2015 CVEs (page 10)
Page 10 of 82 — CVEs published in 2015, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-3618 | Medium | 6.1 | 2018-02-06 | Cross-site scripting (XSS) vulnerability in Nagios Business Process Intelligence (BPI) before 2.3.4 allows remote attackers to inject arbitrary web script or H… |
CVE-2015-5674 | Medium | 6.5 | 2018-02-05 | The routed daemon in FreeBSD 9.3 before 9.3-RELEASE-p22, 10.2-RC2 before 10.2-RC2-p1, 10.2-RC1 before 10.2-RC1-p2, 10.2 before 10.2-BETA2-p3, and 10.1 before 1… |
CVE-2015-4461 | Medium | 6.5 | 2018-02-05 | Absolute path traversal vulnerability in eFront CMS 3.6.15.4 and earlier allows remote Professor users to obtain sensitive information via a full pathname in t… |
CVE-2015-4412 | Critical | 9.8 | 2018-02-05 | BSON injection vulnerability in the legal? function in BSON (bson-ruby) gem before 3.0.4 for Ruby allows remote attackers to cause a denial of service (resourc… |
CVE-2015-4179 | High | 8.8 | 2018-02-05 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Codestyling Localization plugin 1.99.30 and earlier for Wordpress. |
CVE-2015-1418 | High | 7.8 | 2018-02-05 | The do_ed_script function in pch.c in GNU patch through 2.7.6, and patch in FreeBSD 10.1 before 10.1-RELEASE-p17, 10.2 before 10.2-BETA2-p3, 10.2-RC1 before 10… |
CVE-2015-1416 | High | 7.8 | 2018-02-05 | Larry Wall's patch; patch in FreeBSD 10.2-RC1 before 10.2-RC1-p1, 10.2 before 10.2-BETA2-p2, and 10.1 before 10.1-RELEASE-p16; Bitrig; GNU patch before 2.2.5… |
CVE-2015-2186 | High | 7.5 | 2018-02-03 | The Ansible edxapp role in the Configuration Repo in edX allows remote websites to spoof edX accounts by leveraging use of the string literal "False" instead o… |
CVE-2015-2796 | Medium | 6.1 | 2018-02-02 | Multiple cross-site scripting (XSS) vulnerabilities in Project-Pier ProjectPier-Core allow remote attackers to inject arbitrary web script or HTML via the sear… |
CVE-2015-2204 | High | 7.5 | 2018-02-01 | Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to bypass an intended access restriction and obtain sensitive inform… |
CVE-2015-2203 | Medium | 6.5 | 2018-02-01 | Evergreen 2.5.9, 2.6.7, and 2.7.4 allows remote authenticated users with STAFF_LOGIN permission to obtain sensitive settings history information by leveraging… |
CVE-2015-1142857 | High | 8.6 | 2018-01-23 | On multiple SR-IOV cars it is possible for VF's assigned to guests to send ethernet flow control pause frames via the PF. This includes Linux kernel ixgbe driv… |
CVE-2015-6926 | High | 7.5 | 2018-01-19 | The OpenID Single Sign-On authentication functionality in OXID eShop before 4.5.0 allows remote attackers to impersonate users via the email address in a craft… |
CVE-2015-9251 | Medium | 6.1 | 2018-01-18 | jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text… |
CVE-2015-7486 | Medium | 5.4 | 2018-01-16 | Cross-site scripting (XSS) vulnerability in IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 bef… |
CVE-2015-7485 | Medium | 5.4 | 2018-01-16 | Cross-site scripting (XSS) vulnerability in IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 bef… |
CVE-2015-7484 | Medium | 4.3 | 2018-01-16 | IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1 and 4.0 before 4.0.7 iFix10 allow remote authenticated users with access to l… |
CVE-2015-7474 | Medium | 5.4 | 2018-01-16 | Cross-site scripting (XSS) vulnerability in Jazz Foundation in IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4… |
CVE-2015-9250 | High | 7.5 | 2018-01-12 | An issue was discovered in Skybox Platform before 7.5.201. Directory Traversal exists in /skyboxview/webskybox/attachmentdownload and /skyboxview/webskybox/fil… |
CVE-2015-9249 | Critical | 9.8 | 2018-01-12 | An issue was discovered in Skybox Platform before 7.5.201. SQL Injection exists in /skyboxview/webservice/services/VersionWebService via a soapenv:Body element. |
CVE-2015-9248 | Medium | 5.4 | 2018-01-12 | An issue was discovered in Skybox Platform before 7.5.201. Stored cross-site scripting vulnerabilities exist in the title, Comments, or Description field to /s… |
CVE-2015-9247 | Medium | 5.4 | 2018-01-12 | An issue was discovered in Skybox Platform before 7.5.401. Reflected cross-site scripting vulnerabilities exist in /skyboxview/webservice/services/VersionRepos… |
