2015 CVEs (page 12)
Page 12 of 82 — CVEs published in 2015, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-4074 | High | 7.5 | 2017-09-20 | Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the… |
CVE-2015-4073 | Critical | 9.8 | 2017-09-20 | Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1)… |
CVE-2015-4072 | Medium | 5.4 | 2017-09-20 | Multiple cross-site scripting (XSS) vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to inject arbitrary web script o… |
CVE-2015-1329 | High | 8.8 | 2017-09-20 | Use-after-free vulnerability in oxide::qt::URLRequestDelegatedJob in oxide-qt in Ubuntu 15.04 and 14.04 LTS might allow remote attackers to execute arbitrary c… |
CVE-2015-4685 | High | 7.0 | 2017-09-19 | Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users with access to the plcm account to gain privileges via a script in /var/polycom/… |
CVE-2015-4684 | Medium | 6.5 | 2017-09-19 | Multiple directory traversal vulnerabilities in Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allow (1) remote authenticated users to read arbitr… |
CVE-2015-4683 | Critical | 9.8 | 2017-09-19 | Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows attackers to obtain sensitive information and potentially gain privileges by leveraging use… |
CVE-2015-4682 | Medium | 6.5 | 2017-09-19 | Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows remote authenticated users to obtain the installation path via an HTTP POST request to PlcmR… |
CVE-2015-4681 | High | 7.8 | 2017-09-19 | Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users to have unspecified impact via vectors related to weak passwords. |
CVE-2015-1849 | Medium | 5.9 | 2017-09-19 | AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information via vectors involv… |
CVE-2015-7837 | Medium | 5.5 | 2017-09-19 | The Linux kernel, as used in Red Hat Enterprise Linux 7, kernel-rt, and Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to b… |
CVE-2015-4089 | High | 8.8 | 2017-09-19 | Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPr… |
CVE-2015-3880 | Medium | 6.1 | 2017-09-19 | Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and… |
CVE-2015-3432 | Medium | 6.1 | 2017-09-19 | Multiple cross-site scripting (XSS) vulnerabilities in Pydio (formerly AjaXplorer) before 6.0.7 allow remote attackers to inject arbitrary web script or HTML v… |
CVE-2015-3431 | Critical | 9.8 | 2017-09-19 | Pydio (formerly AjaXplorer) before 6.0.7 allows remote attackers to execute arbitrary commands via unspecified vectors, aka "Pydio OS Command Injection Vulnera… |
CVE-2015-3420 | Medium | 5.9 | 2017-09-19 | The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a denial of service (login process crash) vi… |
CVE-2015-3419 | Medium | 6.5 | 2017-09-19 | vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations via vectors related… |
CVE-2015-3299 | Medium | 6.1 | 2017-09-19 | Cross-site scripting (XSS) vulnerability in the Floating Social Bar plugin before 1.1.7 for WordPress allows remote attackers to inject arbitrary web script or… |
CVE-2015-1864 | Medium | 5.4 | 2017-09-19 | Multiple cross-site scripting (XSS) vulnerabilities in the administration pages in Kallithea before 0.2.1 allow remote attackers to inject arbitrary web script… |
CVE-2015-1854 | High | 7.5 | 2017-09-19 | 389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call. |
CVE-2015-0689 | High | 7.5 | 2017-09-19 | Cisco Cloud Web Security before 3.0.1.7 allows remote attackers to bypass intended filtering protection mechanisms by leveraging improper handling of HTTP meth… |
CVE-2015-1527 | High | 7.8 | 2017-09-15 | Integer overflow in IAudioPolicyService.cpp in Android allows local users to gain privileges via a crafted application, aka Android Bug ID 19261727. |
CVE-2015-0110 | Medium | 6.5 | 2017-09-15 | IBM Business Process Manager (aka BPM) 7.5.x, 8.0.x, and 8.5.x and WebSphere Lombardi Edition (aka WLE) 7.2.x allow remote authenticated users to bypass intend… |
