2015 CVEs (page 14)
Page 14 of 82 — CVEs published in 2015, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-2675 | High | 7.5 | 2017-08-18 | The OAuth implementation in librest before 0.7.93 incorrectly truncates the pointer returned by the rest_proxy_call_get_url function, which allows remote attac… |
CVE-2015-0576 | High | 7.0 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in HSDPA. |
CVE-2015-0575 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, insecure ciphersuites were included in the default configuration. |
CVE-2015-0574 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, the validation of filesystem access was insufficient. |
CVE-2015-7945 | High | 7.5 | 2017-08-18 | The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before… |
CVE-2015-7944 | High | 7.5 | 2017-08-18 | The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before… |
CVE-2015-4082 | Medium | 6.5 | 2017-08-18 | attic before 0.15 does not confirm unencrypted backups with the user, which allows remote attackers with read and write privileges for the encrypted repository… |
CVE-2015-3649 | High | 7.8 | 2017-08-18 | The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing "openuri-" followed by a crafted UI… |
CVE-2015-1878 | Medium | 6.8 | 2017-08-18 | Thales nShield Connect hardware models 500, 1500, 6000, 500+, 1500+, and 6000+ before 11.72 allows physically proximate attackers to sign arbitrary data with p… |
CVE-2015-1817 | Critical | 9.8 | 2017-08-18 | Stack-based buffer overflow in the inet_pton function in network/inet_pton.c in musl libc 0.9.15 through 1.0.4, and 1.1.0 through 1.1.7 allows attackers to hav… |
CVE-2015-3616 | Critical | 9.8 | 2017-08-11 | SQL injection vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote attackers to execute arbitrary commands via unspecif… |
CVE-2015-3615 | Medium | 5.4 | 2017-08-11 | Cross-site scripting (XSS) vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote authenticated users to inject arbitrary… |
CVE-2015-3614 | High | 7.5 | 2017-08-11 | Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote attackers to obtain arbitrary files via vectors involving another unspecified vulne… |
CVE-2015-3156 | Medium | 5.5 | 2017-08-11 | The _write_config function in trove/guestagent/datastore/experimental/mongodb/service.py, reset_configuration function in trove/guestagent/datastore/experiment… |
CVE-2015-1783 | High | 7.5 | 2017-08-11 | The prefix variable in the get_or_define_ns function in Lasso before commit 6d854cef4211cdcdbc7446c978f23ab859847cdd allows remote attackers to cause a denial… |
CVE-2015-7894 | High | 8.8 | 2017-08-09 | The DCMProvider service in Samsung LibQjpeg on a Samsung SM-G925V device running build number LRX22G.G925VVRU1AOE2 allows remote attackers to cause a denial of… |
CVE-2015-6816 | Critical | 9.8 | 2017-08-09 | ganglia-web before 3.7.1 allows remote attackers to bypass authentication. |
CVE-2015-6498 | High | 7.5 | 2017-08-09 | Alcatel-Lucent Home Device Manager before 4.1.10, 4.2.x before 4.2.2 allows remote attackers to spoof and make calls as target devices. |
CVE-2015-3277 | High | 7.5 | 2017-08-09 | The mod_nss module before 1.0.11 in Fedora allows remote attackers to obtain cipher lists due to incorrect parsing of multi-keyword cipherstring. |
CVE-2015-2687 | Medium | 4.7 | 2017-08-09 | OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local users to access VM volumes that they would normally not have permissi… |
CVE-2015-2674 | Medium | 5.9 | 2017-08-09 | Restkit allows man-in-the-middle attackers to spoof TLS servers by leveraging use of the ssl.wrap_socket function in Python with the default CERT_NONE value fo… |
CVE-2015-2313 | High | 7.5 | 2017-08-09 | Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.2, when an application invokes the totalSize method on an object reader, allows remote peers to cau… |
CVE-2015-2312 | High | 7.5 | 2017-08-09 | Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service (CPU and possibly general resource consumption)… |
