2015 CVEs (page 15)
Page 15 of 82 — CVEs published in 2015, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-5195 | High | 7.5 | 2017-07-21 | ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen co… |
CVE-2015-5194 | High | 7.5 | 2017-07-21 | The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted lo… |
CVE-2015-4639 | High | 8.8 | 2017-07-21 | Cross-site scripting (XSS) vulnerability in opac-addbybiblionumber.pl in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, and 3.20.x before 3.20.1 allows rem… |
CVE-2015-3932 | High | 7.8 | 2017-07-21 | Netlock Mokka before 2.7.8.1204 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a cr… |
CVE-2015-3931 | High | 7.8 | 2017-07-21 | Microsec e-Szigno before 3.2.7.12 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a… |
CVE-2015-3886 | Critical | 9.8 | 2017-07-21 | libinfinity before 0.6.6-1 does not validate expired SSL certificates, which allows remote attackers to have unspecified impact via unknown vectors. |
CVE-2015-3640 | High | 7.5 | 2017-07-21 | phpMyBackupPro 2.5 and earlier does not properly escape the "." character in request parameters, which allows remote authenticated users with knowledge of a we… |
CVE-2015-3639 | High | 8.8 | 2017-07-21 | phpMyBackupPro 2.5 and earlier does not properly sanitize input strings, which allows remote authenticated users to execute arbitrary PHP code by storing a cra… |
CVE-2015-3638 | High | 8.8 | 2017-07-21 | phpMyBackupPro before 2.5 does not validate integer input, which allows remote authenticated users to execute arbitrary PHP code by injecting scripts via the p… |
CVE-2015-3421 | Medium | 6.1 | 2017-07-21 | The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart" HTTP cookie, which… |
CVE-2015-3198 | High | 7.5 | 2017-07-21 | The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a JSP page via a "/" at… |
CVE-2015-3170 | Medium | 5.5 | 2017-07-21 | selinux-policy when sysctl fs.protected_hardlinks are set to 0 allows local users to cause a denial of service (SSH login prevention) by creating a hardlink to… |
CVE-2015-1323 | Medium | 5.5 | 2017-07-21 | The simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 as packaged in Ubuntu 15.04, before 1.1.1+bzr980-0ubuntu1.1 as packaged in Ubuntu 14.10, b… |
CVE-2015-5152 | High | 8.1 | 2017-07-17 | Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the require_ssl setting is set to true, which allows remote attackers to o… |
CVE-2015-0249 | High | 7.2 | 2017-07-17 | The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code… |
CVE-2015-3297 | High | 7.5 | 2017-07-07 | Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by leveraging replace… |
CVE-2015-9105 | Medium | 5.4 | 2017-06-30 | Multiple cross-site scripting (XSS) vulnerabilities in Synology Video Station 1.2 before 1.2-0455, 1.5 before 1.5-0772, and 1.6 before 1.6-0847 allow remote au… |
CVE-2015-9104 | Medium | 5.4 | 2017-06-30 | Cross-site scripting (XSS) vulnerabilities in Synology Audio Station 5.1 before 5.1-2550 and 5.4 before 5.4-2857 allows remote authenticated attackers to injec… |
CVE-2015-9103 | Medium | 5.4 | 2017-06-30 | Multiple cross-site scripting (XSS) vulnerabilities in Synology Note Station 1.1-0212 and earlier allow remote authenticated attackers to inject arbitrary web… |
CVE-2015-9102 | Medium | 5.4 | 2017-06-30 | Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers… |
CVE-2015-8697 | Medium | 5.5 | 2017-06-27 | stalin 0.11-5 allows local users to write to arbitrary files. |
CVE-2015-7898 | Medium | 5.5 | 2017-06-27 | Samsung Gallery in the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). |
CVE-2015-7895 | Medium | 5.5 | 2017-06-27 | Samsung Gallery on the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). |
CVE-2015-7781 | High | 7.5 | 2017-06-27 | ManageEngine Firewall Analyzer before 8.0 does not restrict access permissions. |
CVE-2015-7780 | Medium | 6.5 | 2017-06-27 | Directory traversal vulnerability in ManageEngine Firewall Analyzer before 8.0. |
