2015 CVEs (page 13)
Page 13 of 82 — CVEs published in 2015, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-3654 | High | 7.2 | 2017-08-29 | Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to gain root privileges via unspecified… |
CVE-2015-3653 | High | 7.2 | 2017-08-29 | Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to write to arbitrary files within the u… |
CVE-2015-0234 | High | 7.5 | 2017-08-29 | Multiple temporary file creation vulnerabilities in pki-core 10.2.0. |
CVE-2015-8332 | High | 8.8 | 2017-08-28 | Huawei Video Content Management (VCM) before V100R001C10SPC001 does not properly "authenticate online user identities and privileges," which allows remote auth… |
CVE-2015-8300 | High | 7.8 | 2017-08-28 | Polycom BToE Connector before 3.0.0 uses weak permissions (Everyone: Full Control) for "Program Files (x86)\polycom\polycom btoe connector\plcmbtoesrv.exe," wh… |
CVE-2015-1600 | High | 7.5 | 2017-08-28 | Information disclosure vulnerability in Netatmo Indoor Module firmware 100 and earlier. |
CVE-2015-1554 | High | 7.5 | 2017-08-28 | kgb-bot 1.33-2 allows remote attackers to cause a denial of service (crash). |
CVE-2015-0233 | Medium | 4.2 | 2017-08-28 | Multiple insecure Temporary File vulnerabilities in 389 Administration Server before 1.1.38. |
CVE-2015-3976 | Medium | 5.4 | 2017-08-28 | Cross-site scripting (XSS) vulnerability in GE Multilink ML810/3000/3100 series switch 5.2.0 and earlier, and GE Multilink ML800/1200/1600/2400 4.2.1 and earli… |
CVE-2015-2046 | Medium | 6.1 | 2017-08-28 | Cross-site scripting (XSS) vulnerability in MantisBT 1.2.13 and later before 1.2.20. |
CVE-2015-1876 | High | 7.5 | 2017-08-28 | Directory traversal vulnerability in ES File Explorer 3.2.4.1. |
CVE-2015-1445 | High | 7.2 | 2017-08-28 | HTTP header injection in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30. |
CVE-2015-1443 | High | 8.8 | 2017-08-28 | The httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allows remote attackers to execute arbitrary code. |
CVE-2015-1430 | Critical | 9.8 | 2017-08-28 | Buffer overflow in xymon 4.3.17-1. |
CVE-2015-1401 | Critical | 9.8 | 2017-08-28 | Improper Authentication vulnerability in the "LDAP / SSO Authentication" (ig_ldap_sso_auth) extension 2.0.0 for TYPO3. |
CVE-2015-1386 | High | 7.5 | 2017-08-28 | Directory traversal vulnerability in unshield 1.0-1. |
CVE-2015-1199 | High | 7.5 | 2017-08-28 | Directory traversal vulnerability in ppmd 10.1-5. |
CVE-2015-1198 | High | 7.5 | 2017-08-28 | Multiple directory traversal vulnerabilities in ha 0.999p+dfsg-5. |
CVE-2015-1177 | Medium | 6.1 | 2017-08-28 | Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.2. |
CVE-2015-0974 | High | 7.8 | 2017-08-28 | Untrusted search path vulnerability in ZTE Datacard MF19 0V1.0.0B04 allows local users to gain privilege by modifying the 'Ucell Internet' directory to referen… |
CVE-2015-0928 | High | 7.5 | 2017-08-28 | libhtp 0.5.15 allows remote attackers to cause a denial of service (NULL pointer dereference). |
CVE-2015-0210 | Medium | 5.9 | 2017-08-28 | wpa_supplicant 2.0-16 does not properly check certificate subject name, which allows remote attackers to cause a man-in-the-middle attack. |
CVE-2015-0114 | High | 7.8 | 2017-08-28 | Stack-based buffer overflow in IBM V5R4, and IBM i Access for Windows 6.1 and 7.1. |
CVE-2015-0101 | Medium | 6.1 | 2017-08-28 | Cross-site scripting (XSS) vulnerability in IBM Business Process Manager Standard 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5; IBM Business Proces… |
CVE-2015-5701 | Medium | 6.1 | 2017-08-25 | mktexlsr revision 36855, and before revision 36626 as packaged in texlive allows local users to write to arbitrary files via a symlink attack. NOTE: this vuln… |
CVE-2015-5700 | Medium | 6.1 | 2017-08-25 | mktexlsr revision 22855 through revision 36625 as packaged in texlive allows local users to write to arbitrary files via a symlink attack. |
CVE-2015-4181 | High | 7.5 | 2017-08-25 | Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the v… |
CVE-2015-4180 | High | 7.5 | 2017-08-25 | Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the v… |
CVE-2015-4017 | High | 7.5 | 2017-08-25 | Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules. |
CVE-2015-3257 | Medium | 6.1 | 2017-08-25 | Zend/Diactoros/Uri::filterPath in zend-diactoros before 1.0.4 does not properly sanitize path input, which allows remote attackers to perform cross-site script… |
CVE-2015-3211 | Medium | 5.5 | 2017-08-25 | php-fpm allows local users to write to or create arbitrary files via a symlink attack. |
