CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In August 2015 (CVSS score >= 5)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2015-6750 119 Exec Code Overflow 2015-08-31 2015-09-01
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in Ricoh DL FTP Server 1.1.0.6 and earlier allows remote attackers to execute arbitrary code via a long USER command.
2 CVE-2015-6747 200 +Info 2015-08-31 2015-08-31
5.0
 None Remote Low Not required Partial None None
Basware Banking (Maksuliikenne) 8.90.07.X does not properly prevent access to private keys, which allows remote attackers to spoof communications with banks via unspecified vectors. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 due to different vulnerability types. NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-6746.
3 CVE-2015-6743 255 Bypass 2015-08-31 2015-08-31
6.5
 None Remote Low ??? Partial Partial Partial
Basware Banking (Maksuliikenne) 8.90.07.X uses a hardcoded password for an unspecified account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability types and different affected versions.
4 CVE-2015-6742 255 Bypass 2015-08-31 2015-08-31
6.5
 None Remote Low ??? Partial Partial Partial
Basware Banking (Maksuliikenne) before 8.90.07.X uses a hardcoded password for the ANCO account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability types and different affected versions.
5 CVE-2015-6664 2015-08-24 2018-12-10
6.8
 None Remote Medium Not required Partial Partial Partial
XML external entity (XXE) vulnerability in the application import functionality in SAP Mobile Platform 2.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via crafted XML data, aka SAP Security Note 2152227.
6 CVE-2015-6662 2015-08-24 2018-12-10
6.8
 None Remote Medium Not required Partial Partial Partial
XML external entity (XXE) vulnerability in SAP NetWeaver Portal 7.4 allows remote attackers to read arbitrary files and possibly have other unspecified impact via crafted XML data, aka SAP Security Note 2168485.
7 CVE-2015-6661 200 +Info 2015-08-24 2016-12-24
5.0
 None Remote Low Not required Partial None None
Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu.
8 CVE-2015-6660 352 CSRF 2015-08-24 2016-12-24
6.8
 None Remote Medium Not required Partial Partial Partial
The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks."
9 CVE-2015-6659 89 Exec Code Sql 2015-08-24 2016-12-24
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment.
10 CVE-2015-6655 352 CSRF 2015-08-31 2016-12-22
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in Pligg CMS 2.0.2 allows remote attackers to hijack the authentication of administrators for requests that add an administrator via a request to admin/admin_users.php.
11 CVE-2015-6565 264 DoS 2015-08-24 2017-09-02
7.2
 None Local Low Not required Complete Complete Complete
sshd in OpenSSH 6.8 and 6.9 uses world-writable permissions for TTY devices, which allows local users to cause a denial of service (terminal disruption) or possibly have unspecified other impact by writing to a device, as demonstrated by writing an escape sequence.
12 CVE-2015-6564 264 +Priv 2015-08-24 2019-03-26
6.9
 None Local Medium Not required Complete Complete Complete
Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-OpenBSD platforms might allow local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request.
13 CVE-2015-6525 189 DoS Overflow 2015-08-24 2015-08-26
7.5
 None Remote Low Not required Partial Partial Partial
Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact via "insanely large inputs" to the (1) evbuffer_add, (2) evbuffer_prepend, (3) evbuffer_expand, (4) exbuffer_reserve_space, or (5) evbuffer_read function, which triggers a heap-based buffer overflow or an infinite loop. NOTE: this identifier was SPLIT from CVE-2014-6272 per ADT3 due to different affected versions.
14 CVE-2015-6524 255 2015-08-24 2016-12-09
5.0
 None Remote Low Not required Partial None None
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.
15 CVE-2015-6523 352 CSRF 2015-08-19 2016-12-22
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in the Portfolio plugin before 1.05 for WordPress allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via a request to the instagram-portfolio page in wp-admin/options-general.php.
16 CVE-2015-6522 89 Exec Code Sql 2015-08-19 2016-12-09
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the WP Symposium plugin before 15.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the size parameter to get_album_item.php.
17 CVE-2015-6519 89 Exec Code Sql 2015-08-18 2015-08-20
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Arab Portal 3 allows remote attackers to execute arbitrary SQL commands via the showemail parameter in a signup action to members.php.
18 CVE-2015-6517 352 CSRF 2015-08-18 2019-03-12
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in phpLiteAdmin 1.1 allows remote attackers to hijack the authentication of users for requests that drop database tables via the droptable parameter to phpliteadmin.php.
19 CVE-2015-6516 89 Exec Code Sql 2015-08-18 2018-10-09
6.5
 None Remote Low ??? Partial Partial Partial
SQL injection vulnerability in cygnux.org sysPass 1.0.9 and earlier allows remote authenticated users to execute arbitrary SQL commands via the search parameter to ajax/ajax_search.php.
20 CVE-2015-6513 89 Exec Code Sql 2015-08-18 2015-08-19
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the J2Store (com_j2store) extension before 3.1.7 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) sortby or (2) manufacturer_ids[] parameter to index.php.
21 CVE-2015-6512 89 Exec Code Sql 2015-08-18 2015-08-19
5.0
 None Remote Low Not required Partial None None
SQL injection vulnerability in the get_messages function in server/plugins/chatroom/chatroom.php in FreiChat 9.6 allows remote attackers to execute arbitrary SQL commands via the time parameter to server/freichat.php.
