CVE-2015-2918

The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.

• CWE-20

• https://www.kb.cert.org/vuls/id/845332Third Party Advisory, US Government Resource
• https://www.kb.cert.org/vuls/id/845332Third Party Advisory, US Government Resource

Published

Dec 31, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-2912The JSONP endpoint in the Studio component in OrientDB Serve…
• CVE-2015-2913server/network/protocol/http/OHttpSessionManager.java in the…
• CVE-2015-2914Securifi Almond devices with firmware before AL1-R201EXP10-L…
• CVE-2015-2915Securifi Almond devices with firmware before AL1-R201EXP10-L…
• CVE-2015-2916Cross-site request forgery (CSRF) vulnerability on Securifi …
• CVE-2015-2917Securifi Almond devices with firmware before AL1-R201EXP10-L…
• CVE-2015-2922The ndisc_router_discovery function in net/ipv6/ndisc.c in t…
• CVE-2015-2923The Neighbor Discovery (ND) protocol implementation in the I…6.5
• CVE-2015-2924The receive_ra function in rdisc/nm-lndp-rdisc.c in the Neig…
• CVE-2015-2925The prepend_path function in fs/dcache.c in the Linux kernel…
• CVE-2015-2926Cross-site scripting (XSS) vulnerability in Php/stats/statsR…
• CVE-2015-2927node 0.3.2 and URONode before 1.0.5r3 allows remote attacker…