2015 CVEs (page 23)
Page 23 of 82 — CVEs published in 2015, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-7444 | Medium | 5.3 | 2016-02-15 | The Update Installer in IBM WebSphere Commerce Enterprise 7.0.0.8 and 7.0.0.9 does not properly replicate the search index, which allows attackers to obtain se… |
CVE-2015-7408 | Low | 3.7 | 2016-02-15 | The server in IBM Spectrum Protect (aka Tivoli Storage Manager) 5.5 and 6.x before 6.3.5.1 and 7.x before 7.1.4 does not properly restrict use of the ASNODENAM… |
CVE-2015-7398 | Medium | 5.4 | 2016-02-15 | Cross-site scripting (XSS) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2… |
CVE-2015-5050 | High | 8.8 | 2016-02-15 | Cross-site request forgery (CSRF) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5… |
CVE-2015-5042 | High | 7.5 | 2016-02-15 | IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x befor… |
CVE-2015-5012 | High | 7.5 | 2016-02-15 | The SSH implementation on IBM Security Access Manager for Web appliances 7.0 before 7.0.0 FP19, 8.0 before 8.0.1.3 IF3, and 9.0 before 9.0.0.0 IF1 does not pro… |
CVE-2015-5010 | High | 7.5 | 2016-02-15 | IBM Security Access Manager for Web 7.0 before 7.0.0 IF21, 8.0 before 8.0.1.3 IF4, and 9.0 before 9.0.0.1 IF1 does not have a lockout mechanism for invalid log… |
CVE-2015-4991 | Medium | 4.0 | 2016-02-15 | IBM SPSS Modeler 14.2 through FP3 IF027, 15 through FP3 IF015, 16 through FP2 IF012, 17 through FP1 IF018, and 17.1 through IF008 includes unspecified cleartex… |
CVE-2015-4957 | Medium | 5.4 | 2016-02-15 | Cross-site scripting (XSS) vulnerability in the Web UI in IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 allows remote authenticated users to inject ar… |
CVE-2015-4956 | High | 7.4 | 2016-02-15 | The Web UI in IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 allows remote authenticated users to execute unspecified OS commands via unknown vectors. |
CVE-2015-3197 | Medium | 5.9 | 2016-02-15 | ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle atta… |
CVE-2015-2008 | Medium | 4.4 | 2016-02-15 | IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 and 7.2.x before 7.2.6 includes SSH private keys during backup operations, which allows remote authentic… |
CVE-2015-2005 | Medium | 5.3 | 2016-02-15 | IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 and 7.2.x before 7.2.5 Patch 6 does not properly expire sessions, which allows remote attackers to obtai… |
CVE-2015-8631 | Medium | 6.5 | 2016-02-13 | Multiple memory leaks in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated… |
CVE-2015-8630 | High | 7.5 | 2016-02-13 | The (1) kadm5_create_principal_3 and (2) kadm5_modify_principal functions in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.12.x and 1… |
CVE-2015-8629 | Medium | 5.3 | 2016-02-13 | The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether… |
CVE-2015-7680 | Medium | 5.3 | 2016-02-10 | Ipswitch MOVEit DMZ before 8.2 provides different error messages for authentication attempts depending on whether the user account exists, which allows remote… |
CVE-2015-7679 | Medium | 6.1 | 2016-02-10 | Cross-site scripting (XSS) vulnerability in Ipswitch MOVEit Mobile before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the query st… |
CVE-2015-7678 | High | 8.8 | 2016-02-10 | Multiple cross-site request forgery (CSRF) vulnerabilities in Ipswitch MOVEit Mobile 1.2.0.962 and earlier allow remote attackers to hijack the authentication… |
CVE-2015-7677 | Medium | 4.3 | 2016-02-10 | The MOVEitISAPI service in Ipswitch MOVEit DMZ before 8.2 provides different error messages depending on whether a FileID exists, which allows remote authentic… |
CVE-2015-7675 | Medium | 6.5 | 2016-02-10 | The "Send as attachment" feature in Ipswitch MOVEit DMZ before 8.2 and MOVEit Mobile before 1.2.2 allow remote authenticated users to bypass authorization and… |
CVE-2015-8361 | Critical | 9.1 | 2016-02-08 | Multiple unspecified services in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 do not require authentication, which allows remote attackers to obtain… |
CVE-2015-8360 | Critical | 9.8 | 2016-02-08 | An unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote attackers to execute arbitrary Java code via serialized data to… |
CVE-2015-3252 | Critical | 9.8 | 2016-02-08 | Apache CloudStack before 4.5.2 does not properly preserve VNC passwords when migrating KVM virtual machines, which allows remote attackers to gain access by co… |
