CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In September 2015

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2015-7604 79 XSS 2015-09-29 2015-09-30
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.2.x before 6.2.6 and Splunk Light 6.2.x before 6.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
2 CVE-2015-7603 22 Dir. Trav. 2015-09-29 2015-09-30
7.8
 None Remote Low Not required Complete None None
Directory traversal vulnerability in Konica Minolta FTP Utility 1.0 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in a RETR command.
3 CVE-2015-7602 22 Dir. Trav. 2015-09-29 2015-10-13
7.8
 None Remote Low Not required Complete None None
Directory traversal vulnerability in BisonWare BisonFTP 3.5 allows remote attackers to read arbitrary files via a ../ (dot dot slash) in a RETR command.
4 CVE-2015-7601 22 Dir. Trav. 2015-09-29 2017-11-07
7.8
 None Remote Low Not required Complete None None
Directory traversal vulnerability in PCMan's FTP Server 2.0.7 allows remote attackers to read arbitrary files via a ..// (dot dot double slash) in a RETR command.
5 CVE-2015-7387 89 Exec Code Sql Bypass 2015-09-28 2020-03-26
7.5
 None Remote Low Not required Partial Partial Partial
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do, as demonstrated by "SELECT 1;INSERT INTO." Fixed in Build 11200.
6 CVE-2015-7386 79 XSS 2015-09-28 2015-09-29
3.5
 None Remote Medium ??? None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in includes/metaboxes.php in the Gallery - Photo Albums - Portfolio plugin 1.3.47 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) Media Title or (2) Media Subtitle fields.
7 CVE-2015-7383 79 XSS 2015-09-28 2015-09-29
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge through 2015-04-28 allow remote attackers to inject arbitrary web script or HTML via the (1) adminUserName, (2) pathToMYSQL, (3) databaseStructureFile, or (4) pathToBibutils parameter to install.php or the (5) adminUserName parameter to update.php.
8 CVE-2015-7382 89 Exec Code Sql 2015-09-28 2015-09-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in install.php in Web Reference Database (aka refbase) through 0.9.6 allows remote attackers to execute arbitrary SQL commands via the defaultCharacterSet parameter, a different issue than CVE-2015-6009.
9 CVE-2015-7381 94 Exec Code File Inclusion 2015-09-28 2015-09-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in install.php in Web Reference Database (aka refbase) through 0.9.6 allow remote attackers to execute arbitrary PHP code via the (1) pathToMYSQL or (2) databaseStructureFile parameter, a different issue than CVE-2015-6008.
10 CVE-2015-7375 20 DoS Exec Code 2015-09-25 2015-09-29
7.5
 None Remote Low Not required Partial Partial Partial
Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code or cause a denial of service (unhandled runtime exception and application crash) via a crafted Indusoft Project file.
11 CVE-2015-7374 20 Exec Code 2015-09-25 2016-12-08
7.5
 None Remote Low Not required Partial Partial Partial
The Remote Agent component in Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-2649.
12 CVE-2015-7337 20 Exec Code 2015-09-29 2016-12-07
6.8
 None Remote Medium Not required Partial Partial Partial
The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
13 CVE-2015-7327 200 +Info 2015-09-24 2016-12-22
4.3
 None Remote Medium Not required Partial None None
Mozilla Firefox before 41.0 does not properly restrict the availability of High Resolution Time API times, which allows remote attackers to track last-level cache access, and consequently obtain sensitive information, via crafted JavaScript code that makes performance.now calls.
14 CVE-2015-7320 79 XSS 2015-09-29 2018-10-09
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
15 CVE-2015-7319 89 Exec Code Sql 2015-09-29 2018-10-09
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to updating the username.
16 CVE-2015-7310 78 Exec Code 2015-09-22 2016-12-08
6.5
 None Remote Low ??? Partial Partial Partial
McAfee Enterprise Security Manager (ESM), Enterprise Security Manager/Log Manager (ESMLM), and Enterprise Security Manager/Receiver (ESMREC) before 9.3.2MR18, 9.4.x before 9.4.2MR8, and 9.5.x before 9.5.0MR7 allow remote authenticated users to execute arbitrary OS commands via a crafted filename, which is not properly handled when downloading the file.
17 CVE-2015-7309 74 Exec Code 2015-09-22 2021-01-04
6.5
 None Remote Low ??? Partial Partial Partial
The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it.
18 CVE-2015-7307 79 XSS 2015-09-21 2015-09-23
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the configuration page.
