2015 CVEs (page 3)
Page 3 of 82 — CVEs published in 2015, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-1877 | High | 8.8 | 2021-06-02 | The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables, which allows remote… |
CVE-2015-20001 | High | 7.5 | 2021-04-11 | In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is left in an inconsistent state when the comparison of generic ele… |
CVE-2015-9551 | Critical | 9.8 | 2020-11-24 | An issue was discovered on TOTOLINK A850R-V1 through 1.0.1-B20150707.1612 and F1-V2 through 1.1-B20150708.1646 devices. There is Remote Code Execution in the m… |
CVE-2015-9550 | High | 7.5 | 2020-11-24 | An issue was discovered on TOTOLINK A850R-V1 through 1.0.1-B20150707.1612 and F1-V2 through 1.1-B20150708.1646 devices. By sending a specific hel,xasf packet t… |
CVE-2015-4719 | Critical | 9.8 | 2020-09-24 | The client API authentication mechanism in Pexip Infinity before 10 allows remote attackers to gain privileges via a crafted request. |
CVE-2015-8033 | Medium | 5.3 | 2020-08-14 | In Textpattern 4.5.7, the password-reset feature does not securely tether a hash to a user account. |
CVE-2015-8032 | Medium | 5.3 | 2020-08-14 | In Textpattern 4.5.7, an unprivileged author can change an article's markup setting. |
CVE-2015-9549 | Medium | 6.1 | 2020-08-03 | A reflected Cross-site Scripting (XSS) vulnerability exists in OcPortal 9.0.20 via the OCF_EMOTICON_CELL.tpl FIELD_NAME field to data/emoticons.php. |
CVE-2015-9548 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 1.2.0. It allows attackers to cause a denial of service (memory consumption) via a small compressed file th… |
CVE-2015-7946 | High | 7.3 | 2020-05-07 | Information Exposure vulnerability in Unity8 as used on the Ubuntu phone and possibly also in Unity8 shipped elsewhere. This allows an attacker to enable the M… |
CVE-2015-9547 | High | 7.5 | 2020-04-10 | An issue was discovered on Samsung mobile devices with JBP(4.3) and KK(4.4.2) software. Because the READ_LOGS permission is mishandled, sensitive information i… |
CVE-2015-9546 | Medium | 4.8 | 2020-04-10 | An issue was discovered on Samsung mobile devices with KK(4.4) and later software through 2015-06-16. In some cases, HTTP is used for an Inputmethod, rather th… |
CVE-2015-8546 | Critical | 9.8 | 2020-04-10 | An issue was discovered on Samsung mobile devices with software through 2015-11-12, affecting the Galaxy S6/S6 Edge, Galaxy S6 Edge+, and Galaxy Note5 with the… |
CVE-2015-5524 | Critical | 9.8 | 2020-04-10 | An issue was discovered on Samsung mobile devices with KK(4.4) and later software through 2015-05-13. There is a buffer overflow in datablock_write because the… |
CVE-2015-9545 | High | 7.1 | 2020-04-07 | An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage() function in xdLocalStorage.js does not implement any validation of the origin of… |
CVE-2015-9544 | High | 7.1 | 2020-04-07 | An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage() function in xdLocalStoragePostMessageApi.js does not implement any validation of… |
CVE-2015-8536 | High | 8.8 | 2020-03-27 | MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was discovered (fixed and publicly disclosed in 2015) in Le… |
CVE-2015-8535 | High | 7.8 | 2020-03-27 | MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A directory traversal vulnerability was discovered (fixed and publicly disc… |
CVE-2015-8534 | High | 7.8 | 2020-03-27 | MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was discovered (fixed and public… |
CVE-2015-7336 | High | 7.5 | 2020-03-27 | MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was reported (fixed and publicly disclosed in 2015) in Leno… |
CVE-2015-7335 | High | 7.0 | 2020-03-27 | MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A race condition was reported (fixed and publicly disclosed in 2015) in Len… |