CVE-2015-3206 | High | 8.1 | 2017-08-25 | The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of… |
CVE-2015-1395 | High | 7.5 | 2017-08-25 | Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrary files with… |
CVE-2015-1325 | High | 7.0 | 2017-08-25 | Race condition in Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2.14.1-0ubuntu3.11 a… |
CVE-2015-1324 | High | 7.8 | 2017-08-25 | Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2.14.1-0ubuntu3.11 as packaged in Ubun… |
CVE-2015-8355 | High | 8.8 | 2017-08-24 | Multiple SQL injection vulnerabilities in the orion.extfeedbackform module before 2.1.3 for Bitrix allow remote authenticated users to execute arbitrary SQL co… |
CVE-2015-8352 | Critical | 9.8 | 2017-08-24 | Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act paramete… |
CVE-2015-4699 | Medium | 6.1 | 2017-08-24 | Cross-site scripting (XSS) vulnerability in the Splash Portal in Cloud4Wi before 5.9.7 allows remote attackers to inject arbitrary web script or HTML via the r… |
CVE-2015-8308 | High | 7.8 | 2017-08-24 | LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections. |
CVE-2015-7896 | Medium | 6.5 | 2017-08-24 | LibQJpeg in the Samsung Galaxy S6 before the October 2015 MR allows remote attackers to cause a denial of service (memory corruption and SIGSEGV) via a crafted… |
CVE-2015-7516 | High | 7.5 | 2017-08-24 | ONOS before 1.5.0 when using the ifwd app allows remote attackers to cause a denial of service (NULL pointer dereference and switch disconnect) by sending two… |
CVE-2015-7259 | High | 8.8 | 2017-08-24 | ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow user accounts to have multiple valid username and password pairs, which allo… |
CVE-2015-7258 | High | 8.8 | 2017-08-24 | ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated users to obtain user passwords by displaying user infor… |
CVE-2015-7257 | High | 7.5 | 2017-08-24 | ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated non-administrator users to change the admin password by… |
CVE-2015-5293 | Medium | 5.9 | 2017-08-24 | Red Hat Enterprise Virtualization Manager 3.6 and earlier gives valid SLAAC IPv6 addresses to interfaces when "boot protocol" is set to None, which might allow… |
CVE-2015-5146 | Medium | 5.3 | 2017-08-24 | ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a com… |
CVE-2015-1801 | Critical | 9.8 | 2017-08-24 | The samsung_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to cause a denial of service (memory corruption) o… |
CVE-2015-1800 | High | 7.5 | 2017-08-24 | The samsung_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to potentially obtain sensitive information. |
CVE-2015-5224 | Critical | 9.8 | 2017-08-23 | The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks. |
CVE-2015-6473 | Critical | 9.8 | 2017-08-22 | WAGO IO 750-849 01.01.27 and WAGO IO 750-881 01.02.05 do not contain privilege separation. |
CVE-2015-6472 | Critical | 9.8 | 2017-08-22 | WAGO IO 750-849 01.01.27 and 01.02.05, WAGO IO 750-881, and WAGO IO 758-870 have weak credential management. |
CVE-2015-5258 | High | 8.8 | 2017-08-22 | Cross-site request forgery (CSRF) vulnerability in springframework-social before 1.1.3. |
CVE-2015-3617 | High | 7.8 | 2017-08-22 | Fortinet FortiManager 5.0 before 5.0.11 and 5.2 before 5.2.2 allow local users to gain privileges via crafted CLI commands. |
CVE-2015-2857 | Critical | 9.8 | 2017-08-22 | Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metacharacters in the oauth_token parameter. |
CVE-2015-9073 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall. |
CVE-2015-9072 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall. |
CVE-2015-9071 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in a TrustZone syscall. |
CVE-2015-9070 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in a TrustZone syscall. |
CVE-2015-9069 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, the Secure File System can become corrupted. |
CVE-2015-9068 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, an argument to a mink syscall is not properly validated. |
CVE-2015-9067 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a potential compiler optimization of memset() is addressed. |
CVE-2015-9066 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in an Inter-RAT procedure. |
CVE-2015-9065 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a UE can respond to a UEInformationRequest before Access Stratum security is es… |
CVE-2015-9064 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, the UE can send IMEI or IMEISV to the network on a network request before NAS s… |