CVE-2015-5378 | High | 7.5 | 2017-06-27 | Logstash 1.5.x before 1.5.3 and 1.4.x before 1.4.4 allows remote attackers to read communications between Logstash Forwarder agent and Logstash server. |
CVE-2015-5180 | High | 7.5 | 2017-06-27 | res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash). |
CVE-2015-3840 | Medium | 5.5 | 2017-06-27 | The MessageStatusReceiver service in the AndroidManifest.XML in Android 5.1.1 and earlier allows local users to alter sent/received statuses of SMS and MMS mes… |
CVE-2015-2245 | High | 7.5 | 2017-06-27 | Huawei Ascend P7 allows remote attackers to cause a denial of service (phone process crash). |
CVE-2015-1795 | High | 7.8 | 2017-06-27 | Red Hat Gluster Storage RPM Package 3.2 allows local users to gain privileges and execute arbitrary code as root. |
CVE-2015-1778 | Critical | 9.8 | 2017-06-27 | The custom authentication realm used by karaf-tomcat's "opendaylight" realm in Opendaylight before Helium SR3 will authenticate any username and password combi… |
CVE-2015-1591 | High | 7.8 | 2017-06-27 | The kamailio build in kamailio before 4.2.0-2 process allows local users to gain privileges. |
CVE-2015-3315 | High | 7.8 | 2017-06-26 | Automatic Bug Reporting Tool (ABRT) allows local users to read, change the ownership of, or have other unspecified impact on arbitrary files via a symlink atta… |
CVE-2015-3215 | High | 7.5 | 2017-06-26 | The NetKVM Windows Virtio driver allows remote attackers to cause a denial of service (guest crash) via a crafted length value in an IP packet, as demonstrated… |
CVE-2015-3142 | Medium | 4.7 | 2017-06-26 | The kernel-invoked coredump processor in Automatic Bug Reporting Tool (ABRT) does not properly check the ownership of files before writing core dumps to them… |
CVE-2015-1870 | Medium | 5.5 | 2017-06-26 | The event scripts in Automatic Bug Reporting Tool (ABRT) uses world-readable permission on a copy of sosreport file in problem directories, which allows local… |
CVE-2015-9101 | Medium | 5.5 | 2017-06-25 | The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.98.4, 3.98.2, 3.98, 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4 and 3.99.5 allows remote attacke… |
CVE-2015-9100 | Medium | 5.5 | 2017-06-25 | The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a denial of service (NULL pointer dereference and a… |
CVE-2015-9099 | Medium | 5.5 | 2017-06-25 | The lame_init_params function in lame.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid read and application crash… |
CVE-2015-9098 | Critical | 9.8 | 2017-06-22 | In Redgate SQL Monitor before 3.10 and 4.x before 4.2, a remote attacker can gain unauthenticated access to the Base Monitor, resulting in the ability to execu… |
CVE-2015-3254 | Medium | 6.5 | 2017-06-16 | The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involvi… |
CVE-2015-9056 | Medium | 6.1 | 2017-06-16 | Kibana versions prior to 4.1.3 and 4.2.1 are vulnerable to a XSS attack. |
CVE-2015-7732 | High | 7.5 | 2017-06-15 | The Avira Mobile Security app before 1.5.11 for iOS sends sensitive login information in cleartext. |
CVE-2015-9033 | High | 7.8 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, a QTEE system call fails to validate a pointer. |
CVE-2015-9032 | Low | 3.3 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, a DRM key was exposed to QTEE applications. |
CVE-2015-9031 | Low | 3.3 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, a TZ memory address is exposed to HLOS by HDCP. |
CVE-2015-9030 | High | 7.8 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, the Hypervisor API could be misused to bypass authentication. |
CVE-2015-9029 | High | 7.8 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, a vulnerability exists in the access control settings of modem memory. |
CVE-2015-9028 | High | 7.8 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a cryptographic routine. |
