2015 CVEs (page 21)
Page 21 of 82 — CVEs published in 2015, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-6360 | High | 7.5 | 2016-04-21 | The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via crafted fields in SRTP packets, aka Bu… |
CVE-2015-8842 | Low | 3.3 | 2016-04-20 | tmpfiles.d/systemd.conf in systemd before 229 uses weak permissions for /var/log/journal/%m/system.journal, which allows local users to obtain sensitive inform… |
CVE-2015-7802 | Medium | 5.5 | 2016-04-20 | gifread.c in gif2png, as used in OptiPNG before 0.7.6, allows remote attackers to cause a denial of service (uninitialized memory read) via a crafted GIF file. |
CVE-2015-7801 | High | 8.8 | 2016-04-20 | Use-after-free vulnerability in OptiPNG 0.6.4 allows remote attackers to execute arbitrary code via a crafted PNG file. |
CVE-2015-8779 | Critical | 9.8 | 2016-04-19 | Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial… |
CVE-2015-8778 | Critical | 9.8 | 2016-04-19 | Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or p… |
CVE-2015-8776 | Critical | 9.1 | 2016-04-19 | The strftime function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash)… |
CVE-2015-7511 | Low | 2.0 | 2016-04-19 | Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attacker… |
CVE-2015-1776 | Medium | 6.2 | 2016-04-19 | Apache Hadoop 2.6.x encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials file on disk when the… |
CVE-2015-5479 | Medium | 6.5 | 2016-04-19 | The ff_h263_decode_mba function in libavcodec/ituh263dec.c in Libav before 11.5 allows remote attackers to cause a denial of service (divide-by-zero error and… |
CVE-2015-7378 | High | 7.8 | 2016-04-18 | Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and installed files, which allows local users to g… |
CVE-2015-8106 | High | 7.8 | 2016-04-18 | Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10 allows remote attackers to execute arbitrary code via format str… |
CVE-2015-7552 | High | 7.8 | 2016-04-18 | Heap-based buffer overflow in the gdk_pixbuf_flip function in gdk-pixbuf-scale.c in gdk-pixbuf 2.30.x allows remote attackers to cause a denial of service or p… |
CVE-2015-5271 | High | 7.5 | 2016-04-15 | The TripleO Heat templates (tripleo-heat-templates) do not properly order the Identity Service (keystone) before the OpenStack Object Storage (Swift) staticweb… |
CVE-2015-7676 | Medium | 5.4 | 2016-04-15 | Ipswitch MOVEit File Transfer (formerly DMZ) 8.1 and earlier, when configured to support file view on download, allows remote authenticated users to conduct cr… |
CVE-2015-5348 | High | 8.1 | 2016-04-15 | Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel route… |
CVE-2015-8677 | Medium | 6.5 | 2016-04-14 | Memory leak in Huawei S5300EI, S5300SI, S5310HI, and S6300EI Campus series switches with software V200R003C00 before V200R003SPH011 and V200R005C00 before V200… |
CVE-2015-8676 | High | 7.5 | 2016-04-14 | Memory leak in Huawei S5300EI, S5300SI, S5310HI, S6300EI/ S2350EI, and S5300LI Campus series switches with software V200R001C00 before V200R001SPH018, V200R002… |
CVE-2015-8336 | Medium | 4.3 | 2016-04-14 | Huawei FusionCompute with software before V100R005C10SPC700 allows remote authenticated users to obtain sensitive "role and permission" information via unspeci… |
CVE-2015-5247 | Medium | 6.5 | 2016-04-14 | The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a denial of service (li… |
CVE-2015-8560 | High | 7.3 | 2016-04-14 | Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.4.0 and in foomatic-filters in Foomatic 4.0.x allows remote attack… |
CVE-2015-8554 | High | 7.5 | 2016-04-14 | Buffer overflow in hw/pt-msi.c in Xen 4.6.x and earlier, when using the qemu-xen-traditional (aka qemu-dm) device model, allows local x86 HVM guest administrat… |
CVE-2015-8550 | High | 8.2 | 2016-04-14 | Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (host OS crash) or gain privileges by writi… |
CVE-2015-8540 | High | 8.8 | 2016-04-14 | Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x before 1.0.66, 1.1.x and 1.2.x before 1.2.56, 1.3.x and 1… |
