2015 CVEs (page 17)
Page 17 of 82 — CVEs published in 2015, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-7265 | High | 7.5 | 2017-04-10 | Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypass ACL checks. |
CVE-2015-7264 | Critical | 9.8 | 2017-04-10 | The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows hijacking and injection attacks. |
CVE-2015-7263 | High | 7.5 | 2017-04-10 | The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a crafted host value. |
CVE-2015-7260 | High | 7.8 | 2017-04-10 | Liebert MultiLink Automated Shutdown v4.2.4 allows local users to gain privileges by replacing the LiebertM executable file. |
CVE-2015-6035 | Medium | 6.1 | 2017-04-10 | Opsview before 2015-11-06 has XSS via SNMP. |
CVE-2015-6028 | High | 8.8 | 2017-04-10 | Castle Rock Computing SNMPc before 2015-12-17 has SQL injection via the sc parameter. |
CVE-2015-6027 | Medium | 6.1 | 2017-04-10 | Castle Rock Computing SNMPc before 2015-12-17 has XSS via SNMP. |
CVE-2015-6021 | Medium | 6.1 | 2017-04-10 | Spiceworks Desktop before 2015-12-01 has XSS via an SNMP response. |
CVE-2015-2889 | High | 8.8 | 2017-04-10 | Summer Baby Zoom Wifi Monitor & Internet Viewing System allows remote attackers to gain privileges via manual entry of a Settings URL. |
CVE-2015-2888 | Critical | 9.8 | 2017-04-10 | Summer Baby Zoom Wifi Monitor & Internet Viewing System allows remote attackers to bypass authentication, related to the MySnapCam web service. |
CVE-2015-2887 | Critical | 9.8 | 2017-04-10 | iBaby M3S has a password of admin for the backdoor admin account. |
CVE-2015-2886 | High | 7.5 | 2017-04-10 | iBaby M6 allows remote attackers to obtain sensitive information, related to the ibabycloud.com service. |
CVE-2015-2885 | Critical | 9.8 | 2017-04-10 | Lens Peek-a-View has a password of 2601hx for the backdoor admin account, a password of user for the backdoor user account, and a password of guest for the bac… |
CVE-2015-2884 | High | 7.5 | 2017-04-10 | Philips In.Sight B120/37 allows remote attackers to obtain sensitive information via a direct request, related to yoics.net URLs, stream.m3u8 URIs, and cam_ser… |
CVE-2015-2883 | Medium | 5.4 | 2017-04-10 | Philips In.Sight B120/37 has XSS, related to the Weaved cloud web service, as demonstrated by the name parameter to deviceSettings.php or shareDevice.php. |
CVE-2015-2882 | Critical | 9.8 | 2017-04-10 | Philips In.Sight B120/37 has a password of b120root for the backdoor root account, a password of /ADMIN/ for the backdoor admin account, a password of merlin f… |
CVE-2015-2881 | Critical | 9.8 | 2017-04-10 | Gynoii has a password of guest for the backdoor guest account and a password of 12345 for the backdoor admin account. |
CVE-2015-2880 | High | 8.8 | 2017-04-10 | TRENDnet WiFi Baby Cam TV-IP743SIC has a password of admin for the backdoor root account. |
CVE-2015-4673 | Medium | 5.4 | 2017-04-06 | Multiple cross-site scripting (XSS) vulnerabilities in ClipBucket 2.7.0.5 allow remote authenticated users to inject arbitrary web script or HTML via (1) the c… |
CVE-2015-8965 | Critical | 9.8 | 2017-04-06 | Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the classpath, such as test… |
CVE-2015-9019 | Medium | 5.3 | 2017-04-05 | In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function t… |
CVE-2015-4680 | High | 7.5 | 2017-04-05 | FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates. |
CVE-2015-1612 | High | 7.5 | 2017-04-04 | OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to the reuse of LLDP… |
CVE-2015-1611 | High | 7.5 | 2017-04-04 | OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to "fake LLDP injecti… |
CVE-2015-8671 | High | 8.8 | 2017-04-02 | Huawei LogCenter V100R001C10 could allow an authenticated attacker to tamper with requests using a tool and submit a request to the server for privilege escala… |
CVE-2015-8670 | Medium | 6.5 | 2017-04-02 | Huawei LogCenter V100R001C10 could allow an authenticated attacker to add abnormal device information to the log collection module, causing denial of service. |