CVE-2015-2311 | Critical | 9.8 | 2017-08-09 | Integer underflow in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 might allow remote peers to cause a denial of service or possibly obtain sen… |
CVE-2015-2310 | Critical | 9.1 | 2017-08-09 | Integer overflow in layout.c++ in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service or possibly ob… |
CVE-2015-2291 | High | 7.8 | 2017-08-09 | (1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of se… |
CVE-2015-1820 | Critical | 9.8 | 2017-08-09 | REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by lever… |
CVE-2015-0786 | Critical | 9.8 | 2017-08-09 | Stack-based buffer overflow in the logging functionality in the Preboot Policy service in Novell ZENworks Configuration Management (ZCM) allows remote attacker… |
CVE-2015-0785 | High | 7.5 | 2017-08-09 | com.novell.zenworks.inventory.rtr.actionclasses.wcreports in Novell ZENworks Configuration Management (ZCM) allows remote attackers to read arbitrary folders v… |
CVE-2015-0784 | High | 7.5 | 2017-08-09 | Rtrlet.class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to obtain Session IDs of logged in users via a value of ShowLogins for t… |
CVE-2015-0783 | Medium | 6.5 | 2017-08-09 | The FileViewer class in Novell ZENworks Configuration Management (ZCM) allows remote authenticated users to read arbitrary files via the filename variable. |
CVE-2015-0782 | Critical | 9.8 | 2017-08-09 | SQL injection vulnerability in the ScheduleQuery method of the schedule class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to exec… |
CVE-2015-0781 | Critical | 9.8 | 2017-08-09 | Directory traversal vulnerability in the doPost method of the Rtrlet class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to upload… |
CVE-2015-0780 | Critical | 9.8 | 2017-08-09 | SQL injection vulnerability in the GetReRequestData method of the GetStoredResult class in Novell ZENworks Configuration Management (ZCM) allows remote attacke… |
CVE-2015-7764 | High | 7.5 | 2017-08-09 | Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode. |
CVE-2015-6941 | Critical | 9.8 | 2017-08-09 | win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs. |
CVE-2015-5619 | Medium | 5.9 | 2017-08-09 | Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumberjack output or the Logstash forwarder does not validate SSL/TLS certificates from the Logstash se… |
CVE-2015-4165 | High | 7.5 | 2017-08-09 | The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code from them, is accessib… |
CVE-2015-3405 | High | 7.5 | 2017-08-09 | ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest… |
CVE-2015-7871 | Critical | 9.8 | 2017-08-07 | Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication. |
CVE-2015-7855 | Medium | 6.5 | 2017-08-07 | The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure)… |
CVE-2015-7854 | High | 8.8 | 2017-08-07 | Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a deni… |
CVE-2015-7853 | Critical | 9.8 | 2017-08-07 | The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitrary code or cause a… |
CVE-2015-7852 | Medium | 5.9 | 2017-08-07 | ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets. |
CVE-2015-7850 | Medium | 6.5 | 2017-08-07 | ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (infinite loop or crash) by pointing t… |
CVE-2015-7849 | High | 8.8 | 2017-08-07 | Use-after-free vulnerability in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to possibly execute arbitrary code… |
CVE-2015-7705 | Critical | 9.8 | 2017-08-07 | The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted re… |
CVE-2015-7704 | High | 7.5 | 2017-08-07 | The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted "KOD" messages. |
CVE-2015-7702 | Medium | 6.5 | 2017-08-07 | The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This… |
CVE-2015-7701 | High | 7.5 | 2017-08-07 | Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (mem… |
CVE-2015-7692 | High | 7.5 | 2017-08-07 | The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This… |
CVE-2015-7691 | High | 7.5 | 2017-08-07 | The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted… |
