2015 CVEs (page 19)
Page 19 of 82 — CVEs published in 2015, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-8951 | High | 7.8 | 2016-10-10 | Multiple use-after-free vulnerabilities in sound/soc/msm/qdsp6v2/msm-lsm-client.c in the Qualcomm sound driver in Android before 2016-10-05 on Nexus 5X, Nexus… |
CVE-2015-8950 | Medium | 5.5 | 2016-10-10 | arch/arm64/mm/dma-mapping.c in the Linux kernel before 4.0.3, as used in the ION subsystem in Android and other products, does not initialize certain data stru… |
CVE-2015-0572 | High | 7.0 | 2016-10-10 | Multiple race conditions in drivers/char/adsprpc.c and drivers/char/adsprpc_compat.c in the ADSPRPC driver for the Linux kernel 3.x, as used in Qualcomm Innova… |
CVE-2015-7363 | Medium | 5.4 | 2016-10-07 | Cross-site scripting (XSS) vulnerability in the advanced settings page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, in hardware models wi… |
CVE-2015-5162 | High | 7.5 | 2016-10-07 | The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit… |
CVE-2015-2080 | High | 7.5 | 2016-10-07 | The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal cha… |
CVE-2015-1000013 | High | 7.8 | 2016-10-06 | Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1 |
CVE-2015-1000012 | High | 7.5 | 2016-10-06 | Local File Inclusion Vulnerability in mypixs v0.3 wordpress plugin |
CVE-2015-1000011 | Critical | 9.8 | 2016-10-06 | Blind SQL Injection in wordpress plugin dukapress v2.5.9 |
CVE-2015-1000010 | High | 7.5 | 2016-10-06 | Remote file download in simple-image-manipulator v1.0 wordpress plugin |
CVE-2015-1000009 | Critical | 9.1 | 2016-10-06 | Open proxy in Wordpress plugin google-adsense-and-hotel-booking v1.05 |
CVE-2015-1000008 | Medium | 5.3 | 2016-10-06 | Path Disclosure Vulnerability in wordpress plugin MP3-jPlayer v2.3.2 |
CVE-2015-1000007 | High | 7.5 | 2016-10-06 | Remote file download vulnerability in wptf-image-gallery v1.03 |
CVE-2015-1000006 | High | 7.5 | 2016-10-06 | Remote file download vulnerability in recent-backups v0.7 wordpress plugin |
CVE-2015-1000005 | High | 7.5 | 2016-10-06 | Remote file download vulnerability in candidate-application-form v1.0 wordpress plugin |
CVE-2015-1000004 | Medium | 6.1 | 2016-10-06 | XSS in filedownload v1.4 wordpress plugin |
CVE-2015-1000003 | Critical | 9.8 | 2016-10-06 | Blind SQL Injection in filedownload v1.4 wordpress plugin |
CVE-2015-1000002 | High | 8.2 | 2016-10-06 | Open Proxy in filedownload v1.4 wordpress plugin |
CVE-2015-1000001 | Critical | 9.8 | 2016-10-06 | Remote file upload vulnerability in fast-image-adder v1.1 Wordpress plugin |
CVE-2015-1000000 | Critical | 9.8 | 2016-10-06 | Remote file upload vulnerability in mailcwp v1.99 wordpress plugin |
CVE-2015-6393 | High | 7.5 | 2016-10-06 | Cisco NX-OS 4.1 through 7.3 and 11.0 through 11.2 on Nexus 2000, 3000, 3500, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote attackers to ca… |
CVE-2015-0721 | High | 8.0 | 2016-10-06 | Cisco NX-OS 4.0 through 7.3 on Multilayer Director and Nexus 1000V, 2000, 3000, 3500, 4000, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote… |
CVE-2015-6392 | High | 7.5 | 2016-10-06 | Cisco NX-OS 4.1 through 7.3 and 11.0 through 11.2 on Nexus 2000, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote attackers to cause a denial… |
CVE-2015-8086 | Medium | 4.9 | 2016-10-03 | Huawei AR routers with software before V200R007C00SPC100; Quidway S9300 routers with software before V200R009C00; S12700 routers with software before V200R008C… |
CVE-2015-8085 | Medium | 4.9 | 2016-10-03 | Huawei AR routers with software before V200R007C00SPC100; Quidway S9300 routers with software before V200R009C00; S12700 routers with software before V200R008C… |
CVE-2015-1832 | Critical | 9.1 | 2016-10-03 | XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-d… |
CVE-2015-8871 | Critical | 9.8 | 2016-09-21 | Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown… |
CVE-2015-8960 | High | 8.1 | 2016-09-21 | The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not di… |
CVE-2015-8934 | Medium | 5.5 | 2016-09-20 | The copy_from_lzss_window function in archive_read_support_format_rar.c in libarchive 3.2.0 and earlier allows remote attackers to cause a denial of service (o… |
