2015 CVEs (page 25)
Page 25 of 82 — CVEs published in 2015, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-8376 | Medium | 6.1 | 2016-01-08 | Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.6.3 allow remote attackers to inject arbitrary web script or HTML via the (1) Name, (2) N… |
CVE-2015-7541 | Critical | 10.0 | 2016-01-08 | The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to e… |
CVE-2015-7512 | Critical | 9.0 | 2016-01-08 | Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of servic… |
CVE-2015-8765 | High | 8.3 | 2016-01-08 | Intel McAfee ePolicy Orchestrator (ePO) 4.6.9 and earlier, 5.0.x, 5.1.x before 5.1.3 Hotfix 1106041, and 5.3.x before 5.3.1 Hotfix 1106041 allow remote attacke… |
CVE-2015-8557 | Critical | 9.0 | 2016-01-08 | The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shel… |
CVE-2015-4694 | High | 8.6 | 2016-01-08 | Directory traversal vulnerability in download.php in the Zip Attachments plugin before 1.5.1 for WordPress allows remote attackers to read arbitrary files via… |
CVE-2015-8761 | Critical | 9.0 | 2016-01-08 | The Values module 7.x-1.x before 7.x-1.2 for Drupal does not properly check permissions, which allows remote administrators with the "Import value sets" permis… |
CVE-2015-8760 | Medium | 6.1 | 2016-01-08 | The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Si… |
CVE-2015-8759 | Medium | 5.4 | 2016-01-08 | Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote authenticated editors to inje… |
CVE-2015-8758 | Medium | 5.4 | 2016-01-08 | Multiple cross-site scripting (XSS) vulnerabilities in unspecified frontend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authentic… |
CVE-2015-8757 | Medium | 6.1 | 2016-01-08 | Cross-site scripting (XSS) vulnerability in the Extension Manager in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote attackers to inject arbitrary… |
CVE-2015-8756 | Medium | 5.4 | 2016-01-08 | Cross-site scripting (XSS) vulnerability in the search result view in the Indexed Search (indexed_search) component in TYPO3 6.2.x before 6.2.16 allows remote… |
CVE-2015-8755 | Medium | 5.4 | 2016-01-08 | Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authentica… |
CVE-2015-8754 | High | 7.5 | 2016-01-08 | The Mollom module 6.x-2.7 before 6.x-2.15 for Drupal allows remote attackers to bypass intended access restrictions and modify the mollom blacklist via unspeci… |
CVE-2015-8753 | Critical | 9.1 | 2016-01-08 | SAP Afaria 7.0.6001.5 allows remote attackers to bypass authorization checks and wipe or lock mobile devices via a crafted request, related to "Insecure signat… |
CVE-2015-8668 | Critical | 9.8 | 2016-01-08 | Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote attackers to execute arbi… |
CVE-2015-8615 | Medium | 5.0 | 2016-01-08 | The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, w… |
CVE-2015-8612 | High | 8.4 | 2016-01-08 | The EnableNetwork method in the Network class in plugins/mechanism/Network.py in Blueman before 2.0.3 allows local users to gain privileges via the dhcp_handle… |
CVE-2015-8597 | High | 7.4 | 2016-01-08 | Open redirect vulnerability in Blue Coat ProxySG 6.5 before 6.5.8.8 and 6.6 and Advanced Secure Gateway (ASG) 6.6 might allow remote attackers to redirect user… |
CVE-2015-8547 | High | 7.5 | 2016-01-08 | The CoreUserInputHandler::doMode function in core/coreuserinputhandler.cpp in Quassel 0.10.0 allows remote attackers to cause a denial of service (application… |
CVE-2015-8481 | Low | 3.1 | 2016-01-08 | Atlassian JIRA Software 7.0.3, JIRA Core 7.0.3, and the bundled JIRA Service Desk 3.0.3 installer attaches the wrong image to e-mail notifications when a user… |
