2015 CVEs (page 7)
Page 7 of 82 — CVEs published in 2015, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-9302 | Medium | 6.1 | 2019-08-13 | The simple-fields plugin before 1.4.11 for WordPress has XSS. |
CVE-2015-9301 | Critical | 9.8 | 2019-08-13 | The liveforms plugin before 3.2.0 for WordPress has SQL injection. |
CVE-2015-9300 | Medium | 6.1 | 2019-08-13 | The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues. |
CVE-2015-9299 | Medium | 6.1 | 2019-08-13 | The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS. |
CVE-2015-9298 | Critical | 9.8 | 2019-08-13 | The events-manager plugin before 5.6 for WordPress has code injection. |
CVE-2015-9297 | Medium | 6.1 | 2019-08-13 | The events-manager plugin before 5.6 for WordPress has XSS. |
CVE-2015-9296 | Medium | 6.1 | 2019-08-13 | The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg. |
CVE-2015-9295 | Medium | 6.1 | 2019-08-13 | The contact-form-plugin plugin before 3.96 for WordPress has XSS. |
CVE-2015-9294 | Medium | 6.1 | 2019-08-13 | The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances. |
CVE-2015-9293 | Medium | 6.1 | 2019-08-13 | The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature. |
CVE-2015-9304 | Medium | 6.1 | 2019-08-12 | The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input. |
CVE-2015-9303 | Medium | 6.1 | 2019-08-12 | The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS. |
CVE-2015-9306 | Medium | 6.1 | 2019-08-12 | The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS. |
CVE-2015-9305 | Medium | 6.1 | 2019-08-12 | The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions. |
CVE-2015-9292 | High | 8.8 | 2019-08-08 | 6kbbs 7.1 and 8.0 allows CSRF via portalchannel_ajax.php (id or code parameter) or admin.php (fileids parameter). |
CVE-2015-9291 | High | 7.5 | 2019-08-01 | cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221). |
CVE-2015-7559 | Low | 2.7 | 2019-08-01 | It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a comprom… |
CVE-2015-5297 | Medium | 6.7 | 2019-07-31 | An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to… |
CVE-2015-9290 | Critical | 9.8 | 2019-07-30 | In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict where there is no check that the new values of cur and l… |
CVE-2015-9288 | Medium | 6.5 | 2019-07-29 | The Unity Web Player plugin before 4.6.6f2 and 5.x before 5.0.3f2 allows attackers to read messages or access online services via a victim's credentials |
CVE-2015-6960 | Medium | 6.1 | 2019-07-29 | edx-platform before 2015-09-17 allows XSS via a team name. |
CVE-2015-6253 | Medium | 5.4 | 2019-07-29 | edx-platform before 2015-08-17 allows XSS in the Studio listing of courses. |
CVE-2015-5601 | High | 8.8 | 2019-07-29 | edx-platform before 2015-07-20 allows code execution by privileged users because the course import endpoint mishandles .tar.gz files. |
CVE-2015-9289 | Medium | 5.5 | 2019-07-27 | In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSE… |
CVE-2015-7882 | High | 8.1 | 2019-07-19 | Improper handling of LDAP authentication in MongoDB Server versions 3.0.0 to 3.0.6 allows an unauthenticated client to gain unauthorized access. |
CVE-2015-3907 | Critical | 9.8 | 2019-07-03 | CodeIgniter Rest Server (aka codeigniter-restserver) 2.7.1 allows XXE attacks. |
CVE-2015-7609 | Medium | 6.1 | 2019-05-30 | Synacor Zimbra Mail Client 8.6 before 8.6.0 Patch 5 has XSS via the error/warning dialog and email body content in Zimbra. |
CVE-2015-2230 | Medium | 6.1 | 2019-05-30 | Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console. |
CVE-2015-9287 | Critical | 9.8 | 2019-05-13 | Directory Traversal was discovered in University of Cambridge mod_ucam_webauth before 2.0.2. The key identification field ("kid") of the IdP's HTTP response me… |
CVE-2015-1006 | Critical | 9.8 | 2019-05-10 | A vulnerable file in Opto 22 PAC Project Professional versions prior to R9.4006, PAC Project Basic versions prior to R9.4006, PAC Display Basic versions prior… |
CVE-2015-9286 | Medium | 6.1 | 2019-04-30 | Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS. |
CVE-2015-9285 | Medium | 6.1 | 2019-04-29 | esoTalk 1.0.0g4 has XSS via the PATH_INFO to the conversations/ URI. |
CVE-2015-9284 | High | 8.8 | 2019-04-26 | The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, al… |
CVE-2015-1343 | Low | 2.0 | 2019-04-22 | All versions of unity-scope-gdrive logs search terms to syslog. |
CVE-2015-1341 | High | 7.4 | 2019-04-22 | Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport befor… |
CVE-2015-1340 | High | 7.0 | 2019-04-22 | LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic l… |
CVE-2015-1327 | Low | 3.9 | 2019-04-22 | Content Hub before version 0.0+15.04.20150331-0ubuntu1.0 DBUS API only requires a file path for a content item, it doesn't actually require the confined app ha… |
