Security Vulnerabilities Published In 2015(Gain Privilege)

2015 : January February March April May June July August September October November December

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2015-8600	264	+Priv Bypass +Info	2015-12-17	2018-12-10	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The SysAdminWebTool servlets in SAP Mobile Platform allow remote attackers to bypass authentication and obtain sensitive information, gain privileges, or have unspecified other impact via unknown vectors, aka SAP Security Note 2227855.
2	CVE-2015-8543		DoS +Priv	2015-12-28	2018-01-05	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
The networking implementation in the Linux kernel through 4.3.3, as used in Android and other products, does not validate protocol identifiers for certain protocol families, which allows local users to cause a denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by leveraging CLONE_NEWUSER support to execute a crafted SOCK_RAW application.
3	CVE-2015-8368	254	+Priv	2015-12-17	2015-12-18	6.0	None	Remote	Medium	???	Partial	Partial	Partial
ntopng (aka ntop) before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and username parameter to admin/password_reset.lua.
4	CVE-2015-8328	119	DoS Overflow +Priv +Info	2015-11-24	2019-02-14	6.6	None	Local	Medium	Not required	Complete	Partial	Complete
Unspecified vulnerability in the NVAPI support layer in the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 before 358.87 on Windows allows local users to obtain sensitive information, cause a denial of service (crash), or possibly gain privileges via unknown vectors. NOTE: this identifier was SPLIT from CVE-2015-7869 per ADT2 and ADT3 due to different vulnerability types and affected versions.
5	CVE-2015-8222	264	+Priv	2015-11-17	2015-11-18	4.6	None	Local	Low	Not required	Partial	Partial	Partial
The lxd-unix.socket systemd unit file in the Ubuntu lxd package before 0.20-0ubuntu4.1 uses world-readable permissions for /var/lib/lxd/unix.socket, which allows local users to gain privileges via unspecified vectors.
6	CVE-2015-8113		+Priv	2015-11-12	2015-11-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Untrusted search path vulnerability in the client in Symantec Endpoint Protection (SEP) 12.1 before 12.1-RU6-MP3 allows local users to gain privileges via a Trojan horse DLL in a client install package. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1492.
7	CVE-2015-8090	200	+Priv +Info	2015-11-18	2015-11-19	4.0	None	Remote	Low	???	Partial	None	None
The Web Server component in TIBCO LogLogic Unity before 1.1.1 allows remote authenticated users to gain privileges, and consequently obtain sensitive information, via an HTTP request.
8	CVE-2015-7985	276	+Priv	2015-11-24	2022-02-07	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Valve Steam 2.10.91.91 uses weak permissions (Users: read and write) for the Install folder, which allows local users to gain privileges via a Trojan horse steam.exe file.
9	CVE-2015-7917		+Priv	2015-12-23	2016-11-28	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Untrusted search path vulnerability in Open Automation OPC Systems.NET 8.00.0023 and earlier allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.
10	CVE-2015-7897	119	DoS Overflow +Priv Mem. Corr.	2015-11-16	2015-11-17	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The media scanning functionality in the face recognition library in android.media.process in Samsung Galaxy S6 Edge before G925VVRU4B0G9 allows remote attackers to gain privileges or cause a denial of service (memory corruption) via a crafted BMP image file.
11	CVE-2015-7869	189	DoS Overflow +Priv +Info	2015-11-24	2019-02-13	6.6	None	Local	Medium	Not required	Complete	Partial	Complete
Multiple integer overflows in the kernel mode driver for the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 before 358.87 on Windows and R304 before 304.131, R340 before 340.96, R352 before 352.63, and R358 before 358.16 on Linux allow local users to obtain sensitive information, cause a denial of service (crash), or possibly gain privileges via unknown vectors, which trigger uninitialized or out of bounds memory access. NOTE: this identifier has been SPLIT per ADT2 and ADT3 due to different vulnerability type and affected versions. See CVE-2015-8328 for the vulnerability in the NVAPI support layer in NVIDIA drivers for Windows.
12	CVE-2015-7866		+Priv	2015-11-24	2019-02-13	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Unquoted Windows search path vulnerability in the Smart Maximize Helper (nvSmartMaxApp.exe) in the Control Panel in the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 before 358.87 on Windows allows local users to gain privileges via a Trojan horse application, as demonstrated by C:\Program.exe.
13	CVE-2015-7865	284	+Priv	2015-11-24	2019-02-13	7.7	None	Local Network	Low	???	Complete	Complete	Complete
nvSCPAPISvr.exe in the Stereoscopic 3D Driver Service in the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 before 358.87 on Windows does not properly restrict access to the stereosvrpipe named pipe, which allows local users to gain privileges via a commandline in a number 2 command, which is stored in the HKEY_LOCAL_MACHINE explorer Run registry key, a different vulnerability than CVE-2011-4784.
14	CVE-2015-7835	264	+Priv	2015-10-30	2018-10-30	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The mod_l2_entry function in arch/x86/mm.c in Xen 3.4 through 4.6.x does not properly validate level 2 page table entries, which allows local PV guest administrators to gain privileges via a crafted superpage mapping.
