CVE-2015-8368

MediumCVSS 6.0/10Last modified Jun 17, 2026

Description

ntopng (aka ntop) before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and username parameter to admin/password_reset.lua.

Metrics

CVSS 2.0 6.0/10AV:N/AC:M/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-254

Affected software

No affected versions have been published.

Timeline

Published: Dec 17, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-83697.5SQL injection vulnerability in include/top_graph_header.php in Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary SQL com CVE-2015-83707.4Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive infor CVE-2015-83718.8Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code enter CVE-2015-83736.8The kea-dhcp4 and kea-dhcp6 servers 0.9.2 and 1.0.0-beta in ISC Kea, when certain debugging settings are used, allow remote attackers to cau CVE-2015-83744.0fs/btrfs/inode.c in the Linux kernel before 4.3.3 mishandles compressed inline extents, which allows local users to obtain sensitive pre-tru CVE-2015-83755.4Cross-site scripting (XSS) vulnerability in PHP-Fusion 9.CVE-2015-83766.1Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.6.3 allow remote attackers to inject arbitrary web script or HTML via CVE-2015-83776.5SQL injection vulnerability in the host_new_graphs_save function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated u CVE-2015-83787.5In KeePassX before 0.4.4, a cleartext copy of password data is created upon a cancel of an XML export action. This allows context-dependent CVE-2015-83798.8CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.CVE-2015-83807.5The pcre_exec function in pcre_exec.c in PCRE before 8.38 mishandles a // pattern with a \01 string, which allows remote attackers to cause CVE-2015-83817.5The compile_regex function in pcre_compile.c in PCRE before 8.38 and pcre2_compile.c in PCRE2 before 10.2x mishandles the /(?J:(?|(:(?|(?'R'