CVEs

396,199 total · page 6490 of 7,924

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2015-6923	VBox Communications Satellite Express Protocol	0.03	—	0.01	Sep 21, 2015	The ndvbs module in VBox Communications Satellite Express Protocol 2.3.17.3 allows local users to write to arbitrary physical memory locations and gain privileges via a 0x00000ffd ioctl call.
CVE-2015-6749	Xiph.Org Vorbis Tools	0.00	—	0.04	Sep 21, 2015	Buffer overflow in the aiff_open function in oggenc/audio.c in vorbis-tools 1.4.0 and earlier allows remote attackers to cause a denial of service (crash) via a crafted AIFF file.
CVE-2015-6238	WordPress Google Analyticator	0.00	—	0.03	Sep 21, 2015	Multiple cross-site scripting (XSS) vulnerabilities in the Google Analyticator plugin before 6.4.9.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) ga_adsense, (2) ga_admin_disable_DimentionIndex, (3) ga_downloads_prefix, (4)…
CVE-2015-5603	Atlassian Jira	0.08	—	0.59	Sep 21, 2015	The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java code via unspecified vectors, related to "Velocity Template Injection Vulnerability."
CVE-2015-7296	Securifi Almond	0.00	—	0.01	Sep 21, 2015	Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M use a linear algorithm for selecting the ID value in the header of a DNS query performed on behalf of the device itself, which makes it easier for remote…
CVE-2015-5993	Kasda KW58293	0.00	—	0.02	Sep 21, 2015	Buffer overflow in form2ping.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to cause a denial of service (device outage) via a long ipaddr parameter.
CVE-2015-5992	PLDT SpeedSurf 504AN	0.00	—	0.01	Sep 21, 2015	Cross-site scripting (XSS) vulnerability in form2WlanSetup.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to inject arbitrary web script or HTML via the ssid…
CVE-2015-5991	PLDT SpeedSurf 504AN	0.00	—	0.01	Sep 21, 2015	Cross-site request forgery (CSRF) vulnerability in form2WlanSetup.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to hijack the authentication of administrators…
CVE-2015-2917	Securifi Almond	0.00	—	0.01	Sep 21, 2015	Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M unintentionally omit the X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site that…
CVE-2015-2916	Securifi Almond	0.00	—	0.01	Sep 21, 2015	Cross-site request forgery (CSRF) vulnerability on Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M allows remote attackers to hijack the authentication of arbitrary users.
CVE-2015-2915	Securifi Almond	0.00	—	0.01	Sep 21, 2015	Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M have a default password of admin for the admin account, which allows remote attackers to obtain web-management access by leveraging the ability to…
CVE-2015-2914	Securifi Almond	0.00	—	0.02	Sep 21, 2015	Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M use a fixed source-port number in outbound DNS queries performed on behalf of any device, which makes it easier for remote attackers to spoof responses by…
CVE-2015-2864	Retrospect Retrospect	0.00	—	0.03	Sep 21, 2015	Retrospect and Retrospect Client before 10.0.2.119 on Windows, before 12.0.2.116 on OS X, and before 10.0.2.104 on Linux improperly generate password hashes, which makes it easier for remote attackers to bypass authentication and obtain access to backup files by leveraging a…
CVE-2015-6548	Symantec Web Gateway	0.00	—	0.02	Sep 20, 2015	Multiple SQL injection vulnerabilities in a PHP script in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVE-2015-6547	Symantec Web Gateway	0.00	—	0.04	Sep 20, 2015	The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands at boot time via unspecified vectors.
CVE-2015-5693	Symantec Web Gateway	0.00	—	0.04	Sep 20, 2015	The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands via vectors related to "traffic capture."
CVE-2015-5692	Symantec Web Gateway	0.00	—	0.05	Sep 20, 2015	admin_messages.php in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary code by uploading a file with a safe extension and content type, and then leveraging an improper…
CVE-2015-5691	Symantec Web Gateway	0.00	—	0.02	Sep 20, 2015	Multiple cross-site scripting (XSS) vulnerabilities in PHP scripts in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, as demonstrated…
CVE-2015-5690	Symantec Web Gateway	0.00	—	0.04	Sep 20, 2015	The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands by leveraging a "redirect."