15	CVE-2015-7751	264	+Priv	2015-10-19	2015-10-20	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Juniper Junos OS before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R9, 12.3X48 before 12.3X48-D15, 13.2 before 13.2R7, 13.2X51 before 13.2X51-D35, 13.3 before 13.3R6, 14.1 before 14.1R5, 14.1X50 before 14.1X50-D105, 14.1X51 before 14.1X51-D70, 14.1X53 before 14.1X53-D25, 14.1X55 before 14.1X55-D20, 14.2 before 14.2R1, 15.1 before 15.1F2 or 15.1R1, and 15.1X49 before 15.1X49-D10 does not require a password for the root user when pam.conf is "corrupted," which allows local users to gain root privileges by modifying the file.
16	CVE-2015-7717	264	+Priv	2015-10-06	2015-10-07	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
mediaserver in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to gain privileges via a crafted application, aka internal bug 19573085, a different vulnerability than CVE-2015-6596.
17	CVE-2015-7613	362	+Priv	2015-10-19	2016-12-08	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Race condition in the IPC object implementation in the Linux kernel through 4.2.3 allows local users to gain privileges by triggering an ipc_addid call that leads to uid and gid comparisons against uninitialized data, related to msg.c, shm.c, and util.c.
18	CVE-2015-7600	264	+Priv	2015-10-06	2017-01-05	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Cisco VPN Client 5.x through 5.0.07.0440 uses weak permissions for vpnclient.ini, which allows local users to gain privileges by entering an arbitrary program name in the Command field of the ApplicationLauncher section.
19	CVE-2015-7394	264	DoS Exec Code +Priv	2015-11-06	2019-06-06	9.0	None	Remote	Low	???	Complete	Complete	Complete
The datastor kernel module in F5 BIG-IP Analytics, APM, ASM, Link Controller, and LTM 11.1.0 before 12.0.0, BIG-IP AAM 11.4.0 before 12.0.0, BIG-IP AFM, PEM 11.3.0 before 12.0.0, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.1.0 through 11.3.0, BIG-IP GTM 11.1.0 through 11.6.0, BIG-IP PSM 11.1.0 through 11.4.1, BIG-IQ Cloud and Security 4.0.0 through 4.5.0, BIG-IQ Device 4.2.0 through 4.5.0, BIG-IQ ADC 4.5.0, and Enterprise Manager 3.0.0 through 3.1.1 allows remote authenticated users to cause a denial of service or gain privileges by leveraging permission to upload and execute code.
20	CVE-2015-7312	362	DoS +Priv	2015-11-16	2020-08-07	4.4	None	Local	Medium	Not required	Partial	Partial	Partial
Multiple race conditions in the Advanced Union Filesystem (aufs) aufs3-mmap.patch and aufs4-mmap.patch patches for the Linux kernel 3.x and 4.x allow local users to cause a denial of service (use-after-free and BUG) or possibly gain privileges via a (1) madvise or (2) msync system call, related to mm/madvise.c and mm/msync.c.
21	CVE-2015-7223	264	+Priv XSS +Info	2015-12-16	2018-10-30	4.0	None	Remote	High	Not required	Partial	Partial	None
The WebExtension APIs in Mozilla Firefox before 43.0 allow remote attackers to gain privileges, and possibly obtain sensitive information or conduct cross-site scripting (XSS) attacks, via a crafted web site.
22	CVE-2015-7110	119	DoS Overflow +Priv Mem. Corr.	2015-12-11	2017-09-13	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
The Disk Images component in Apple OS X before 10.11.2 and tvOS before 9.1 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted disk image.
23	CVE-2015-7108	119	DoS Overflow +Priv Mem. Corr.	2015-12-11	2017-09-13	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The Bluetooth HCI interface in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
24	CVE-2015-7106	119	DoS Overflow +Priv Mem. Corr.	2015-12-11	2017-09-13	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The Intel Graphics Driver component in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
25	CVE-2015-7084	119	DoS Overflow +Priv Mem. Corr.	2015-12-11	2019-03-08	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7083.
26	CVE-2015-7083	119	DoS Overflow +Priv Mem. Corr.	2015-12-11	2019-03-08	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7084.
27	CVE-2015-7078		+Priv	2015-12-11	2017-09-13	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Use-after-free vulnerability in Hypervisor in Apple OS X before 10.11.2 allows local users to gain privileges via vectors involving VM objects.
28	CVE-2015-7077	119	DoS Overflow +Priv	2015-12-11	2017-09-13	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The Intel Graphics Driver component in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (out-of-bounds memory access) via unspecified vectors.
29	CVE-2015-7076		DoS +Priv	2015-12-11	2017-09-13	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The Intel Graphics Driver component in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.
30	CVE-2015-7063	264	+Priv	2015-12-11	2017-09-13	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The kernel loader in EFI in Apple OS X before 10.11.2 allows local users to gain privileges via a crafted pathname.