CVE-2015-7571 | High | 7.8 | 2017-08-07 | Unrestricted file upload vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension. |
CVE-2015-5946 | High | 7.8 | 2017-08-07 | Incomplete blacklist vulnerability in SuiteCRM 7.2.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extensi… |
CVE-2015-5244 | Critical | 9.8 | 2017-08-07 | The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions. |
CVE-2015-8621 | Medium | 5.5 | 2017-08-07 | t-coffee before 11.00.8cbe486-2 allows local users to write to ~/.t_coffee globally. |
CVE-2015-7887 | High | 8.1 | 2017-08-07 | NetApp SnapCenter Server 1.0 allows remote authenticated users to list and delete backups. |
CVE-2015-7875 | High | 7.5 | 2017-08-07 | ctools 6.x-1.x before 6.x-1.14 and 7.x-1.x before 7.x-1.8 in Drupal does not verify the "edit" permission for the "content type" plugins that are used on Panel… |
CVE-2015-7561 | Low | 3.1 | 2017-08-07 | Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image. |
CVE-2015-3839 | Medium | 5.5 | 2017-08-07 | The updateMessageStatus function in Android 5.1.1 and earlier allows local users to cause a denial of service (NULL pointer exception and process crash). |
CVE-2015-1555 | Critical | 9.1 | 2017-08-07 | Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9, 2.3.x before 2.3.4 allows remote attackers to create valid sessions without using session val… |
CVE-2015-1378 | High | 7.5 | 2017-08-07 | cmdlineopts.clp in grml-debootstrap in Debian 0.54, 0.68.x before 0.68.1, 0.7x before 0.78 is sourced without checking that the local directory is writable by… |
CVE-2015-9107 | Critical | 9.8 | 2017-08-04 | Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented… |
CVE-2015-8264 | High | 7.8 | 2017-08-02 | Untrusted search path vulnerability in F-Secure Online Scanner allows remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan… |
CVE-2015-7891 | High | 7.0 | 2017-08-02 | Race condition in the ioctl implementation in the Samsung Graphics 2D driver (aka /dev/fimg2d) in Samsung devices with Android L(5.0/5.1) allows local users to… |
CVE-2015-5203 | Medium | 5.5 | 2017-08-02 | Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted… |
CVE-2015-3642 | Medium | 5.9 | 2017-08-02 | The TLS and DTLS processing functionality in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway devices with firmware 9.x before 9.3… |
CVE-2015-2690 | Medium | 6.1 | 2017-08-02 | Multiple cross-site scripting (XSS) vulnerabilities in views/add-license-form.php in the Digium Addons module (digiumaddoninstaller) before 2.11.0.7 for FreePB… |
CVE-2015-2560 | Critical | 9.8 | 2017-08-02 | Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser oper… |
CVE-2015-1174 | Critical | 9.8 | 2017-08-02 | Session fixation vulnerability in Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 and earlier allows remote attackers to hijack web sessions via a se… |
CVE-2015-0839 | High | 8.1 | 2017-08-02 | The hp-plugin utility in HP Linux Imaging and Printing (HPLIP) makes it easier for man-in-the-middle attackers to execute arbitrary code by leveraging use of a… |
CVE-2015-0194 | Medium | 6.5 | 2017-08-02 | XML External Entity (XXE) vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and IBM Sterling File Gateway 2.1 and 2.2 allows remote attackers to read ar… |
CVE-2015-5059 | Medium | 5.3 | 2017-08-01 | The "Project Documentation" feature in MantisBT 1.2.19 and earlier, when the threshold to access files ($g_view_proj_doc_threshold) is set to ANYBODY, allows r… |
CVE-2015-5191 | Medium | 6.7 | 2017-07-28 | VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of… |
CVE-2015-8013 | High | 7.5 | 2017-07-25 | s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if me… |
CVE-2015-6585 | High | 7.8 | 2017-07-25 | hwpapp.dll in Hangul Word Processor allows remote attackers to execute arbitrary code via a crafted heap spray, and by leveraging a "type confusion" via an HWP… |
CVE-2015-5594 | Medium | 6.1 | 2017-07-25 | The sanitize_string function in ZenPhoto before 1.4.9 utilized the html_entity_decode function after input sanitation, which might allow remote attackers to pe… |