CVE-2015-5689	Symantec Ghost Solutions Suite	0.00	—	0.03	Sep 20, 2015	ghostexp.exe in Ghost Explorer Utility in Symantec Ghost Solutions Suite (GSS) before 3.0 HF2 12.0.0.8010 and Symantec Deployment Solution (DS) before 7.6 HF4 12.0.0.7045 performs improper sign-extend operations before array-element accesses, which allows remote attackers to…
CVE-2014-9229	Symantec Endpoint Protection	0.00	—	0.02	Sep 20, 2015	Multiple SQL injection vulnerabilities in interface PHP scripts in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allow remote authenticated users to execute arbitrary SQL commands by leveraging the Limited Administrator role.
CVE-2014-9228	Symantec Endpoint Protection	0.00	—	0.00	Sep 20, 2015	sysplant.sys in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allows local users to cause a denial of service (blocked system shutdown) by triggering an unspecified deadlock condition.
CVE-2014-9227	Symantec Endpoint Protection	0.00	—	0.00	Sep 20, 2015	Multiple untrusted search path vulnerabilities in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allow local users to gain privileges via a Trojan horse DLL in an unspecified directory.
CVE-2015-5637	Newphoria Corporation Photon	0.00	—	0.01	Sep 20, 2015	The Newphoria Photon application before 1.2 for Android allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
CVE-2015-5636	Newphoria Corporation Reversi	0.00	—	0.01	Sep 20, 2015	The Newphoria Reversi application before 1.0.3 for Android and before 1.2 for iOS allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
CVE-2015-5635	Newphoria Corporation Koritore	0.00	—	0.01	Sep 20, 2015	The Newphoria Koritore application before 1.1 for Android and before 1.1 for iOS allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
CVE-2015-5634	Newphoria Corporation MEGAPHONE MUSIC	0.00	—	0.01	Sep 20, 2015	The Newphoria MEGAPHONE MUSIC application before 1.1 for Android and before 1.1 for iOS allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
CVE-2015-5633	Newphoria Corporation Auction Camera	0.00	—	0.01	Sep 20, 2015	The Newphoria Auction Camera application for iOS and before 1.2 for Android allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
CVE-2015-5632	Newphoria Corporation Applican	0.00	—	0.01	Sep 20, 2015	The runtime engine in the Newphoria applican framework before 1.12.3 for Android and before 1.12.2 for iOS allows attackers to bypass a whitelist.xml URL whitelist protection mechanism and obtain API access via unspecified vectors.
CVE-2015-6301	Cisco Systems, Inc. Cisco iOS	0.00	—	0.02	Sep 20, 2015	The DHCPv6 server in Cisco IOS on ASR 9000 devices with software 5.2.0 Base allows remote attackers to cause a denial of service (process reset) via crafted packets, aka Bug ID CSCun72171.
CVE-2015-6300	Cisco Systems, Inc. Secure Access Control Server	0.00	—	0.02	Sep 20, 2015	Cisco Secure Access Control Server (ACS) Solution Engine 5.7(0.15) allows remote authenticated users to cause a denial of service (SSH screen process crash) via crafted (1) CLI or (2) GUI commands, aka Bug ID CSCuw24694.
CVE-2015-6299	Cisco Systems, Inc. Unity Connection	0.00	—	0.02	Sep 20, 2015	SQL injection vulnerability in the web interface in Cisco Unity Connection 9.1(1.2) and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted POST request, aka Bug ID CSCuv63824.
CVE-2015-6295	Cisco Systems, Inc. Nx OS	0.00	—	0.01	Sep 20, 2015	Cisco NX-OS 6.1(2)I3(4) and 7.0(3)I1(1) on Nexus 9000 (N9K) devices allows remote attackers to cause a denial of service (CPU consumption or control-plane instability) or trigger unintended traffic forwarding via a Layer 2 packet with a reserved VLAN number, aka Bug ID…
CVE-2015-6284	Cisco Systems, Inc. Telepresence Server Software	0.00	—	0.02	Sep 20, 2015	Buffer overflow in the Conference Control Protocol API implementation in Cisco TelePresence Server software before 4.1(2.33) on 7010, MSE 8710, Multiparty Media 310 and 320, and Virtual Machine devices allows remote attackers to cause a denial of service (device crash) via a…
CVE-2015-5638	H2o Project H20	0.00	—	0.02	Sep 20, 2015	Directory traversal vulnerability in H2O before 1.4.5 and 1.5.x before 1.5.0-beta2, when the file.dir directive is enabled, allows remote attackers to read arbitrary files via a crafted URL.