CVE-2015-7847 | Medium | 5.5 | 2017-04-02 | Huawei MBB (Mobile Broadband) product E3272s with software versions earlier than E3272s-153TCPU-V200R002B491D09SP00C00 has a Denial of Service (DoS) vulnerabil… |
CVE-2015-7844 | High | 7.5 | 2017-04-02 | Huawei FusionAccess with software V100R005C10,V100R005C20 could allow attackers to craft and send a malformed HDP protocol packet to cause the virtual cloud de… |
CVE-2015-2246 | Low | 3.3 | 2017-04-02 | The MeWidget module on Huawei P7 smartphones with software P7-L10 V100R001C00B136 and earlier versions could lead to the disclosure of contact information. |
CVE-2015-4624 | High | 7.5 | 2017-03-31 | Hak5 WiFi Pineapple 2.0 through 2.3 uses predictable CSRF tokens. |
CVE-2015-8234 | Medium | 5.5 | 2017-03-29 | The image signature algorithm in OpenStack Glance 11.0.0 allows remote attackers to bypass the signature verification process via a crafted image, which trigge… |
CVE-2015-4556 | High | 7.5 | 2017-03-29 | The string-translate* procedure in the data-structures unit in CHICKEN before 4.10.0 allows remote attackers to cause a denial of service (crash). |
CVE-2015-8764 | High | 8.1 | 2017-03-27 | Off-by-one error in the EAP-PWD module in FreeRADIUS 3.0 through 3.0.8, which triggers a buffer overflow. |
CVE-2015-8763 | High | 8.1 | 2017-03-27 | The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to have unspecified impact via a crafted (1) commit or (2) confirm message, which tr… |
CVE-2015-8762 | Medium | 5.9 | 2017-03-27 | The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a zero-… |
CVE-2015-8010 | Medium | 6.1 | 2017-03-27 | Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inj… |
CVE-2015-0864 | High | 8.0 | 2017-03-27 | Samsung Account (AKA com.osp.app.signin) before 1.6.0069 and 2.x before 2.1.0069 allows man-in-the-middle attackers to obtain sensitive information and execute… |
CVE-2015-0863 | High | 8.0 | 2017-03-27 | GALAXY Apps (aka Samsung Apps, Samsung Updates, or com.sec.android.app.samsungapps) before 14120405.03.012 allows man-in-the-middle attackers to obtain sensiti… |
CVE-2015-8310 | Medium | 5.4 | 2017-03-27 | Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or HTML via the playlis… |
CVE-2015-8309 | Medium | 4.3 | 2017-03-27 | Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "downloa… |
CVE-2015-8026 | High | 7.8 | 2017-03-27 | Heap-based buffer overflow in the verify_vbr_checksum function in exfatfsck in exfat-utils before 1.2.1 allows remote attackers to cause a denial of service (i… |
CVE-2015-8678 | Medium | 5.5 | 2017-03-24 | The ION driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL… |
CVE-2015-8556 | Critical | 10.0 | 2017-03-24 | Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1. |
CVE-2015-8687 | Medium | 5.4 | 2017-03-23 | Multiple cross-site scripting (XSS) vulnerabilities in the Management Console in Alcatel-Lucent Motive Home Device Manager (HDM) before 4.2 allow remote attack… |
CVE-2015-8628 | Medium | 5.3 | 2017-03-23 | The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaWiki before 1.23.12… |
CVE-2015-8627 | Medium | 5.3 | 2017-03-23 | MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly normalize IP addresses containing zero-padded oc… |
CVE-2015-8626 | Critical | 9.8 | 2017-03-23 | The User::randomPassword function in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 generates passwords smaller… |
CVE-2015-8625 | High | 7.5 | 2017-03-23 | MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL librar… |
CVE-2015-8624 | High | 8.8 | 2017-03-23 | The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does n… |
CVE-2015-8623 | High | 8.8 | 2017-03-23 | The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time… |
CVE-2015-8622 | Medium | 6.1 | 2017-03-23 | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1, when is configured… |
CVE-2015-5729 | Critical | 9.8 | 2017-03-23 | The Soft Access Point (AP) feature in Samsung Smart TVs X10P, X12, X14H, X14J, and NT14U and Xpress M288OFW printers generate weak WPA2 PSK keys, which makes i… |
CVE-2015-4166 | Critical | 9.8 | 2017-03-23 | Cloudera Key Trustee Server before 5.4.3 does not store keys synchronously, which might allow attackers to have unspecified impact via vectors related to loss… |