CVE-2015-5221 | Medium | 5.5 | 2017-07-25 | Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers… |
CVE-2015-5187 | Medium | 6.5 | 2017-07-25 | Candlepin allows remote attackers to obtain sensitive information by obtaining Java exception statements as a result of excessive web traffic. |
CVE-2015-4463 | Medium | 6.5 | 2017-07-25 | The file_manager component in eFront CMS before 3.6.15.5 allows remote authenticated users to bypass intended file-upload restrictions by appending a crafted p… |
CVE-2015-4462 | Medium | 6.5 | 2017-07-25 | Absolute path traversal vulnerability in the file_manager component of eFront CMS before 3.6.15.5 allows remote authenticated users to read arbitrary files via… |
CVE-2015-4035 | High | 7.8 | 2017-07-25 | scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process file names containing semicolons, which allows remote attackers to execu… |
CVE-2015-3278 | Critical | 9.8 | 2017-07-25 | The cipherstring parsing code in nss_compat_ossl while in multi-keyword mode does not match the expected set of ciphers for a given cipher combination, which a… |
CVE-2015-3243 | Medium | 5.5 | 2017-07-25 | rsyslog uses weak permissions for generating log files, which allows local users to obtain sensitive information by reading files in /var/log/cron. |
CVE-2015-3171 | Medium | 5.5 | 2017-07-25 | sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive information by read… |
CVE-2015-3149 | Medium | 5.5 | 2017-07-25 | The Hotspot component in OpenJDK8 as packaged in Red Hat Enterprise Linux 6 and 7 allows local users to write to arbitrary files via a symlink attack. |
CVE-2015-2798 | Critical | 9.8 | 2017-07-25 | SQL injection vulnerability in Joomla! Component Contact Form Maker 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
CVE-2015-1438 | High | 7.8 | 2017-07-25 | Heap-based buffer overflow in Panda Security Kernel Memory Access Driver 1.0.0.13 allows attackers to execute arbitrary code with kernel privileges via a craft… |
CVE-2015-1417 | High | 7.5 | 2017-07-25 | The inet module in FreeBSD 10.2x before 10.2-PRERELEASE, 10.2-BETA2-p2, 10.2-RC1-p1, 10.1x before 10.1-RELEASE-p16, 9.x before 9.3-STABLE, 9.3-RELEASE-p21, and… |
CVE-2015-1332 | High | 8.8 | 2017-07-25 | The oxide::JavaScriptDialogManager function in oxide-qt before 1.9.1 as packaged in Ubuntu 15.04 and Ubuntu 14.04 allows remote attackers to cause a denial of… |
CVE-2015-0904 | Medium | 5.9 | 2017-07-25 | The Restaurant Karaoke SHIDAX app 1.3.3 and earlier on Android does not verify SSL certificates, which allows remote attackers to obtain sensitive information… |
CVE-2015-0674 | Medium | 6.1 | 2017-07-25 | Cross-site scripting (XSS) vulnerability in the Alert Service of Cisco Cloud Web Security base revision allows remote attackers to inject arbitrary web script… |
CVE-2015-8009 | Critical | 9.8 | 2017-07-25 | The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11 does not properly v… |
CVE-2015-7543 | High | 7.0 | 2017-07-25 | aRts 1.5.10 and kdelibs3 3.5.10 and earlier do not properly create temporary directories, which allows local users to hijack the IPC by pre-creating the tempor… |
CVE-2015-2280 | High | 8.8 | 2017-07-25 | snwrite.cgi in AirLink101 SkyIPCam1620W Wireless N MPEG4 3GPP network camera with firmware FW_AIC1620W_1.1.0-12_20120709_r1192.pck allows remote authenticated… |
CVE-2015-2279 | Critical | 9.8 | 2017-07-25 | cgi_test.cgi in AirLive BU-2015 with firmware 1.03.18, BU-3026 with firmware 1.43, and MD-3025 with firmware 1.81 allows remote attackers to execute arbitrary… |
CVE-2015-1847 | High | 7.5 | 2017-07-25 | Directory traversal vulnerability in the web request/response interface in Appserver before 1.0.3 allows remote attackers to read normally inaccessible files v… |
CVE-2015-7703 | High | 7.5 | 2017-07-24 | The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allow… |
CVE-2015-5300 | High | 7.5 | 2017-07-21 | The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, whi… |
CVE-2015-5219 | High | 7.5 | 2017-07-21 | The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attac… |