CVE-2015-8933 | Medium | 5.5 | 2016-09-20 | Integer overflow in the archive_read_format_tar_skip function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause… |
CVE-2015-8932 | Medium | 5.5 | 2016-09-20 | The compress_bidder_init function in archive_read_support_filter_compress.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (cr… |
CVE-2015-8931 | High | 7.8 | 2016-09-20 | Multiple integer overflows in the (1) get_time_t_max and (2) get_time_t_min functions in archive_read_support_format_mtree.c in libarchive before 3.2.0 allow r… |
CVE-2015-8930 | High | 7.5 | 2016-09-20 | bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (infinite loop) via an ISO with a directory that is a member of itself. |
CVE-2015-8929 | Medium | 5.5 | 2016-09-20 | Memory leak in the __archive_read_get_extract function in archive_read_extract2.c in libarchive before 3.2.0 allows remote attackers to cause a denial of servi… |
CVE-2015-8928 | Medium | 5.5 | 2016-09-20 | The process_add_entry function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-b… |
CVE-2015-8927 | Medium | 5.5 | 2016-09-20 | The trad_enc_decrypt_update function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-… |
CVE-2015-8926 | Medium | 5.5 | 2016-09-20 | The archive_read_format_rar_read_data function in archive_read_support_format_rar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of ser… |
CVE-2015-8925 | Medium | 5.5 | 2016-09-20 | The readline function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read) via… |
CVE-2015-8924 | Medium | 5.5 | 2016-09-20 | The archive_read_format_tar_read_header function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of s… |
CVE-2015-8923 | Medium | 6.5 | 2016-09-20 | The process_extra function in libarchive before 3.2.0 uses the size field and a signed number in an offset, which allows remote attackers to cause a denial of… |
CVE-2015-8922 | Medium | 5.5 | 2016-09-20 | The read_CodersInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointe… |
CVE-2015-8921 | High | 7.5 | 2016-09-20 | The ae_strtofflags function in archive_entry.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a craft… |
CVE-2015-8920 | Medium | 5.5 | 2016-09-20 | The _ar_read_header function in archive_read_support_format_ar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds… |
CVE-2015-8919 | High | 7.5 | 2016-09-20 | The lha_read_file_extended_header function in archive_read_support_format_lha.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service… |
CVE-2015-8918 | High | 7.5 | 2016-09-20 | The archive_string_append function in archive_string.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted ca… |
CVE-2015-8917 | High | 7.5 | 2016-09-20 | bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid character in the nam… |
CVE-2015-8916 | Medium | 6.5 | 2016-09-20 | bsdtar in libarchive before 3.2.0 returns a success code without filling the entry when the header is a "split file in multivolume RAR," which allows remote at… |
CVE-2015-8915 | Medium | 5.5 | 2016-09-20 | bsdcpio in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read and crash) via crafted cpio file. |
CVE-2015-8948 | High | 7.5 | 2016-09-07 | idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bou… |
CVE-2015-5721 | Critical | 9.8 | 2016-09-03 | Malware Information Sharing Platform (MISP) before 2.3.90 allows remote attackers to conduct PHP object injection attacks via crafted serialized data, related… |
CVE-2015-5720 | Medium | 6.1 | 2016-09-03 | Multiple cross-site scripting (XSS) vulnerabilities in the template-creation feature in Malware Information Sharing Platform (MISP) before 2.3.90 allow remote… |
CVE-2015-5719 | Critical | 9.8 | 2016-09-03 | app/Controller/TemplatesController.php in Malware Information Sharing Platform (MISP) before 2.3.92 does not properly restrict filenames under the tmp/files/ d… |
CVE-2015-5399 | Medium | 5.4 | 2016-08-26 | Cross-site scripting (XSS) vulnerability in PHPVibe before 4.21 allows remote authenticated users to inject arbitrary web script or HTML via a comment. |
CVE-2015-8949 | Critical | 9.8 | 2016-08-19 | Use-after-free vulnerability in the my_login function in DBD::mysql before 4.033_01 allows attackers to have unspecified impact by leveraging a call to mysql_e… |