CVE-2015-7999 | High | 8.1 | 2016-04-14 | Multiple SQL injection vulnerabilities in the Administration Web UI servlets in Citrix Command Center before 5.1 Build 36.7 and 5.2 before Build 44.11 allow re… |
CVE-2015-5343 | High | 7.6 | 2016-04-14 | Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to cause a… |
CVE-2015-0284 | Medium | 5.4 | 2016-04-14 | Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web scr… |
CVE-2015-8806 | High | 7.5 | 2016-04-13 | dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediat… |
CVE-2015-8784 | Medium | 6.5 | 2016-04-13 | The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image, as demons… |
CVE-2015-8683 | Medium | 5.5 | 2016-04-13 | The putcontig8bitCIELab function in tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a packed TIFF… |
CVE-2015-8665 | Medium | 5.5 | 2016-04-13 | tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via the SamplesPerPixel tag in a TIFF image. |
CVE-2015-3146 | High | 7.5 | 2016-04-13 | The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cb.c in libssh before 0.6.5 do not properly validate state, which allows remote… |
CVE-2015-1547 | Medium | 6.5 | 2016-04-13 | The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, a… |
CVE-2015-8807 | Medium | 6.1 | 2016-04-13 | Cross-site scripting (XSS) vulnerability in the _renderVarInput_number function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupwa… |
CVE-2015-8843 | High | 7.4 | 2016-04-13 | The Foxit Cloud Update Service (FoxitCloudUpdateService) in Foxit Reader 6.1 through 6.2.x and 7.x before 7.2.2, when an update to the Cloud plugin is availabl… |
CVE-2015-8606 | Medium | 6.1 | 2016-04-13 | Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.x before 3.2.1 allow remote attackers to inject arbit… |
CVE-2015-8555 | High | 8.6 | 2016-04-13 | Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register… |
CVE-2015-8553 | Medium | 6.5 | 2016-04-13 | Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory by not enabling memory and I/O decoding control… |
CVE-2015-8552 | Medium | 4.4 | 2016-04-13 | The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to gen… |
CVE-2015-8551 | Medium | 6.0 | 2016-04-13 | The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to hit… |
CVE-2015-8080 | High | 7.5 | 2016-04-13 | Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission… |
CVE-2015-7555 | Medium | 5.5 | 2016-04-13 | Heap-based buffer overflow in giffix.c in giffix in giflib 5.1.1 allows attackers to cause a denial of service (program crash) via crafted image and logical sc… |
CVE-2015-7545 | Critical | 9.8 | 2016-04-13 | The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 d… |
CVE-2015-0861 | Medium | 4.3 | 2016-04-13 | model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypas… |
CVE-2015-8682 | Medium | 6.1 | 2016-04-13 | The Video0 driver in Huawei P8 smartphones with software GRA-UL00 before GRA-UL00C00B350, GRA-UL10 before GRA-UL10C00B350, GRA-TL00 before GRA-TL00C01B350, GRA… |
CVE-2015-8620 | High | 7.8 | 2016-04-13 | Heap-based buffer overflow in the Avast virtualization driver (aswSnx.sys) in Avast Internet Security, Pro Antivirus, Premier, and Free Antivirus before 11.1.2… |
CVE-2015-8304 | High | 7.8 | 2016-04-13 | Integer overflow in Huawei P7 phones with software before P7-L07 V100R001C01B606 allows remote attackers to gain privileges via a crafted application with the… |
CVE-2015-7520 | Medium | 6.1 | 2016-04-12 | Multiple cross-site scripting (XSS) vulnerabilities in the (1) RadioGroup and (2) CheckBoxMultipleChoice classes in Apache Wicket 1.5.x before 1.5.15, 6.x befo… |
CVE-2015-5347 | Medium | 6.1 | 2016-04-12 | Cross-site scripting (XSS) vulnerability in the getWindowOpenJavaScript function in org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow in Apache W… |
CVE-2015-8702 | High | 8.6 | 2016-04-12 | The DNS::GetResult function in dns.cpp in InspIRCd before 2.0.19 allows remote DNS servers to cause a denial of service (netsplit) via an invalid character in… |