CVE-2015-3251 | Medium | 4.9 | 2016-02-08 | Apache CloudStack before 4.5.2 might allow remote authenticated administrators to obtain sensitive password information for root accounts of virtual machines v… |
CVE-2015-2012 | Medium | 4.0 | 2016-02-08 | The MQXR service in WMQ Telemetry in IBM WebSphere MQ 7.1 before 7.1.0.7, 7.5 through 7.5.0.5, and 8.0 before 8.0.0.4 uses world-readable permissions for a cle… |
CVE-2015-8787 | Critical | 9.8 | 2016-02-08 | The nf_nat_redirect_ipv4 function in net/netfilter/nf_nat_redirect.c in the Linux kernel before 4.4 allows remote attackers to cause a denial of service (NULL… |
CVE-2015-8785 | Medium | 6.2 | 2016-02-08 | The fuse_fill_write_pages function in fs/fuse/file.c in the Linux kernel before 4.4 allows local users to cause a denial of service (infinite loop) via a write… |
CVE-2015-8767 | Medium | 6.2 | 2016-02-08 | net/sctp/sm_sideeffect.c in the Linux kernel before 4.3 does not properly manage the relationship between a lock and a socket, which allows local users to caus… |
CVE-2015-8709 | High | 7.0 | 2016-02-08 | kernel/ptrace.c in the Linux kernel through 4.4.1 mishandles uid and gid mappings, which allows local users to gain privileges by establishing a user namespace… |
CVE-2015-8575 | Medium | 4.0 | 2016-02-08 | The sco_sock_bind function in net/bluetooth/sco.c in the Linux kernel before 4.3.4 does not verify an address length, which allows local users to obtain sensit… |
CVE-2015-8539 | High | 7.8 | 2016-02-08 | The KEYS subsystem in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (BUG) via crafted keyctl commands that neg… |
CVE-2015-7566 | Medium | 4.6 | 2016-02-08 | The clie_5_attach function in drivers/usb/serial/visor.c in the Linux kernel through 4.4.1 allows physically proximate attackers to cause a denial of service (… |
CVE-2015-7550 | Medium | 5.5 | 2016-02-08 | The keyctl_read_key function in security/keys/keyctl.c in the Linux kernel before 4.3.4 does not properly use a semaphore, which allows local users to cause a… |
CVE-2015-7513 | Medium | 6.5 | 2016-02-08 | arch/x86/kvm/x86.c in the Linux kernel before 4.4 does not reset the PIT counter values during state restoration, which allows guest OS users to cause a denial… |
CVE-2015-6398 | High | 7.5 | 2016-02-07 | Cisco Nexus 9000 Application Centric Infrastructure (ACI) Mode switches with software before 11.0(1c) allow remote attackers to cause a denial of service (devi… |
CVE-2015-7916 | Medium | 6.5 | 2016-02-06 | Cross-site scripting (XSS) vulnerability in Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows remote authenticated users to inject arbitrary web script or… |
CVE-2015-7915 | Critical | 9.8 | 2016-02-06 | Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 sends cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the netw… |
CVE-2015-7914 | High | 8.1 | 2016-02-06 | Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows remote attackers to bypass authentication by leveraging knowledge of a password hash without knowledge o… |
CVE-2015-8269 | High | 7.5 | 2016-02-04 | The API on Fisher-Price Smart Toy Bear devices allows remote attackers to obtain sensitive information or modify data by leveraging presence in an 802.11 netwo… |
CVE-2015-8748 | Medium | 5.3 | 2016-02-03 | Radicale before 1.1 allows remote authenticated users to bypass owner_write and owner_only limitations via regex metacharacters in the user name, as demonstrat… |
CVE-2015-8747 | Critical | 10.0 | 2016-02-03 | The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name. |
CVE-2015-7546 | High | 7.5 | 2016-02-03 | The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystonec… |
CVE-2015-7539 | High | 7.5 | 2016-02-03 | The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site data, which makes it ea… |
CVE-2015-7538 | High | 8.8 | 2016-02-03 | Jenkins before 1.640 and LTS before 1.625.2 allow remote attackers to bypass the CSRF protection mechanism via unspecified vectors. |
CVE-2015-7537 | High | 8.8 | 2016-02-03 | Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administ… |
CVE-2015-7536 | Medium | 5.4 | 2016-02-03 | Cross-site scripting (XSS) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject arbitrary web script or HTM… |
