2015 CVEs (page 11)
Page 11 of 82 — CVEs published in 2015, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-2988 | High | 7.4 | 2017-10-10 | Rakuten card App for iOS 5.2.0 through 5.2.4 does not verify SSL certificates which might allow remote attackers to execute man-in-the-middle attacks. |
CVE-2015-2856 | High | 7.5 | 2017-10-10 | Directory traversal vulnerability in the template function in function.inc in Accellion File Transfer Appliance devices before FTA_9_11_210 allows remote attac… |
CVE-2015-7842 | High | 7.1 | 2017-10-10 | Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software be… |
CVE-2015-2673 | High | 8.8 | 2017-10-06 | The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax_functions.php in the WP EasyCart plugin 1.1.30 through 3.0.20 for Wo… |
CVE-2015-2148 | Medium | 4.8 | 2017-10-06 | Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.2 allow remote attackers to inject arbitrary web script or HTML vi… |
CVE-2015-2147 | Critical | 9.8 | 2017-10-06 | Multiple SQL injection vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to execute arbitrary SQL commands via unspecified para… |
CVE-2015-2146 | Critical | 9.8 | 2017-10-06 | Multiple SQL injection vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to execute arbitrary SQL commands via the (1) id param… |
CVE-2015-2145 | Medium | 4.8 | 2017-10-06 | Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to inject arbitrary web script or HTML vi… |
CVE-2015-2144 | Medium | 4.8 | 2017-10-06 | Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote authenticated users to inject arbitrary web script… |
CVE-2015-2143 | High | 8.8 | 2017-10-06 | Multiple cross-site request forgery (CSRF) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to hijack the authentication of us… |
CVE-2015-2142 | High | 8.0 | 2017-10-06 | Multiple cross-site request forgery (CSRF) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote authenticated users to (1) hijack the authen… |
CVE-2015-1828 | Medium | 5.9 | 2017-10-06 | The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-th… |
CVE-2015-1429 | High | 7.5 | 2017-10-06 | Directory traversal vulnerability in Cybele Software Thinfinity Remote Desktop Workstation 3.0.0.3 32-bit and 64-bit allows remote attackers to download arbitr… |
CVE-2015-0296 | Medium | 4.7 | 2017-10-06 | The pre-install script in texlive 3.1.20140525_r34255.fc21 as packaged in Fedora 21 and rpm, and texlive 6.20131226_r32488.fc20 and rpm allows local users to d… |
CVE-2015-5246 | High | 8.1 | 2017-10-06 | The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors involving the password… |
CVE-2015-2297 | High | 7.5 | 2017-10-06 | nanohttp in libcsoap allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Authorization header. |
CVE-2015-2158 | High | 7.8 | 2017-10-06 | Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service (applicatio… |
CVE-2015-1206 | Medium | 5.5 | 2017-10-06 | Heap-based buffer overflow in Google Chrome before M40 allows remote attackers to cause a denial of service (unpaged memory write and process crash) via a craf… |
CVE-2015-7980 | Medium | 6.1 | 2017-10-03 | Cross-site scripting (XSS) vulnerability in the Compass Rose module 6.x-1.x before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or… |
CVE-2015-7843 | High | 8.8 | 2017-10-03 | The management interface on Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC50… |
CVE-2015-7841 | Critical | 9.8 | 2017-10-03 | The login page of the server on Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00S… |
CVE-2015-7359 | High | 7.8 | 2017-10-03 | The (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Wind… |
CVE-2015-7358 | High | 7.8 | 2017-10-03 | The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, does not properly vali… |
