Vulnerabilities
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2016-01-08 | CVE-2015-8557 | OS Command Injection vulnerability in multiple products The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name. | 9.0 |
| 2016-01-08 | CVE-2015-4694 | Path Traversal vulnerability in ZIP Attachments Project ZIP Attachments 1.5 Directory traversal vulnerability in download.php in the Zip Attachments plugin before 1.5.1 for WordPress allows remote attackers to read arbitrary files via a .. | 8.6 |
| 2016-01-08 | CVE-2014-8886 | Cryptographic Issues vulnerability in AVM Fritz! OS 6.23 AVM FRITZ!OS before 6.30 extracts the contents of firmware updates before verifying their cryptographic signature, which allows remote attackers to create symlinks or overwrite critical files, and consequently execute arbitrary code, via a crafted firmware image. | 8.1 |
| 2016-01-08 | CVE-2015-8761 | Code Injection vulnerability in Values Project Values 7.X1.0/7.X1.1 The Values module 7.x-1.x before 7.x-1.2 for Drupal does not properly check permissions, which allows remote administrators with the "Import value sets" permission to execute arbitrary PHP code via the exported values list in a ctools import. | 9.0 |
| 2016-01-08 | CVE-2015-8760 | Improper Input Validation vulnerability in Typo3 The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing." | 6.1 |
| 2016-01-08 | CVE-2015-8759 | Cross-site Scripting vulnerability in Typo3 Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote authenticated editors to inject arbitrary web script or HTML via a link field. | 5.4 |
| 2016-01-08 | CVE-2015-8758 | Cross-site Scripting vulnerability in Typo3 Multiple cross-site scripting (XSS) vulnerabilities in unspecified frontend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to inject arbitrary web script or HTML via unknown vectors. | 5.4 |
| 2016-01-08 | CVE-2015-8757 | Cross-site Scripting vulnerability in Typo3 Cross-site scripting (XSS) vulnerability in the Extension Manager in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to extension data during an extension installation. | 6.1 |
| 2016-01-08 | CVE-2015-8756 | Cross-site Scripting vulnerability in Typo3 Cross-site scripting (XSS) vulnerability in the search result view in the Indexed Search (indexed_search) component in TYPO3 6.2.x before 6.2.16 allows remote authenticated editors to inject arbitrary web script or HTML via unspecified vectors. | 5.4 |
| 2016-01-08 | CVE-2015-8755 | Cross-site Scripting vulnerability in Typo3 Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to inject arbitrary web script or HTML via unknown vectors. | 5.4 |