2015 CVEs (page 16)
Page 16 of 82 — CVEs published in 2015, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-3189 | Low | 3.7 | 2017-05-25 | With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions 2.2.5 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier, ol… |
CVE-2015-1834 | Medium | 6.5 | 2017-05-25 | A path traversal vulnerability was identified in the Cloud Foundry component Cloud Controller that affects cf-release versions prior to v208 and Pivotal Cloud… |
CVE-2015-8477 | Medium | 6.1 | 2017-05-23 | Cross-site scripting (XSS) vulnerability in Redmine before 2.6.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving flash mes… |
CVE-2015-8089 | High | 7.8 | 2017-05-23 | The GPU driver in Huawei P7 phones with software P7-L00 before P7-L00C17B851, P7-L05 before P7-L05C00B851, and P7-L09 before P7-L09C92B851 allows local users t… |
CVE-2015-6817 | High | 8.1 | 2017-05-23 | PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username. |
CVE-2015-6586 | High | 7.5 | 2017-05-23 | The mDNS module in Huawei WLAN AC6005, AC6605, and ACU2 devices with software before V200R006C00SPC100 allows remote attackers to obtain sensitive information… |
CVE-2015-5682 | High | 7.5 | 2017-05-23 | upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to create arbitrary directories via vectors related to the targetDir varia… |
CVE-2015-5609 | Critical | 9.1 | 2017-05-23 | Absolute path traversal vulnerability in the Image Export plugin 1.1 for WordPress allows remote attackers to read and delete arbitrary files via a full pathna… |
CVE-2015-5469 | High | 7.5 | 2017-05-23 | Absolute path traversal vulnerability in the MDC YouTube Downloader plugin 2.1.0 for WordPress allows remote attackers to read arbitrary files via a full pathn… |
CVE-2015-5468 | High | 7.5 | 2017-05-23 | Directory traversal vulnerability in the WP e-Commerce Shop Styling plugin before 2.6 for WordPress allows remote attackers to read arbitrary files via a .. (d… |
CVE-2015-5401 | High | 7.5 | 2017-05-23 | Teradata Gateway before 15.00.03.02-1 and 15.10.x before 15.10.00.01-1 and TD Express before 15.00.02.08_Sles10 and 15.00.02.08_Sles11 allow remote attackers t… |
CVE-2015-5383 | High | 7.5 | 2017-05-23 | Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs director… |
CVE-2015-5382 | Medium | 6.5 | 2017-05-23 | program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the… |
CVE-2015-5381 | Medium | 6.1 | 2017-05-23 | Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web… |
CVE-2015-4704 | High | 7.5 | 2017-05-23 | Directory traversal vulnerability in the Download Zip Attachments plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) i… |
CVE-2015-4455 | Critical | 9.8 | 2017-05-23 | Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote a… |
CVE-2015-4054 | High | 7.5 | 2017-05-23 | PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by sending a password packet before a startup… |
CVE-2015-4046 | High | 7.2 | 2017-05-23 | The asset discovery scanner in AlienVault OSSIM before 5.0.1 allows remote authenticated users to execute arbitrary commands via the assets array parameter to… |
CVE-2015-4045 | Medium | 6.7 | 2017-05-23 | The sudoers file in the asset discovery scanner in AlienVault OSSIM before 5.0.1 allows local users to gain privileges via a crafted nmap script. |
CVE-2015-1529 | High | 7.5 | 2017-05-23 | Integer overflow in soundtrigger/ISoundTriggerHwService.cpp in Android allows attacks to cause a denial of service via unspecified vectors. |
CVE-2015-5241 | Medium | 6.1 | 2017-05-19 | After logging into the portal, the logout jsp page redirects the browser back to the login page after. It is feasible for malicious users to redirect the brows… |
CVE-2015-4070 | Medium | 6.1 | 2017-05-17 | Open redirect vulnerability in the proxyimages function in wowproxy.php in the Wow Moodboard Lite plugin 1.1.1.1 for WordPress allows remote attackers to redir… |
CVE-2015-3998 | Medium | 6.1 | 2017-05-17 | Cross-site scripting (XSS) vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows remote attackers t… |
CVE-2015-9003 | High | 7.8 | 2017-05-16 | In TrustZone a cryptographic issue can potentially occur in all Android releases from CAF using the Linux kernel. |