CVE-2015-1326 | Medium | 5.7 | 2019-04-22 | python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious… |
CVE-2015-1320 | Medium | 5.5 | 2019-04-22 | The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects Ubuntu MAAS versio… |
CVE-2015-1316 | Medium | 6.4 | 2019-04-22 | Juju Core's Joyent provider before version 1.25.5 uploads the user's private ssh key. |
CVE-2015-5462 | Medium | 6.1 | 2019-04-03 | AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier allows remote attackers to inject HTML into the scoping dashboard features. |
CVE-2015-5384 | High | 8.8 | 2019-04-03 | AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier is vulnerable to a Session Fixation attack. |
CVE-2015-5463 | Critical | 9.8 | 2019-04-03 | AxiomSL's Axiom java applet module (used for editing uploaded Excel files and associated Java RMI services) 9.5.3 and earlier allows remote attackers to (1) ac… |
CVE-2015-5606 | High | 7.5 | 2019-04-03 | Vordel XML Gateway (acquired by Axway) version 7.2.2 could allow remote attackers to cause a denial of service via a specially crafted request. |
CVE-2015-1014 | High | 7.3 | 2019-03-25 | A successful exploit of these vulnerabilities requires the local user to load a crafted DLL file in the system directory on servers running Schneider Electric… |
CVE-2015-1012 | High | 7.5 | 2019-03-25 | Wireless keys are stored in plain text on version 5 of the Hospira LifeCare PCA Infusion System. According to Hospira, version 3 of the LifeCare PCA Infusion S… |
CVE-2015-1007 | High | 7.8 | 2019-03-25 | A specially crafted configuration file could be used to cause a stack-based buffer overflow condition in the OPCTest.exe, which may allow remote code execution… |
CVE-2015-3956 | Critical | 9.8 | 2019-03-25 | Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior acc… |
CVE-2015-3954 | Critical | 9.8 | 2019-03-25 | Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior giv… |
CVE-2015-3953 | Critical | 9.8 | 2019-03-25 | Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq I… |
CVE-2015-3952 | High | 7.5 | 2019-03-25 | Wireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq I… |
CVE-2015-3965 | High | 8.8 | 2019-03-23 | Hospira Symbiq Infusion System 3.13 and earlier allows remote authenticated users to trigger "unanticipated operations" by leveraging "elevated privileges" for… |
CVE-2015-6458 | High | 8.8 | 2019-03-21 | Moxa SoftCMS 1.3 and prior is susceptible to a buffer overflow condition that may crash or allow remote code execution. Moxa released SoftCMS version 1.4 on Ju… |
CVE-2015-6457 | High | 8.8 | 2019-03-21 | Moxa SoftCMS 1.3 and prior is susceptible to a buffer overflow condition that may crash or allow remote code execution. Moxa released SoftCMS version 1.4 on Ju… |
CVE-2015-6462 | Medium | 5.4 | 2019-03-21 | Reflected Cross-Site Scripting (nonpersistent) allows an attacker to craft a specific URL, which contains Java script that will be executed on the Schneider El… |
CVE-2015-6461 | Medium | 5.4 | 2019-03-21 | Remote file inclusion allows an attacker to craft a specific URL referencing the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BM… |
CVE-2015-2254 | Critical | 9.1 | 2019-03-13 | Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to capture and change patch loading information resulting in t… |
CVE-2015-4617 | High | 7.5 | 2019-02-15 | Vulnerability in Easy2map-photos WordPress Plugin v1.09 MapPinImageUpload.php and MapPinIconSave.php allows path traversal when specifying file names creating… |
CVE-2015-4615 | Critical | 9.8 | 2019-02-15 | Vulnerability in Easy2map-photos WordPress Plugin v1.09 allows SQL Injection via unsanitized mapTemplateName, mapName, mapSettingsXML, parentCSSXML, photoCSSXM… |
CVE-2015-9282 | Medium | 6.1 | 2019-02-06 | The Pie Chart Panel plugin through 2019-01-02 for Grafana is vulnerable to XSS via legend data or tooltip data. When a chart is included in a Grafana dashboard… |
CVE-2015-9281 | Medium | 6.1 | 2019-01-17 | Logon Manager in SAS Web Infrastructure Platform before 9.4M3 allows reflected XSS on the Timeout page. |
CVE-2015-9280 | Critical | 10.0 | 2019-01-16 | MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter. |
CVE-2015-9279 | Medium | 6.1 | 2019-01-16 | MailEnable before 8.60 allows Stored XSS via malformed use of "<img/src" with no ">" character in the body of an e-mail message. |
CVE-2015-9278 | Critical | 9.8 | 2019-01-16 | MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB after a password-cha… |
CVE-2015-9277 | Critical | 9.1 | 2019-01-16 | MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/.. /" are m… |
CVE-2015-9276 | Medium | 6.1 | 2019-01-16 | SmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS by bypassing the anti-XSS mechanisms. It was possible to run JavaScript code when a vict… |