CVE-2015-9246 | Critical | 9.8 | 2018-01-12 | An issue was discovered in Skybox Platform before 7.5.201. Remote Unauthenticated Code Execution exists via a WAR archive containing a JSP file. The WAR file i… |
CVE-2015-3888 | High | 7.5 | 2018-01-12 | Jolla Sailfish OS before 1.1.2.16 allows remote attackers to spoof phone numbers and trigger calls to arbitrary numbers via spaces in a tel: URL. |
CVE-2015-2981 | Medium | 5.9 | 2018-01-12 | The Yodobashi App for Android 1.2.1.0 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof server… |
CVE-2015-2298 | High | 7.5 | 2018-01-12 | node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive information by leveraging an improper substring ch… |
CVE-2015-1290 | High | 8.8 | 2018-01-09 | The Google V8 engine, as used in Google Chrome before 44.0.2403.89 and QtWebEngineCore in Qt before 5.5.1, allows remote attackers to cause a denial of service… |
CVE-2015-1208 | Medium | 5.5 | 2018-01-09 | Integer underflow in the mov_read_default function in libavformat/mov.c in FFmpeg before 2.4.6 allows remote attackers to obtain sensitive information from hea… |
CVE-2015-2320 | Critical | 9.8 | 2018-01-08 | The TLS stack in Mono before 3.12.1 allows remote attackers to have unspecified impact via vectors related to client-side SSLv2 fallback. |
CVE-2015-2319 | High | 7.5 | 2018-01-08 | The TLS stack in Mono before 3.12.1 makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, rel… |
CVE-2015-2318 | High | 8.1 | 2018-01-08 | The TLS stack in Mono before 3.12.1 allows man-in-the-middle attackers to conduct message skipping attacks and consequently impersonate clients by leveraging m… |
CVE-2015-8008 | High | 7.5 | 2017-12-29 | The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allows attackers to bypass intended IP addre… |
CVE-2015-3302 | High | 7.5 | 2017-12-29 | The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtai… |
CVE-2015-7889 | Medium | 5.5 | 2017-12-28 | The SecEmailComposer/EmailComposer application in the Samsung S6 Edge before the October 2015 MR uses weak permissions for the com.samsung.android.email.intent… |
CVE-2015-3637 | High | 8.1 | 2017-12-28 | SQL injection vulnerability in phpMyBackupPro when run in multi-user mode before 2.5 allows remote attackers to execute arbitrary SQL commands via the username… |
CVE-2015-7669 | Critical | 9.8 | 2017-12-27 | Multiple directory traversal vulnerabilities in (1) includes/MapImportCSV2.php and (2) includes/MapImportCSV.php in the Easy2Map plugin before 1.3.0 for WordPr… |
CVE-2015-7668 | Medium | 6.1 | 2017-12-27 | Cross-site scripting (XSS) vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.3.0 for WordPress allows remote attackers to inject ar… |
CVE-2015-7667 | Medium | 6.1 | 2017-12-27 | Multiple cross-site scripting (XSS) vulnerabilities in (1) templates/admanagement/admanagement.php and (2) templates/adspot/adspot.php in the ResAds plugin bef… |
CVE-2015-7666 | Medium | 6.1 | 2017-12-27 | Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_int_message_list.inc… |
CVE-2015-7324 | Medium | 6.1 | 2017-12-27 | Multiple cross-site scripting (XSS) vulnerabilities in helpers/comment.php in the StackIdeas Komento (com_komento) component before 2.0.5 for Joomla! allow rem… |
CVE-2015-6237 | Critical | 9.8 | 2017-12-27 | The RPC service in Tripwire (formerly nCircle) IP360 VnE Manager 7.2.2 before 7.2.6 allows remote attackers to bypass authentication and (1) enumerate users, (… |
CVE-2015-7224 | Critical | 9.8 | 2017-12-21 | puppetlabs-mysql 3.1.0 through 3.6.0 allow remote attackers to bypass authentication by leveraging creation of a database account without a password when a 'my… |
CVE-2015-4100 | Medium | 6.8 | 2017-12-21 | Puppet Enterprise 3.7.x and 3.8.0 might allow remote authenticated users to manage certificates for arbitrary nodes by leveraging a client certificate trusted… |
CVE-2015-8470 | Medium | 6.5 | 2017-12-11 | The console in Puppet Enterprise 3.7.x, 3.8.x, and 2015.2.x does not set the secure flag for the JSESSIONID cookie in an HTTPS session, which makes it easier f… |
CVE-2015-6502 | Medium | 6.1 | 2017-12-11 | Cross-site scripting (XSS) vulnerability in the console in Puppet Enterprise before 2015.2.1 allows remote attackers to inject arbitrary web script or HTML via… |