CVE-2015-8303 | Medium | 4.0 | 2016-01-08 | Huawei Document Security Management (DSM) with software before V100R002C05SPC661 does not clear the clipboard when closing a secure file, which allows local us… |
CVE-2015-8226 | Medium | 5.5 | 2016-01-08 | The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-70… |
CVE-2015-8225 | Medium | 5.5 | 2016-01-08 | The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-70… |
CVE-2015-7758 | Low | 3.3 | 2016-01-08 | Gummi 0.6.5 allows local users to write to arbitrary files via a symlink attack on a temporary dot file that uses the name of an existing file and a (1) .aux… |
CVE-2015-7754 | High | 8.1 | 2016-01-08 | Juniper ScreenOS before 6.3.0r21, when ssh-pka is configured and enabled, allows remote attackers to cause a denial of service (system crash) or execute arbitr… |
CVE-2015-7554 | Critical | 9.8 | 2016-01-08 | The _TIFFVGetField function in tif_dir.c in libtiff 4.0.6 allows attackers to cause a denial of service (invalid memory write and crash) or possibly have unspe… |
CVE-2015-7519 | Low | 3.7 | 2016-01-08 | agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode wi… |
CVE-2015-7362 | High | 7.8 | 2016-01-08 | Fortinet FortiClient Linux SSLVPN before build 2313, when installed on Linux in a home directory that is world readable and executable, allows local users to g… |
CVE-2015-7328 | Medium | 4.7 | 2016-01-08 | Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certificat… |
CVE-2015-6856 | High | 7.8 | 2016-01-08 | Dell Pre-Boot Authentication Driver (PBADRV.sys) 1.0.1.5 allows local users to write to arbitrary physical memory locations and gain privileges via a 0x0022201… |
CVE-2015-5259 | High | 8.6 | 2016-01-08 | Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary co… |
CVE-2015-5254 | Critical | 9.8 | 2016-01-08 | Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code v… |
CVE-2015-8261 | Critical | 9.8 | 2016-01-08 | The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized XML objects, which allows remote attac… |
CVE-2015-6862 | High | 8.4 | 2016-01-08 | HPE UCMDB Browser before 4.02 allows remote attackers to obtain sensitive information or bypass intended access restrictions via unspecified vectors. |
CVE-2015-6434 | Medium | 6.1 | 2016-01-08 | Cisco Prime Infrastructure does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and un… |
CVE-2015-6433 | Medium | 6.5 | 2016-01-08 | SQL injection vulnerability in Cisco Unified Communications Manager 11.0(0.98000.225) allows remote authenticated users to execute arbitrary SQL commands via a… |
CVE-2015-6647 | High | 7.8 | 2016-01-06 | The Widevine QSEE TrustZone application in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted applicat… |
CVE-2015-6646 | Medium | 6.2 | 2016-01-06 | The System V IPC implementation in the kernel in Android before 6.0 2016-01-01 allows attackers to cause a denial of service (global kernel resource consumptio… |
CVE-2015-6645 | Medium | 5.0 | 2016-01-06 | SyncManager in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to cause a denial of service (continuous rebooting) via a crafted applica… |
CVE-2015-6644 | Low | 3.3 | 2016-01-06 | Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information via a crafted application, aka internal… |
CVE-2015-6643 | Medium | 6.6 | 2016-01-06 | Setup Wizard in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows physically proximate attackers to modify settings or bypass a reset protection… |
CVE-2015-6642 | Critical | 9.8 | 2016-01-06 | The kernel in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information, and consequently bypass an unspecified pr… |