CVE-2015-5344 | Critical | 9.8 | 2016-02-03 | The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via a crafted serialize… |
CVE-2015-8783 | Medium | 6.5 | 2016-02-01 | tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds reads) via a crafted TIFF image. |
CVE-2015-8782 | Medium | 6.5 | 2016-02-01 | tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds writes) via a crafted TIFF image, a different vulnerability than CVE-2015-878… |
CVE-2015-8781 | Medium | 6.5 | 2016-02-01 | tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds write) via an invalid number of samples per pixel in a LogL compressed TIFF i… |
CVE-2015-8265 | High | 7.5 | 2016-02-01 | Huawei Mobile WiFi E5151 routers with software before E5151s-2TCPU-V200R001B146D27SP00C00 and E5186 routers with software before V200R001B310D01SP00C00 allow D… |
CVE-2015-7923 | Critical | 9.0 | 2016-01-30 | Westermo WeOS before 4.19.0 uses the same SSL private key across different customers' installations, which makes it easier for man-in-the-middle attackers to d… |
CVE-2015-8773 | High | 7.5 | 2016-01-29 | Stack-based buffer overflow in McPvDrv.sys 4.6.111.0 in McAfee File Lock 5.x in McAfee Total Protection allows attackers to cause a denial of service (system c… |
CVE-2015-8772 | Critical | 9.1 | 2016-01-29 | McPvDrv.sys 4.6.111.0 in McAfee File Lock 5.x in McAfee Total Protection allows local users to obtain sensitive information from kernel memory or cause a denia… |
CVE-2015-7521 | High | 8.3 | 2016-01-29 | The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows att… |
CVE-2015-8794 | Medium | 6.5 | 2016-01-29 | Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users… |
CVE-2015-8793 | Medium | 6.1 | 2016-01-29 | Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote attackers to inject arbit… |
CVE-2015-8792 | Medium | 5.3 | 2016-01-29 | The KaxInternalBlock::ReadData function in libMatroska before 1.4.4 allows context-dependent attackers to obtain sensitive information from process heap memory… |
CVE-2015-8791 | Medium | 4.3 | 2016-01-29 | The EbmlElement::ReadCodedSizeValue function in libEBML before 1.3.3 allows context-dependent attackers to obtain sensitive information from process heap memor… |
CVE-2015-8790 | Medium | 4.3 | 2016-01-29 | The EbmlUnicodeString::UpdateFromUTF8 function in libEBML before 1.3.3 allows context-dependent attackers to obtain sensitive information from process heap mem… |
CVE-2015-8789 | Critical | 9.6 | 2016-01-29 | Use-after-free vulnerability in the EbmlMaster::Read function in libEBML before 1.3.3 allows context-dependent attackers to have unspecified impact via a "deep… |
CVE-2015-8770 | High | 7.5 | 2016-01-29 | Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows re… |
CVE-2015-7464 | High | 7.5 | 2016-01-29 | Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote attackers to c… |
CVE-2015-6421 | High | 7.5 | 2016-01-27 | cifs-ao in the CIFS optimization functionality on Cisco Wide Area Application Service (WAAS) and Virtual WAAS (vWAAS) devices 5.x before 5.3.5d and 5.4 and 5.5… |
CVE-2015-6319 | Critical | 9.8 | 2016-01-27 | SQL injection vulnerability in the web-based management interface on Cisco RV220W devices allows remote attackers to execute arbitrary SQL commands via a craft… |
CVE-2015-8618 | High | 7.5 | 2016-01-27 | The Int.Exp Montgomery code in the math/big library in Go 1.5.x before 1.5.3 mishandles carry propagation and produces incorrect output, which makes it easier… |
CVE-2015-7488 | Medium | 5.9 | 2016-01-27 | IBM Spectrum Scale 4.1.1.x before 4.1.1.4 and 4.2.x before 4.2.0.1, in certain LDAP File protocol configurations, allows remote attackers to discover an LDAP p… |
CVE-2015-7487 | Medium | 4.1 | 2016-01-27 | IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 IFIX002, and 7.6.0 before 7.6.0.3 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9… |
CVE-2015-7439 | Medium | 6.1 | 2016-01-27 | Cross-site scripting (XSS) vulnerability in InfoSphere Data Architect (IDA), as distributed in IBM Rational Software Architect 8.5 through 9.5, Rational Softwa… |
CVE-2015-8379 | High | 8.8 | 2016-01-26 | CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter. |
CVE-2015-7974 | High | 7.7 | 2016-01-26 | NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attacker… |
CVE-2015-6337 | Medium | 6.1 | 2016-01-26 | Cross-site scripting (XSS) vulnerability in Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) 1.0.10 allows remote attackers to in… |