CVE-2015-4307	Cisco Systems, Inc. Prime Collaboration Provisioning	0.00	—	0.03	Sep 20, 2015	The web framework in Cisco Prime Collaboration Provisioning before 11.0 allows remote authenticated users to bypass intended access restrictions and create administrative accounts via a crafted URL, aka Bug ID CSCut64111.
CVE-2015-4306	Cisco Systems, Inc. Prime Collaboration Assurance	0.00	—	0.02	Sep 20, 2015	The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended login-session read restrictions, and impersonate administrators of arbitrary tenant domains, by discovering a session identifier and constructing a…
CVE-2015-4305	Cisco Systems, Inc. Prime Collaboration Assurance	0.00	—	0.02	Sep 20, 2015	The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended system-database read restrictions, and discover credentials or SNMP communities for arbitrary tenant domains, via a crafted URL, aka Bug ID…
CVE-2015-4304	Cisco Systems, Inc. Prime Collaboration Assurance	0.00	—	0.03	Sep 20, 2015	The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended access restrictions, and create administrative accounts or read data from arbitrary tenant domains, via a crafted URL, aka Bug IDs CSCus62671 and…
CVE-2015-6932	VMware Vcenter Server	0.00	—	0.01	Sep 18, 2015	VMware vCenter Server 5.5 before u3 and 6.0 before u1 does not verify X.509 certificates from TLS LDAP servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2015-6460	3S Smart Software Solutions CODESYS Gateway Server	0.00	—	0.06	Sep 18, 2015	Multiple heap-based buffer overflows in 3S-Smart CODESYS Gateway Server before 2.3.9.34 allow remote attackers to execute arbitrary code via opcode (1) 0x3ef or (2) 0x3f0.
CVE-2015-6459	Ge Mds Pulsenet	0.00	—	0.03	Sep 18, 2015	Absolute path traversal vulnerability in the download feature in FileDownloadServlet in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 allows remote attackers to read or delete arbitrary files via a full pathname.
CVE-2015-6456	Ge Mds Pulsenet	0.00	—	0.04	Sep 18, 2015	GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 have hardcoded credentials for a support account, which allows remote attackers to obtain administrative access, and consequently execute arbitrary code, by leveraging knowledge of the password.
CVE-2015-6297	Cisco Systems, Inc. Cisco iOS	0.00	—	0.02	Sep 18, 2015	The DHCPv6 server in Cisco IOS on ASR 9000 devices with software 5.2.0 Base allows remote attackers to cause a denial of service (process reset) via crafted packets, aka Bug ID CSCun36525.
CVE-2015-6296	Cisco Systems, Inc. Prime Network Registrar	0.00	—	0.00	Sep 18, 2015	Cisco Prime Network Registrar (CPNR) 8.1(3.3), 8.2(3), and 8.3(2) has a default account, which allows local users to obtain root access by leveraging knowledge of the credentials, aka Bug ID CSCuw21825.
CVE-2015-6294	Cisco Systems, Inc. Cisco iOS	0.00	—	0.01	Sep 18, 2015	Cisco IOS 15.2(3)E and earlier and IOS XE 3.6(2)E and earlier allow remote attackers to cause a denial of service (functionality loss) via crafted Cisco Discovery Protocol (CDP) packets, aka Bug ID CSCuu25770.
CVE-2015-3962	Schneider Electric StruxureWare Building Expert MPM	0.00	—	0.01	Sep 18, 2015	Schneider Electric StruxureWare Building Expert MPM before 2.15 does not use encryption for the client-server data stream, which allows remote attackers to discover credentials by sniffing the network.
CVE-2015-7243	Boxoft Boxoft Wav To Mp3 Converter	0.08	—	0.58	Sep 18, 2015	Buffer overflow in Boxoft WAV to MP3 Converter allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted WAV file.
CVE-2015-6939	Joomla Joomla!	0.00	—	0.03	Sep 18, 2015	Cross-site scripting (XSS) vulnerability in the login module in Joomla! 3.4.x before 3.4.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2015-7239	SAP Netweaver J2ee Engine	0.00	—	0.02	Sep 18, 2015	SQL injection vulnerability in the BP_FIND_JOBS_WITH_PROGRAM function module in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2015-6923Sep 21, 2015
VBox Communications
Satellite Express Protocol
risk 0.03cvss —epss 0.01
The ndvbs module in VBox Communications Satellite Express Protocol 2.3.17.3 allows local users to write to arbitrary physical memory locations and gain privileges via a 0x00000ffd ioctl call.
