Vulnerabilities

DATE CVE VULNERABILITY TITLE RISK
2015-12-28 CVE-2015-8460 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Adobe products
Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8459, CVE-2015-8636, and CVE-2015-8645.
network
low complexity
adobe CWE-119
8.8
2015-12-28 CVE-2015-8459 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Adobe products
Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8460, CVE-2015-8636, and CVE-2015-8645.
network
low complexity
adobe CWE-119
critical
10.0
2015-12-28 CVE-2015-6852 Information Exposure vulnerability in EMC Secure Remote Services 3.0/3.02/3.03
Directory traversal vulnerability in the API in EMC Secure Remote Services Virtual Edition 3.x before 3.10 allows remote authenticated users to read log files via a crafted parameter.
network
low complexity
emc CWE-200
4.3
2015-12-28 CVE-2015-6850 Permissions, Privileges, and Access Controls vulnerability in EMC Vplex Geosynchrony 5.4/5.5
EMC VPLEX GeoSynchrony 5.4 SP1 before P3 and 5.5 before Patch 1 has a default password for the root account, which allows local users to gain privileges by leveraging a login session.
local
low complexity
emc CWE-264
8.4
2015-12-28 CVE-2015-8660 Permissions, Privileges, and Access Controls vulnerability in Linux Kernel
The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application.
local
low complexity
linux CWE-264
6.7
2015-12-28 CVE-2015-8569 Information Exposure vulnerability in Linux Kernel
The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through 4.3.3 do not verify an address length, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.
local
low complexity
linux CWE-200
2.3
2015-12-28 CVE-2015-8543 Unspecified vulnerability in Linux Kernel
The networking implementation in the Linux kernel through 4.3.3, as used in Android and other products, does not validate protocol identifiers for certain protocol families, which allows local users to cause a denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by leveraging CLONE_NEWUSER support to execute a crafted SOCK_RAW application.
local
high complexity
linux
7.0
2015-12-28 CVE-2015-8374 Information Exposure vulnerability in Linux Kernel
fs/btrfs/inode.c in the Linux kernel before 4.3.3 mishandles compressed inline extents, which allows local users to obtain sensitive pre-truncation information from a file via a clone action.
local
low complexity
linux CWE-200
4.0
2015-12-28 CVE-2015-7990 Race Condition vulnerability in Linux Kernel
Race condition in the rds_sendmsg function in net/rds/sendmsg.c in the Linux kernel before 4.3.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound.
local
high complexity
linux CWE-362
5.8
2015-12-28 CVE-2015-7885 Information Exposure vulnerability in Linux Kernel
The dgnc_mgmt_ioctl function in drivers/staging/dgnc/dgnc_mgmt.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a crafted application.
local
low complexity
linux CWE-200
2.3