CVE-2015-8022 | High | 7.5 | 2016-08-19 | The Configuration utility in F5 BIG-IP LTM, Analytics, APM, ASM, GTM, and Link Controller 11.x before 11.2.1 HF16, 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x be… |
CVE-2015-6397 | High | 8.8 | 2016-08-08 | Cisco RV110W, RV130W, and RV215W devices have an incorrect RBAC configuration for the default account, which allows remote authenticated users to obtain root a… |
CVE-2015-6396 | High | 7.8 | 2016-08-08 | The CLI command parser on Cisco RV110W, RV130W, and RV215W devices allows local users to execute arbitrary shell commands as an administrator via crafted param… |
CVE-2015-3854 | High | 7.5 | 2016-08-07 | packages/SystemUI/src/com/android/systemui/power/PowerNotificationWarnings.java in Android 5.x allows attackers to bypass a DEVICE_POWER permission requirement… |
CVE-2015-0573 | Critical | 9.8 | 2016-08-07 | drivers/media/platform/msm/broadcast/tsc.c in the TSC driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for M… |
CVE-2015-0568 | High | 7.8 | 2016-08-07 | Use-after-free vulnerability in the msm_set_crop function in drivers/media/video/msm/msm_camera.c in the MSM-Camera driver for the Linux kernel 3.x, as used in… |
CVE-2015-8935 | Medium | 6.1 | 2016-08-07 | The sapi_header_op function in main/SAPI.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 supports deprecated line folding without consideri… |
CVE-2015-8944 | Medium | 5.5 | 2016-08-06 | The ioresources_init function in kernel/resource.c in the Linux kernel through 4.7, as used in Android before 2016-08-05 on Nexus 6 and 7 (2013) devices, uses… |
CVE-2015-8943 | High | 7.8 | 2016-08-06 | drivers/video/msm/mdss/mdss_mdp_util.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 devices does not verify that a mapping exists before… |
CVE-2015-8942 | High | 7.8 | 2016-08-06 | drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c in the Qualcomm components in Android before 2016-08-05 on Nexus 6 devices does not validate the strea… |
CVE-2015-8941 | High | 7.8 | 2016-08-06 | drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c in the Qualcomm components in Android before 2016-08-05 on Nexus 6 and 7 (2013) devices does not pr… |
CVE-2015-8940 | High | 7.8 | 2016-08-06 | Integer overflow in sound/soc/msm/qdsp6v2/q6lsm.c in the Qualcomm components in Android before 2016-08-05 on Nexus 6 devices allows attackers to gain privilege… |
CVE-2015-8939 | High | 7.8 | 2016-08-06 | drivers/video/msm/mdp4_util.c in the Qualcomm components in Android before 2016-08-05 on Nexus 7 (2013) devices does not validate r stages, g stages, or b stag… |
CVE-2015-8938 | High | 7.8 | 2016-08-06 | The MSM camera driver in the Qualcomm components in Android before 2016-08-05 on Nexus 6 devices does not validate input parameters, which allows attackers to… |
CVE-2015-8937 | High | 7.8 | 2016-08-06 | drivers/char/diag/diagchar_core.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5, 6, and 7 (2013) devices mishandles a socket process, whic… |
CVE-2015-8945 | Medium | 5.1 | 2016-08-05 | openshift-node in OpenShift Origin 1.1.6 and earlier improperly stores router credentials as envvars in the pod when the --credentials option is used, which al… |
CVE-2015-5738 | High | 7.5 | 2016-07-26 | The RSA-CRT implementation in the Cavium Software Development Kit (SDK) 2.x, when used on OCTEON II CN6xxx Hardware on Linux to support TLS with Perfect Forwar… |
CVE-2015-8946 | Low | 3.3 | 2016-07-22 | ecryptfs-setup-swap in eCryptfs before 111 does not prevent the unencrypted swap partition from activating during boot when using GPT partitioning and certain… |
CVE-2015-8947 | High | 7.6 | 2016-07-19 | hb-ot-layout-gpos-table.hh in HarfBuzz before 1.0.5 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other… |
CVE-2015-1977 | High | 7.5 | 2016-07-15 | Directory traversal vulnerability in the Web Administration tool in IBM Tivoli Directory Server (ITDS) before 6.1.0.74-ISS-ISDS-IF0074, 6.2.x before 6.2.0.50-I… |
CVE-2015-8808 | Medium | 5.5 | 2016-07-13 | The DecodeImage function in coders/gif.c in GraphicsMagick 1.3.18 allows remote attackers to cause a denial of service (uninitialized memory access) via a craf… |
CVE-2015-3192 | Medium | 5.5 | 2016-07-12 | Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows rem… |
