# |
CVE ID
|
CWE ID
|
# of Exploits
|
Vulnerability Type(s)
|
Publish Date
|
Update Date
|
Score
|
Gained Access Level
|
Access
|
Complexity
|
Authentication
|
Conf.
|
Integ.
|
Avail.
|
1 |
CVE-2015-8703 |
200 |
|
Bypass +Info |
2015-12-30 |
2016-11-28 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE and ZXV10 W300 devices W300V1.0.0f_ER1_PE allow remote authenticated users to bypass intended access restrictions, and discover credentials and keys, by reading the configuration file, a different vulnerability than CVE-2015-7248. |
2 |
CVE-2015-8669 |
200 |
|
+Info |
2015-12-26 |
2016-12-07 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
libraries/config/messages.inc.php in phpMyAdmin 4.0.x before 4.0.10.12, 4.4.x before 4.4.15.2, and 4.5.x before 4.5.3.1 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message. |
3 |
CVE-2015-8602 |
200 |
|
Bypass +Info |
2015-12-17 |
2015-12-18 |
3.5 |
None |
Remote |
Medium |
??? |
Partial |
None |
None |
The Token Insert Entity module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permissions, which allows remote authenticated users with certain permissions to bypass intended access restrictions and possibly obtain sensitive information by inserting a token, which embeds a rendered entity in the main node. |
4 |
CVE-2015-8601 |
200 |
|
Bypass +Info |
2015-12-17 |
2015-12-18 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The Chat Room module 7.x-2.x before 7.x-2.2 for Drupal does not properly check permissions when setting up a websocket for chat messages, which allows remote attackers to bypass intended access restrictions and read messages from arbitrary Chat Rooms via unspecified vectors. |
5 |
CVE-2015-8600 |
264 |
|
+Priv Bypass +Info |
2015-12-17 |
2018-12-10 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
The SysAdminWebTool servlets in SAP Mobile Platform allow remote attackers to bypass authentication and obtain sensitive information, gain privileges, or have unspecified other impact via unknown vectors, aka SAP Security Note 2227855. |
6 |
CVE-2015-8569 |
200 |
|
Bypass +Info |
2015-12-28 |
2017-11-04 |
1.9 |
None |
Local |
Medium |
Not required |
Partial |
None |
None |
The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through 4.3.3 do not verify an address length, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application. |
7 |
CVE-2015-8453 |
200 |
|
Bypass +Info |
2015-12-10 |
2017-02-17 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to bypass the ASLR protection mechanism via JIT data, a different vulnerability than CVE-2015-8409 and CVE-2015-8440. |
8 |
CVE-2015-8393 |
200 |
|
+Info |
2015-12-02 |
2022-09-16 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file, as demonstrated by a CGI script that sends stdout data to a client. |
9 |
CVE-2015-8382 |
119 |
|
DoS Overflow +Info |
2015-12-02 |
2016-12-28 |
6.4 |
None |
Remote |
Low |
Not required |
Partial |
None |
Partial |
The match function in pcre_exec.c in PCRE before 8.37 mishandles the /(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi)abc)|((*ACCEPT)))/ pattern and related patterns involving (*ACCEPT), which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (partially initialized memory and application crash) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-2547. |
10 |
CVE-2015-8374 |
200 |
|
+Info |
2015-12-28 |
2018-01-05 |
2.1 |
None |
Local |
Low |
Not required |
Partial |
None |
None |
fs/btrfs/inode.c in the Linux kernel before 4.3.3 mishandles compressed inline extents, which allows local users to obtain sensitive pre-truncation information from a file via a clone action. |
11 |
CVE-2015-8370 |
264 |
|
DoS Mem. Corr. Bypass +Info |
2015-12-16 |
2018-10-09 |
6.9 |
None |
Local |
Medium |
Not required |
Complete |
Complete |
Complete |
Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get function in lib/crypto.c, which trigger an "Off-by-two" or "Out of bounds overwrite" memory error. |
12 |
CVE-2015-8357 |
22 |
|
DoS Dir. Trav. +Info |
2015-12-16 |
2018-10-09 |
6.5 |
None |
Remote |
Low |
??? |
Partial |
Partial |
Partial |