CVE-2015-8537 | Medium | 5.3 | 2016-04-12 | app/views/journals/index.builder in Redmine before 2.6.9, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote attackers to obtain sensitive information by… |
CVE-2015-8474 | High | 7.4 | 2016-04-12 | Open redirect vulnerability in the valid_back_url function in app/controllers/application_controller.rb in Redmine before 2.6.7, 3.0.x before 3.0.5, and 3.1.x… |
CVE-2015-8473 | Medium | 4.3 | 2016-04-12 | The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote authenticated users to obtain sensitive information in changes… |
CVE-2015-8346 | Medium | 5.3 | 2016-04-12 | app/views/timelog/_form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote attackers to obtain sensitive information ab… |
CVE-2015-8021 | Medium | 4.3 | 2016-04-12 | Incomplete blacklist vulnerability in the Configuration utility in F5 BIG-IP LTM, Analytics, APM, ASM, GTM, Link Controller, and PSM 11.x before 11.2.1 HF11, 1… |
CVE-2015-5167 | Medium | 6.5 | 2016-04-12 | The Policy Admin Tool in Apache Ranger before 0.5.1 allows remote authenticated users to bypass intended access restrictions via the REST API. |
CVE-2015-3268 | Medium | 6.1 | 2016-04-12 | Cross-site scripting (XSS) vulnerability in the DisplayEntityField.getDescription method in ModelFormField.java in Apache OFBiz before 12.04.06 and 13.07.x bef… |
CVE-2015-8841 | Critical | 9.8 | 2016-04-12 | Heap-based buffer overflow in the Archive support module in ESET NOD32 before update 11861 allows remote attackers to execute arbitrary code via a large number… |
CVE-2015-8833 | Critical | 9.8 | 2016-04-12 | Use-after-free vulnerability in the create_smp_dialog function in gtk-dialog.c in the Off-the-Record Messaging (OTR) pidgin-otr plugin before 4.0.2 for Pidgin… |
CVE-2015-8108 | Medium | 5.3 | 2016-04-12 | The management interface in LenovoEMC EZ Media & Backup (hm3), ix2/ix2-dl, ix4-300d, px12-400r/450r, px6-300d, px2-300d, px4-300r, px4-400d, px4-400r, and px4-… |
CVE-2015-5158 | Medium | 5.5 | 2016-04-12 | Stack-based buffer overflow in hw/scsi/scsi-bus.c in QEMU, when built with SCSI-device emulation support, allows guest OS users with CAP_SYS_RAWIO permissions… |
CVE-2015-8710 | Critical | 9.8 | 2016-04-11 | The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service (out-of-bounds heap memory… |
CVE-2015-8708 | High | 7.3 | 2016-04-11 | Stack-based buffer overflow in the conv_euctojis function in codeconv.c in Claws Mail 3.13.1 allows remote attackers to have unspecified impact via a crafted e… |
CVE-2015-8614 | High | 7.3 | 2016-04-11 | Multiple stack-based buffer overflows in the (1) conv_jistoeuc, (2) conv_euctojis, and (3) conv_sjistoeuc functions in codeconv.c in Claws Mail before 3.13.1 a… |
CVE-2015-8604 | High | 8.8 | 2016-04-11 | SQL injection vulnerability in the host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrar… |
CVE-2015-8399 | Medium | 4.3 | 2016-04-11 | Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecor… |
CVE-2015-8398 | Medium | 6.1 | 2016-04-11 | Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.8.17 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO… |
CVE-2015-7528 | Medium | 5.3 | 2016-04-11 | Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name. |
CVE-2015-7502 | Medium | 5.1 | 2016-04-11 | Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the backend PostgreSQL… |
CVE-2015-7330 | High | 8.8 | 2016-04-11 | Puppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist protection mechanism by leveraging the Puppet communications protoc… |
CVE-2015-5349 | High | 7.8 | 2016-04-11 | The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does not properly escape field values, which might allow attackers to execute… |
CVE-2015-5329 | High | 7.3 | 2016-04-11 | The TripleO Heat templates (tripleo-heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 7.0, do not properly use the configured RabbitMQ cr… |
CVE-2015-5313 | Low | 2.5 | 2016-04-11 | Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Con… |
CVE-2015-5303 | High | 7.5 | 2016-04-11 | The TripleO Heat templates (tripleo-heat-templates), when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata… |