CVE-2015-7417 | Medium | 5.4 | 2016-01-23 | Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server 7.0 before 7.0.0.41, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.9 allows remote aut… |
CVE-2015-6317 | Medium | 6.5 | 2016-01-23 | Cisco Identity Services Engine (ISE) before 2.0 allows remote authenticated users to bypass intended web-resource access restrictions via a direct request, aka… |
CVE-2015-7744 | Medium | 5.9 | 2016-01-22 | wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key… |
CVE-2015-6925 | High | 7.5 | 2016-01-22 | wolfSSL (formerly CyaSSL) before 3.6.8 allows remote attackers to cause a denial of service (resource consumption or traffic amplification) via a crafted DTLS… |
CVE-2015-6015 | | 2016-01-22 | Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availa… | |
CVE-2015-6014 | | 2016-01-22 | Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availa… | |
CVE-2015-6013 | | 2016-01-22 | Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availa… | |
CVE-2015-8362 | Critical | 9.8 | 2016-01-22 | The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before 2015-10-12 has a hardcoded password for the BlackWidow account, which makes it easi… |
CVE-2015-7909 | High | 7.3 | 2016-01-22 | Stack-based buffer overflow in Hospira Communication Engine (CE) before 1.2 in LifeCare PCA Infusion System 5.07, Plum A+ Infusion System 13.40, and Plum A+3 I… |
CVE-2015-6435 | Critical | 9.8 | 2016-01-22 | An unspecified CGI script in Cisco FX-OS before 1.1.2 on Firepower 9000 devices and Cisco Unified Computing System (UCS) Manager before 2.2(4b), 2.2(5) before… |
CVE-2015-6412 | Critical | 9.8 | 2016-01-22 | Cisco Modular Encoding Platform D9036 Software before 02.04.70 has hardcoded (1) root and (2) guest passwords, which makes it easier for remote attackers to ob… |
CVE-2015-8472 | High | 7.3 | 2016-01-21 | Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x… |
CVE-2015-4926 | | 2016-01-21 | Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.1, and 12.2 allows remote attackers to affect… | |
CVE-2015-4925 | | 2016-01-21 | Unspecified vulnerability in the Workspace Manager component in Oracle Database Server 11.2.0.4 allows remote authenticated users to affect confidentiality, in… | |
CVE-2015-4924 | | 2016-01-21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.1.1, 9.3.1.2, 9.3.2, and 9.3.3 allows remote authenticate… | |
CVE-2015-4923 | | 2016-01-21 | Unspecified vulnerability in the XML Developer's Kit for C component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated use… | |
CVE-2015-4922 | | 2016-01-21 | Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability via vectors related to Boot. | |
CVE-2015-4921 | | 2016-01-21 | Unspecified vulnerability in the Database Vault component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affec… | |
CVE-2015-4920 | | 2016-01-21 | Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect integrity via vectors related to NDMP Backup Service. | |
CVE-2015-4919 | | 2016-01-21 | Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect confident… | |
CVE-2015-4885 | | 2016-01-21 | Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 12.1.0.4 allows remote attackers to affec… | |
CVE-2015-4808 | | 2016-01-21 | Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availa… | |
CVE-2015-5516 | High | 7.5 | 2016-01-20 | Memory leak in the last hop kernel module in F5 BIG-IP LTM, GTM, and Link Controller 10.1.x, 10.2.x before 10.2.4 HF13, 11.x before 11.2.1 HF15, 11.3.x, 11.4.x… |
CVE-2015-5295 | Medium | 5.4 | 2016-01-20 | The template-validate command in OpenStack Orchestration API (Heat) before 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote authenticated users t… |
CVE-2015-8705 | High | 7.0 | 2016-01-20 | buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when debug logging is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion f… |
CVE-2015-8704 | Medium | 6.5 | 2016-01-20 | apl_42.c in ISC BIND 9.x before 9.9.8-P3, 9.9.x, and 9.10.x before 9.10.3-P3 allows remote authenticated users to cause a denial of service (INSIST assertion f… |
CVE-2015-8777 | Medium | 5.5 | 2016-01-20 | The process_envvars function in elf/rtld.c in the GNU C Library (aka glibc or libc6) before 2.23 allows local users to bypass a pointer-guarding protection mec… |