CVE-2015-9027 | High | 7.8 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, an untrusted pointer dereference vulnerability exists in WideVine DRM. |
CVE-2015-9026 | High | 7.8 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, an untrusted pointer dereference vulnerability exists in WideVine DRM. |
CVE-2015-9025 | High | 7.8 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a QTEE application. |
CVE-2015-9024 | Medium | 5.5 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, some interfaces were improperly exposed to QTEE applications. |
CVE-2015-9023 | High | 7.8 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in the PlayReady API. |
CVE-2015-9022 | High | 7.0 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, time-of-check Time-of-use (TOCTOU) Race Conditions exist in several TZ APIs. |
CVE-2015-9021 | Medium | 5.5 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, access control to SMEM memory was not enabled. |
CVE-2015-9020 | High | 7.8 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, an untrusted pointer dereference vulnerability exists in the unlocking of memory. |
CVE-2015-4596 | High | 7.8 | 2017-06-13 | Lenovo Mouse Suite before 6.73 allows local users to run arbitrary code with administrator privileges. |
CVE-2015-3220 | High | 7.5 | 2017-06-13 | The tlslite library before 0.4.9 for Python allows remote attackers to trigger a denial of service (runtime exception and process crash). |
CVE-2015-9097 | Medium | 6.1 | 2017-06-12 | The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM comman… |
CVE-2015-9096 | Medium | 6.1 | 2017-06-12 | Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences… |
CVE-2015-3913 | High | 7.5 | 2017-06-08 | The IP stack in multiple Huawei Campus series switch models allows remote attackers to cause a denial of service (reboot) via a crafted ICMP request message. |
CVE-2015-3634 | High | 7.5 | 2017-06-08 | The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for Wordpress allows remote attackers to rea… |
CVE-2015-2692 | Critical | 10.0 | 2017-06-08 | AdBlock before 2.21 allows remote attackers to block arbitrary resources on arbitrary websites and to disable arbitrary blocking filters. |
CVE-2015-1786 | High | 8.8 | 2017-06-08 | Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers. |
CVE-2015-1588 | Medium | 6.1 | 2017-06-08 | Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange Server 6 and OX AppSuite before 7.4.2-rev43, 7.6.0-rev38, and 7.6.1-rev21. |
CVE-2015-1379 | High | 7.5 | 2017-06-08 | The signal handler implementations in socat before 1.7.3.0 and 2.0.0-b8 allow remote attackers to cause a denial of service (process freeze or crash). |
CVE-2015-2800 | High | 7.5 | 2017-06-08 | The user authentication module in Huawei Campus switches S5700, S5300, S6300, and S6700 with software before V200R001SPH012 and S7700, S9300, and S9700 with so… |
CVE-2015-2255 | Medium | 5.9 | 2017-06-08 | Huawei AR1220 routers with software before V200R005SPH006 allow remote attackers to cause a denial of service (board reset) via vectors involving a large amoun… |
CVE-2015-2253 | Medium | 5.0 | 2017-06-08 | The XML interface in Huawei OceanStor UDS devices with software before V100R002C01SPC102 allows remote authenticated users to obtain sensitive information via… |
CVE-2015-2252 | High | 8.8 | 2017-06-08 | Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to execute arbitrary code with root privileges via a crafted U… |
CVE-2015-2251 | High | 7.5 | 2017-06-08 | The DeviceManager in Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to obtain sensitive information via a cra… |
CVE-2015-7346 | Critical | 9.8 | 2017-06-07 | SQL injection vulnerability in ZCMS 1.1. |
CVE-2015-3295 | Medium | 5.3 | 2017-06-07 | markdown-it before 4.1.0 does not block data: URLs. |
CVE-2015-8538 | Medium | 6.5 | 2017-06-07 | dwarf_leb.c in libdwarf allows attackers to cause a denial of service (SIGSEGV). |
