 2021-09-08
7.5
None Remote Low Not required Partial Partial Partial
The OriginCanAccessServiceWorkers function in content/browser/service_worker/service_worker_dispatcher_host.cc in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android does not properly restrict the URI scheme during a ServiceWorker registration, which allows remote attackers to gain privileges via a filesystem: URI.
Total number of vulnerabilities : 178   Page : 1 (This Page)2 3 4
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.