CVE-2015-7357 | Medium | 6.1 | 2017-10-03 | Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to inject arbitrary web… |
CVE-2015-6971 | High | 7.8 | 2017-10-03 | Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0013 allows local users to submit commands to the System Update service (SUService.exe)… |
CVE-2015-6576 | High | 8.8 | 2017-10-03 | Bamboo 2.2 before 5.8.5 and 5.9.x before 5.9.7 allows remote attackers with access to the Bamboo web interface to execute arbitrary Java code via an unspecifie… |
CVE-2015-3321 | Medium | 6.7 | 2017-10-03 | Services and files in Lenovo Fingerprint Manager before 8.01.42 have incorrect ACLs, which allows local users to invalidate local checks and gain privileges vi… |
CVE-2015-9234 | High | 7.2 | 2017-09-30 | The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactformpp_id parameter to… |
CVE-2015-9233 | High | 8.8 | 2017-09-30 | The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cp_contactformpp.ph… |
CVE-2015-1027 | Medium | 5.9 | 2017-09-29 | The version checking subroutine in percona-toolkit before 2.2.13 and xtrabackup before 2.2.9 was vulnerable to silent HTTP downgrade attacks and Man In The Mid… |
CVE-2015-8249 | Critical | 9.8 | 2017-09-28 | The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary files via the Connecti… |
CVE-2015-7349 | Medium | 6.1 | 2017-09-28 | Cross-site scripting (XSS) vulnerability in the sample feedback.inc file in VASCO DIGIPASS authentication plug-in for Citrix Web Interface allows remote attack… |
CVE-2015-7256 | Medium | 5.9 | 2017-09-28 | ZyXEL NWA1100-N, NWA1100-NH, NWA1121-NI, NWA1123-AC, and NWA1123-NI access points; P-660HN-51, P-663HN-51, VMG1312-B10A, VMG1312-B30A, VMG1312-B30B, VMG4380-B1… |
CVE-2015-5613 | Medium | 5.4 | 2017-09-28 | Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involv… |
CVE-2015-3643 | High | 7.8 | 2017-09-28 | usb-creator before 0.2.38.3ubuntu0.1 on Ubuntu 12.04 LTS, before 0.2.56.3ubuntu0.1 on Ubuntu 14.04 LTS, before 0.2.62ubuntu0.3 on Ubuntu 14.10, and before 0.2… |
CVE-2015-3138 | High | 7.5 | 2017-09-28 | print-wb.c in tcpdump before 4.7.4 allows remote attackers to cause a denial of service (segmentation fault and process crash). |
CVE-2015-1537 | High | 7.8 | 2017-09-28 | Integer overflow in IHDCP.cpp in the media_server component in Android allows remote attackers to execute arbitrary code via a crafted application. |
CVE-2015-1526 | Medium | 5.5 | 2017-09-28 | The media_server component in Android allows remote attackers to cause a denial of service via a crafted application. |
CVE-2015-1336 | High | 7.8 | 2017-09-28 | The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to gain privileges vi… |
CVE-2015-7670 | Critical | 9.8 | 2017-09-26 | Multiple SQL injection vulnerabilities in includes/update.php in the Support Ticket System plugin before 1.2.1 for WordPress allow remote attackers to execute… |
CVE-2015-7391 | Medium | 6.1 | 2017-09-26 | Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the (1) selecte… |
CVE-2015-7390 | Critical | 9.8 | 2017-09-26 | SQL injection vulnerability in TestLink before 1.9.14 allows remote attackers to execute arbitrary SQL commands via the apikey parameter to lnl.php. |
CVE-2015-3248 | Medium | 4.7 | 2017-09-26 | openhpi/Makefile.am in OpenHPI before 3.6.0 uses world-writable permissions for /var/lib/openhpi directory, which allows local users, when quotas are not prope… |
CVE-2015-5070 | Low | 3.1 | 2017-09-26 | The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.4 and… |
CVE-2015-5069 | Medium | 4.3 | 2017-09-26 | The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.3 and… |