CVE-2015-8235 | High | 7.5 | 2017-06-07 | Directory traversal vulnerability in Spiffy before 5.4. |
CVE-2015-6959 | Medium | 5.4 | 2017-06-07 | Cross-site scripting (XSS) vulnerability in Vindula 1.9. |
CVE-2015-6540 | Medium | 6.1 | 2017-06-07 | Cross-site scripting (XSS) vulnerability in Intellect Design Arena Intellect Core banking software. |
CVE-2015-6240 | High | 7.8 | 2017-06-07 | The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink attack. |
CVE-2015-5232 | High | 8.1 | 2017-06-07 | Race conditions in opa-fm before 10.4.0.0.196 and opa-ff before 10.4.0.0.197. |
CVE-2015-5175 | High | 7.5 | 2017-06-07 | Application plugins in Apache CXF Fediz before 1.1.3 and 1.2.x before 1.2.1 allow remote attackers to cause a denial of service. |
CVE-2015-8326 | Medium | 5.5 | 2017-06-07 | The IPTables-Parse module before 1.6 for Perl allows local users to write to arbitrary files owned by the current user. |
CVE-2015-7888 | High | 7.5 | 2017-06-07 | Directory traversal vulnerability in the WifiHs20UtilityService on the Samsung S6 Edge LRX22G.G925VVRU1AOE2 allows remote attackers to overwrite or create arbi… |
CVE-2015-7724 | High | 7.8 | 2017-06-07 | AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. NOTE: This vulnerability exists due to an incomplete fix for CVE-2015… |
CVE-2015-7723 | High | 7.8 | 2017-06-07 | AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack. |
CVE-2015-7514 | Medium | 6.5 | 2017-06-07 | OpenStack Ironic 4.2.0 through 4.2.1 does not "clean" the disk after use, which allows remote authenticated users to obtain sensitive information. |
CVE-2015-7326 | Critical | 9.8 | 2017-06-07 | XML External Entity (XXE) vulnerability in Milton Webdav before 2.7.0.3. |
CVE-2015-3830 | Medium | 6.5 | 2017-06-06 | The stock Android browser address bar in all Android operating systems suffers from Address Bar Spoofing, which allows remote attackers to trick a victim by di… |
CVE-2015-1207 | Medium | 6.5 | 2017-06-06 | Double-free vulnerability in libavformat/mov.c in FFMPEG in Google Chrome 41.0.2251.0 allows remote attackers to cause a denial of service (memory corruption a… |
CVE-2015-9007 | High | 7.8 | 2017-06-06 | In TrustZone in all Android releases from CAF using the Linux kernel, a Double Free vulnerability could potentially exist. |
CVE-2015-9006 | High | 7.8 | 2017-06-06 | In Resource Power Manager (RPM) in all Android releases from CAF using the Linux kernel, an Improper Access Control vulnerability could potentially exist. |
CVE-2015-9005 | High | 7.8 | 2017-06-06 | In TrustZone in all Android releases from CAF using the Linux kernel, an Integer Overflow to Buffer Overflow vulnerability could potentially exist. |
CVE-2015-6531 | High | 7.8 | 2017-06-01 | Palo Alto Networks Panorama VM Appliance with PAN-OS before 6.0.1 might allow remote attackers to execute arbitrary Python code via a crafted firmware image fi… |
CVE-2015-5473 | Critical | 9.8 | 2017-06-01 | Multiple directory traversal vulnerabilities in Samsung SyncThru 6 before 1.0 allow remote attackers to delete arbitrary files via unspecified parameters to (1… |
CVE-2015-0936 | Critical | 9.8 | 2017-06-01 | Ceragon FibeAir IP-10 have a default SSH public key in the authorized_keys file for the mateidu user, which allows remote attackers to obtain SSH access by lev… |
CVE-2015-9059 | Critical | 9.8 | 2017-05-28 | picocom before 2.0 has a command injection vulnerability in the 'send and receive file' command because the command line is executed by /bin/sh unsafely. |
CVE-2015-0269 | Medium | 4.3 | 2017-05-26 | Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file… |
CVE-2015-5211 | Critical | 9.6 | 2017-05-25 | Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Do… |
CVE-2015-3191 | High | 8.8 | 2017-05-25 | With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the… |
CVE-2015-3190 | Medium | 6.1 | 2017-05-25 | With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the… |