CVE-2015-6749Sep 21, 2015
Xiph.Org
Vorbis Tools
risk 0.00cvss —epss 0.04
Buffer overflow in the aiff_open function in oggenc/audio.c in vorbis-tools 1.4.0 and earlier allows remote attackers to cause a denial of service (crash) via a crafted AIFF file.
CVE-2015-6238Sep 21, 2015
WordPress
Google Analyticator
risk 0.00cvss —epss 0.03
Multiple cross-site scripting (XSS) vulnerabilities in the Google Analyticator plugin before 6.4.9.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) ga_adsense, (2) ga_admin_disable_DimentionIndex, (3) ga_downloads_prefix, (4)…
CVE-2015-5603Sep 21, 2015
Atlassian
Jira
risk 0.08cvss —epss 0.59
The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java code via unspecified vectors, related to "Velocity Template Injection Vulnerability."
CVE-2015-7296Sep 21, 2015
Securifi
Almond
risk 0.00cvss —epss 0.01
Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M use a linear algorithm for selecting the ID value in the header of a DNS query performed on behalf of the device itself, which makes it easier for remote…
CVE-2015-5993Sep 21, 2015
Kasda
KW58293
risk 0.00cvss —epss 0.02
Buffer overflow in form2ping.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to cause a denial of service (device outage) via a long ipaddr parameter.
CVE-2015-5992Sep 21, 2015
PLDT
SpeedSurf 504AN
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in form2WlanSetup.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to inject arbitrary web script or HTML via the ssid…
CVE-2015-5991Sep 21, 2015
PLDT
SpeedSurf 504AN
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in form2WlanSetup.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to hijack the authentication of administrators…
CVE-2015-2917Sep 21, 2015
Securifi
Almond
risk 0.00cvss —epss 0.01
Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M unintentionally omit the X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site that…
CVE-2015-2916Sep 21, 2015
Securifi
Almond
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability on Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M allows remote attackers to hijack the authentication of arbitrary users.
CVE-2015-2915Sep 21, 2015
Securifi
Almond
risk 0.00cvss —epss 0.01
Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M have a default password of admin for the admin account, which allows remote attackers to obtain web-management access by leveraging the ability to…
CVE-2015-2914Sep 21, 2015
Securifi
Almond
risk 0.00cvss —epss 0.02
Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M use a fixed source-port number in outbound DNS queries performed on behalf of any device, which makes it easier for remote attackers to spoof responses by…
CVE-2015-2864Sep 21, 2015
Retrospect
Retrospect
risk 0.00cvss —epss 0.03
Retrospect and Retrospect Client before 10.0.2.119 on Windows, before 12.0.2.116 on OS X, and before 10.0.2.104 on Linux improperly generate password hashes, which makes it easier for remote attackers to bypass authentication and obtain access to backup files by leveraging a…
CVE-2015-6548Sep 20, 2015
Symantec
Web Gateway
risk 0.00cvss —epss 0.02
Multiple SQL injection vulnerabilities in a PHP script in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVE-2015-6547Sep 20, 2015
Symantec
Web Gateway
risk 0.00cvss —epss 0.04
The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands at boot time via unspecified vectors.
CVE-2015-5693Sep 20, 2015
Symantec
Web Gateway
risk 0.00cvss —epss 0.04
The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands via vectors related to "traffic capture."
CVE-2015-5692Sep 20, 2015
Symantec
Web Gateway
risk 0.00cvss —epss 0.05
admin_messages.php in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary code by uploading a file with a safe extension and content type, and then leveraging an improper…
CVE-2015-5691Sep 20, 2015
Symantec
Web Gateway
risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in PHP scripts in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, as demonstrated…
CVE-2015-5690Sep 20, 2015
Symantec
Web Gateway
risk 0.00cvss —epss 0.04
The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands by leveraging a "redirect."
CVE-2015-5689Sep 20, 2015
Symantec
Ghost Solutions Suite
risk 0.00cvss —epss 0.03
ghostexp.exe in Ghost Explorer Utility in Symantec Ghost Solutions Suite (GSS) before 3.0 HF2 12.0.0.8010 and Symantec Deployment Solution (DS) before 7.6 HF4 12.0.0.7045 performs improper sign-extend operations before array-element accesses, which allows remote attackers to…
CVE-2014-9229Sep 20, 2015
Symantec
Endpoint Protection
risk 0.00cvss —epss 0.02
Multiple SQL injection vulnerabilities in interface PHP scripts in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allow remote authenticated users to execute arbitrary SQL commands by leveraging the Limited Administrator role.