CVE-2015-5233 | Medium | 4.2 | 2016-04-11 | Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view_hosts permissions, which allows (1) remote authenticated users with the view_reports per… |
CVE-2015-0266 | High | 7.1 | 2016-04-11 | The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs. |
CVE-2015-0265 | Medium | 6.1 | 2016-04-11 | Cross-site scripting (XSS) vulnerability in the Policy Admin Tool in Apache Ranger before 0.5.0 allows remote attackers to inject arbitrary web script or HTML… |
CVE-2015-8240 | High | 7.5 | 2016-04-11 | The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and BIG-IP PEM before 11.4.1 HF10, 11.5.x befor… |
CVE-2015-5969 | Medium | 6.2 | 2016-04-08 | The mysql-systemd-helper script in the mysql-community-server package before 5.6.28-2.17.1 in openSUSE 13.2 and before 5.6.28-13.1 in openSUSE Leap 42.1 and th… |
CVE-2015-5229 | High | 7.5 | 2016-04-08 | The calloc function in the glibc package in Red Hat Enterprise Linux (RHEL) 6.7 and 7.2 does not properly initialize memory areas, which might allow context-de… |
CVE-2015-6541 | High | 8.8 | 2016-04-08 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Mail interface in Zimbra Collaboration Server (ZCS) before 8.5 allow remote attackers to hija… |
CVE-2015-8840 | High | 8.8 | 2016-04-08 | The XML Data Archiving Service (XML DAS) in SAP NetWeaver AS Java does not check authorization, which allows remote authenticated users to obtain sensitive inf… |
CVE-2015-2774 | Medium | 5.9 | 2016-04-07 | Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obt… |
CVE-2015-8681 | High | 7.8 | 2016-04-07 | The ovisp driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-… |
CVE-2015-8680 | High | 7.8 | 2016-04-07 | The Graphics driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, G… |
CVE-2015-8679 | Medium | 5.5 | 2016-04-07 | The Maxim_smartpa_dev driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C… |
CVE-2015-8319 | High | 7.8 | 2016-04-07 | Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10… |
CVE-2015-8318 | High | 7.8 | 2016-04-07 | Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10… |
CVE-2015-8307 | High | 7.8 | 2016-04-07 | The Graphics driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, G… |
CVE-2015-8305 | Medium | 5.5 | 2016-04-07 | Huawei Sophia-L10 smartphones with software before P7-L10C900B852 allow attackers to cause a denial of service (system panic) via a crafted application with th… |
CVE-2015-7921 | Critical | 9.1 | 2016-04-06 | The FTP server in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 has hardcoded c… |
CVE-2015-6313 | High | 7.5 | 2016-04-06 | Cisco TelePresence Server 4.1(2.29) through 4.2(4.17) on 7010; Mobility Services Engine (MSE) 8710; Multiparty Media 310, 320, and 820; and Virtual Machine (VM… |
CVE-2015-6312 | High | 7.5 | 2016-04-06 | Cisco TelePresence Server 3.1 on 7010, Mobility Services Engine (MSE) 8710, Multiparty Media 310 and 320, and Virtual Machine (VM) devices allows remote attack… |
CVE-2015-8523 | High | 7.5 | 2016-04-05 | The server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to cause a denial of service (service crash) via crafte… |
CVE-2015-8522 | Critical | 9.8 | 2016-04-05 | Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a craf… |
CVE-2015-8521 | Critical | 9.8 | 2016-04-05 | Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a craf… |
CVE-2015-8520 | Critical | 9.8 | 2016-04-05 | Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a craf… |
CVE-2015-8519 | Critical | 9.8 | 2016-04-05 | Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a craf… |
CVE-2015-8837 | High | 7.3 | 2016-03-30 | Stack-based buffer overflow in the isofs_real_readdir function in isofs.c in FuseISO 20070708 allows remote attackers to cause a denial of service (application… |
CVE-2015-8836 | High | 7.3 | 2016-03-30 | Integer overflow in the isofs_real_read_zf function in isofs.c in FuseISO 20070708 might allow remote attackers to cause a denial of service (application crash… |