CVE-2015-9002 | High | 7.8 | 2017-05-16 | In TrustZone an out-of-range pointer offset vulnerability can potentially occur in a DRM routine in all Android releases from CAF using the Linux kernel. |
CVE-2015-9001 | Medium | 5.5 | 2017-05-16 | In TrustZone an information exposure vulnerability can potentially occur in all Android releases from CAF using the Linux kernel. |
CVE-2015-9000 | High | 7.8 | 2017-05-16 | In TrustZone an untrusted pointer dereference vulnerability can potentially occur in a DRM routine in all Android releases from CAF using the Linux kernel. |
CVE-2015-8999 | High | 7.8 | 2017-05-16 | In TrustZone a buffer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel while loading an ELF file. |
CVE-2015-8998 | High | 7.8 | 2017-05-16 | In TrustZone an integer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel. |
CVE-2015-8997 | High | 7.0 | 2017-05-16 | In TrustZone a time-of-check time-of-use race condition could potentially exist in a listener routine in all Android releases from CAF using the Linux kernel. |
CVE-2015-8996 | High | 7.0 | 2017-05-16 | In TrustZone a time-of-check time-of-use race condition could potentially exist in a QFPROM routine in all Android releases from CAF using the Linux kernel. |
CVE-2015-8995 | High | 7.8 | 2017-05-16 | In TrustZone an integer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel. |
CVE-2015-5436 | High | 7.5 | 2017-05-11 | A potential security vulnerability has been identified with HP Integrated Lights-Out 4 (iLO 4) firmware version 2.11 and later, but prior to version 2.30. The… |
CVE-2015-9058 | Medium | 6.1 | 2017-05-03 | Open redirect vulnerability in Proxmox Mail Gateway prior to hotfix 4.0-8-097d26a9 allows remote attackers to redirect users to arbitrary web sites and conduct… |
CVE-2015-9057 | Medium | 6.1 | 2017-05-03 | Multiple cross-site scripting (XSS) vulnerabilities in Proxmox Mail Gateway prior to hotfix 4.0-8-097d26a9 allow remote attackers to inject arbitrary web scrip… |
CVE-2015-9004 | High | 7.8 | 2017-05-02 | kernel/events/core.c in the Linux kernel before 3.19 mishandles counter grouping, which allows local users to gain privileges via a crafted application, relate… |
CVE-2015-8257 | High | 8.8 | 2017-05-02 | The devtools.sh script in AXIS network cameras allows remote authenticated users to execute arbitrary commands via shell metacharacters in the app parameter to… |
CVE-2015-7570 | High | 7.2 | 2017-04-24 | Multiple server-side request forgery (SSRF) vulnerabilities in Yeager CMS 1.2.1 allow remote attackers to trigger outbound requests and enumerate open ports vi… |
CVE-2015-7569 | High | 8.8 | 2017-04-24 | SQL injection vulnerability in "yeager/y.php/tab_USERLIST" in Yeager CMS 1.2.1 allows local users to execute arbitrary SQL commands via the "pagedir_orderby" p… |
CVE-2015-7568 | Critical | 9.8 | 2017-04-24 | SQL injection vulnerability in the password recovery feature in Yeager CMS 1.2.1 allows remote attackers to change the account credentials of known users via t… |
CVE-2015-7247 | Critical | 9.8 | 2017-04-24 | D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 discloses usernames, passwords, keys, values, and web account hashes (super and admin) i… |
CVE-2015-7246 | Critical | 9.8 | 2017-04-24 | D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root account and tw for the tw account, which mak… |
CVE-2015-7245 | High | 7.5 | 2017-04-24 | Directory traversal vulnerability in D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 allows remote attackers to read sensitive informati… |
CVE-2015-8110 | High | 7.8 | 2017-04-24 | Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0019 allows local users to gain privileges by navigating to (1) "Click here to learn mor… |
CVE-2015-8109 | High | 7.0 | 2017-04-24 | Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0019 allows local users to gain privileges by making a prediction of tvsu_tmp_xxxxxXXXXX… |
CVE-2015-1522 | High | 7.5 | 2017-04-24 | analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not reject certain non-zero values of a packet length, which allows remote attackers to cause a denial… |
CVE-2015-1521 | High | 7.5 | 2017-04-24 | analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not properly handle zero values of a packet length, which allows remote attackers to cause a denial of… |