CVE-2014-9228Sep 20, 2015
Symantec
Endpoint Protection
risk 0.00cvss —epss 0.00
sysplant.sys in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allows local users to cause a denial of service (blocked system shutdown) by triggering an unspecified deadlock condition.
CVE-2014-9227Sep 20, 2015
Symantec
Endpoint Protection
risk 0.00cvss —epss 0.00
Multiple untrusted search path vulnerabilities in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allow local users to gain privileges via a Trojan horse DLL in an unspecified directory.
CVE-2015-5637Sep 20, 2015
Newphoria Corporation
Photon
risk 0.00cvss —epss 0.01
The Newphoria Photon application before 1.2 for Android allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
CVE-2015-5636Sep 20, 2015
Newphoria Corporation
Reversi
risk 0.00cvss —epss 0.01
The Newphoria Reversi application before 1.0.3 for Android and before 1.2 for iOS allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
CVE-2015-5635Sep 20, 2015
Newphoria Corporation
Koritore
risk 0.00cvss —epss 0.01
The Newphoria Koritore application before 1.1 for Android and before 1.1 for iOS allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
CVE-2015-5634Sep 20, 2015
Newphoria Corporation
MEGAPHONE MUSIC
risk 0.00cvss —epss 0.01
The Newphoria MEGAPHONE MUSIC application before 1.1 for Android and before 1.1 for iOS allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
CVE-2015-5633Sep 20, 2015
Newphoria Corporation
Auction Camera
risk 0.00cvss —epss 0.01
The Newphoria Auction Camera application for iOS and before 1.2 for Android allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
CVE-2015-5632Sep 20, 2015
Newphoria Corporation
Applican
risk 0.00cvss —epss 0.01
The runtime engine in the Newphoria applican framework before 1.12.3 for Android and before 1.12.2 for iOS allows attackers to bypass a whitelist.xml URL whitelist protection mechanism and obtain API access via unspecified vectors.
CVE-2015-6301Sep 20, 2015
Cisco Systems, Inc.
Cisco iOS
risk 0.00cvss —epss 0.02
The DHCPv6 server in Cisco IOS on ASR 9000 devices with software 5.2.0 Base allows remote attackers to cause a denial of service (process reset) via crafted packets, aka Bug ID CSCun72171.
CVE-2015-6300Sep 20, 2015
Cisco Systems, Inc.
Secure Access Control Server
risk 0.00cvss —epss 0.02
Cisco Secure Access Control Server (ACS) Solution Engine 5.7(0.15) allows remote authenticated users to cause a denial of service (SSH screen process crash) via crafted (1) CLI or (2) GUI commands, aka Bug ID CSCuw24694.
CVE-2015-6299Sep 20, 2015
Cisco Systems, Inc.
Unity Connection
risk 0.00cvss —epss 0.02
SQL injection vulnerability in the web interface in Cisco Unity Connection 9.1(1.2) and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted POST request, aka Bug ID CSCuv63824.
CVE-2015-6295Sep 20, 2015
Cisco Systems, Inc.
Nx OS
risk 0.00cvss —epss 0.01
Cisco NX-OS 6.1(2)I3(4) and 7.0(3)I1(1) on Nexus 9000 (N9K) devices allows remote attackers to cause a denial of service (CPU consumption or control-plane instability) or trigger unintended traffic forwarding via a Layer 2 packet with a reserved VLAN number, aka Bug ID…
CVE-2015-6284Sep 20, 2015
Cisco Systems, Inc.
Telepresence Server Software
risk 0.00cvss —epss 0.02
Buffer overflow in the Conference Control Protocol API implementation in Cisco TelePresence Server software before 4.1(2.33) on 7010, MSE 8710, Multiparty Media 310 and 320, and Virtual Machine devices allows remote attackers to cause a denial of service (device crash) via a…
CVE-2015-5638Sep 20, 2015
H2o Project
H20
risk 0.00cvss —epss 0.02
Directory traversal vulnerability in H2O before 1.4.5 and 1.5.x before 1.5.0-beta2, when the file.dir directive is enabled, allows remote attackers to read arbitrary files via a crafted URL.
CVE-2015-4307Sep 20, 2015
Cisco Systems, Inc.