CVE-2015-7553 | Medium | 4.7 | 2017-09-14 | Race condition in the kernel in Red Hat Enterprise Linux 7, kernel-rt and Red Hat Enterprise MRG 2, when the nfnetlink_log module is loaded, allows local users… |
CVE-2015-7880 | Medium | 4.3 | 2017-09-13 | The Entity Registration module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to obtain sensitive event registration information by leveraging the "… |
CVE-2015-5206 | Critical | 9.8 | 2017-09-13 | Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x before 5.3.2 has unknown impact and attack vectors, a differ… |
CVE-2015-5168 | Critical | 9.8 | 2017-09-13 | Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vul… |
CVE-2015-2750 | Medium | 6.1 | 2017-09-13 | Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary w… |
CVE-2015-2749 | Medium | 6.1 | 2017-09-13 | Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing… |
CVE-2015-9230 | Medium | 4.8 | 2017-09-12 | In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for WordPress, XSS is possible for remote authentic… |
CVE-2015-9229 | Medium | 4.8 | 2017-09-12 | In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated administrators via… |
CVE-2015-9228 | High | 8.8 | 2017-09-12 | In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extensio… |
CVE-2015-9227 | High | 7.2 | 2017-09-11 | PHP remote file inclusion vulnerability in the get_file function in upload/admin2/controller/report_logs.php in AlegroCart 1.2.8 allows remote administrators t… |
CVE-2015-9226 | High | 7.2 | 2017-09-11 | Multiple SQL injection vulnerabilities in AlegroCart 1.2.8 allow remote administrators to execute arbitrary SQL commands via the download parameter in the (1)… |
CVE-2015-8354 | Medium | 6.1 | 2017-09-11 | Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web sc… |
CVE-2015-8353 | Medium | 6.1 | 2017-09-11 | Cross-site scripting (XSS) vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary web script or HTML v… |
CVE-2015-8351 | Critical | 9.0 | 2017-09-11 | PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_include is enabled, allows remote authenticat… |
CVE-2015-8350 | Medium | 6.1 | 2017-09-11 | Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to inject arbitrary web scr… |
CVE-2015-8349 | Medium | 6.1 | 2017-09-11 | Cross-site scripting (XSS) vulnerability in SourceBans before 2.0 pre-alpha allows remote attackers to inject arbitrary web script or HTML via the advSearch pa… |
CVE-2015-5054 | Medium | 6.1 | 2017-09-11 | Open redirect vulnerability in Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to redirect users to arbitrary web sites… |
CVE-2015-4689 | Critical | 9.8 | 2017-09-11 | Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to reset arbitrary passwords via unspecified vectors, aka "Weak Password… |
CVE-2015-4688 | Medium | 5.3 | 2017-09-11 | Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allow remote attackers to enumerate user accounts via a series of requests. |
CVE-2015-4687 | Medium | 6.1 | 2017-09-11 | Cross-site scripting (XSS) vulnerability in Ellucian (formerly SunGard) Banner Student 8.5.1.2 allows remote attackers to inject arbitrary web script or HTML v… |
CVE-2015-7879 | Medium | 5.4 | 2017-09-11 | Cross-site scripting (XSS) vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authenticated users with permission to create or… |
CVE-2015-7877 | Critical | 9.8 | 2017-09-11 | Multiple SQL injection vulnerabilities in the User Dashboard module 7.x before 7.x-1.4 for Drupal allow remote attackers to execute arbitrary SQL commands via… |
CVE-2015-4523 | Critical | 9.3 | 2017-09-11 | Blue Coat Malware Analysis Appliance (MAA) before 4.2.5 and Malware Analyzer G2 allow remote attackers to bypass a virtual machine protection mechanism and con… |
CVE-2015-8079 | Medium | 5.3 | 2017-09-07 | qt5-qtwebkit before 5.4 records private browsing URLs to its favicon database, WebpageIcons.db. |
CVE-2015-7672 | Medium | 5.4 | 2017-09-07 | Cross-site scripting (XSS) vulnerability in Centreon 2.6.1 (fixed in Centreon 18.10.0 and Centreon web 2.8.27). |