CVE-2015-0874 | Medium | 5.9 | 2017-09-26 | Smartphone Passbook 1.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information from en… |
CVE-2015-8707 | Critical | 9.8 | 2017-09-26 | Password reset tokens in Magento CE before 1.9.2.2, and Magento EE before 1.14.2.2 are passed via a GET request and not canceled after use, which allows remote… |
CVE-2015-0238 | Low | 3.3 | 2017-09-26 | selinux-policy as packaged in Red Hat OpenShift 2 allows attackers to obtain process listing information via a privilege escalation attack. |
CVE-2015-8375 | Medium | 5.4 | 2017-09-25 | Cross-site scripting (XSS) vulnerability in PHP-Fusion 9. |
CVE-2015-8251 | Medium | 5.9 | 2017-09-25 | OpenStage 60 and OpenScape Desk Phone IP 55G SIP V3, OpenStage 15, 20E, 20 and 40 and OpenScape Desk Phone IP 35G SIP V3, OpenScape Desk Phone IP 35G Eco SIP V… |
CVE-2015-7846 | Medium | 4.6 | 2017-09-25 | Huawei S7700, S9700, S9300 before V200R07C00SPC500, and AR200, AR1200, AR2200, AR3200 before V200R005C20SPC200 allows attackers with physical access to the CF… |
CVE-2015-7785 | Medium | 5.9 | 2017-09-25 | GANMA! App for iOS does not verify SSL certificates. |
CVE-2015-7544 | Critical | 9.1 | 2017-09-25 | redhat-support-plugin-rhev in Red Hat Enterprise Virtualization Manager (aka RHEV Manager) before 3.6 allows remote authenticated users with the SuperUser role… |
CVE-2015-7510 | Critical | 9.8 | 2017-09-25 | Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd. |
CVE-2015-7293 | High | 8.8 | 2017-09-25 | Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x. |
CVE-2015-6592 | Medium | 6.8 | 2017-09-25 | Huawei UAP2105 before V300R012C00SPC160(BootRom) does not require authentication to the serial port or the VxWorks shell. |
CVE-2015-5704 | High | 7.8 | 2017-09-25 | scripts/licensecheck.pl in devscripts before 2.15.7 allows local users to execute arbitrary shell commands. |
CVE-2015-5666 | Medium | 5.9 | 2017-09-25 | ANA App for Android 3.1.1 and earlier, and ANA App for iOS 3.3.6 and earlier does not verify SSL certificates. |
CVE-2015-5327 | Medium | 6.5 | 2017-09-25 | Out-of-bounds memory read in the x509_decode_time function in x509_cert_parser.c in Linux kernels 4.3-rc1 and after. |
CVE-2015-5263 | High | 8.1 | 2017-09-25 | pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's public key upon registration. |
CVE-2015-5184 | High | 7.5 | 2017-09-25 | Console: CORS headers set to allow all in Red Hat AMQ. |
CVE-2015-5183 | High | 7.5 | 2017-09-25 | Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ. |
CVE-2015-5182 | High | 8.8 | 2017-09-25 | Cross-site request forgery (CSRF) vulnerability in the jolokia API in A-MQ. |
CVE-2015-5181 | Medium | 5.4 | 2017-09-25 | The JBoss console in A-MQ allows remote attackers to execute arbitrary JavaScript. |
CVE-2015-5169 | Medium | 6.1 | 2017-09-25 | Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20. |
CVE-2015-7318 | High | 7.5 | 2017-09-25 | Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses. |
CVE-2015-7317 | Medium | 6.8 | 2017-09-25 | Kupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7 allows remote authenticated users to edit Kupu settings. |
CVE-2015-7316 | Medium | 6.1 | 2017-09-25 | Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and… |
CVE-2015-7315 | Medium | 5.9 | 2017-09-25 | Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new… |
CVE-2015-6748 | Medium | 6.1 | 2017-09-25 | Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3. |
CVE-2015-5282 | Medium | 6.1 | 2017-09-25 | Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after. |
CVE-2015-5237 | High | 8.8 | 2017-09-25 | protobuf allows remote authenticated attackers to cause a heap-based buffer overflow. |
CVE-2015-4669 | High | 7.8 | 2017-09-25 | The MySQL "root" user in Xsuite 2.x does not have a password set, which allows local users to access databases on the system. |