Prime Collaboration Provisioning
risk 0.00cvss —epss 0.03
The web framework in Cisco Prime Collaboration Provisioning before 11.0 allows remote authenticated users to bypass intended access restrictions and create administrative accounts via a crafted URL, aka Bug ID CSCut64111.
CVE-2015-4306Sep 20, 2015
Cisco Systems, Inc.
Prime Collaboration Assurance
risk 0.00cvss —epss 0.02
The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended login-session read restrictions, and impersonate administrators of arbitrary tenant domains, by discovering a session identifier and constructing a…
CVE-2015-4305Sep 20, 2015
Cisco Systems, Inc.
Prime Collaboration Assurance
risk 0.00cvss —epss 0.02
The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended system-database read restrictions, and discover credentials or SNMP communities for arbitrary tenant domains, via a crafted URL, aka Bug ID…
CVE-2015-4304Sep 20, 2015
Cisco Systems, Inc.
Prime Collaboration Assurance
risk 0.00cvss —epss 0.03
The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended access restrictions, and create administrative accounts or read data from arbitrary tenant domains, via a crafted URL, aka Bug IDs CSCus62671 and…
CVE-2015-6932Sep 18, 2015
VMware
Vcenter Server
risk 0.00cvss —epss 0.01
VMware vCenter Server 5.5 before u3 and 6.0 before u1 does not verify X.509 certificates from TLS LDAP servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2015-6460Sep 18, 2015
3S Smart Software Solutions
CODESYS Gateway Server
risk 0.00cvss —epss 0.06
Multiple heap-based buffer overflows in 3S-Smart CODESYS Gateway Server before 2.3.9.34 allow remote attackers to execute arbitrary code via opcode (1) 0x3ef or (2) 0x3f0.
CVE-2015-6459Sep 18, 2015
Ge
Mds Pulsenet
risk 0.00cvss —epss 0.03
Absolute path traversal vulnerability in the download feature in FileDownloadServlet in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 allows remote attackers to read or delete arbitrary files via a full pathname.
CVE-2015-6456Sep 18, 2015
Ge
Mds Pulsenet
risk 0.00cvss —epss 0.04
GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 have hardcoded credentials for a support account, which allows remote attackers to obtain administrative access, and consequently execute arbitrary code, by leveraging knowledge of the password.
CVE-2015-6297Sep 18, 2015
Cisco Systems, Inc.
Cisco iOS
risk 0.00cvss —epss 0.02
The DHCPv6 server in Cisco IOS on ASR 9000 devices with software 5.2.0 Base allows remote attackers to cause a denial of service (process reset) via crafted packets, aka Bug ID CSCun36525.
CVE-2015-6296Sep 18, 2015
Cisco Systems, Inc.
Prime Network Registrar
risk 0.00cvss —epss 0.00
Cisco Prime Network Registrar (CPNR) 8.1(3.3), 8.2(3), and 8.3(2) has a default account, which allows local users to obtain root access by leveraging knowledge of the credentials, aka Bug ID CSCuw21825.
CVE-2015-6294Sep 18, 2015
Cisco Systems, Inc.
Cisco iOS
risk 0.00cvss —epss 0.01
Cisco IOS 15.2(3)E and earlier and IOS XE 3.6(2)E and earlier allow remote attackers to cause a denial of service (functionality loss) via crafted Cisco Discovery Protocol (CDP) packets, aka Bug ID CSCuu25770.
CVE-2015-3962Sep 18, 2015
Schneider Electric
StruxureWare Building Expert MPM
risk 0.00cvss —epss 0.01
Schneider Electric StruxureWare Building Expert MPM before 2.15 does not use encryption for the client-server data stream, which allows remote attackers to discover credentials by sniffing the network.
CVE-2015-7243Sep 18, 2015
Boxoft
Boxoft Wav To Mp3 Converter
risk 0.08cvss —epss 0.58
Buffer overflow in Boxoft WAV to MP3 Converter allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted WAV file.
CVE-2015-6939Sep 18, 2015
Joomla
Joomla!
risk 0.00cvss —epss 0.03
Cross-site scripting (XSS) vulnerability in the login module in Joomla! 3.4.x before 3.4.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2015-7239Sep 18, 2015
SAP
Netweaver J2ee Engine
risk 0.00cvss —epss 0.02
SQL injection vulnerability in the BP_FIND_JOBS_WITH_PROGRAM function module in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.