Directory traversal vulnerability in the bitrix.xscan module before 1.0.4 for Bitrix allows remote authenticated users to rename arbitrary files, and consequently obtain sensitive information or cause a denial of service, via a .. (dot dot) in the file parameter to admin/bitrix.xscan_worker.php. |
13 |
CVE-2015-8328 |
119 |
|
DoS Overflow +Priv +Info |
2015-11-24 |
2019-02-14 |
6.6 |
None |
Local |
Medium |
Not required |
Complete |
Partial |
Complete |
Unspecified vulnerability in the NVAPI support layer in the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 before 358.87 on Windows allows local users to obtain sensitive information, cause a denial of service (crash), or possibly gain privileges via unknown vectors. NOTE: this identifier was SPLIT from CVE-2015-7869 per ADT2 and ADT3 due to different vulnerability types and affected versions. |
14 |
CVE-2015-8317 |
119 |
|
Overflow +Info |
2015-12-15 |
2017-09-14 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive information via an (1) unterminated encoding value or (2) incomplete XML declaration in XML data, which triggers an out-of-bounds heap read. |
15 |
CVE-2015-8253 |
200 |
|
+Info |
2015-12-27 |
2015-12-28 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
The Frontel protocol before 3 on RSI Video Technologies Videofied devices sets up AES encryption but sends all traffic in cleartext, which allows remote attackers to obtain sensitive (1) message or (2) MJPEG video data by sniffing the network. |
16 |
CVE-2015-8252 |
200 |
|
+Info |
2015-12-27 |
2015-12-28 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
The Frontel protocol before 3 on RSI Video Technologies Videofied devices sends a cleartext serial number, which allows remote attackers to determine a hardcoded key by sniffing the network and performing a "jumbled up" calculation with this number. |
17 |
CVE-2015-8242 |
119 |
|
DoS Overflow +Info |
2015-12-15 |
2019-03-08 |
5.8 |
None |
Remote |
Medium |
Not required |
Partial |
None |
Partial |
The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (stack-based buffer over-read and application crash) or obtain sensitive information via crafted XML data. |
18 |
CVE-2015-8241 |
119 |
|
DoS Overflow +Info |
2015-12-15 |
2017-09-14 |
6.4 |
None |
Remote |
Low |
Not required |
Partial |
None |
Partial |
The xmlNextChar function in libxml2 2.9.2 does not properly check the state, which allows context-dependent attackers to cause a denial of service (heap-based buffer over-read and application crash) or obtain sensitive information via crafted XML data. |
19 |
CVE-2015-8232 |
200 |
|
+Info |
2015-11-17 |
2015-11-18 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
The UC Profile module 6.x-1.x before 6.x-1.3 for Drupal does not properly check access to profiles in certain circumstances, which might allow remote attackers to obtain sensitive information from the anonymous user profile via unspecified vectors. |
20 |
CVE-2015-8227 |
20 |
|
DoS +Info |
2015-11-24 |
2016-09-13 |
8.5 |
None |
Remote |
Medium |
??? |
Complete |
Complete |
Complete |
The built-in web server in Huawei VP9660 multi-point control unit with software before V200R001C30SPC700 allows remote administrators to obtain sensitive information or cause a denial of service via a crafted message. |
21 |
CVE-2015-8213 |
200 |
|
+Info |
2015-12-07 |
2016-12-07 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY. |
22 |
CVE-2015-8100 |
200 |
|
+Info |
2015-11-10 |
2016-12-07 |
2.1 |
None |
Local |
Low |
Not required |
Partial |
None |
None |
The net-snmp package in OpenBSD through 5.8 uses 0644 permissions for snmpd.conf, which allows local users to obtain sensitive community information by reading this file. |
23 |
CVE-2015-8095 |
200 |
|
+Info |
2015-11-09 |
2015-11-10 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The recycle bin feature in the Monster Menus module 7.x-1.21 before 7.x-1.24 for Drupal does not properly remove nodes from view, which allows remote attackers to obtain sensitive information via an unspecified URL pattern. |
24 |
CVE-2015-8090 |
200 |
|
+Priv +Info |
2015-11-18 |
2015-11-19 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
The Web Server component in TIBCO LogLogic Unity before 1.1.1 allows remote authenticated users to gain privileges, and consequently obtain sensitive information, via an HTTP request. |