CVE-2015-7334 | High | 7.8 | 2020-03-27 | MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly… |
CVE-2015-7333 | High | 7.8 | 2020-03-27 | MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly… |
CVE-2015-5684 | Critical | 9.8 | 2020-03-27 | MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A buffer overflow vulnerability was reported, (fixed and publicly disclosed… |
CVE-2015-3641 | High | 7.5 | 2020-03-12 | bitcoind and Bitcoin-Qt prior to 0.10.2 allow attackers to cause a denial of service (disabled functionality such as a client application crash) via an "Easy"… |
CVE-2015-7342 | High | 7.2 | 2020-03-09 | JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field. |
CVE-2015-7341 | High | 8.8 | 2020-03-09 | JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension. |
CVE-2015-7340 | High | 7.2 | 2020-03-09 | JEvents Joomla Component before 3.4.0 RC6 has SQL Injection via evid in a Manage Events action. |
CVE-2015-7339 | High | 8.8 | 2020-03-09 | JCE Joomla Component 2.5.0 to 2.5.2 allows arbitrary file upload via a .php file extension for an image file to the /com_jce/editor/libraries/classes/browser.p… |
CVE-2015-7338 | High | 7.2 | 2020-03-09 | SQL Injection exists in AcyMailing Joomla Component before 4.9.5 via exportgeolocorder in a geolocation_longitude request to index.php. |
CVE-2015-7968 | Medium | 4.3 | 2020-03-09 | nwbc_ext2int in SAP NetWeaver Application Server before Security Note 2183189 allows XXE attacks for local file inclusion via the sap/bc/ui2/nwbc/nwbc_ext2int/… |
CVE-2015-7344 | Medium | 4.8 | 2020-03-09 | HikaShop Joomla Component before 2.6.0 has XSS via an injected payload[/caption]. |
CVE-2015-7343 | Medium | 4.8 | 2020-03-09 | JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter. |
CVE-2015-1583 | High | 8.8 | 2020-03-02 | Multiple cross-site request forgery (CSRF) vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrators for requests tha… |
CVE-2015-5361 | Medium | 6.5 | 2020-02-28 | Background For regular, unencrypted FTP traffic, the FTP ALG can inspect the unencrypted control channel and open related sessions for the FTP data channel. Th… |
CVE-2015-3006 | Medium | 6.5 | 2020-02-28 | On the QFX3500 and QFX3600 platforms, the number of bytes collected from the RANDOM_INTERRUPT entropy source when the device boots up is insufficient, possibly… |
CVE-2015-2992 | Medium | 6.1 | 2020-02-27 | Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability. |
CVE-2015-5686 | High | 8.8 | 2020-02-27 | Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF (Cross-Site Request Forgery) attacks. This would allow an atta… |
CVE-2015-5201 | High | 7.5 | 2020-02-25 | VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117.0 as packaged in Re… |
CVE-2015-0565 | Critical | 10.0 | 2020-02-25 | NaCl in 2015 allowed the CLFLUSH instruction, making rowhammer attacks possible. |
CVE-2015-9542 | High | 7.5 | 2020-02-24 | add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer over… |
CVE-2015-4411 | High | 7.5 | 2020-02-20 | The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker… |
CVE-2015-4410 | High | 7.5 | 2020-02-20 | The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of ser… |
CVE-2015-2923 | Medium | 6.5 | 2020-02-20 | The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in FreeBSD through 10.1 allows remote attackers to reconfigure a hop-limit setting via a… |
CVE-2015-7747 | High | 8.8 | 2020-02-19 | Buffer overflow in the afReadFrames function in audiofile (aka libaudiofile and Audio File Library) allows user-assisted remote attackers to cause a denial of… |
CVE-2015-9543 | Low | 3.3 | 2020-02-19 | An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker… |
CVE-2015-0749 | Medium | 4.3 | 2020-02-19 | A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on the a… |
CVE-2015-7507 | High | 7.5 | 2020-02-18 | libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a crafted color table to the (1) bmp_deco… |