CVE-2015-6641 | Low | 3.1 | 2016-01-06 | Bluetooth in Android 6.0 before 2016-01-01 allows remote attackers to obtain sensitive Contacts information by leveraging pairing, aka internal bug 23607427. |
CVE-2015-6640 | High | 7.8 | 2016-01-06 | The prctl_set_vma_anon_name function in kernel/sys.c in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 does not ensure that only one vma is accessed in… |
CVE-2015-6639 | High | 7.8 | 2016-01-06 | The Widevine QSEE TrustZone application in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted applicat… |
CVE-2015-6638 | High | 7.8 | 2016-01-06 | The Imagination Technologies driver in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted application… |
CVE-2015-6637 | High | 7.8 | 2016-01-06 | The MediaTek misc-sd driver in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted application, aka interna… |
CVE-2015-6636 | Critical | 9.8 | 2016-01-06 | mediaserver in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory… |
CVE-2015-5310 | Medium | 4.3 | 2016-01-06 | The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 does not properly ignore key data in response frames when management frame protection (MFP) was not ne… |
CVE-2015-6861 | High | 7.5 | 2016-01-05 | HPE Helion Eucalyptus 3.4.0 through 4.2.0 allows remote authenticated users to bypass an intended AssumeRole permission requirement and assume an IAM role by l… |
CVE-2015-6860 | High | 8.4 | 2016-01-05 | HPE Network Switches with software 15.16.x and 15.17.x allow local users to bypass intended access restrictions via unspecified vectors, a different vulnerabil… |
CVE-2015-6859 | High | 7.8 | 2016-01-05 | HPE Network Switches with software 15.16.x and 15.17.x allow local users to bypass intended access restrictions via unspecified vectors, a different vulnerabil… |
CVE-2015-6858 | Low | 3.7 | 2016-01-05 | HP Insight Control server provisioning before 7.5.0 RabbitMQ allows remote attackers to obtain sensitive information via unspecified vectors. |
CVE-2015-5447 | Medium | 5.4 | 2016-01-05 | Cross-site scripting (XSS) vulnerability in HP StoreOnce Backup system software before 3.13.1 allows remote authenticated users to inject arbitrary web script… |
CVE-2015-5446 | High | 7.5 | 2016-01-05 | HP StoreOnce Backup system software before 3.13.1 allows remote attackers to execute arbitrary code via unspecified vectors. |
CVE-2015-5445 | High | 8.8 | 2016-01-05 | Cross-site request forgery (CSRF) vulnerability in HP StoreOnce Backup system software before 3.13.1 allows remote authenticated users to hijack the authentica… |
CVE-2015-5434 | Medium | 6.5 | 2016-01-05 | HPE Networking Products, originally branded as Comware 5, Comware 7, H3C, or HP, allow remote attackers to bypass intended access restrictions or cause a denia… |
CVE-2015-6432 | High | 7.5 | 2016-01-05 | Cisco IOS XR 4.2.0, 4.3.0, 5.0.0, 5.1.0, 5.2.0, 5.2.2, 5.2.4, 5.3.0, and 5.3.2 does not properly restrict the number of Path Computation Elements (PCEs) for OS… |
CVE-2015-8742 | Medium | 5.5 | 2016-01-04 | The dissect_CPMSetBindings function in epan/dissectors/packet-mswsp.c in the MS-WSP dissector in Wireshark 2.0.x before 2.0.1 does not validate the column size… |
CVE-2015-8741 | Medium | 5.5 | 2016-01-04 | The dissect_ppi function in epan/dissectors/packet-ppi.c in the PPI dissector in Wireshark 2.0.x before 2.0.1 does not initialize a packet-header data structur… |
CVE-2015-8740 | Medium | 5.3 | 2016-01-04 | The dissect_tds7_colmetadata_token function in epan/dissectors/packet-tds.c in the TDS dissector in Wireshark 2.0.x before 2.0.1 does not validate the number o… |
CVE-2015-8739 | Medium | 5.5 | 2016-01-04 | The ipmi_fmt_udpport function in epan/dissectors/packet-ipmi.c in the IPMI dissector in Wireshark 2.0.x before 2.0.1 improperly attempts to access a packet sco… |