19 CVE-2015-7306 284 2015-09-21 2015-09-23
4.9
 None Remote Medium ??? None Partial Partial
The CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal does not properly check access permissions, which allows remote authenticated users to access and change settings by leveraging the "access administration pages" permission.
20 CVE-2015-7305 200 +Info 2015-09-21 2015-09-23
5.0
 None Remote Low Not required Partial None None
The Scald module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to fields, which allows remote attackers to obtain sensitive atom property information via vectors involving a "debug context."
21 CVE-2015-7304 79 XSS 2015-09-21 2015-09-23
2.6
 None Remote High Not required None Partial None
Cross-site scripting (XSS) vulnerability in the amoCRM module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified HTTP POST data.
22 CVE-2015-7303 Exec Code 2015-09-21 2015-09-23
10.0
 None Remote Low Not required Complete Complete Complete
Use-after-free vulnerability in the Update Manager service in Avira Management Console allows remote attackers to execute arbitrary code via a large header.
23 CVE-2015-7296 2015-09-21 2015-09-30
4.3
 None Remote Medium Not required None Partial None
Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M use a linear algorithm for selecting the ID value in the header of a DNS query performed on behalf of the device itself, which makes it easier for remote attackers to spoof responses by including this ID value, as demonstrated by a response containing the address of the firmware update server, a different vulnerability than CVE-2015-2914.
24 CVE-2015-7243 119 DoS Exec Code Overflow 2015-09-18 2018-07-06
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in Boxoft WAV to MP3 Converter allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted WAV file.
25 CVE-2015-7239 89 Exec Code Sql 2015-09-18 2018-12-10
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the BP_FIND_JOBS_WITH_PROGRAM function module in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
26 CVE-2015-7238 264 +Info 2015-09-18 2015-09-22
2.1
 None Local Low Not required Partial None None
The Secondary server in Threat Intelligence Exchange (TIE) before 1.2.0 uses weak permissions for unspecified (1) configuration files and (2) installation logs, which allows local users to obtain sensitive information by reading the files.
27 CVE-2015-7237 22 Dir. Trav. +Info 2015-09-18 2015-09-22
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in the remote log viewing functionality in McAfee Agent (MA) 5.x before 5.0.2 allows remote attackers to obtain sensitive information via unspecified vectors.
28 CVE-2015-7235 89 Exec Code Sql 2015-09-17 2016-12-22
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar plugin before 1.1.7 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a dex_reservations_calendar_load2 action or (2) dex_item parameter in a dex_reservations_check_posted_data action in a request to the default URI.
29 CVE-2015-7234 20 2015-09-17 2015-09-23
4.0
 None Remote High Not required None Partial Partial
The OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology and OSF Import modules are enabled, allows user-assisted remote attackers to delete arbitrary files via unspecified vectors.
30 CVE-2015-7233 352 CSRF 2015-09-17 2015-09-18
5.1
 None Remote High Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in the OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Import module is enabled, allows remote attackers to hijack the authentication of administrators for requests that create new OSF datasets via unspecified vectors.
31 CVE-2015-7232 79 XSS 2015-09-17 2015-09-18
2.6
 None Remote High Not required None Partial None
Cross-site scripting (XSS) vulnerability in unspecified administration pages in the OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology module is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
32 CVE-2015-7231 20 2015-09-17 2015-09-22
5.0
 None Remote Low Not required None Partial None
The Commerce Commonwealth (CBA) module 7.x-1.x before 7.x-1.5 for Drupal does not properly validate payments, which allows remote attackers to make a failed payment appear valid via a crafted URL, related to a "response from commweb."
33 CVE-2015-7230 264 Bypass 2015-09-17 2015-09-22
3.5
 None Remote Medium ??? None Partial None
The Workbench Email module 7.x-3.x before 7.x-3.4 for Drupal allows remote authenticated users with certain permissions to bypass node and field validation by saving a node.
34 CVE-2015-7229 264 2015-09-17 2015-09-22
3.5
 None Remote Medium ??? None Partial None
The Twitter module 6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, and 7.x-6.x before 7.x-6.0 for Drupal does not properly check access permissions, which allows remote authenticated users to post tweets to arbitrary accounts by leveraging the (1) "post to twitter" permission or change the options for arbitrary attached accounts by leveraging the (2) "add twitter accounts" or (3) "add authenticated twitter accounts" permission.
35 CVE-2015-7228 +Info 2015-09-17 2015-09-22
5.0
 None Remote Low Not required Partial None None
The RESTful module 7.x-1.x before 7.x-1.3 for Drupal does not properly cache pages of authenticated users when using non-cookie authentication providers, which allows remote attackers to obtain sensitive information via unspecified vectors.