CVE-2015-0107 | Medium | 6.5 | 2017-04-24 | IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7.1 through 7.1.1.8 and 7.2 and Maximo… |
CVE-2015-0104 | High | 8.8 | 2017-04-24 | IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7.1 through 7.1.1.8 and 7.2 and Maximo… |
CVE-2015-8285 | High | 7.5 | 2017-04-20 | The webssx.sys driver in QuickHeal 16.00 allows remote attackers to cause a denial of service. |
CVE-2015-8959 | Medium | 6.5 | 2017-04-20 | coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (CPU consumption) via a crafted DDS file. |
CVE-2015-8958 | Medium | 6.5 | 2017-04-20 | coders/sun.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted S… |
CVE-2015-8957 | Medium | 6.5 | 2017-04-20 | Buffer overflow in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (application crash) via a crafted SUN file. |
CVE-2015-8256 | Medium | 6.1 | 2017-04-17 | Multiple cross-site scripting (XSS) vulnerabilities in Axis network cameras. |
CVE-2015-6568 | High | 8.8 | 2017-04-14 | Wolf CMS before 0.8.3.1 allows unrestricted file rename and PHP Code Execution because admin/plugin/file_manager/browse/ (aka the filemanager) does not prevent… |
CVE-2015-6567 | High | 8.8 | 2017-04-14 | Wolf CMS before 0.8.3.1 allows unrestricted file upload and PHP Code Execution because admin/plugin/file_manager/browse/ (aka the filemanager) does not validat… |
CVE-2015-8356 | High | 8.0 | 2017-04-14 | Multiple SQL injection vulnerabilities in the mcart.xls module 6.5.2 and earlier for Bitrix allow remote authenticated users to execute arbitrary SQL commands… |
CVE-2015-8619 | High | 7.5 | 2017-04-13 | The Human Monitor Interface support in QEMU allows remote attackers to cause a denial of service (out-of-bounds write and application crash). |
CVE-2015-8567 | High | 7.7 | 2017-04-13 | Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption). |
CVE-2015-8345 | Medium | 6.5 | 2017-04-13 | The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving… |
CVE-2015-4646 | High | 7.5 | 2017-04-13 | (1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service (appli… |
CVE-2015-2947 | Critical | 9.1 | 2017-04-13 | KanColleViewer versions 3.8.1 and earlier operates as an open proxy which allows remote attackers to trigger outbound network traffic. |
CVE-2015-8780 | Medium | 6.4 | 2017-04-13 | Samsung wssyncmlnps before 2015-10-31 allows directory traversal in a Kies restore, aka ZipFury. |
CVE-2015-8864 | Medium | 6.1 | 2017-04-13 | Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTM… |
CVE-2015-8284 | High | 8.8 | 2017-04-13 | SeaWell Networks Spectrum SDC 02.05.00 allows remote viewer users to perform administrative functions. |
CVE-2015-8283 | Medium | 6.5 | 2017-04-13 | Directory traversal vulnerability in configure_manage.php in SeaWell Networks Spectrum SDC 02.05.00. |
CVE-2015-8282 | Critical | 9.8 | 2017-04-13 | SeaWell Networks Spectrum SDC 02.05.00 has a default password of "admin" for the "admin" account. |
CVE-2015-8272 | Medium | 6.5 | 2017-04-13 | RTMPDump 2.4 allows remote attackers to trigger a denial of service (NULL pointer dereference and process crash). |
CVE-2015-8271 | Critical | 9.8 | 2017-04-13 | The AMF3CD_AddProp function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to execute arbitrary code. |
CVE-2015-8270 | High | 7.5 | 2017-04-13 | The AMF3ReadString function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to cause a denial of service (invalid pointer dereference and process cra… |
CVE-2015-8223 | Medium | 5.5 | 2017-04-13 | Huawei P7 before P7-L00C17B851, P7-L05C00B851, and P7-L09C92B85, and P8 ALE-UL00 before ALE-UL00B211 allows local users to cause a denial of service (OS crash)… |
CVE-2015-8107 | High | 7.8 | 2017-04-13 | Format string vulnerability in GNU a2ps 4.14 allows remote attackers to execute arbitrary code. |
CVE-2015-7740 | Medium | 5.5 | 2017-04-13 | Huawei P7 before P7-L00C17B851, P7-L05C00B851, and P7-L09C92B851 and P8 ALE-UL00 before ALE-UL00B211 allows local users to cause a denial of service (OS crash)… |
CVE-2015-7565 | Medium | 6.1 | 2017-04-13 | Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12, 2.0.x before 2.0… |
