2015 CVEs (page 4)
Page 4 of 88 — CVEs published in 2015, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-4042 | Critical | 9.8 | 2020-01-24 | Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 might allow attackers to cause a denial of service (application… |
CVE-2015-4041 | High | 7.8 | 2020-01-24 | The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a size calculation without considering the number of by… |
CVE-2015-5333 | High | 7.5 | 2020-01-23 | Memory leak in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (memory consumption) via a large number o… |
CVE-2015-5745 | Medium | 6.5 | 2020-01-23 | Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows guest users to cause a denial of service (QEMU proc… |
CVE-2015-5334 | Critical | 9.8 | 2020-01-23 | Off-by-one error in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (program crash) or possible execute… |
CVE-2015-5278 | Medium | 6.5 | 2020-01-23 | The ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows attackers to cause a denial of service (infinite loop and instance crash) or possi… |
CVE-2015-5239 | Medium | 6.5 | 2020-01-23 | Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, wh… |
CVE-2015-2784 | Critical | 9.8 | 2020-01-21 | The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input. |
CVE-2015-6591 | Medium | 5.5 | 2020-01-15 | Directory traversal vulnerability in application/templates/amelia/loadjs.php in Free Reprintables ArticleFR 3.0.7 and earlier allows local users to read arbitr… |
CVE-2015-1811 | High | 7.5 | 2020-01-15 | XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via a craf… |
CVE-2015-1809 | High | 7.5 | 2020-01-15 | XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via an XPa… |
CVE-2015-5072 | Medium | 6.5 | 2020-01-15 | The BIRT Engine servlet in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users to "navigate" to a… |
CVE-2015-5071 | Medium | 6.5 | 2020-01-15 | AR System Mid Tier in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users to "navigate" to arbitr… |
CVE-2015-6497 | High | 8.8 | 2020-01-15 | The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before… |
CVE-2015-5952 | Critical | 9.8 | 2020-01-15 | Directory traversal vulnerability in Thomson Reuters for FATCA before 5.2 allows remote attackers to execute arbitrary files via the item parameter. |
CVE-2015-5230 | High | 7.5 | 2020-01-15 | The DNS packet parsing/generation code in PowerDNS (aka pdns) Authoritative Server 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (cra… |
CVE-2015-7874 | Critical | 9.8 | 2020-01-15 | Buffer overflow in the chat server in KiTTY Portable 0.65.0.2p and earlier allows remote attackers to execute arbitrary code via a long nickname. |
CVE-2015-5484 | Medium | 5.4 | 2020-01-15 | Cross-site scripting (XSS) vulnerability in the Plotly plugin before 1.0.3 for WordPress allows remote authenticated users to inject arbitrary web script or HT… |
CVE-2015-5466 | High | 7.8 | 2020-01-15 | Silicon Integrated Systems XGI WindowsXP Display Manager (aka XGI VGA Driver Manager and VGA Display Manager) 6.14.10.1090 allows local users to gain privilege… |
CVE-2015-8549 | High | 7.1 | 2020-01-15 | XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action… |
CVE-2015-7556 | High | 7.8 | 2020-01-15 | DeleGate 9.9.13 allows local users to gain privileges as demonstrated by the dgcpnod setuid program. |
CVE-2015-3159 | High | 7.8 | 2020-01-14 | The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) does not properly handle the process environment before inv… |
CVE-2015-3151 | High | 7.8 | 2020-01-14 | Directory traversal vulnerability in abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to read, write to, or change ownership of arbitrary fi… |
CVE-2015-3150 | High | 7.1 | 2020-01-14 | abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to delete or change the ownership of arbitrary files via the problem directory argument to… |
CVE-2015-3147 | Medium | 6.5 | 2020-01-14 | daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local users to write to ar… |
CVE-2015-1869 | High | 7.8 | 2020-01-14 | The default event handling scripts in Automatic Bug Reporting Tool (ABRT) allow local users to gain privileges as demonstrated by a symlink attack on a var_log… |
CVE-2015-2326 | Medium | 5.5 | 2020-01-14 | The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read)… |
CVE-2015-2325 | High | 7.8 | 2020-01-14 | The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap rea… |
CVE-2015-0558 | Medium | 5.3 | 2020-01-14 | The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6, and possibly other routers, uses "1236790" and the MAC addre… |
CVE-2015-8367 | Critical | 9.8 | 2020-01-14 | The phase_one_correct function in Libraw before 0.17.1 allows attackers to cause memory errors and possibly execute arbitrary code, related to memory object in… |
CVE-2015-8366 | Critical | 9.8 | 2020-01-14 | Array index error in smal_decode_segment function in LibRaw before 0.17.1 allows context-dependent attackers to cause memory errors and possibly execute arbitr… |
