CVE-2015-7556

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

DeleGate 9.9.13 allows local users to gain privileges as demonstrated by the dgcpnod setuid program.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
National Institute of Advanced Industrial Science and Technology	DeleGate	9.9.13

References

http://seclists.org/fulldisclosure/2015/Dec/123Exploit, Mailing List, Third Party Advisory
http://www.vapidlabs.com/advisory.php?v=159Exploit, Third Party Advisory
http://seclists.org/fulldisclosure/2015/Dec/123Exploit, Mailing List, Third Party Advisory
http://www.vapidlabs.com/advisory.php?v=159Exploit, Third Party Advisory

Timeline

Published: Jan 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-75577.5The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent attackers to cause a denial of se CVE-2015-75587.5librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service (infinite loop, stack consumption, and application cr CVE-2015-75592.7It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker lo CVE-2015-75606.5The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allows CVE-2015-75613.1Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image.CVE-2015-75626.1Multiple cross-site scripting (XSS) vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or CVE-2015-75638.8Cross-site request forgery (CSRF) vulnerability in TeamPass 2.1.24 and earlier allows remote attackers to hijack the authentication of an au CVE-2015-75649.8Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) i CVE-2015-75656.1Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12 CVE-2015-75664.6The clie_5_attach function in drivers/usb/serial/visor.c in the Linux kernel through 4.4.1 allows physically proximate attackers to cause a CVE-2015-75679.8SQL injection vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary SQL commands via the "passwordreset&token" para CVE-2015-75689.8SQL injection vulnerability in the password recovery feature in Yeager CMS 1.2.1 allows remote attackers to change the account credentials o