CVE-2015-7269 | Medium | 4.2 | 2017-11-27 | Seagate ST500LT015 hard disk drives, when operating in eDrive mode on Lenovo ThinkPad W541 laptops with BIOS 2.21, allow physically proximate attackers to bypa… |
CVE-2015-7268 | Medium | 4.2 | 2017-11-27 | Samsung 850 Pro and PM851 solid-state drives and Seagate ST500LT015 and ST500LT025 hard disk drives, when used on Windows and operating in Opal mode on Lenovo… |
CVE-2015-7267 | Medium | 4.2 | 2017-11-27 | Samsung 850 Pro and PM851 solid-state drives and Seagate ST500LT015 and ST500LT025 hard disk drives, when in sleep mode and operating in Opal or eDrive mode on… |
CVE-2015-3934 | Critical | 9.8 | 2017-11-21 | Multiple SQL injection vulnerabilities in Fiyo CMS 2.0_1.9.1 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to apps/app_arti… |
CVE-2015-7501 | Critical | 9.8 | 2017-11-09 | Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x… |
CVE-2015-3933 | Critical | 9.8 | 2017-11-08 | Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote attackers to execute arbitrary SQL comm… |
CVE-2015-7878 | Medium | 5.4 | 2017-11-06 | Cross-site scripting (XSS) vulnerability in the Taxonomy Find module 6.x-2.x through 6.x-1.2 and 7.x-2.x through 7.x-1.0 in Drupal allows remote authenticated… |
CVE-2015-7529 | High | 7.8 | 2017-11-06 | sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an archive file in a te… |
CVE-2015-9245 | Critical | 9.8 | 2017-10-31 | Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to specify arbitrary URLs from which to loa… |
CVE-2015-7549 | Medium | 6.0 | 2017-10-30 | The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (NULL pointer derefere… |
CVE-2015-3249 | Critical | 9.8 | 2017-10-30 | The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daem… |
CVE-2015-0226 | High | 7.5 | 2017-10-30 | Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, whic… |
CVE-2015-0224 | High | 7.5 | 2017-10-30 | qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service (daemon crash) via a crafted protocol sequence set. NOTE: this vuln… |
CVE-2015-1835 | Medium | 5.3 | 2017-10-27 | Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify und… |
CVE-2015-5173 | High | 8.8 | 2017-10-24 | Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified… |
CVE-2015-5172 | Critical | 9.8 | 2017-10-24 | Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified… |
CVE-2015-5171 | Critical | 9.8 | 2017-10-24 | The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7… |
CVE-2015-5170 | High | 8.8 | 2017-10-24 | Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attackers to conduct c… |
CVE-2015-6839 | Medium | 4.6 | 2017-10-23 | The parse function in MSA vot.Ar 3.1 does not check whether a candidate receives more than one vote, which allows physically proximate attackers to cast multip… |
CVE-2015-5533 | High | 7.2 | 2017-10-23 | SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote authenticated administrators to execute… |
CVE-2015-5532 | Medium | 6.1 | 2017-10-23 | Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPress allow remote attackers to inject ar… |
CVE-2015-5379 | Medium | 5.4 | 2017-10-23 | Cross-site scripting (XSS) vulnerability in actions.hsp in the Ajax WebMail interface in AXIGEN Mail Server before 9.0 allows remote attackers to inject arbitr… |
CVE-2015-2878 | High | 8.8 | 2017-10-23 | Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijack the authentication of administrators… |
CVE-2015-5699 | High | 7.8 | 2017-10-22 | The Switch Configuration Tools Backend (clcmd_server) in Cumulus Linux 2.5.3 and earlier allows local users to execute arbitrary commands via shell metacharact… |
CVE-2015-5177 | High | 7.5 | 2017-10-22 | Double free vulnerability in the SLPDKnownDAAdd function in slpd/slpd_knownda.c in OpenSLP 1.2.1 allows remote attackers to cause a denial of service (crash) v… |
CVE-2015-6668 | High | 7.5 | 2017-10-19 | The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload directory structure, r… |
CVE-2015-4422 | High | 7.0 | 2017-10-19 | The TEEOS module in Huawei Mate 7 (Mate7-TL10) smartphones before V100R001CHNC00B126SP03 allows local users with root permissions to gain privileges or cause a… |
CVE-2015-4421 | High | 7.5 | 2017-10-19 | The tzdriver module in Huawei Mate 7 (Mate7-TL10) smartphones before V100R001CHNC00B126SP03 allows local users to gain privileges or cause a denial of service… |
