Search Results (Refine Search)
Vuln ID | Summary | CVSS Severity |
---|---|---|
CVE-2015-6747 |
Basware Banking (Maksuliikenne) 8.90.07.X does not properly prevent access to private keys, which allows remote attackers to spoof communications with banks via unspecified vectors. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 due to different vulnerability types. NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-6746. Published: August 31, 2015; 10:59:07 AM -0400 |
V3.x:(not available) V2.0: 5.0 MEDIUM |
CVE-2015-6746 |
Basware Banking (Maksuliikenne) before 8.90.07.X stores private keys in plaintext in the SQL database, which allows remote attackers to spoof communications with banks via unspecified vectors. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 due to different vulnerability types. Published: August 31, 2015; 10:59:06 AM -0400 |
V3.x:(not available) V2.0: 2.1 LOW |
CVE-2015-6745 |
Basware Banking (Maksuliikenne) 8.90.07.X relies on the client to enforce account locking, which allows local users to bypass that security mechanism by deleting the entry from the locking table. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability type and different affected versions. NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-6744. Published: August 31, 2015; 10:59:04 AM -0400 |
V3.x:(not available) V2.0: 4.6 MEDIUM |
CVE-2015-6744 |
Basware Banking (Maksuliikenne) before 8.90.07.X relies on the client to enforce (1) login verification, (2) audit trail creation, and (3) account locking, which allows remote attackers to "disrupt security-critical functions" by "dropping network traffic." NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability type and different affected versions. Published: August 31, 2015; 10:59:03 AM -0400 |
V3.x:(not available) V2.0: 4.3 MEDIUM |
CVE-2015-6743 |
Basware Banking (Maksuliikenne) 8.90.07.X uses a hardcoded password for an unspecified account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability types and different affected versions. Published: August 31, 2015; 10:59:02 AM -0400 |
V3.x:(not available) V2.0: 6.5 MEDIUM |
CVE-2015-6742 |
Basware Banking (Maksuliikenne) before 8.90.07.X uses a hardcoded password for the ANCO account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability types and different affected versions. Published: August 31, 2015; 10:59:01 AM -0400 |
V3.x:(not available) V2.0: 6.5 MEDIUM |
CVE-2015-0943 |
Basware Banking (Maksuliikenne) before 9.10.0.0 does not encrypt communication between the client and the backend server, which allows man-in-the-middle attackers to obtain encryption keys, user credentials, and other sensitive information by sniffing the network or modify this traffic by inserting packets into the client-server data stream. Published: August 31, 2015; 10:59:00 AM -0400 |
V3.x:(not available) V2.0: 5.8 MEDIUM |
CVE-2015-5717 |
The Siemens COMPAS Mobile application before 1.6 for Android does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Published: August 31, 2015; 6:59:17 AM -0400 |
V3.x:(not available) V2.0: 5.8 MEDIUM |
CVE-2015-5706 |
Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a denial of service or possibly have unspecified other impact via O_TMPFILE filesystem operations that leverage a duplicate cleanup operation. Published: August 31, 2015; 6:59:16 AM -0400 |
V3.x:(not available) V2.0: 4.6 MEDIUM |
CVE-2015-5697 |
The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a certain bitmap data structure, which allows local users to obtain sensitive information from kernel memory via a GET_BITMAP_FILE ioctl call. Published: August 31, 2015; 6:59:14 AM -0400 |
V3.x:(not available) V2.0: 2.1 LOW |
CVE-2015-5366 |
The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 provide inappropriate -EAGAIN return values, which allows remote attackers to cause a denial of service (EPOLLET epoll application read outage) via an incorrect checksum in a UDP packet, a different vulnerability than CVE-2015-5364. Published: August 31, 2015; 6:59:13 AM -0400 |
V3.x:(not available) V2.0: 5.0 MEDIUM |
CVE-2015-5364 |
The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 do not properly consider yielding a processor, which allows remote attackers to cause a denial of service (system hang) via incorrect checksums within a UDP packet flood. Published: August 31, 2015; 6:59:12 AM -0400 |
V3.x:(not available) V2.0: 7.8 HIGH |
CVE-2015-5157 |
arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform mishandles IRET faults in processing NMIs that occurred during userspace execution, which might allow local users to gain privileges by triggering an NMI. Published: August 31, 2015; 6:59:11 AM -0400 |
V3.x:(not available) V2.0: 7.2 HIGH |
CVE-2015-4700 |
The bpf_int_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 4.0.6 allows local users to cause a denial of service (system crash) by creating a packet filter and then loading crafted BPF instructions that trigger late convergence by the JIT compiler. Published: August 31, 2015; 6:59:10 AM -0400 |
V3.x:(not available) V2.0: 4.9 MEDIUM |
CVE-2015-3291 |
arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform does not properly determine when nested NMI processing is occurring, which allows local users to cause a denial of service (skipped NMI) by modifying the rsp register, issuing a syscall instruction, and triggering an NMI. Published: August 31, 2015; 6:59:09 AM -0400 |
V3.x:(not available) V2.0: 2.1 LOW |
CVE-2015-3290 |
arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during nested NMI processing, which allows local users to gain privileges by triggering an NMI within a certain instruction window. Published: August 31, 2015; 6:59:08 AM -0400 |
V3.x:(not available) V2.0: 7.2 HIGH |
CVE-2015-3214 |
The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index. Published: August 31, 2015; 6:59:07 AM -0400 |
V3.x:(not available) V2.0: 6.9 MEDIUM |
CVE-2015-3212 |
Race condition in net/sctp/socket.c in the Linux kernel before 4.1.2 allows local users to cause a denial of service (list corruption and panic) via a rapid series of system calls related to sockets, as demonstrated by setsockopt calls. Published: August 31, 2015; 6:59:06 AM -0400 |
V3.x:(not available) V2.0: 4.9 MEDIUM |
CVE-2015-1333 |
Memory leak in the __key_link_end function in security/keys/keyring.c in the Linux kernel before 4.1.4 allows local users to cause a denial of service (memory consumption) via many add_key system calls that refer to existing keys. Published: August 31, 2015; 6:59:05 AM -0400 |
V3.x:(not available) V2.0: 4.9 MEDIUM |
CVE-2014-9731 |
The UDF filesystem implementation in the Linux kernel before 3.18.2 does not ensure that space is available for storing a symlink target's name along with a trailing \0 character, which allows local users to obtain sensitive information via a crafted filesystem image, related to fs/udf/symlink.c and fs/udf/unicode.c. Published: August 31, 2015; 6:59:04 AM -0400 |
V3.x:(not available) V2.0: 2.1 LOW |