2015 CVEs (page 9)
Page 9 of 82 — CVEs published in 2015, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-9124 | Critical | 9.1 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, MDM9640, MDM9645, SD 210/SD 212/SD 205, SD 400, S… |
CVE-2015-9123 | High | 7.5 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile, Snapdragon Wear, and Small Cell SoC FSM9055, IPQ4019, MDM9206, MDM9… |
CVE-2015-9122 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MD… |
CVE-2015-9120 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM960… |
CVE-2015-9119 | High | 7.5 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MD… |
CVE-2015-9118 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, MDM9635M, SD 400, SD 410/12, SD 615/16/SD 415, SD… |
CVE-2015-9116 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, S… |
CVE-2015-9115 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 410/12, SD 425, SD 430, SD 450… |
CVE-2015-9114 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 425, SD 430, SD 450, SD 625, SD 650/52… |
CVE-2015-9113 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, S… |
CVE-2015-9112 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 400, SD 800, SD 820, and SD 82… |
CVE-2015-9111 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, S… |
CVE-2015-9110 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 425, SD 430, SD 450, SD 625, SD 650/52… |
CVE-2015-9109 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, S… |
CVE-2015-9108 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, S… |
CVE-2015-1952 | Medium | 5.4 | 2018-04-16 | Cross-site scripting (XSS) vulnerability in IBM AppScan Enterprise Edition 9.0.x before 9.0.2 iFix 001 allows remote attackers to inject arbitrary web script o… |
CVE-2015-0153 | High | 7.5 | 2018-04-12 | D-Link DIR-815 devices with firmware before 2.07.B01 allow remote attackers to obtain sensitive information by leveraging cleartext storage of the wireless key. |
CVE-2015-0152 | Critical | 9.8 | 2018-04-12 | D-Link DIR-815 devices with firmware before 2.07.B01 allow remote attackers to obtain sensitive information by leveraging cleartext storage of the administrati… |
CVE-2015-0151 | High | 8.8 | 2018-04-12 | Cross-site request forgery (CSRF) vulnerability in D-Link DIR-815 devices with firmware before 2.07.B01 allows remote attackers to hijack the authentication of… |
CVE-2015-0150 | Critical | 9.8 | 2018-04-12 | The remote administration UI in D-Link DIR-815 devices with firmware before 2.07.B01 allows remote attackers to bypass intended access restrictions via unspeci… |
CVE-2015-4557 | Medium | 6.1 | 2018-04-12 | Cross-site scripting (XSS) vulnerability in the new_Twitter_sign_button function in nextend-Twitter-connect.php in the Nextend Twitter Connect plugin before 1… |
CVE-2015-1777 | Medium | 5.9 | 2018-04-12 | rhnreg_ks in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Gluster Storage 2.1 and Enterprise Linux (RHEL) 5, 6, and 7 does not properly valid… |
CVE-2015-1957 | Medium | 5.3 | 2018-04-10 | IBM WebSphere MQ 7.5.x before 7.5.0.6 and 8.0.x before 8.0.0.3 allows remote authenticated users to obtain sensitive information via a man-in-the-middle attack… |
CVE-2015-0172 | High | 7.5 | 2018-04-10 | IBM Security SiteProtector System 3.0, 3.1.0 and 3.1.1 allows remote attackers to bypass intended security restrictions and consequently execute unspecified co… |
CVE-2015-9016 | High | 7.0 | 2018-04-05 | In blk_mq_tag_to_rq in blk-mq.c in the upstream kernel, there is a possible use after free due to a race condition when a request has been previously freed by… |
CVE-2015-9015 | High | 7.8 | 2018-04-04 | An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36714120. |
CVE-2015-9014 | Critical | 9.8 | 2018-04-04 | An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393750. |
CVE-2015-9013 | Critical | 9.8 | 2018-04-04 | An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393251. |
CVE-2015-9012 | Critical | 9.8 | 2018-04-04 | An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384691. |