31	CVE-2015-7057	119	DoS Overflow +Priv Mem. Corr.	2015-12-11	2016-12-07	4.6	None	Local	Low	Not required	Partial	Partial	Partial
otools in Apple Xcode before 7.2 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted mach-o file, a different vulnerability than CVE-2015-7049.
32	CVE-2015-7052	264	+Priv	2015-12-11	2017-09-13	7.2	None	Local	Low	Not required	Complete	Complete	Complete
kext tools in Apple OS X before 10.11.2 mishandles kernel-extension loading, which allows local users to gain privileges via unspecified vectors.
33	CVE-2015-7049	119	DoS Overflow +Priv Mem. Corr.	2015-12-11	2016-12-07	4.6	None	Local	Low	Not required	Partial	Partial	Partial
otools in Apple Xcode before 7.2 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted mach-o file, a different vulnerability than CVE-2015-7057.
34	CVE-2015-7047	20	+Priv	2015-12-11	2019-03-08	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to gain privileges via a crafted mach message that is misparsed.
35	CVE-2015-7021	119	DoS Overflow +Priv Mem. Corr.	2015-10-23	2015-10-27	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to gain privileges or cause a denial of service (kernel memory corruption) via unspecified vectors.
36	CVE-2015-7016	264	+Priv Bypass	2015-10-23	2015-10-27	7.6	None	Remote	High	Not required	Complete	Complete	Complete
The MCX Application Restrictions component in Apple OS X before 10.11.1, when Managed Configuration is enabled, mishandles provisioning profiles, which allows attackers to bypass intended entitlement restrictions and gain privileges via a crafted developer-signed app.
37	CVE-2015-6923		+Priv	2015-09-21	2018-10-09	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The ndvbs module in VBox Communications Satellite Express Protocol 2.3.17.3 allows local users to write to arbitrary physical memory locations and gain privileges via a 0x00000ffd ioctl call.
38	CVE-2015-6850	264	+Priv	2015-12-28	2016-12-07	7.2	None	Local	Low	Not required	Complete	Complete	Complete
EMC VPLEX GeoSynchrony 5.4 SP1 before P3 and 5.5 before Patch 1 has a default password for the root account, which allows local users to gain privileges by leveraging a login session.
39	CVE-2015-6630	200	+Priv +Info	2015-12-08	2019-02-12	4.3	None	Remote	Medium	Not required	Partial	None	None
SystemUI in Android 5.x before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to read screenshots and consequently gain privileges via a crafted application, aka internal bug 19121797.
40	CVE-2015-6625	200	+Priv +Info	2015-12-08	2015-12-09	4.3	None	Remote	Medium	Not required	Partial	None	None
System Server in Android 6.0 before 2015-12-01 allows attackers to obtain sensitive information and consequently gain privileges via a crafted application, aka internal bug 23936840.
41	CVE-2015-6623	264	+Priv	2015-12-08	2015-12-09	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Wi-Fi in Android 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24872703.
42	CVE-2015-6621	264	+Priv	2015-12-08	2015-12-09	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
SystemUI in Android 5.x before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23909438.
43	CVE-2015-6620	264	+Priv	2015-12-08	2019-02-12	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bugs 24123723 and 24445127.
44	CVE-2015-6619	264	+Priv	2015-12-08	2019-02-12	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
The kernel in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, aka internal bug 23520714.
45	CVE-2015-6614	264	DoS +Priv Bypass	2015-11-03	2016-12-07	5.8	None	Remote	Medium	Not required	None	Partial	Partial
Telephony in Android 5.x before 5.1.1 LMY48X allows attackers to gain privileges, and consequently bypass intended network-interface restrictions, perform expensive data transfers, or cause a denial of service (call-reception outage or mute manipulation), via a crafted application, aka internal bug 21900139.
46	CVE-2015-6613	77	+Priv	2015-11-03	2019-02-12	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Bluetooth in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows attackers to send commands to a debugging port, and consequently gain privileges, via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24371736.
47	CVE-2015-6612	264	+Priv	2015-11-03	2019-02-12	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
libmedia in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows attackers to gain privileges via a crafted application, aka internal bug 23540426.
48	CVE-2015-6610	119	DoS Overflow +Priv Mem. Corr.	2015-11-03	2019-02-12	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
libstagefright in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows attackers to gain privileges or cause a denial of service (memory corruption) via a crafted application, aka internal bug 23707088.
49	CVE-2015-6607	264	+Priv	2015-10-06	2017-03-25	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
SQLite before 3.8.9, as used in Android before 5.1.1 LMY48T, allows attackers to gain privileges via a crafted application, aka internal bug 20099586.
50	CVE-2015-6606	264	+Priv	2015-10-06	2015-10-07	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
The Secure Element Evaluation Kit (aka SEEK or SmartCard API) plugin in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 22301786.

Total number of vulnerabilities : 359 Page : 1 (This Page)2 3 4 5 6 7 8