CVE-2015-6961 | Medium | 6.1 | 2017-10-18 | Open redirect vulnerability in gluon/tools.py in Web2py 2.9.11 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks vi… |
CVE-2015-5740 | Critical | 9.8 | 2017-10-18 | The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smu… |
CVE-2015-5739 | Critical | 9.8 | 2017-10-18 | The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP requ… |
CVE-2015-5376 | Critical | 9.8 | 2017-10-18 | SQL injection vulnerability in the login form in GSI WiNPAT Portal 3.2.0.1001 through 3.6.1.0 allows remote attackers to execute arbitrary SQL commands via the… |
CVE-2015-5227 | High | 8.8 | 2017-10-18 | The Landing Pages plugin before 1.9.2 for WordPress allows remote attackers to execute arbitrary code via the url parameter. |
CVE-2015-7943 | Medium | 6.1 | 2017-10-18 | Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7… |
CVE-2015-7715 | High | 8.8 | 2017-10-18 | Cross-site request forgery (CSRF) vulnerability in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allows remote attackers to hijack the authenti… |
CVE-2015-7714 | High | 7.2 | 2017-10-18 | Multiple SQL injection vulnerabilities in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allow remote administrators to execute arbitrary SQL co… |
CVE-2015-1239 | Medium | 6.5 | 2017-10-18 | Double free vulnerability in the j2k_read_ppm_v3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attackers to cause a deni… |
CVE-2015-5164 | High | 7.2 | 2017-10-18 | The Qpid server on Red Hat Satellite 6 does not properly restrict message types, which allows remote authenticated users with administrative access on a manage… |
CVE-2015-3400 | Medium | 4.3 | 2017-10-18 | sharenfs 0.6.4, when built with commits bcdd594 and 7d08880 from the zfs repository, provides world readable access to the shared zfs file system, which might… |
CVE-2015-2156 | High | 7.5 | 2017-10-18 | Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow r… |
CVE-2015-7806 | Critical | 9.8 | 2017-10-17 | Eval injection vulnerability in the fm_saveHelperGatherItems function in ajax.php in the Form Manager plugin before 1.7.3 for WordPress allows remote attackers… |
CVE-2015-7504 | High | 8.8 | 2017-10-16 | Heap-based buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of service (instance crash)… |
CVE-2015-7687 | Critical | 9.8 | 2017-10-16 | Use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors invol… |
CVE-2015-4650 | Critical | 9.8 | 2017-10-16 | Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to gain shell access and execute arbitrary code with root p… |
CVE-2015-3229 | Medium | 5.9 | 2017-10-16 | fedora-cloud-atomic.ks in spin-kickstarts allows remote attackers to conduct man-in-the-middle attacks by leveraging use of HTTP to download Fedora Atomic upda… |
CVE-2015-2780 | Critical | 9.8 | 2017-10-16 | Unrestricted file upload vulnerability in Berta CMS allows remote attackers to execute arbitrary code by uploading a crafted image file with an executable exte… |
CVE-2015-6358 | Medium | 5.9 | 2017-10-12 | Multiple Cisco embedded devices use hardcoded X.509 certificates and SSH host keys embedded in the firmware, which allows remote attackers to defeat cryptograp… |
CVE-2015-8239 | High | 7.0 | 2017-10-10 | The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them bef… |
CVE-2015-7778 | Medium | 5.9 | 2017-10-10 | Gurunavi App for iOS before 6.0.0 does not verify SSL certificates which could allow remote attackers to perform man-in-the-middle attacks. |
CVE-2015-7503 | High | 7.5 | 2017-10-10 | Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key. |
CVE-2015-7384 | High | 7.5 | 2017-10-10 | Node.js 4.0.0, 4.1.0, and 4.1.1 allows remote attackers to cause a denial of service. |
CVE-2015-6918 | Medium | 6.3 | 2017-10-10 | salt before 2015.5.5 leaks git usernames and passwords to the log. |
CVE-2015-6521 | Medium | 5.4 | 2017-10-10 | Multiple cross-site scripting (XSS) vulnerabilities in ATutor LMS version 2.2. |
CVE-2015-5675 | High | 7.8 | 2017-10-10 | The sys_amd64 IRET Handler in the kernel in FreeBSD 9.3 and 10.1 allows local users to gain privileges or cause a denial of service (kernel panic). |
CVE-2015-5639 | High | 7.4 | 2017-10-10 | niconico App for iOS before 6.38 does not verify SSL certificates which could allow remote attackers to execute man-in-the-middle attacks. |