CVE-2015-7567 | Critical | 9.8 | 2020-02-18 | SQL injection vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary SQL commands via the "passwordreset&token" parameter. |
CVE-2015-7505 | High | 8.8 | 2020-02-18 | Stack-based buffer overflow in the gif_next_LZW function in libnsgif.c in Libnsgif 0.1.2 allows context-dependent attackers to cause a denial of service (appli… |
CVE-2015-7506 | Medium | 6.5 | 2020-02-18 | The gif_next_LZW function in libnsgif.c in Libnsgif 0.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application c… |
CVE-2015-6970 | Critical | 9.8 | 2020-02-18 | The web interface in Bosch Security Systems NBN-498 Dinion2X Day/Night IP Cameras with H.264 Firmware 4.54.0026 allows remote attackers to conduct XML injectio… |
CVE-2015-1425 | Critical | 9.8 | 2020-02-18 | JAKWEB Gecko CMS has Multiple Input Validation Vulnerabilities |
CVE-2015-8751 | High | 8.8 | 2020-02-17 | Integer overflow in the jas_matrix_create function in JasPer allows context-dependent attackers to have unspecified impact via a crafted JPEG 2000 image, relat… |
CVE-2015-5216 | Medium | 6.1 | 2020-02-17 | The Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly escape certain characters in a Python exception-message template, which make… |
CVE-2015-5215 | Medium | 6.1 | 2020-02-17 | The default configuration of the Jinja templating engine used in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not enable auto-escaping… |
CVE-2015-4715 | Medium | 4.9 | 2020-02-17 | The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox s… |
CVE-2015-6922 | Critical | 9.8 | 2020-02-17 | Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authe… |
CVE-2015-0258 | High | 8.8 | 2020-02-17 | Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before 2.1 allow remote authenticated users to… |
CVE-2015-6589 | High | 8.8 | 2020-02-13 | Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and… |
CVE-2015-3309 | High | 7.5 | 2020-02-13 | Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of t… |
CVE-2015-7890 | Medium | 5.5 | 2020-02-12 | Multiple buffer overflows in the esa_write function in /dev/seirenin the Exynos Seiren Audio driver, as used in Samsung S6 Edge, allow local users to cause a d… |
CVE-2015-5617 | Critical | 9.8 | 2020-02-12 | SQL injection vulnerability in pub/m_pending_news/delete_pending_news.jsp in Enorth Webpublisher CMS allows remote attackers to execute arbitrary SQL commands… |
CVE-2015-7508 | High | 8.8 | 2020-02-12 | Heap-based buffer overflow in the bmp_decode_rle function in libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent attackers to cause a denial of service (appl… |
CVE-2015-5741 | Critical | 9.8 | 2020-02-08 | The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smu… |
CVE-2015-3423 | High | 8.8 | 2020-02-08 | Multiple SQL injection vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to execute arbitrary SQL commands v… |
CVE-2015-2207 | Medium | 5.4 | 2020-02-08 | Multiple cross-site scripting (XSS) vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to inject arbitrary we… |
CVE-2015-2062 | High | 7.2 | 2020-02-08 | Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) plugin before 2.7.0 for WordPress allow remote administrators to execute arbitrary… |
CVE-2015-1394 | Medium | 5.4 | 2020-02-08 | Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrar… |
CVE-2015-2909 | Critical | 9.8 | 2020-02-06 | Dedicated Micros DV-IP Express, SD Advanced, SD, EcoSense, and DS2 devices rely on a GUI warning to help ensure that the administrator configures login credent… |
CVE-2015-6000 | High | 8.8 | 2020-02-06 | Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtig… |
CVE-2015-5628 | Critical | 9.8 | 2020-02-05 | Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CE… |
CVE-2015-5627 | Critical | 9.8 | 2020-02-05 | Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CE… |