25 |
CVE-2015-8081 |
200 |
|
+Info |
2015-11-06 |
2017-01-05 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The Field as Block module 7.x-1.x before 7.x-1.4 for Drupal might allow remote attackers to obtain sensitive field information by reading a cached block. |
26 |
CVE-2015-8076 |
119 |
|
Overflow +Info |
2015-12-03 |
2018-10-30 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
The index_urlfetch function in index.c in Cyrus IMAP 2.3.x before 2.3.19, 2.4.x before 2.4.18, 2.5.x before 2.5.4 allows remote attackers to obtain sensitive information or possibly have unspecified other impact via vectors related to the urlfetch range, which triggers an out-of-bounds heap read. |
27 |
CVE-2015-8074 |
200 |
|
Bypass +Info |
2015-11-03 |
2015-11-03 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
mediaserver in Android before 5.1.1 LMY48X allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, aka internal bugs 23540907 and 23515142, a different vulnerability than CVE-2015-6611. |
28 |
CVE-2015-8007 |
200 |
|
+Info |
2015-11-09 |
2015-11-10 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
The Echo extension for MediWiki does not properly implement the hideuser functionality, which allows remote authenticated users to see hidden usernames in "non-revision based" notifications, as demonstrated by viewing a hidden username in a Thanks notification. |
29 |
CVE-2015-8005 |
200 |
|
+Info |
2015-11-09 |
2015-11-10 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 uses the thumbnail ImageMagick command line argument, which allows remote attackers to obtain the installation path by reading the metadata of a PNG thumbnail file. |
30 |
CVE-2015-7998 |
200 |
|
+Info |
2015-11-17 |
2016-12-07 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The administration UI in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 133.9, 10.5 before Build 58.11, and 10.5.e before Build 56.1505.e on NetScaler Service Delivery Appliance Service VM (SVM) devices allows attackers to obtain sensitive information via unspecified vectors. |
31 |
CVE-2015-7996 |
200 |
|
+Info |
2015-11-17 |
2016-12-07 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The Nitro API in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 133.9, 10.5 before Build 58.11, and 10.5.e before Build 56.1505.e on NetScaler Service Delivery Appliance Service VM (SVM) devices allow attackers to obtain credentials via the browser cache. |
32 |
CVE-2015-7991 |
200 |
|
+Info |
2015-11-10 |
2015-11-12 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The Web Dispatcher service in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to read web dispatcher and security trace files and possibly obtain passwords via unspecified vectors, aka SAP Security Note 2148854. |
33 |
CVE-2015-7981 |
200 |
|
+Info |
2015-11-24 |
2017-07-01 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The png_convert_to_rfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before 1.2.54, and 1.4.x before 1.4.17 allows remote attackers to obtain sensitive process memory information via crafted tIME chunk data in an image file, which triggers an out-of-bounds read. |
34 |
CVE-2015-7935 |
200 |
|
+Info |
2015-12-23 |
2016-11-28 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
Motorola Solutions MOSCAD IP Gateway allows remote attackers to read arbitrary files via unspecified vectors. |
35 |
CVE-2015-7934 |
200 |
|
+Info |
2015-12-24 |
2016-11-28 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to discover log-file pathnames via unspecified vectors. |
36 |
CVE-2015-7932 |
200 |
|
+Info |
2015-12-24 |
2016-11-28 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to obtain sensitive information by sniffing the network. |
37 |
CVE-2015-7931 |
200 |
|
+Info |
2015-12-24 |
2016-11-28 |
5.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
None |
The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station does not authenticate the station device, which allows man-in-the-middle attackers to spoof devices and obtain sensitive information by reading cleartext packet data, related to the lack of SSL support. |
38 |
CVE-2015-7929 |
200 |
|
+Info |
2015-12-23 |
