# |
CVE ID
|
CWE ID
|
# of Exploits
|
Vulnerability Type(s)
|
Publish Date
|
Update Date
|
Score
|
Gained Access Level
|
Access
|
Complexity
|
Authentication
|
Conf.
|
Integ.
|
Avail.
|
42951 |
CVE-2015-7372 |
22 |
|
Dir. Trav. |
2015-10-14 |
2018-10-09 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
Directory traversal vulnerability in delivery-dev/al.php in Revive Adserver before 3.2.2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the layerstyle parameter. |
42952 |
CVE-2015-7371 |
264 |
|
DoS |
2015-10-14 |
2018-10-09 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
Revive Adserver before 3.2.2 does not restrict access to run-mpe.php, which allows remote attackers to run the Maintenance Priority Engine and possibly cause a denial of service (resource consumption) via a direct request. |
42953 |
CVE-2015-7370 |
79 |
|
XSS |
2015-10-14 |
2018-10-09 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Multiple cross-site scripting (XSS) vulnerabilities in open-flash-chart.swf in Open Flash Chart 2, as used in the VideoAds plugin in Revive Adserver before 3.2.2 and CA Release Automation (formerly LISA Release Automation) 5.0.2 before 5.0.2-227, 5.5.1 before 5.5.1-1616, 5.5.2 before 5.5.2-434, and 6.1.0 before 6.1.0-1026, allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) data-file parameter. |
42954 |
CVE-2015-7369 |
284 |
|
|
2015-10-14 |
2018-10-09 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
The default Flash cross-domain policy (crossdomain.xml) in Revive Adserver before 3.2.2 does not restrict access cross domain access, which allows remote attackers to conduct cross domain attacks via unspecified vectors. |
42955 |
CVE-2015-7367 |
284 |
|
|
2015-10-14 |
2018-10-09 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
Revive Adserver before 3.2.2 allows remote attackers to perform unspecified actions by leveraging an unexpired session after the user has been (1) deleted or (2) unlinked. |
42956 |
CVE-2015-7366 |
352 |
|
DoS CSRF |
2015-10-14 |
2018-10-09 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
Multiple cross-site request forgery (CSRF) vulnerabilities in Revive Adserver before 3.2.2 allow remote attackers to hijack the authentication of users for requests that (1) perform certain plugin actions and possibly cause a denial of service (disabled core plugins) via unknown vectors or (2) change the contact name and language or possibly have unspecified other impact via a crafted POST request to an account-user-*.php script. |
42957 |
CVE-2015-7365 |
79 |
|
XSS |
2015-10-14 |
2018-10-09 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Cross-site scripting (XSS) vulnerability in the plugin upgrade form in Revive Adserver before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via the filename of an uploaded file containing errors. |
42958 |
CVE-2015-7364 |
352 |
|
Bypass CSRF |
2015-10-14 |
2018-10-09 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
The HTML_Quickform library, as used in Revive Adserver before 3.2.2, allows remote attackers to bypass the CSRF protection mechanism via an empty token. |
42959 |
CVE-2015-7362 |
264 |
|
+Priv |
2016-01-08 |
2016-12-02 |
7.2 |
Admin |
Local |
Low |
Not required |
Complete |
Complete |
Complete |
Fortinet FortiClient Linux SSLVPN before build 2313, when installed on Linux in a home directory that is world readable and executable, allows local users to gain privileges via the helper/subroc setuid program. |
42960 |
CVE-2015-7361 |
287 |
|
|
2015-10-15 |
2016-12-02 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
FortiOS 5.2.3, when configured to use High Availability (HA) and the dedicated management interface is enabled, does not require authentication for access to the ZebOS shell on the HA dedicated management interface, which allows remote attackers to obtain shell access via unspecified vectors. |
42961 |
CVE-2015-7360 |
79 |
|
XSS |
2016-05-26 |
2018-10-09 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface (WebUI) in Fortinet FortiSandbox before 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) serial parameter to alerts/summary/profile/; the (2) urlForCreatingReport parameter to csearch/report/export/; the (3) id parameter to analysis/detail/download/screenshot; or vectors related to (4) "Fortiview threats by users search filtered by vdom" or (5) "PCAP file download generated by the VM scan feature." |
42962 |
CVE-2015-7359 |
264 |
|
|
2017-10-02 |
2017-10-23 |
4.6 |
None |
Local |
Low |
Not required |
Partial |
Partial |
Partial |
The (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, do not check the impersonation level of impersonation tokens, which allows local users to impersonate a user at SecurityIdentify level and gain access to other users' mounted encrypted volumes. |
42963 |
CVE-2015-7358 |
264 |
|
+Priv |
2017-10-02 |
2017-10-17 |
7.2 |
None |
Local |
Low |
Not required |
Complete |
Complete |
Complete |