CVE-2015-8738 | Medium | 5.5 | 2016-01-04 | The s7comm_decode_ud_cpu_szl_subfunc function in epan/dissectors/packet-s7comm_szl_ids.c in the S7COMM dissector in Wireshark 2.0.x before 2.0.1 does not valid… |
CVE-2015-8737 | Medium | 5.5 | 2016-01-04 | The mp2t_open function in wiretap/mp2t.c in the MP2T file parser in Wireshark 2.0.x before 2.0.1 does not validate the bit rate, which allows remote attackers… |
CVE-2015-8736 | Medium | 5.5 | 2016-01-04 | The mp2t_find_next_pcr function in wiretap/mp2t.c in the MP2T file parser in Wireshark 2.0.x before 2.0.1 does not reserve memory for a trailer, which allows r… |
CVE-2015-8735 | Medium | 5.5 | 2016-01-04 | The get_value function in epan/dissectors/packet-btatt.c in the Bluetooth Attribute (aka BT ATT) dissector in Wireshark 2.0.x before 2.0.1 uses an incorrect in… |
CVE-2015-8734 | Medium | 5.5 | 2016-01-04 | The dissect_nwp function in epan/dissectors/packet-nwp.c in the NWP dissector in Wireshark 2.0.x before 2.0.1 mishandles the packet type, which allows remote a… |
CVE-2015-8733 | Medium | 5.5 | 2016-01-04 | The ngsniffer_process_record function in wiretap/ngsniffer.c in the Sniffer file parser in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not valid… |
CVE-2015-8732 | Medium | 5.5 | 2016-01-04 | The dissect_zcl_pwr_prof_pwrprofstatersp function in epan/dissectors/packet-zbee-zcl-general.c in the ZigBee ZCL dissector in Wireshark 1.12.x before 1.12.9 an… |
CVE-2015-8731 | Medium | 5.5 | 2016-01-04 | The dissct_rsl_ipaccess_msg function in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not rej… |
CVE-2015-8730 | Medium | 5.5 | 2016-01-04 | epan/dissectors/packet-nbap.c in the NBAP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the number of items, which allow… |
CVE-2015-8729 | Medium | 5.5 | 2016-01-04 | The ascend_seek function in wiretap/ascendtext.c in the Ascend file parser in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not ensure the presenc… |
CVE-2015-8728 | Medium | 5.5 | 2016-01-04 | The Mobile Identity parser in (1) epan/dissectors/packet-ansi_a.c in the ANSI A dissector and (2) epan/dissectors/packet-gsm_a_common.c in the GSM A dissector… |
CVE-2015-8727 | Medium | 5.5 | 2016-01-04 | The dissect_rsvp_common function in epan/dissectors/packet-rsvp.c in the RSVP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not prope… |
CVE-2015-8726 | Medium | 5.5 | 2016-01-04 | wiretap/vwr.c in the VeriWave file parser in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate certain signature and Modulation and Codin… |
CVE-2015-8725 | Medium | 5.5 | 2016-01-04 | The dissect_diameter_base_framed_ipv6_prefix function in epan/dissectors/packet-diameter.c in the DIAMETER dissector in Wireshark 1.12.x before 1.12.9 and 2.0… |
CVE-2015-8724 | Medium | 5.5 | 2016-01-04 | The AirPDcapDecryptWPABroadcastKey function in epan/crypt/airpdcap.c in the 802.11 dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not… |
CVE-2015-8723 | Medium | 5.5 | 2016-01-04 | The AirPDcapPacketProcess function in epan/crypt/airpdcap.c in the 802.11 dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate… |
CVE-2015-8722 | Medium | 5.5 | 2016-01-04 | epan/dissectors/packet-sctp.c in the SCTP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the frame pointer, which allows… |
CVE-2015-8721 | Medium | 5.5 | 2016-01-04 | Buffer overflow in the tvb_uncompress function in epan/tvbuff_zlib.c in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 allows remote attackers to cause… |