2016-12-07 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
eWON devices with firmware through 10.1s0 support unspecified GET requests, which might allow remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history. |
39 |
CVE-2015-7928 |
200 |
|
+Info |
2015-12-23 |
2016-12-07 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
eWON devices with firmware before 10.1s0 do not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation. |
40 |
CVE-2015-7926 |
200 |
|
+Info |
2015-12-23 |
2016-12-07 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
eWON devices with firmware before 10.1s0 omit RBAC for I/O server information and status requests, which allows remote attackers to obtain sensitive information via an unspecified URL. |
41 |
CVE-2015-7910 |
200 |
|
Bypass +Info |
2015-11-19 |
2015-11-19 |
7.8 |
None |
Remote |
Low |
Not required |
Complete |
None |
None |
Exemys Telemetry Web Server relies on an HTTP Location header to indicate that a client is unauthorized, which allows remote attackers to bypass intended access restrictions by disregarding this header and processing the response body. |
42 |
CVE-2015-7908 |
200 |
|
+Info |
2015-12-21 |
2015-12-21 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
Honeywell Midas gas detectors before 1.13b3 and Midas Black gas detectors before 2.13b3 allow remote attackers to discover cleartext passwords by sniffing the network. |
43 |
CVE-2015-7902 |
200 |
|
+Info |
2015-10-28 |
2015-10-28 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 provides different error messages for failed login attempts in unspecified circumstances, which allows remote attackers to obtain sensitive information via a series of requests. |
44 |
CVE-2015-7900 |
200 |
|
+Info |
2015-10-28 |
2015-10-28 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote attackers to obtain sensitive debugging information by entering a crafted URL to trigger an exception, and then visiting a certain status page. |
45 |
CVE-2015-7899 |
284 |
|
+Info |
2015-10-29 |
2015-10-30 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The com_content component in Joomla! 3.x before 3.4.5 does not properly check ACLs, which allows remote attackers to obtain sensitive information via unspecified vectors. |
46 |
CVE-2015-7885 |
200 |
|
+Info |
2015-12-28 |
2016-12-07 |
2.1 |
None |
Local |
Low |
Not required |
Partial |
None |
None |
The dgnc_mgmt_ioctl function in drivers/staging/dgnc/dgnc_mgmt.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a crafted application. |
47 |
CVE-2015-7884 |
200 |
|
+Info |
2015-12-28 |
2016-12-07 |
1.9 |
None |
Local |
Medium |
Not required |
Partial |
None |
None |
The vivid_fb_ioctl function in drivers/media/platform/vivid/vivid-osd.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a crafted application. |
48 |
CVE-2015-7869 |
189 |
|
DoS Overflow +Priv +Info |
2015-11-24 |
2019-02-13 |
6.6 |
None |
Local |
Medium |
Not required |
Complete |
Partial |
Complete |
Multiple integer overflows in the kernel mode driver for the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 before 358.87 on Windows and R304 before 304.131, R340 before 340.96, R352 before 352.63, and R358 before 358.16 on Linux allow local users to obtain sensitive information, cause a denial of service (crash), or possibly gain privileges via unknown vectors, which trigger uninitialized or out of bounds memory access. NOTE: this identifier has been SPLIT per ADT2 and ADT3 due to different vulnerability type and affected versions. See CVE-2015-8328 for the vulnerability in the NVAPI support layer in NVIDIA drivers for Windows. |
49 |
CVE-2015-7859 |
200 |
|
+Info |
2015-10-29 |
2015-10-30 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The com_contenthistory component in Joomla! 3.2 before 3.4.5 does not properly check ACLs, which allows remote attackers to obtain sensitive information via unspecified vectors. |
50 |
CVE-2015-7836 |
200 |
|
+Info |
2015-10-28 |
2017-09-15 |
3.3 |
None |
Local Network |
Low |
Not required |
Partial |
None |
None |
Siemens RUGGEDCOM ROS before 4.2.1 allows remote attackers to obtain sensitive information by sniffing the network for VLAN data within the padding section of an Ethernet frame. |