The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, does not properly validate drive letter symbolic links, which allows local users to mount an encrypted volume over an existing drive letter and gain privileges via an entry in the /GLOBAL?? directory. |
42964 |
CVE-2015-7357 |
79 |
|
XSS |
2017-10-02 |
2017-10-11 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via a fragment identifier, as demonstrated by #<svg onload=alert(1)>. |
42965 |
CVE-2015-7349 |
79 |
|
XSS |
2017-09-27 |
2017-10-06 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Cross-site scripting (XSS) vulnerability in the sample feedback.inc file in VASCO DIGIPASS authentication plug-in for Citrix Web Interface allows remote attackers to inject arbitrary web script or HTML via the failmessage parameter. |
42966 |
CVE-2015-7348 |
79 |
|
XSS |
2015-12-07 |
2015-12-08 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Cross-site scripting (XSS) vulnerability in zTree 3.5.19.1 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter to demo/en/asyncData/getNodesForBigData.php. |
42967 |
CVE-2015-7346 |
89 |
|
Sql |
2017-06-07 |
2017-06-12 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
SQL injection vulnerability in ZCMS 1.1. |
42968 |
CVE-2015-7337 |
20 |
|
Exec Code |
2015-09-29 |
2016-12-07 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types. |
42969 |
CVE-2015-7331 |
254 |
|
Exec Code |
2017-01-30 |
2017-02-24 |
4.9 |
None |
Remote |
Medium |
Single system |
Partial |
Partial |
None |
The mcollective-puppet-agent plugin before 1.11.1 for Puppet allows remote attackers to execute arbitrary code via vectors involving the --server argument. |
42970 |
CVE-2015-7330 |
254 |
|
Bypass |
2016-04-11 |
2018-05-24 |
6.5 |
None |
Remote |
Low |
Single system |
Partial |
Partial |
Partial |
Puppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist protection mechanism by leveraging the Puppet communications protocol. |
42971 |
CVE-2015-7327 |
200 |
|
+Info |
2015-09-24 |
2016-12-21 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
Mozilla Firefox before 41.0 does not properly restrict the availability of High Resolution Time API times, which allows remote attackers to track last-level cache access, and consequently obtain sensitive information, via crafted JavaScript code that makes performance.now calls. |
42972 |
CVE-2015-7326 |
611 |
|
|
2017-06-07 |
2018-10-09 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
XML External Entity (XXE) vulnerability in Milton Webdav before 2.7.0.3. |
42973 |
CVE-2015-7324 |
79 |
|
XSS |
2017-12-27 |
2018-01-11 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Multiple cross-site scripting (XSS) vulnerabilities in helpers/comment.php in the StackIdeas Komento (com_komento) component before 2.0.5 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) img or (2) url tag of a new comment. |
42974 |
CVE-2015-7322 |
200 |
|
+Info |
2015-10-05 |
2016-12-07 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The Secure Meeting (Pulse Collaboration) in Pulse Connect Secure (formerly Juniper Junos Pulse) before 7.1R22.1, 7.4, 8.0 before 8.0R11, and 8.1 before 8.1R3 provides different messages for attempts to join a meeting depending on the status of the meeting, which allows remote attackers to enumerate valid meeting ids via a series of requests. |
42975 |
CVE-2015-7320 |
79 |
|
XSS |
2015-09-29 |
2018-10-09 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
42976 |
CVE-2015-7319 |
89 |
|
Exec Code Sql |
2015-09-29 |
2018-10-09 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to updating the username. |
42977 |
CVE-2015-7318 |
20 |
|
|
2017-09-25 |
2017-10-03 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses. |
42978 |
CVE-2015-7317 |
264 |
|
|
2017-09-25 |
2017-10-06 |
4.9 |
None |
Remote |
Medium |
Single system |
Partial |
Partial |
None |
Kupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7 allows remote authenticated users to edit Kupu settings. |
42979 |
CVE-2015-7316 |
79 |
|
XSS |
2017-09-25 |
2017-10-03 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1. |
42980 |
CVE-2015-7315 |
284 |
|
|
2017-09-25 |
2017-10-03 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator. |
42981 |
CVE-2015-7314 |
200 |
|
+Info |
2015-10-05 |
2015-10-07 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check. |
42982 |
CVE-2015-7313 |
399 |
|
DoS |
2017-03-17 |
2017-03-20 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
LibTIFF allows remote attackers to cause a denial of service (memory consumption and crash) via a crafted tiff file. |
42983 |
CVE-2015-7312 |
362 |
|
DoS +Priv |
2015-11-16 |
2017-11-03 |
4.4 |
None |
Local |
Medium |
Not required |
Partial |
Partial |
Partial |
Multiple race conditions in the Advanced Union Filesystem (aufs) aufs3-mmap.patch and aufs4-mmap.patch patches for the Linux kernel 3.x and 4.x allow local users to cause a denial of service (use-after-free and BUG) or possibly gain privileges via a (1) madvise or (2) msync system call, related to mm/madvise.c and mm/msync.c. |
42984 |
CVE-2015-7310 |
78 |
|
Exec Code |
2015-09-22 |
2016-12-07 |
6.5 |
None |
Remote |
Low |
Single system |