CVE-2015-4668 | Medium | 6.1 | 2017-09-25 | Open redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a U… |
CVE-2015-4667 | Critical | 9.8 | 2017-09-25 | Multiple hardcoded credentials in Xsuite 2.x. |
CVE-2015-3887 | High | 7.8 | 2017-09-21 | Untrusted search path vulnerability in ProxyChains-NG before 4.9 allows local users to gain privileges via a Trojan horse libproxychains4.so library in the cur… |
CVE-2015-1187 | Critical | 9.8 | 2017-09-21 | The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp. |
CVE-2015-8559 | High | 7.5 | 2017-09-21 | The knife bootstrap command in chef Infra client before version 15.4.45 leaks the validator.pem private RSA key to /var/log/messages. |
CVE-2015-5284 | Critical | 9.8 | 2017-09-21 | ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable. |
CVE-2015-4706 | Medium | 6.1 | 2017-09-21 | Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON er… |
CVE-2015-3296 | Medium | 6.1 | 2017-09-21 | Multiple cross-site scripting (XSS) vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to (… |
CVE-2015-0276 | High | 8.8 | 2017-09-21 | Cross-site request forgery (CSRF) vulnerability in Kallithea before 0.2. |
CVE-2015-9232 | Medium | 5.3 | 2017-09-20 | The Good for Enterprise application 3.0.0.415 for Android does not use signature protection for its Authentication Delegation API intent. Also, the Good Dynami… |
CVE-2015-9231 | High | 7.5 | 2017-09-20 | iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS queries. A new (default) feature was added to iTerm2 version 3.0.0 (and un… |
CVE-2015-7347 | Medium | 4.8 | 2017-09-20 | Cross-site scripting (XSS) vulnerability in ZCMS JavaServer Pages Content Management System 1.1. |
CVE-2015-6673 | Critical | 9.8 | 2017-09-20 | Use-after-free vulnerability in Decoder.cpp in libpgf before 6.15.32. |
CVE-2015-5608 | Medium | 6.1 | 2017-09-20 | Open redirect vulnerability in Joomla! CMS 3.0.0 through 3.4.1. |
CVE-2015-5395 | High | 8.8 | 2017-09-20 | Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0. |
CVE-2015-4707 | Medium | 6.1 | 2017-09-20 | Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error… |
CVE-2015-3890 | High | 7.5 | 2017-09-20 | Use-after-free vulnerability in Open Litespeed before 1.3.10. |
CVE-2015-2927 | Medium | 6.5 | 2017-09-20 | node 0.3.2 and URONode before 1.0.5r3 allows remote attackers to cause a denial of service (bandwidth consumption). |
CVE-2015-2826 | Medium | 5.3 | 2017-09-20 | WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information. |
CVE-2015-1866 | Medium | 6.1 | 2017-09-20 | Cross-site scripting (XSS) vulnerability in Ember.js 1.10.x before 1.10.1 and 1.11.x before 1.11.2. |
CVE-2015-1865 | Medium | 5.1 | 2017-09-20 | fts.c in coreutils 8.4 allows local users to delete arbitrary files. |
CVE-2015-0162 | High | 7.0 | 2017-09-20 | IBM Security SiteProtector System 3.0, 3.1, and 3.1.1 allows local users to gain privileges. |
CVE-2015-8224 | Low | 3.7 | 2017-09-20 | Huawei P8 before GRA-CL00C92B210, before GRA-L09C432B200, before GRA-TL00C01B210, and before GRA-UL00C00B210 allows remote attackers to obtain user equipment (… |
CVE-2015-5607 | High | 8.8 | 2017-09-20 | Cross-site request forgery in the REST API in IPython 2 and 3. |
CVE-2015-5248 | Medium | 6.5 | 2017-09-20 | Reflected file download vulnerability in Red Hat Feedhenry Enterprise Mobile Application Platform. |
CVE-2015-5179 | High | 7.5 | 2017-09-20 | FreeIPA might display user data improperly via vectors involving non-printable characters. |
CVE-2015-4075 | High | 8.1 | 2017-09-20 | The Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to write to arbitrary .ini files via a crafted language.save task. |