CVE-2015-9275 | Medium | 5.3 | 2019-01-07 | ARC 5.21q allows directory traversal via a full pathname in an archive file. |
CVE-2015-9274 | Medium | 6.5 | 2018-11-15 | HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service (invalid read of two bytes and application crash) because of GPOS and GSUB table mis… |
CVE-2015-5159 | High | 7.5 | 2018-10-30 | python-kdcproxy before 0.3.2 allows remote attackers to cause a denial of service via a large POST request. |
CVE-2015-7266 | High | 7.5 | 2018-10-30 | The Interactive Advertising Bureau (IAB) OpenRTB 2.3 protocol implementation might allow remote attackers to conceal the status of ad transactions and potentia… |
CVE-2015-4633 | Critical | 9.8 | 2018-10-18 | Multiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow (1) remote a… |
CVE-2015-4632 | High | 7.5 | 2018-10-18 | Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote… |
CVE-2015-4631 | Medium | 5.4 | 2018-10-18 | Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow… |
CVE-2015-4630 | High | 8.0 | 2018-10-18 | Multiple cross-site request forgery (CSRF) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20… |
CVE-2015-9273 | Medium | 6.1 | 2018-10-07 | The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-base… |
CVE-2015-9272 | Critical | 9.8 | 2018-10-05 | The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file sa… |
CVE-2015-9271 | Critical | 9.8 | 2018-10-04 | The VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress allows remote attackers to execute arbitrary code because vc/vw_upload.p… |
CVE-2015-9270 | Medium | 6.1 | 2018-10-01 | XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter. |
CVE-2015-9269 | High | 7.5 | 2018-10-01 | The export/content.php exportarticle feature in the wordpress-mobile-pack plugin before 2.1.3 2015-06-03 for WordPress allows remote attackers to obtain sensit… |
CVE-2015-9268 | High | 7.8 | 2018-10-01 | Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in whic… |
CVE-2015-9267 | Medium | 5.5 | 2018-10-01 | Nullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a loc… |
CVE-2015-8298 | Critical | 9.8 | 2018-09-24 | Multiple SQL injection vulnerabilities in the login page in RXTEC RXAdmin UPDATE 06 / 2012 allow remote attackers to execute arbitrary SQL commands via the (1)… |
CVE-2015-9266 | Critical | 9.8 | 2018-09-05 | The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and… |
CVE-2015-9264 | Critical | 9.8 | 2018-08-27 | Lansweeper 4.x through 6.x before 6.0.0.48 allows attackers to execute arbitrary code on the administrator's workstation via a crafted Windows service. |
CVE-2015-9263 | Critical | 9.8 | 2018-08-27 | An issue was discovered in post2file.php in Up.Time Monitoring Station 7.5.0 (build 16) and 7.4.0 (build 13). It allows an attacker to upload an arbitrary file… |
CVE-2015-5243 | Critical | 9.8 | 2018-08-20 | phpWhois allows remote attackers to execute arbitrary code via a crafted whois record. |
CVE-2015-5160 | Medium | 5.5 | 2018-08-20 | libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive inf… |
CVE-2015-9262 | Critical | 9.8 | 2018-08-01 | _XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execution via a one-byte… |
CVE-2015-9261 | Medium | 5.5 | 2018-07-26 | huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip op… |
CVE-2015-9260 | Medium | 5.4 | 2018-07-05 | An issue was discovered in BEdita before 3.7.0. A cross-site scripting (XSS) attack occurs via a crafted pages/showObjects URI, as demonstrated by appending a… |
CVE-2015-4043 | Critical | 9.8 | 2018-06-19 | SQL injection vulnerability in ConnX ESP HR Management 4.4.0 allows remote attackers to execute arbitrary SQL commands via the ctl00$cphMainContent$txtUserName… |
CVE-2015-4664 | Critical | 9.8 | 2018-06-18 | An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary commands. |
CVE-2015-9239 | High | 7.5 | 2018-05-31 | ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in. |
CVE-2015-9238 | Medium | 5.3 | 2018-05-31 | secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check p… |
CVE-2015-9236 | Medium | 5.3 | 2018-05-31 | Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-… |
CVE-2015-7610 | High | 8.8 | 2018-05-30 | Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, a… |
CVE-2015-9244 | Critical | 9.8 | 2018-05-29 | Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection. |
CVE-2015-9243 | Medium | 5.9 | 2018-05-29 | When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included s… |
CVE-2015-9242 | High | 7.5 | 2018-05-29 | Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. This leads to a crash… |
CVE-2015-9241 | High | 7.5 | 2018-05-29 | Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 e… |