Partial |
Partial |
Partial |
McAfee Enterprise Security Manager (ESM), Enterprise Security Manager/Log Manager (ESMLM), and Enterprise Security Manager/Receiver (ESMREC) before 9.3.2MR18, 9.4.x before 9.4.2MR8, and 9.5.x before 9.5.0MR7 allow remote authenticated users to execute arbitrary OS commands via a crafted filename, which is not properly handled when downloading the file. |
42985 |
CVE-2015-7309 |
74 |
|
Exec Code |
2015-09-22 |
2015-09-23 |
6.5 |
None |
Remote |
Low |
Single system |
Partial |
Partial |
Partial |
The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it. |
42986 |
CVE-2015-7307 |
79 |
|
XSS |
2015-09-21 |
2015-09-22 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Cross-site scripting (XSS) vulnerability in the CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the configuration page. |
42987 |
CVE-2015-7306 |
284 |
|
|
2015-09-21 |
2015-09-22 |
4.9 |
None |
Remote |
Medium |
Single system |
None |
Partial |
Partial |
The CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal does not properly check access permissions, which allows remote authenticated users to access and change settings by leveraging the "access administration pages" permission. |
42988 |
CVE-2015-7305 |
200 |
|
+Info |
2015-09-21 |
2015-09-22 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The Scald module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to fields, which allows remote attackers to obtain sensitive atom property information via vectors involving a "debug context." |
42989 |
CVE-2015-7303 |
|
|
Exec Code |
2015-09-21 |
2015-09-22 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
Use-after-free vulnerability in the Update Manager service in Avira Management Console allows remote attackers to execute arbitrary code via a large header. |
42990 |
CVE-2015-7299 |
89 |
|
Exec Code Sql |
2015-10-21 |
2018-10-09 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
SQL injection vulnerability in Runtime/Runtime/AjaxCall.ashx in K2 blackpearl, smartforms, and K2 for SharePoint 4.6.7 allows remote attackers to execute arbitrary SQL commands via the xml parameter. |
42991 |
CVE-2015-7298 |
|
|
|
2015-10-26 |
2015-10-28 |
5.1 |
None |
Remote |
High |
Not required |
Partial |
Partial |
Partial |
ownCloud Desktop Client before 2.0.1, when compiled with a Qt release after 5.3.x, does not call QNetworkReply::ignoreSslErrors with the list of errors to be ignored, which makes it easier for remote attackers to conduct man-in-the-middle (MITM) attacks by leveraging a server using a self-signed certificate. NOTE: this vulnerability exists because of a partial CVE-2015-4456 regression. |
42992 |
CVE-2015-7297 |
89 |
|
Exec Code Sql |
2015-10-29 |
2017-09-12 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2015-7858. |
42993 |
CVE-2015-7296 |
|
|
|
2015-09-21 |
2015-09-30 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M use a linear algorithm for selecting the ID value in the header of a DNS query performed on behalf of the device itself, which makes it easier for remote attackers to spoof responses by including this ID value, as demonstrated by a response containing the address of the firmware update server, a different vulnerability than CVE-2015-2914. |
42994 |
CVE-2015-7295 |
119 |
|
DoS Overflow |
2015-11-09 |
2017-11-03 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allows remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface. |
42995 |
CVE-2015-7294 |
90 |
|
|
2017-09-06 |
2017-09-11 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username. |
42996 |
CVE-2015-7293 |
352 |
|
CSRF |
2017-09-25 |
2017-10-06 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x. |
42997 |
CVE-2015-7292 |
119 |
|
DoS Overflow |
2017-04-09 |
2017-04-14 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
Stack-based buffer overflow in the havok_write function in drivers/staging/havok/havok.c in Amazon Fire OS before 2016-01-15 allows attackers to cause a denial of service (panic) or possibly have unspecified other impact via a long string to /dev/hv. |
42998 |
CVE-2015-7291 |
352 |
|
CSRF |
2015-11-21 |
2015-11-23 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
Cross-site request forgery (CSRF) vulnerability in adv_pwd_cgi in the web management interface on Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 allows remote attackers to hijack the authentication of arbitrary users. |
42999 |
CVE-2015-7290 |
79 |
|
XSS |
2015-11-21 |
2015-11-23 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Cross-site scripting (XSS) vulnerability in adv_pwd_cgi in the web management interface on Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 allows remote attackers to inject arbitrary web script or HTML via the pwd parameter. |
43000 |
CVE-2015-7289 |
255 |
|
|
2015-11-21 |
2015-11-23 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 have a hardcoded administrator password derived from a serial number, which makes it easier for remote attackers to obtain access via the web management interface, SSH, TELNET, or SNMP. |