CVE-2015-6674 | Critical | 9.8 | 2017-04-13 | Buffer underflow vulnerability in the Debian inspircd package before 2.0.5-1+deb7u1 for wheezy and before 2.0.16-1 for jessie and sid. NOTE: This issue exists… |
CVE-2015-1839 | Medium | 5.3 | 2017-04-13 | modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp. |
CVE-2015-1838 | Medium | 5.3 | 2017-04-13 | modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp. |
CVE-2015-7564 | Critical | 9.8 | 2017-04-12 | Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an a… |
CVE-2015-7563 | High | 8.8 | 2017-04-12 | Cross-site request forgery (CSRF) vulnerability in TeamPass 2.1.24 and earlier allows remote attackers to hijack the authentication of an authenticated user. |
CVE-2015-7562 | Medium | 6.1 | 2017-04-12 | Multiple cross-site scripting (XSS) vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) la… |
CVE-2015-8666 | High | 7.9 | 2017-04-11 | Heap-based buffer overflow in QEMU, when built with the Q35-chipset-based PC system emulator. |
CVE-2015-8613 | Medium | 6.5 | 2017-04-11 | Stack-based buffer overflow in the megasas_ctrl_get_info function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows local guest users to… |
CVE-2015-8568 | Medium | 6.5 | 2017-04-11 | Memory leak in QEMU, when built with a VMWARE VMXNET3 paravirtual NIC emulator support, allows local guest users to cause a denial of service (host memory cons… |
CVE-2015-8504 | Medium | 6.5 | 2017-04-11 | Qemu, when built with VNC display driver support, allows remote attackers to cause a denial of service (arithmetic exception and application crash) via crafted… |
CVE-2015-7893 | High | 8.8 | 2017-04-11 | SecEmailUI in Samsung Galaxy S6 does not sanitize HTML email content, allows remote attackers to execute arbitrary JavaScript. |
CVE-2015-7826 | Critical | 9.8 | 2017-04-10 | botan 1.11.x before 1.11.22 improperly handles wildcard matching against hostnames, which might allow remote attackers to have unspecified impact via a valid X… |
CVE-2015-7825 | High | 7.5 | 2017-04-10 | botan before 1.11.22 improperly validates certificate paths, which allows remote attackers to cause a denial of service (infinite loop and memory consumption)… |
CVE-2015-7824 | High | 7.5 | 2017-04-10 | botan 1.11.x before 1.11.22 makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle attack against TLS CBC ciphersuites. |
CVE-2015-8378 | High | 7.5 | 2017-04-10 | In KeePassX before 0.4.4, a cleartext copy of password data is created upon a cancel of an XML export action. This allows context-dependent attackers to obtain… |
CVE-2015-8276 | Medium | 5.5 | 2017-04-10 | LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 allow attackers to read arbitrary files via crafted EDOC files. |
CVE-2015-8275 | Medium | 5.5 | 2017-04-10 | LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 allow attackers to write to arbitrary files via crafted EDOC files. |
CVE-2015-8258 | High | 7.5 | 2017-04-10 | AXIS Communications products with firmware through 5.80.x allow remote attackers to modify arbitrary files as root via vectors involving Open Script Editor, ak… |
CVE-2015-8255 | High | 8.8 | 2017-04-10 | AXIS Communications products allow CSRF, as demonstrated by admin/pwdgrp.cgi, vaconfig.cgi, and admin/local_del.cgi. |
CVE-2015-7292 | Critical | 9.8 | 2017-04-10 | Stack-based buffer overflow in the havok_write function in drivers/staging/havok/havok.c in Amazon Fire OS before 2016-01-15 allows attackers to cause a denial… |
CVE-2015-7275 | Medium | 6.1 | 2017-04-10 | Dell Integrated Remote Access Controller (iDRAC) 6 before 2.85 and 7/8 before 2.30.30.30 has XSS. |
CVE-2015-7274 | High | 8.8 | 2017-04-10 | Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 allows remote attackers to execute arbitrary administrative HTTP commands. |
CVE-2015-7273 | Critical | 9.8 | 2017-04-10 | Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has XXE. |
CVE-2015-7272 | Critical | 9.8 | 2017-04-10 | Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows attackers to cause a denial of service (buffer overflow) or pos… |
CVE-2015-7271 | Critical | 9.8 | 2017-04-10 | Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has a format string issue in racadm getsystinfo. |
CVE-2015-7270 | High | 7.8 | 2017-04-10 | Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows directory traversal. |