CVE-2015-9063 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a procedure involving a remote UIM cl… |
CVE-2015-9062 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, an integer overflow to buffer overflow vulnerability exists when loading an ELF… |
CVE-2015-9061 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, playReady DRM failed to check a length potentially leading to unauthorized acce… |
CVE-2015-9060 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a pointer is not properly validated in a QTEE system call. |
CVE-2015-9055 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, an assertion was potentially reachable in a memory management routine. |
CVE-2015-9054 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a NULL pointer can be dereferenced during GAL decoding. |
CVE-2015-9053 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in the processing of certain responses f… |
CVE-2015-9052 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached while processin… |
CVE-2015-9051 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached due to an impro… |
CVE-2015-9050 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists where an array out of bounds access can occur during a C… |
CVE-2015-9049 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in the processing of certain responses from the USIM. |
CVE-2015-9048 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in the processing of lost RTP packets. |
CVE-2015-9047 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in GNSS when performing a scan after bootup. |
CVE-2015-9046 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached due to an impro… |
CVE-2015-9045 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in GERAN where a buffer can be overflown while taking po… |
CVE-2015-9044 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached due to an impro… |
CVE-2015-9043 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a NULL pointer can be dereferenced upon the expiry of a timer. |
CVE-2015-9042 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists when processing a QMI message. |
CVE-2015-9041 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists when performing WCDMA radio tuning. |
CVE-2015-9040 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in a GERAN API. |
CVE-2015-9039 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in eMBMS where an assertion can be reached by a sequence… |
CVE-2015-9038 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a NULL pointer may be dereferenced in the front end. |
CVE-2015-9037 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read may occur in the processing of a downlink 3G NAS message. |
CVE-2015-9036 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, an incorrect length is used to clear a memory buffer resulting in adjacent memo… |
CVE-2015-9035 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a memory buffer fails to be freed after it is no longer needed potentially resu… |
CVE-2015-9034 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a string can fail to be null-terminated in SIP leading to a buffer overflow. |
CVE-2015-8596 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, validation of buffer lengths is missing in malware protection. |
CVE-2015-8595 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in digital television/digital radio DRM. |
CVE-2015-8594 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in RFA-1x. |
CVE-2015-8593 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in 1x call processing. |
CVE-2015-8592 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a pointer is not validated prior to being dereferenced potentially resulting in… |
CVE-2015-5153 | High | 8.8 | 2017-08-18 | Pulp does not remove permissions for named objects upon deletion, which allows authenticated users to gain the privileges of a deleted object via creating an o… |
CVE-2015-5081 | High | 8.8 | 2017-08-18 | Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before 3.1.1 allows remote attackers to manipulate privileged users into per… |
CVE-2015-5057 | Medium | 6.1 | 2017-08-18 | Cross-site scripting (XSS) vulnerability exists in the Wordpress admin panel when the Broken Link Checker plugin before 1.10.9 is installed. |
CVE-2015-4464 | Critical | 9.8 | 2017-08-18 | Kguard Digital Video Recorder 104, 108, v2 does not have any authorization or authentication between an ActiveX client and the application server. |
CVE-2015-4071 | Medium | 5.3 | 2017-08-18 | The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users via obtaining the target ticketId, and… |