CVE-2015-9011 | Critical | 9.8 | 2018-04-04 | An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36714882. |
CVE-2015-9010 | Critical | 9.8 | 2018-04-04 | An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393101. |
CVE-2015-9009 | Critical | 9.8 | 2018-04-04 | An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393600. |
CVE-2015-9008 | Critical | 9.8 | 2018-04-04 | An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384689. |
CVE-2015-1975 | High | 7.8 | 2018-04-03 | The web administration tool in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, and 6.3 before iFix 37 and IBM… |
CVE-2015-9259 | Critical | 9.8 | 2018-03-31 | In Docker Notary before 0.1, the checkRoot function in gotuf/client/client.go does not check expiry of root.json files, despite a comment stating that it does… |
CVE-2015-9258 | High | 7.5 | 2018-03-31 | In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability. Because an attacker controls the field specifyi… |
CVE-2015-4953 | Medium | 4.8 | 2018-03-29 | IBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 makes it easier for man-in-the-middle attackers to decrypt traffic by leveraging a w… |
CVE-2015-4952 | High | 8.8 | 2018-03-29 | The on-demand plugin in IBM Endpoint Manager for Remote Control 9.0.1 and 9.1.0 allows user-assisted remote attackers to execute arbitrary code via unspecified… |
CVE-2015-2020 | Critical | 9.8 | 2018-03-29 | The MyScript SDK before 1.3 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly… |
CVE-2015-2009 | High | 8.8 | 2018-03-29 | Cross-site request forgery (CSRF) vulnerability in the xmlrpc.cgi service in IBM QRadar SIEM 7.1 before MR2 Patch 11 Interim Fix 02 and 7.2.x before 7.2.5 Patc… |
CVE-2015-2004 | Critical | 9.8 | 2018-03-29 | The GraceNote GNSDK SDK before SVN Changeset 1.1.7 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializabl… |
CVE-2015-2003 | Critical | 9.8 | 2018-03-29 | The PJSIP PJSUA2 SDK before SVN Changeset 51322 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable c… |
CVE-2015-2002 | Critical | 9.8 | 2018-03-29 | The ESRI ArcGis Runtime SDK before 10.2.6-2 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class… |
CVE-2015-2001 | Critical | 9.8 | 2018-03-29 | The MetaIO SDK before 6.0.2.1 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improper… |
CVE-2015-2000 | Critical | 9.8 | 2018-03-29 | The Jumio SDK before 1.5.0 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly… |
CVE-2015-5016 | Medium | 4.3 | 2018-03-27 | IBM Maximo Asset Management 7.1, 7.5, and 7.6; Maximo Asset Management Essentials 7.1 and 7.5; Control Desk 7.5 and 7.6; Tivoli Asset Management for IT 7.1 and… |
CVE-2015-4987 | Medium | 6.5 | 2018-03-27 | The search and replay servers in IBM Tealeaf Customer Experience 8.0 through 9.0.2 allow remote attackers to bypass authentication via unspecified vectors. IBM… |
CVE-2015-4954 | Medium | 5.9 | 2018-03-27 | IBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 improperly allows self-signed certificates, which might allow remote attackers to co… |
CVE-2015-7434 | High | 7.8 | 2018-03-26 | IBM Capacity Management Analytics 2.1.0.0 allows local users to discover encrypted usernames and passwords by leveraging access to the CMA install machine. IBM… |
CVE-2015-7433 | High | 7.8 | 2018-03-26 | IBM Capacity Management Analytics 2.1.0.0 allows local users to discover cleartext usernames and passwords by leveraging access to the CMA install machine. IBM… |
CVE-2015-7432 | High | 7.8 | 2018-03-26 | IBM Capacity Management Analytics 2.1.0.0 allows local users to decrypt usernames and passwords by leveraging access to setenv.sh and parameter.txt. IBM X-Forc… |
CVE-2015-7424 | Medium | 4.3 | 2018-03-26 | IBM InfoSphere Master Data Management (MDM) - Collaborative Edition 9.1, 10.1, 11.0, 11.3, 11.4, and 11.5 allow remote authenticated users to bypass intended a… |
CVE-2015-7423 | Medium | 5.4 | 2018-03-26 | Multiple cross-site scripting (XSS) vulnerabilities in IBM InfoSphere Master Data Management (MDM) - Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 allo… |
