CVE-2015-7764

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-331

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2015/10/20/3Mailing List, Third Party Advisory
https://github.com/Netflix/lemur/issues/117Third Party Advisory
https://github.com/kvesteri/sqlalchemy-utils/issues/166Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/10/20/3Mailing List, Third Party Advisory
https://github.com/Netflix/lemur/issues/117Third Party Advisory
https://github.com/kvesteri/sqlalchemy-utils/issues/166Third Party Advisory

Timeline

Published: Aug 9, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-77659.0ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows CVE-2015-77669.0PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions vi CVE-2015-77677.5Buffer overflow in Konica Minolta FTP Utility 1.0 allows remote attackers to execute arbitrary code or cause a denial of service (applicatio CVE-2015-77687.5Buffer overflow in Konica Minolta FTP Utility 1.0 allows remote attackers to execute arbitrary code via a long CWD command.CVE-2015-77696.3baserCMS 3.0.2 through 3.0.8 allows remote authenticated users to execute arbitrary OS commands via unspecified vectors.CVE-2015-77705.0Dell SonicWall TotalSecure TZ 100 devices with firmware before 5.9.1.0-22o allow remote attackers to cause a denial of service via a crafted CVE-2015-77714.3Cross-site scripting (XSS) vulnerability in the runtime engine in the Newphoria applican framework before 1.13.0 for Android and iOS allows CVE-2015-77724.3Cross-site scripting (XSS) vulnerability in the runtime engine in the Newphoria applican framework before 1.13.0 for Android and iOS allows CVE-2015-77736.5Unrestricted file upload vulnerability in the Panel component in Bastian Allgeier Kirby before 2.1.2 allows remote authenticated users to ex CVE-2015-77746.5PC-EGG pWebManager before 3.3.10, and before 2.2.2 for PHP 4.x, allows remote authenticated users to execute arbitrary OS commands by levera CVE-2015-77755.4Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via CVE-2015-77764.3Cybozu Garoon 3.x and 4.x before 4.2.0 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to tra