CVE-2015-8720 | Medium | 5.5 | 2016-01-04 | The dissect_ber_GeneralizedTime function in epan/dissectors/packet-ber.c in the BER dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 improper… |
CVE-2015-8719 | Medium | 5.5 | 2016-01-04 | The dissect_dns_answer function in epan/dissectors/packet-dns.c in the DNS dissector in Wireshark 1.12.x before 1.12.9 mishandles the EDNS0 Client Subnet optio… |
CVE-2015-8718 | Medium | 5.5 | 2016-01-04 | Double free vulnerability in epan/dissectors/packet-nlm.c in the NLM dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1, when the "Match MSG/RE… |
CVE-2015-8717 | Medium | 5.5 | 2016-01-04 | The dissect_sdp function in epan/dissectors/packet-sdp.c in the SDP dissector in Wireshark 1.12.x before 1.12.9 does not prevent use of a negative media count… |
CVE-2015-8716 | Medium | 5.5 | 2016-01-04 | The init_t38_info_conv function in epan/dissectors/packet-t38.c in the T.38 dissector in Wireshark 1.12.x before 1.12.9 does not ensure that a conversation exi… |
CVE-2015-8715 | Medium | 5.5 | 2016-01-04 | epan/dissectors/packet-alljoyn.c in the AllJoyn dissector in Wireshark 1.12.x before 1.12.9 does not check for empty arguments, which allows remote attackers t… |
CVE-2015-8714 | Medium | 5.5 | 2016-01-04 | The dissect_dcom_OBJREF function in epan/dissectors/packet-dcom.c in the DCOM dissector in Wireshark 1.12.x before 1.12.9 does not initialize a certain IPv4 da… |
CVE-2015-8713 | Medium | 5.5 | 2016-01-04 | epan/dissectors/packet-umts_fp.c in the UMTS FP dissector in Wireshark 1.12.x before 1.12.9 does not properly reserve memory for channel ID mappings, which all… |
CVE-2015-8712 | Medium | 5.5 | 2016-01-04 | The dissect_hsdsch_channel_info function in epan/dissectors/packet-umts_fp.c in the UMTS FP dissector in Wireshark 1.12.x before 1.12.9 does not validate the n… |
CVE-2015-8711 | Medium | 5.5 | 2016-01-04 | epan/dissectors/packet-nbap.c in the NBAP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate conversation data, which allows… |
CVE-2015-3182 | Medium | 5.5 | 2016-01-04 | epan/dissectors/packet-dec-dnart.c in the DECnet NSP/RT dissector in Wireshark 1.10.12 through 1.10.14 mishandles a certain strdup return value, which allows r… |
CVE-2015-8509 | Low | 3.5 | 2016-01-03 | Template.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.16, 4.3.x and 4.4.x before 4.4.11, and 4.5.x and 5.0.x before 5.0.2 does not properly construct CSV files… |
CVE-2015-8508 | Medium | 4.7 | 2016-01-03 | Cross-site scripting (XSS) vulnerability in showdependencygraph.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2.16, 4.3.x and 4.4.x before 4.4.11, and 4.5.x and 5… |
CVE-2015-5051 | Medium | 4.3 | 2016-01-03 | IBM Maximo Asset Management 7.5 before 7.5.0.8 IF6 and 7.6 before 7.6.0.2 IF1 and Maximo Asset Management 7.5 before 7.5.0.8 IF6, 7.5.1, and 7.6 before 7.6.0.2… |
CVE-2015-5038 | High | 7.5 | 2016-01-03 | IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 does not properly detect recursion during XML entity expansion, whic… |
CVE-2015-5037 | Medium | 5.4 | 2016-01-03 | Cross-site request forgery (CSRF) vulnerability in IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 allows remote aut… |
CVE-2015-5036 | Medium | 5.4 | 2016-01-03 | Cross-site scripting (XSS) vulnerability in IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 allows remote authentica… |
CVE-2015-5035 | Medium | 5.4 | 2016-01-03 | Cross-site scripting (XSS) vulnerability in IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 allows remote authentica… |
CVE-2015-5023 | Medium | 5.4 | 2016-01-03 | SQL injection vulnerability in IBM Curam Social Program Management 6.1 before 6.1.1 allows remote authenticated users to execute arbitrary SQL commands via uns… |