CVE-2015-7401 | Medium | 4.3 | 2018-03-26 | IBM Curam Social Program Management 6.1.x before 6.1.1.1 allows remote authenticated users to bypass intended access restrictions and obtain sensitive document… |
CVE-2015-5045 | Low | 3.3 | 2018-03-26 | The Administration and Reporting tool in IBM Rational License Key Server (RLKS) before 8.1.4.9 iFix 04 allows local users to obtain sensitive information via u… |
CVE-2015-5039 | High | 7.4 | 2018-03-26 | The Remote Client and change management integrations in IBM Rational ClearCase 7.1.x, 8.0.0.x before 8.0.0.18, and 8.0.1.x before 8.0.1.11 do not properly vali… |
CVE-2015-9257 | Medium | 6.1 | 2018-03-24 | BMC Remedy Action Request (AR) System 9.0 before 9.0.00 Service Pack 2 hot fix 1 has persistent XSS. |
CVE-2015-7461 | Medium | 6.5 | 2018-03-20 | XML external entity (XXE) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote authenticated users to cause a denia… |
CVE-2015-7460 | Medium | 5.4 | 2018-03-20 | Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inject arbitrary web s… |
CVE-2015-7459 | Medium | 5.4 | 2018-03-20 | Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inject arbitrary web s… |
CVE-2015-7458 | Medium | 5.4 | 2018-03-20 | Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inject arbitrary web s… |
CVE-2015-7449 | Low | 3.3 | 2018-03-20 | IBM Rational Collaborative Lifecycle Management (CLM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; R… |
CVE-2015-5350 | High | 7.5 | 2018-03-19 | In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on the host system. By… |
CVE-2015-7471 | Medium | 4.8 | 2018-03-15 | Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management (CLM) 3.0.1 before 3.0.1.6 iFix7 Interim Fix 1, 4.0.x before 4.0.7… |
CVE-2015-7463 | Medium | 4.3 | 2018-03-15 | IBM Business Process Manager 7.5.x, 8.0.x, 8.5.0, 8.5.5, and 8.5.6.0 through cumulative fix 2 allow remote authenticated users to delete process and task data… |
CVE-2015-7453 | Medium | 6.1 | 2018-03-15 | Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management (CLM) 3.0.1 before 3.0.1.6 iFix7 Interim Fix 1, 4.0.x before 4.0.7… |
CVE-2015-7440 | High | 7.8 | 2018-03-15 | IBM Rational Collaborative Lifecycle Management (CLM) 3.0.1 before 3.0.1.6 iFix7 Interim Fix 1, 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, and 6.0.x… |
CVE-2015-5377 | Critical | 9.8 | 2018-03-06 | Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol. NOTE: ZDI appears to cl… |
CVE-2015-7967 | High | 7.8 | 2018-03-02 | SafeNet Authentication Service for Citrix Web Interface Agent uses a weak ACL for unspecified installation directories and executable modules, which allows loc… |
CVE-2015-7966 | High | 7.8 | 2018-03-02 | SafeNet Authentication Service Windows Logon Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to… |
CVE-2015-7965 | High | 7.8 | 2018-03-02 | SafeNet Authentication Service Windows Logon Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to… |
CVE-2015-7964 | High | 7.8 | 2018-03-02 | SafeNet Authentication Service for NPS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain… |
CVE-2015-7963 | High | 7.8 | 2018-03-02 | SafeNet Authentication Service for AD FS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gai… |
CVE-2015-7962 | High | 7.8 | 2018-03-02 | SafeNet Authentication Service for Outlook Web App Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local us… |
CVE-2015-7961 | High | 7.8 | 2018-03-02 | SafeNet Authentication Service Remote Web Workplace Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local u… |
CVE-2015-7598 | High | 7.8 | 2018-03-02 | SafeNet Authentication Service TokenValidator Proxy Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local u… |
CVE-2015-7597 | High | 7.8 | 2018-03-02 | SafeNet Authentication Service IIS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain priv… |
CVE-2015-7596 | High | 7.8 | 2018-03-02 | SafeNet Authentication Service End User Software Tools for Windows uses a weak ACL for unspecified installation directories and executable modules, which allow… |