CVE-2015-5060 | Medium | 6.1 | 2017-09-07 | Cross-site scripting (XSS) vulnerability in anchor-cms before 0.9-dev. |
CVE-2015-5052 | Critical | 9.8 | 2017-09-07 | SQL injection vulnerability in Sefrengo before 1.6.5 beta2. |
CVE-2015-4724 | High | 8.8 | 2017-09-07 | SQL injection vulnerability in Concrete5 5.7.3.1. |
CVE-2015-4721 | Medium | 6.1 | 2017-09-07 | Multiple cross-site scripting (XSS) vulnerabilities in Concrete5 5.7.3.1. |
CVE-2015-4697 | High | 8.8 | 2017-09-07 | Cross-site request forgery (CSRF) vulnerability in Google Analyticator Wordpress Plugin before 6.4.9.3 rev @1183563. |
CVE-2015-4629 | Critical | 9.8 | 2017-09-07 | Huawei E5756S before V200R002B146D23SP00C00 allows remote attackers to read device configuration information, enable PIN/PUK authentication, and perform other… |
CVE-2015-4627 | Critical | 9.8 | 2017-09-07 | SQL injection vulnerability in Pragyan CMS 3.0. |
CVE-2015-4619 | High | 8.8 | 2017-09-07 | Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75. |
CVE-2015-4085 | High | 7.5 | 2017-09-07 | Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1. |
CVE-2015-3991 | Critical | 9.8 | 2017-09-07 | strongSwan 5.2.2 and 5.3.0 allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code. |
CVE-2015-3314 | High | 8.1 | 2017-09-07 | SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5. |
CVE-2015-3313 | Critical | 9.8 | 2017-09-07 | SQL injection vulnerability in WordPress Community Events plugin before 1.4. |
CVE-2015-3222 | High | 7.0 | 2017-09-07 | syscheck/seechanges.c in OSSEC 2.7 through 2.8.1 on NIX systems allows local users to execute arbitrary code as root. |
CVE-2015-3169 | Medium | 6.1 | 2017-09-07 | Cross-site scripting (XSS) vulnerability in askbot 0.7.51-4.el6.noarch. |
CVE-2015-1590 | High | 7.8 | 2017-09-07 | The kamcmd administrative utility and default configuration in kamailio before 4.3.0 use /tmp/kamailio_ctl. |
CVE-2015-3442 | Critical | 9.8 | 2017-09-07 | Soreco Xpert.Line 3.0 allows local users to spoof users and consequently gain privileges by intercepting a Windows API call. |
CVE-2015-3250 | High | 7.5 | 2017-09-07 | Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors. |
CVE-2015-8316 | Medium | 5.9 | 2017-09-06 | Array index error in LightDM (aka Light Display Manager) 1.14.3, 1.16.x before 1.16.6 when the XDMCP server is enabled allows remote attackers to cause a denia… |
CVE-2015-7294 | High | 7.5 | 2017-09-06 | ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username. |
CVE-2015-7241 | Critical | 9.8 | 2017-09-06 | XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01. |
CVE-2015-7225 | Medium | 5.3 | 2017-09-06 | Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP… |
CVE-2015-6250 | Medium | 5.3 | 2017-09-06 | simple-php-captcha before commit 9d65a945029c7be7bb6bc893759e74c5636be694 allows remote attackers to automatically generate the captcha response by running the… |
CVE-2015-5959 | Critical | 9.8 | 2017-09-06 | Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log. |
CVE-2015-5948 | High | 8.1 | 2017-09-06 | Race condition in SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code. NOTE: this vulnerability exists because of an incomplete fix for CV… |
CVE-2015-5947 | High | 8.1 | 2017-09-06 | SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code. |
CVE-2015-5705 | High | 7.5 | 2017-09-06 | Argument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to arbitrary files via a crafted symlink and crafted filename. |
CVE-2015-5186 | Medium | 5.3 | 2017-09-06 | Audit before 2.4.4 in Linux does not sanitize escape characters in filenames. |
CVE-2015-3454 | High | 7.5 | 2017-09-06 | TelescopeJS before 0.15 leaks user bcrypt password hashes in websocket messages, which might allow remote attackers to obtain password hashes via a cross-site… |
CVE-2015-3450 | High | 8.8 | 2017-09-06 | Heap-based buffer overflow in libaxl 0.6.9 allows attackers to cause a denial of service (memory corruption) or execute arbitrary code via a crafted XML docume… |