CVE-2015-4078 | Low | 3.1 | 2017-03-23 | Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-mid… |
CVE-2015-2263 | Low | 3.3 | 2017-03-23 | Cloudera Manager 4.x, 5.0.x before 5.0.6, 5.1.x before 5.1.5, 5.2.x before 5.2.5, and 5.3.x before 5.3.3 uses global read permissions for files in its configur… |
CVE-2015-0855 | Critical | 9.8 | 2017-03-23 | The _mediaLibraryPlayCb function in mainwindow.py in pitivi before 0.95 allows attackers to execute arbitrary code via shell metacharacters in a file path. |
CVE-2015-8985 | Medium | 5.9 | 2017-03-20 | The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and ap… |
CVE-2015-8984 | Medium | 5.9 | 2017-03-20 | The fnmatch function in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application cr… |
CVE-2015-8983 | High | 8.1 | 2017-03-20 | Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers… |
CVE-2015-8954 | Critical | 9.8 | 2017-03-20 | The MemcmpLowercase function in Suricata before 2.0.6 improperly excludes the first byte from comparisons, which might allow remote attackers to bypass intrusi… |
CVE-2015-1610 | Medium | 5.3 | 2017-03-20 | hosttracker in OpenDaylight l2switch allows remote attackers to change the host location information by spoofing the MAC address, aka "topology spoofing." |
CVE-2015-7313 | Medium | 5.5 | 2017-03-17 | LibTIFF before 4.0.7 allows remote attackers to cause a denial of service (memory consumption and crash) via a crafted tiff file. |
CVE-2015-4645 | Medium | 5.5 | 2017-03-17 | Integer overflow in the read_fragment_table_4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial of service (applicat… |
CVE-2015-3884 | High | 8.8 | 2017-03-17 | Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdP… |
CVE-2015-3883 | Medium | 6.1 | 2017-03-17 | Multiple cross-site scripting (XSS) vulnerabilities in qdPM 8.3 allow remote attackers to inject arbitrary web script or HTML via the (1) search[keywords] para… |
CVE-2015-3882 | Medium | 5.3 | 2017-03-17 | qdPM 8.3 allows remote attackers to obtain sensitive information via invalid ID value to index.php/users/info/id/[ID], which reveals the installation path in a… |
CVE-2015-3881 | High | 7.5 | 2017-03-17 | Information disclosure issue in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to (1) core/config/databases.yml, (2) cor… |
CVE-2015-8981 | Critical | 9.8 | 2017-03-16 | Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in base/PdfParser.cpp in PoDoFo allows attackers to have unspecified impact via vector… |
CVE-2015-8982 | High | 8.1 | 2017-03-15 | Integer overflow in the strxfrm function in the GNU C Library (aka glibc or libc6) before 2.21 allows context-dependent attackers to cause a denial of service… |
CVE-2015-8898 | Medium | 5.5 | 2017-03-15 | The WriteImages function in magick/constitute.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (NULL pointer dereference) v… |
CVE-2015-8897 | Medium | 5.5 | 2017-03-15 | The SpliceImage function in MagickCore/transform.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (application crash) via a… |
CVE-2015-8896 | Medium | 6.5 | 2017-03-15 | Integer truncation issue in coders/pict.c in ImageMagick before 7.0.5-0 allows remote attackers to cause a denial of service (application crash) via a crafted… |
CVE-2015-8895 | High | 7.5 | 2017-03-15 | Integer overflow in coders/icon.c in ImageMagick 6.9.1-3 and later allows remote attackers to cause a denial of service (application crash) via a crafted lengt… |
CVE-2015-8894 | Medium | 5.5 | 2017-03-15 | Double free vulnerability in coders/tga.c in ImageMagick 7.0.0 and later allows remote attackers to cause a denial of service (application crash) via a crafted… |
CVE-2015-8993 | High | 7.0 | 2017-03-14 | Malicious file execution vulnerability in Intel Security CloudAV (Beta) before 0.5.0.151.3 allows attackers to make the product momentarily vulnerable via exec… |
CVE-2015-8992 | High | 7.0 | 2017-03-14 | Malicious file execution vulnerability in Intel Security WebAdvisor before 4.0.2, 4.0.1 and 3.7.2 allows attackers to make the product momentarily vulnerable v… |