CVE-2015-0796 | Medium | 6.3 | 2018-03-02 | In open buildservice 2.6 before 2.6.3, 2.5 before 2.5.7 and 2.4 before 2.4.8 the source service patch application could generate non-standard files like symlin… |
CVE-2015-5079 | High | 7.5 | 2018-02-28 | Directory traversal vulnerability in widgets/logs.php in BlackCat CMS before 1.1.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the dl… |
CVE-2015-4117 | High | 8.8 | 2018-02-28 | Vesta Control Panel before 0.9.8-14 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the backup parameter to list/ba… |
CVE-2015-3898 | Medium | 6.1 | 2018-02-28 | Multiple open redirect vulnerabilities in Bonita BPM Portal before 6.5.3 allow remote attackers to redirect users to arbitrary web sites and conduct phishing a… |
CVE-2015-5725 | Critical | 9.8 | 2018-02-21 | SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute arbitrary SQL comman… |
CVE-2015-5316 | Medium | 5.9 | 2018-02-21 | The eap_pwd_perform_confirm_exchange function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6, when EAP-pwd is enabled in a network configuration profil… |
CVE-2015-5315 | Medium | 5.9 | 2018-02-21 | The eap_pwd_process function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6 does not validate that the reassembly buffer is large enough for the final… |
CVE-2015-5314 | Medium | 5.9 | 2018-02-21 | The eap_pwd_process function in eap_server/eap_server_pwd.c in hostapd 2.x before 2.6 does not validate that the reassembly buffer is large enough for the fina… |
CVE-2015-6569 | Medium | 5.9 | 2018-02-21 | Race condition in the LoadBalancer module in the Atlassian Floodlight Controller before 1.2 allows remote attackers to cause a denial of service (NULL pointer… |
CVE-2015-0203 | Medium | 6.5 | 2018-02-21 | The qpidd broker in Apache Qpid 0.30 and earlier allows remote authenticated users to cause a denial of service (daemon crash) via an AMQP message with (1) an… |
CVE-2015-6544 | Medium | 6.1 | 2018-02-20 | Cross-site scripting (XSS) vulnerability in application/dashboard.class.inc.php in Combodo iTop before 2.2.0-2459 allows remote attackers to inject arbitrary w… |
CVE-2015-9256 | Medium | 5.3 | 2018-02-20 | Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information via access to device/VM restore mount points, because they do not have ACLs… |
CVE-2015-9255 | Medium | 5.3 | 2018-02-20 | Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information about data, software versions, configuration, and virtual machines via a re… |
CVE-2015-9254 | Critical | 9.8 | 2018-02-20 | Datto ALTO and SIRIS devices have a default VNC password. |
CVE-2015-2081 | Critical | 9.8 | 2018-02-20 | Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts. |
CVE-2015-9253 | Medium | 6.5 | 2018-02-19 | An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endle… |
CVE-2015-2324 | Medium | 5.4 | 2018-02-19 | Cross-site scripting (XSS) vulnerability in the filemanager in the Photo Gallery plugin before 1.2.13 for WordPress allows remote authenticated users with edit… |
CVE-2015-9252 | Medium | 5.5 | 2018-02-13 | An issue was discovered in QPDF before 7.0.0. Endless recursion causes stack exhaustion in QPDFTokenizer::resolveLiteral() in QPDFTokenizer.cc, related to the… |
CVE-2015-1862 | High | 7.0 | 2018-02-09 | The crash reporting feature in Abrt allows local users to gain privileges by leveraging an execve by root after a chroot into a user-specified directory in a n… |
CVE-2015-2329 | Medium | 6.1 | 2018-02-08 | Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML vi… |
CVE-2015-4400 | Medium | 4.6 | 2018-02-06 | Ring (formerly DoorBot) video doorbells allow remote attackers to obtain sensitive information about the wireless network configuration by pressing the set up… |
CVE-2015-3619 | Medium | 5.4 | 2018-02-06 | Cross-site scripting (XSS) vulnerability in assets/js/vm2admin.js in the VirtueMart component before 3.0.8 for Joomla! allows remote attackers to inject arbitr… |