Vulnerabilities > Oracle > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2015-04-08 | CVE-2015-0251 | Insufficient Verification of Data Authenticity vulnerability in multiple products The mod_dav_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP protocol request sequences. | 4.0 |
| 2015-04-08 | CVE-2015-0248 | Resource Management Errors vulnerability in multiple products The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a denial of service (assertion failure and abort) via crafted parameter combinations related to dynamically evaluated revision numbers. | 5.0 |
| 2015-04-08 | CVE-2015-0798 | Permissions, Privileges, and Access Controls vulnerability in multiple products The Reader mode feature in Mozilla Firefox before 37.0.1 on Android, and Desktop Firefox pre-release, does not properly handle privileged URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy. | 5.0 |
| 2015-03-25 | CVE-2015-2317 | Cross-site Scripting vulnerability in multiple products The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL. | 4.3 |
| 2015-03-25 | CVE-2015-2316 | Resource Management Errors vulnerability in multiple products The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string. | 5.0 |
| 2015-02-25 | CVE-2015-0829 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products Buffer overflow in libstagefright in Mozilla Firefox before 36.0 allows remote attackers to execute arbitrary code via a crafted MP4 video that is improperly handled during playback. | 6.8 |
| 2015-02-25 | CVE-2015-0828 | Double Free Memory Corruption vulnerability in Mozilla Firefox Double free vulnerability in the nsXMLHttpRequest::GetResponse function in Mozilla Firefox before 36.0, when a nonstandard memory allocator is used, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted JavaScript code that makes an XMLHttpRequest call with zero bytes of data. | 6.8 |
| 2015-02-12 | CVE-2014-9512 | Link Following vulnerability in multiple products rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path. | 6.4 |
| 2015-02-08 | CVE-2014-9672 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products Array index error in the parse_fond function in base/ftmac.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information from process memory via a crafted FOND resource in a Mac font file. | 5.8 |
| 2015-02-08 | CVE-2014-9671 | Remote vulnerability in FreeType Versions Prior to 2.5.4 Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PCF file with a 0xffffffff size value that is improperly incremented. | 4.3 |