CVE-2015-3163 | Medium | 4.3 | 2017-09-06 | The admin pages for power types and key types in Beaker before 20.1 do not have any access controls, which allows remote authenticated users to modify power ty… |
CVE-2015-3162 | Medium | 5.4 | 2017-09-06 | Cross-site scripting (XSS) vulnerability in the edit comment dialog in bkr/server/widgets.py in Beaker 20.1 allows remote authenticated users to inject arbitra… |
CVE-2015-3161 | Medium | 4.8 | 2017-09-06 | The search bar code in bkr/server/widgets.py in Beaker before 20.1 does not escape </script> tags in string literals when producing JSON. |
CVE-2015-3160 | Medium | 4.3 | 2017-09-06 | XML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users to obtain sensitive information via submi… |
CVE-2015-2943 | Medium | 5.9 | 2017-09-06 | Honda Moto LINC 1.6.1 does not verify SSL certificates. |
CVE-2015-2210 | High | 7.8 | 2017-09-06 | The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into the window source to… |
CVE-2015-0853 | High | 8.8 | 2017-09-06 | svn-workbench 1.6.2 and earlier on a system with xeyes installed allows local users to execute arbitrary commands by using the "Command Shell" menu item while… |
CVE-2015-7746 | Critical | 9.8 | 2017-09-01 | NetApp Data ONTAP before 8.2.4, when operating in 7-Mode, allows remote attackers to bypass authentication and (1) obtain sensitive information from or (2) mod… |
CVE-2015-7711 | Medium | 6.1 | 2017-08-31 | Cross-site scripting (XSS) vulnerability in popuphelp.php in ATutor 2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the h pa… |
CVE-2015-7700 | Critical | 9.8 | 2017-08-31 | Double-free vulnerability in the sPLT chunk structure and png.c in pngcrush before 1.7.87 allows attackers to have unspecified impact via unknown vectors. |
CVE-2015-5958 | High | 8.8 | 2017-08-31 | phpFileManager 0.9.8 allows remote attackers to execute arbitrary commands via a crafted URL. |
CVE-2015-5695 | Medium | 6.5 | 2017-08-31 | Designate 2015.1.0 through 1.0.0.0b1 as packaged in OpenStack Kilo does not enforce RecordSets per domain, and Records per RecordSet quotas when processing an… |
CVE-2015-8334 | High | 8.8 | 2017-08-29 | SQL injection vulnerability in the Operation and Maintenance Unit (OMU) in Huawei VCN500 before V100R002C00SPC201 allows remote authenticated users to execute… |
CVE-2015-8299 | Critical | 9.8 | 2017-08-29 | Buffer overflow in the Group messages monitor (Falcon) in KNX ETS 4.1.5 (Build 3246) allows remote attackers to execute arbitrary code via a crafted KNXnet/IP… |
CVE-2015-7517 | Critical | 9.8 | 2017-08-29 | Multiple SQL injection vulnerabilities in the Double Opt-In for Download plugin before 2.0.9 for WordPress allow remote attackers to execute arbitrary SQL comm… |
CVE-2015-7255 | High | 7.5 | 2017-08-29 | ZTE OX-330P, ZXHN H108N, W300V1.0.0S_ZRD_TR1_D68, HG110, GAN9.8T101A-B, MF28G, ZXHN H108N use non-unique X.509 certificates and SSH host keys, which might allo… |
CVE-2015-6942 | Medium | 6.1 | 2017-08-29 | Cross-site scripting (XSS) vulnerability in Coremail XT3.0 allows remote attackers to inject arbitrary web script or HTML via a hyperlink in a document attachm… |
CVE-2015-6588 | Medium | 6.1 | 2017-08-29 | Cross-site scripting (XSS) vulnerability in login-fsp.html in MODX Revolution before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via t… |
CVE-2015-5209 | High | 7.5 | 2017-08-29 | Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vectors involvi… |
CVE-2015-4649 | High | 7.2 | 2017-08-29 | Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to gain root privileges via unspecified… |
CVE-2015-3657 | High | 7.2 | 2017-08-29 | Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain "Super Admin" privil… |
CVE-2015-3656 | High | 7.2 | 2017-08-29 | Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain privileges by levera… |
CVE-2015-3655 | High | 8.8 | 2017-08-29 | Cross-site request forgery (CSRF) vulnerability in Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to hijac… |