36 CVE-2015-7227 264 2015-09-17 2015-09-22
3.5
 None Remote Medium ??? None Partial None
The Fieldable Panels Panes module 7.x-1.x before 7.x-1.7 for Drupal does not properly check permissions to edit Fieldable Panels Panes entities, which allows remote authenticated users to edit panes by leveraging permissions to edit panels.
37 CVE-2015-7226 200 +Info 2015-09-17 2016-11-28
5.0
 None Remote Low Not required Partial None None
The Administration Views module 7.x-1.x before 7.x-1.5 for Drupal checks access permissions based on the router path from the view instead of the display property, which allows remote attackers to obtain sensitive information via vectors related to the access handler.
38 CVE-2015-7180 119 DoS Overflow Mem. Corr. 2015-09-24 2016-12-22
7.5
 None Remote Low Not required Partial Partial Partial
The ReadbackResultWriterD3D11::Run function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 misinterprets the return value of a function call, which might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.
39 CVE-2015-7179 119 DoS Exec Code Overflow 2015-09-24 2016-12-22
7.5
 None Remote Low Not required Partial Partial Partial
The VertexBufferInterface::reserveVertexSpace function in libGLES in ANGLE, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows, incorrectly allocates memory for shader attribute arrays, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via crafted (1) OpenGL or (2) WebGL content.
40 CVE-2015-7178 119 DoS Exec Code Overflow Mem. Corr. 2015-09-24 2016-12-22
7.5
 None Remote Low Not required Partial Partial Partial
The ProgramBinary::linkAttributes function in libGLES in ANGLE, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows, mishandles shader access, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted (1) OpenGL or (2) WebGL content.
41 CVE-2015-7177 119 DoS Overflow Mem. Corr. 2015-09-24 2016-12-22
7.5
 None Remote Low Not required Partial Partial Partial
The InitTextures function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.
42 CVE-2015-7176 119 DoS Overflow 2015-09-24 2016-12-22
7.5
 None Remote Low Not required Partial Partial Partial
The AnimationThread function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 uses an incorrect argument to the sscanf function, which might allow remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via unknown vectors.
43 CVE-2015-7175 119 DoS Overflow Mem. Corr. 2015-09-24 2016-12-22
7.5
 None Remote Low Not required Partial Partial Partial
The XULContentSinkImpl::AddText function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an "overflow."
44 CVE-2015-7174 119 DoS Overflow Mem. Corr. 2015-09-24 2016-12-22
7.5
 None Remote Low Not required Partial Partial Partial
The nsAttrAndChildArray::GrowBy function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an "overflow."
45 CVE-2015-6973 352 CSRF 2015-09-16 2018-10-09
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password via a crafted request to user-password.jsp, (2) add users via a crafted request to user-create.jsp, (3) edit server settings or (4) disable SSL on the server via a crafted request to server-props.jsp, or (5) add clients via a crafted request to plugins/clientcontrol/permitted-clients.jsp.
46 CVE-2015-6972 79 XSS 2015-09-16 2017-07-01
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject arbitrary web script or HTML via the (1) groupchatName parameter to plugins/clientcontrol/create-bookmark.jsp; the (2) urlName parameter to plugins/clientcontrol/create-bookmark.jsp; the (3) hostname parameter to server-session-details.jsp; or the (4) search parameter to group-summary.jsp.
47 CVE-2015-6969 79 XSS 2015-09-16 2015-09-16
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user name in a comment, which is not properly handled in a Reply link.
48 CVE-2015-6968 Exec Code 2015-09-16 2015-09-16
6.5
 None Remote Low ??? Partial Partial Partial
Multiple incomplete blacklist vulnerabilities in the serendipity_isActiveFile function in include/functions_images.inc.php in Serendipity before 2.0.2 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .pht or (2) .phtml extension.
49 CVE-2015-6967 Exec Code 2015-09-16 2015-09-17
6.5
 None Remote Low ??? Partial Partial Partial
Unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in content/private/plugins/my_image/image.php.
50 CVE-2015-6966 352 XSS CSRF 2015-09-16 2015-09-18
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in Nibbleblog before 4.0.5 allow remote attackers to hijack the authentication of administrators for requests that (1) create a post via a new_simple action to admin.php or (2) conduct cross-site scripting (XSS) attacks via the content parameter in a new_simple action to admin.php.
Total number of vulnerabilities : 494   Page : 1 (This Page)2 3 4 5 6 7 8 9 10
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.