CVE-2015-8991 | High | 7.0 | 2017-03-14 | Malicious file execution vulnerability in Intel Security McAfee Security Scan+ (MSS+) before 3.11.266.3 allows attackers to make the product momentarily vulner… |
CVE-2015-8990 | High | 7.5 | 2017-03-14 | Detection bypass vulnerability in Intel Security Advanced Threat Defense (ATD) 3.4.6 and earlier allows malware samples to bypass ATD detection via renaming th… |
CVE-2015-8989 | High | 8.8 | 2017-03-14 | Unsalted password vulnerability in the Enterprise Manager (web portal) component in Intel Security McAfee Vulnerability Manager (MVM) 7.5.8 and earlier allows… |
CVE-2015-8988 | High | 8.8 | 2017-03-14 | Unquoted executable path vulnerability in Client Management and Gateway components in McAfee (now Intel Security) ePO Deep Command (eDC) 2.2 and 2.1 allows aut… |
CVE-2015-8987 | Medium | 5.3 | 2017-03-14 | Man-in-the-middle (MitM) attack vulnerability in non-Mac OS agents in McAfee (now Intel Security) Agent (MA) 4.8.0 patch 2 and earlier allows attackers to make… |
CVE-2015-8986 | Medium | 5.5 | 2017-03-14 | Sandbox detection evasion vulnerability in hardware appliances in McAfee (now Intel Security) Advanced Threat Defense (MATD) 3.4.2.32 and earlier allows attack… |
CVE-2015-6671 | Medium | 5.9 | 2017-03-13 | Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to… |
CVE-2015-4409 | Medium | 6.5 | 2017-03-13 | Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service (service… |
CVE-2015-4408 | Medium | 6.5 | 2017-03-13 | Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service (service… |
CVE-2015-4407 | Medium | 6.5 | 2017-03-13 | Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service (service… |
CVE-2015-2330 | High | 7.5 | 2017-03-10 | Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies. |
CVE-2015-8815 | Medium | 6.1 | 2017-03-03 | Multiple cross-site scripting (XSS) vulnerabilities in Umbraco before 7.4.0 allow remote attackers to inject arbitrary web script or HTML via the name paramete… |
CVE-2015-8814 | High | 8.8 | 2017-03-03 | Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks as demonstrated by… |
CVE-2015-8813 | High | 8.2 | 2017-03-03 | The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct serve… |
CVE-2015-2877 | Low | 3.3 | 2017-03-03 | Kernel Samepage Merging (KSM) in the Linux kernel 2.6.32 through 4.x does not prevent use of a write-timing side channel, which allows guest OS users to defeat… |
CVE-2015-8994 | High | 7.5 | 2017-03-02 | An issue was discovered in PHP 5.x and 7.x, when the configuration uses apache2handler/mod_php or php-fpm with OpCache enabled. With 5.x after 5.6.28 or 7.x af… |
CVE-2015-8903 | Medium | 6.5 | 2017-02-27 | The ReadVICARImage function in coders/vicar.c in ImageMagick 6.x before 6.9.0-5 Beta allows remote attackers to cause a denial of service (infinite loop) via a… |
CVE-2015-8902 | Medium | 6.5 | 2017-02-27 | The ReadBlobByte function in coders/pdb.c in ImageMagick 6.x before 6.9.0-5 Beta allows remote attackers to cause a denial of service (infinite loop) via a cra… |
CVE-2015-8901 | Medium | 6.5 | 2017-02-27 | ImageMagick 6.x before 6.9.0-5 Beta allows remote attackers to cause a denial of service (infinite loop) via a crafted MIFF file. |
CVE-2015-8900 | Medium | 5.5 | 2017-02-27 | The ReadHDRImage function in coders/hdr.c in ImageMagick 6.x and 7.x allows remote attackers to cause a denial of service (infinite loop) via a crafted HDR fil… |
CVE-2015-4057 | High | 7.5 | 2017-02-21 | The "Plug-in for VMware vCenter" in VCE Vision Intelligent Operations before 2.6.5 sends a cleartext HTTP response upon a request for the Settings screen, whic… |
CVE-2015-4056 | Medium | 6.7 | 2017-02-21 | The System Library in VCE Vision Intelligent Operations before 2.6.5 does not properly implement cryptography, which makes it easier for local users to discove… |
CVE-2015-8979 | High | 7.5 | 2017-02-15 | Stack-based buffer overflow in the parsePresentationContext function in storescp in DICOM dcmtk-3.6.0 and earlier allows remote attackers to cause a denial of… |
CVE-2015-8771 | Critical | 9.8 | 2017-02-13 | The generate_smb_nt_hash function in include/functions.inc in GOsa allows remote attackers to execute arbitrary commands via a crafted password. |