CVE-2015-5951 | Critical | 9.9 | 2020-01-06 | A file upload issue exists in the specid parameter in Thomson Reuters FATCH before 5.2, which allows malicious users to upload arbitrary PHP files to the web r… |
CVE-2015-4553 | High | 8.8 | 2020-01-06 | A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell. |
CVE-2015-4039 | Medium | 5.4 | 2020-01-06 | Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web sc… |
CVE-2015-9540 | Medium | 6.1 | 2020-01-04 | Chamilo LMS through 1.9.10.2 allows a link_goto.php?link_url= open redirect, a related issue to CVE-2015-5503. |
CVE-2015-5595 | Medium | 6.5 | 2019-12-31 | Cross-site request forgery (CSRF) vulnerability in admin.php in Zenphoto before 1.4.9 allows remote attackers to hijack the authentication of admin users for r… |
CVE-2015-5593 | Medium | 6.1 | 2019-12-31 | The sanitize_string function in Zenphoto before 1.4.9 does not properly sanitize HTML tags, which allows remote attackers to perform a cross-site scripting (XS… |
CVE-2015-5592 | Medium | 6.1 | 2019-12-31 | Incomplete blacklist in sanitize_string in Zenphoto before 1.4.9 allows remote attackers to conduct cross-site scripting (XSS) attacks. |
CVE-2015-5591 | High | 7.2 | 2019-12-31 | SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute arbitrary SQL commands. |
CVE-2015-5290 | High | 7.5 | 2019-12-26 | A Denial of Service vulnerability exists in ircd-ratbox 3.0.9 in the MONITOR Command Handler. |
CVE-2015-8313 | Medium | 5.9 | 2019-12-20 | GnuTLS incorrectly validates the first byte of padding in CBC modes |
CVE-2015-7892 | High | 7.8 | 2019-12-09 | Stack-based buffer overflow in the m2m1shot_compat_ioctl32 function in the Samsung m2m1shot driver framework, as used in Samsung S6 Edge, allows local users to… |
CVE-2015-3425 | Medium | 6.1 | 2019-12-09 | Cross-site scripting (XSS) vulnerability in Accentis Content Resource Management System before October 2015 patch allows remote attackers to inject arbitrary w… |
CVE-2015-3424 | High | 8.8 | 2019-12-09 | SQL injection vulnerability in Accentis Content Resource Management System before the October 2015 patch allows remote attackers to execute arbitrary SQL comma… |
CVE-2015-1853 | Medium | 6.5 | 2019-12-09 | chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allows remote attackers with knowledge of NTP… |
CVE-2015-0841 | High | 7.5 | 2019-12-09 | Off-by-one error in the readBuf function in listener.cpp in libcapsinetwork and monopd before 0.9.8, allows remote attackers to cause a denial of service (cras… |
CVE-2015-7542 | Medium | 5.3 | 2019-12-03 | A vulnerability exists in libgwenhywfar through 4.12.0 due to the usage of outdated bundled CA certificates. |
CVE-2015-0837 | Medium | 5.9 | 2019-11-29 | The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when… |
CVE-2015-3406 | High | 7.5 | 2019-11-29 | The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SIGNATURE file to be treated as the signe… |
CVE-2015-2060 | Medium | 5.3 | 2019-11-29 | cabextract before 1.6 does not properly check for leading slashes when extracting files, which allows remote attackers to conduct absolute directory traversal… |
CVE-2015-1855 | Medium | 5.9 | 2019-11-29 | verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate… |
CVE-2015-9539 | Medium | 6.1 | 2019-11-26 | The Fast Secure Contact Form plugin before 4.0.38 for WordPress allows fs_contact_form1[welcome] XSS. |
CVE-2015-9538 | Medium | 6.5 | 2019-11-26 | The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection. |
CVE-2015-9537 | Medium | 5.4 | 2019-11-26 | The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width, thumbnail_height, thumbwidth, thumbheight, wmXpos, an… |
CVE-2015-4457 | Medium | 5.4 | 2019-11-26 | Multiple cross-site scripting (XSS) vulnerabilities in the Cloudera Manager UI before 5.4.3 allow remote authenticated users to inject arbitrary web script or… |
CVE-2015-7831 | High | 8.8 | 2019-11-26 | In Cloudera Hue, there is privilege escalation by a read-only user when CDH 5.x brefore 5.4.9 is used. |
CVE-2015-6495 | High | 7.5 | 2019-11-26 | There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles. |
CVE-2015-1396 | High | 7.5 | 2019-11-25 | A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file… |
CVE-2015-7810 | Medium | 4.7 | 2019-11-22 | libbluray MountManager class has a time-of-check time-of-use (TOCTOU) race when expanding JAR files |
CVE-2015-5694 | Medium | 6.5 | 2019-11-22 | Designate does not enforce the DNS protocol limit concerning record set sizes |
CVE-2015-1780 | Medium | 6.5 | 2019-11-22 | oVirt users with MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data-center |
CVE-2015-3140 | High | 8.8 | 2019-11-21 | Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTai… |
CVE-2015-2793 | Medium | 6.1 | 2019-11-21 | Cross-site scripting (XSS) vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote attackers to inject arbitrary web script… |
CVE-2015-3167 | High | 7.5 | 2019-11-20 | contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error respons… |