CVE-2015-5626 | Critical | 9.8 | 2020-02-05 | Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CE… |
CVE-2015-0102 | High | 8.1 | 2020-02-05 | IBM Workflow for Bluemix does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this co… |
CVE-2015-2802 | High | 7.5 | 2020-02-04 | An Information Disclosure vulnerability exists in HP SiteScope 11.2 and 11.3 on Windows, Linux and Solaris, HP Asset Manager 9.30 through 9.32, 9.40 through 9… |
CVE-2015-3613 | Critical | 9.8 | 2020-02-04 | A vulnerability exists in in FortiManager 5.2.1 and earlier and 5.0.10 and earlier in the WebUI FTP backup page |
CVE-2015-3612 | Medium | 5.4 | 2020-02-04 | A Cross-site Scripting (XSS) vulnerability exists in FortiManager 5.2.1 and earlier and 5.0.10 and earlier via an unspecified parameter in the FortiWeb auto up… |
CVE-2015-3611 | High | 8.8 | 2020-02-04 | A Command Injection vulnerability exists in FortiManager 5.2.1 and earlier and FortiManager 5.0.10 and earlier via unspecified vectors, which could let a malic… |
CVE-2015-6815 | Low | 3.5 | 2020-01-31 | The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which a… |
CVE-2015-8851 | High | 7.5 | 2020-01-30 | node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force gu… |
CVE-2015-0949 | High | 7.8 | 2020-01-30 | The System Management Mode (SMM) implementation in Dell Latitude E6430 BIOS Revision A09, HP EliteBook 850 G1 BIOS revision L71 Ver. 01.09, and possibly other… |
CVE-2015-5483 | High | 8.8 | 2020-01-28 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication o… |
CVE-2015-8012 | High | 7.5 | 2020-01-28 | lldpd before 0.8.0 allows remote attackers to cause a denial of service (assertion failure and daemon crash) via a malformed packet. |
CVE-2015-8011 | Critical | 9.8 | 2020-01-28 | Buffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote attackers to cause a denial of service (daemon crash… |
CVE-2015-7851 | Medium | 6.5 | 2020-01-28 | Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '\' or '/' c… |
CVE-2015-2249 | Medium | 5.4 | 2020-01-27 | Zimbra Collaboration before 8.6.0 patch5 has XSS. |
CVE-2015-3154 | Medium | 6.1 | 2020-01-27 | CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inj… |
CVE-2015-0294 | High | 7.5 | 2020-01-27 | GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate. |
CVE-2015-0244 | Critical | 9.8 | 2020-01-27 | PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a… |
CVE-2015-0243 | High | 8.8 | 2020-01-27 | Multiple buffer overflows in contrib/pgcrypto in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1… |
CVE-2015-0242 | High | 8.8 | 2020-01-27 | Stack-based buffer overflow in the *printf function implementations in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6… |
CVE-2015-0241 | High | 8.8 | 2020-01-27 | The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authentica… |
CVE-2015-9541 | High | 7.5 | 2020-01-24 | Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a related issue to CVE-200… |
CVE-2015-2929 | High | 7.5 | 2020-01-24 | The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to cause a deni… |
CVE-2015-2928 | High | 7.5 | 2020-01-24 | The Hidden Service (HS) server implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote attackers to cause a de… |
CVE-2015-2689 | High | 7.5 | 2020-01-24 | Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle pending-connection resolve states during periods of high DNS load, which allows remote… |
CVE-2015-2688 | High | 7.5 | 2020-01-24 | buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts, which allows r… |
CVE-2015-1530 | High | 7.8 | 2020-01-24 | media/libmedia/IAudioPolicyService.cpp in Android before 5.1 allows attackers to execute arbitrary code with media_server privileges or cause a denial of servi… |
CVE-2015-1525 | Medium | 5.5 | 2020-01-24 | audio/AudioPolicyManagerBase.cpp in Android before 5.1 allows attackers to cause a denial of service (audio_policy application outage) via a crafted applicatio… |