CVE-2015-8893 | Medium | 5.5 | 2016-07-11 | app/aboot/aboot.c in the Qualcomm bootloader in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices allows attackers to cause a denial of service (OS out… |
CVE-2015-8892 | High | 7.8 | 2016-07-11 | platform/msm_shared/boot_verifier.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5X and 6P devices allows attackers to bypass intended acce… |
CVE-2015-8891 | High | 7.8 | 2016-07-11 | Multiple integer overflows in app/aboot/aboot.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices allow attackers to bypa… |
CVE-2015-8890 | High | 7.8 | 2016-07-11 | platform/msm_shared/partition_parser.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices does not validate certain GUID P… |
CVE-2015-8889 | High | 7.8 | 2016-07-11 | The aboot implementation in the Qualcomm components in Android before 2016-07-05 on Nexus 6P devices omits the recovery PIN feature, which has unspecified impa… |
CVE-2015-8888 | High | 7.8 | 2016-07-11 | Integer overflow in app/aboot/aboot.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 devices allows attackers to bypass intended access res… |
CVE-2015-0899 | High | 7.5 | 2016-07-04 | The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page… |
CVE-2015-5664 | Medium | 6.1 | 2016-07-03 | Cross-site scripting (XSS) vulnerability in File Station in QNAP QTS before 4.2.0 allows remote attackers to inject arbitrary web script or HTML via unspecifie… |
CVE-2015-7029 | Critical | 9.8 | 2016-07-03 | Apple AirPort Base Station Firmware before 7.6.7 and 7.7.x before 7.7.7 misparses DNS data, which allows remote attackers to execute arbitrary code or cause a… |
CVE-2015-6931 | Medium | 6.1 | 2016-07-03 | Cross-site scripting (XSS) vulnerability in the vSphere Web Client in VMware vCenter Server 5.0 before U3g, 5.1 before U3d, and 5.5 before U2d allows remote at… |
CVE-2015-8801 | Low | 2.9 | 2016-06-30 | Race condition in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6 MP5 allows local users to bypass intended restrictions on USB file transfer… |
CVE-2015-8899 | High | 7.5 | 2016-06-30 | Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA record defin… |
CVE-2015-8699 | Medium | 6.1 | 2016-06-29 | Multiple cross-site scripting (XSS) vulnerabilities in CA Release Automation (formerly LISA Release Automation) 5.0.2 before 5.0.2-227, 5.5.1 before 5.5.1-1616… |
CVE-2015-8698 | High | 7.1 | 2016-06-29 | CA Release Automation (formerly LISA Release Automation) 5.0.2 before 5.0.2-227, 5.5.1 before 5.5.1-1616, 5.5.2 before 5.5.2-434, and 6.1.0 before 6.1.0-1026 a… |
CVE-2015-7473 | Low | 2.5 | 2016-06-26 | runmqsc in IBM WebSphere MQ 8.x before 8.0.0.5 allows local users to bypass intended queue-manager command access restrictions by leveraging authority for +con… |
CVE-2015-7988 | Critical | 9.8 | 2016-06-26 | The handle_regservice_request function in mDNSResponder before 625.41.2 allows remote attackers to execute arbitrary code or cause a denial of service (NULL po… |
CVE-2015-7987 | Critical | 9.8 | 2016-06-26 | Multiple buffer overflows in mDNSResponder before 625.41.2 allow remote attackers to read or write to out-of-bounds memory locations via vectors involving the… |
CVE-2015-6289 | High | 7.5 | 2016-06-23 | Cisco IOS 15.5(3)M on Integrated Services Router (ISR) 800, 819, and 829 devices allows remote attackers to cause a denial of service (memory consumption) via… |
CVE-2015-8289 | High | 7.5 | 2016-06-20 | The password-recovery feature on NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier allows remote attackers to d… |
CVE-2015-8288 | Medium | 5.9 | 2016-06-20 | NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier use the same hardcoded private key across different customers… |
CVE-2015-7776 | Medium | 4.3 | 2016-06-19 | Cybozu Garoon 3.x and 4.x before 4.2.0 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a craf… |
CVE-2015-7462 | Medium | 4.4 | 2016-06-19 | IBM WebSphere MQ 8.0.0.4 on IBM i platforms allows local users to discover cleartext certificate-keystore passwords within MQ trace output by leveraging admini… |
CVE-2015-7775 | Medium | 5.4 | 2016-06-19 | Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vector… |
CVE-2015-8914 | Critical | 9.1 | 2016-06-17 | The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended ICMPv6-spoofing protection mechan… |