CVE-2015-3166 | Critical | 9.8 | 2019-11-20 | The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly… |
CVE-2015-1607 | Medium | 5.5 | 2019-11-20 | kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not properly handle bitwise left-shifts, which allows remote attac… |
CVE-2015-1606 | Medium | 5.5 | 2019-11-20 | The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a denial of service (invalid read and use… |
CVE-2015-7276 | Medium | 5.9 | 2019-11-06 | Technicolor C2000T and C2100T uses hard-coded cryptographic keys. |
CVE-2015-8980 | Critical | 9.8 | 2019-11-04 | The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code. |
CVE-2015-0270 | Critical | 9.8 | 2019-10-25 | Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter. |
CVE-2015-9524 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Recount Earnings extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x… |
CVE-2015-9523 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Recommended Products extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2… |
CVE-2015-9522 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) QR Code extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2… |
CVE-2015-9521 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Pushover Notifications extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5… |
CVE-2015-9520 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Per Product Emails extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1… |
CVE-2015-9519 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) PDF Stamper extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x befor… |
CVE-2015-9518 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) PDF Invoices extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x befo… |
CVE-2015-9517 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Manual Purchases extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x… |
CVE-2015-9516 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Invoices extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2… |
CVE-2015-9515 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) htaccess Editor extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x b… |
CVE-2015-9514 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Free Downloads extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x be… |
CVE-2015-9513 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Favorites extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before… |
CVE-2015-9512 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) CSV Manager extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x befor… |
CVE-2015-9511 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Conditional Success Redirects extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before… |
CVE-2015-9510 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Cross-sell Upsell extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x… |
CVE-2015-9509 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Content Restriction extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1… |
CVE-2015-9508 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Commissions extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x befor… |
CVE-2015-9507 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Attach Accounts to Orders extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0… |
CVE-2015-9506 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Amazon S3 extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before… |
CVE-2015-9505 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) core component 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x… |
CVE-2015-9504 | Medium | 6.1 | 2019-10-23 | The weeklynews theme before 2.2.9 for WordPress has XSS via the s parameter. |
CVE-2015-9503 | Medium | 6.1 | 2019-10-23 | The Modern theme before 1.4.2 for WordPress has XSS via the genericons/example.html anchor identifier. |
CVE-2015-9502 | Medium | 6.1 | 2019-10-23 | The Auberge theme before 1.4.5 for WordPress has XSS via the genericons/example.html anchor identifier. |
CVE-2015-9536 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Twenty-Twelve theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before… |
CVE-2015-9535 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Shoppette theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1… |
CVE-2015-9534 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Quota theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11… |
CVE-2015-9533 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Lattice theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11… |
CVE-2015-9532 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Digital Store theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before… |
CVE-2015-9531 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Wish Lists extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before… |
CVE-2015-9530 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Upload File extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x befor… |