22 CVE-2015-6496 17 DoS 2015-08-24 2018-05-22
5.0
 None Remote Low Not required None None Partial
conntrackd in conntrack-tools 1.4.2 and earlier does not ensure that the optional kernel modules are loaded before using them, which allows remote attackers to cause a denial of service (crash) via a (1) DCCP, (2) SCTP, or (3) ICMPv6 packet.
23 CVE-2015-6273 399 DoS 2015-08-29 2017-09-20
7.8
 None Remote Low Not required None None Complete
Cisco IOS XE before 3.1.2S on ASR 1000 devices mishandles the automatic setup of Virtual Fragment Reassembly (VFR) by certain firewall and NAT components, which allows remote attackers to cause a denial of service (Embedded Services Processor crash) via crafted IP packets, aka Bug IDs CSCtf87624, CSCte93229, CSCtd19103, and CSCti63623.
24 CVE-2015-6272 399 DoS 2015-08-31 2017-09-20
7.8
 None Remote Low Not required None None Complete
Cisco IOS XE 2.1.0 through 2.2.3 and 2.3.0 on ASR 1000 devices, when NAT Application Layer Gateway is used, allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted H.323 packet, aka Bug ID CSCsx35393, CSCsx07094, and CSCsw93064.
25 CVE-2015-6271 399 DoS 2015-08-31 2017-09-20
7.8
 None Remote Low Not required None None Complete
Cisco IOS XE 2.1.0 through 2.4.3 and 2.5.0 on ASR 1000 devices, when NAT Application Layer Gateway is used, allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted SIP packet, aka Bug IDs CSCta74749 and CSCta77008.
26 CVE-2015-6270 399 DoS 2015-08-31 2017-09-20
7.8
 None Remote Low Not required None None Complete
Cisco IOS XE before 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted IPv6 packet, aka Bug ID CSCsv98555.
27 CVE-2015-6269 399 DoS 2015-08-31 2017-09-20
7.8
 None Remote Low Not required None None Complete
Cisco IOS XE before 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted (1) IPv4 or (2) IPv6 packet, aka Bug ID CSCsw69990.
28 CVE-2015-6268 399 DoS 2015-08-29 2017-09-20
7.8
 None Remote Low Not required None None Complete
Cisco IOS XE before 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted IPv4 UDP packet, aka Bug ID CSCsw95482.
29 CVE-2015-6267 399 DoS 2015-08-29 2017-09-20
7.8
 None Remote Low Not required None None Complete
Cisco IOS XE before 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted L2TP packet, aka Bug IDs CSCsw95722 and CSCsw95496.
30 CVE-2015-6266 287 +Info 2015-08-28 2017-09-20
5.0
 None Remote Low Not required Partial None None
The guest portal in Cisco Identity Services Engine (ISE) 3300 1.2(0.899) does not restrict access to uploaded HTML documents, which allows remote attackers to obtain sensitive information from customized documents via a direct request, aka Bug ID CSCuo78045.
31 CVE-2015-6262 352 CSRF 2015-08-25 2019-07-29
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in Cisco Prime Infrastructure 1.2(0.103) and 2.0(0.0) allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCum49054 and CSCum49059.
32 CVE-2015-6258 20 2015-08-22 2017-01-04
5.0
 None Remote Low Not required Partial None None
The Internet Access Point Protocol (IAPP) module on Cisco Wireless LAN Controller (WLC) devices with software 8.1(104.37) allows remote attackers to trigger incorrect traffic forwarding via crafted IPv6 packets, aka Bug ID CSCuv40033.
33 CVE-2015-6256 20 DoS 2015-08-22 2017-01-04
5.0
 None Remote Low Not required None None Partial
Cisco ASR 5000 devices with software 19.0.M0.60828 allow remote attackers to cause a denial of service (OSPF process restart) via crafted length fields in headers of OSPF packets, aka Bug ID CSCuv62820.
34 CVE-2015-6254 17 2015-08-17 2015-08-19
6.0
 None Remote Medium ??? Partial Partial Partial
The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the message was received, which allows remote attackers to have unspecified impact via unknown vectors. NOTE: this identifier was SPLIT from CVE-2015-0277 per ADT2 due to different vulnerability types.
35 CVE-2015-6251 DoS 2015-08-24 2016-12-24
5.0
 None Remote Low Not required None None Partial
Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service via a long DistinguishedName (DN) entry in a certificate.
36 CVE-2015-5965 20 2015-08-11 2016-12-24
5.0
 None Remote Low Not required None Partial None
The SSL-VPN feature in Fortinet FortiOS before 4.3.13 only checks the first byte of the TLS MAC in finished messages, which makes it easier for remote attackers to spoof encrypted content via a crafted MAC field.
37 CVE-2015-5964 399 DoS 2015-08-24 2016-12-24
5.0
 None Remote Low Not required None None Partial
The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attackers to cause a denial of service (session store consumption) via unspecified vectors.
38 CVE-2015-5963 399 DoS 2015-08-24 2017-10-03
5.0
 None Remote Low Not required None None Partial
contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record.
39 CVE-2015-5962 189 DoS Mem. Corr. 2015-08-08 2015-08-21
5.0
 None Remote Low Not required None None Partial
Integer signedness error in the SharedBufferManagerParent::RecvAllocateGrallocBuffer function in the buffer-management implementation in the graphics layer in Mozilla Firefox OS before 2.2 might allow attackers to cause a denial of service (memory corruption) via a negative value of a size parameter.
40 CVE-2015-5949 119 DoS Exec Code Overflow 2015-08-25 2018-10-09
6.8
 None Remote Medium Not required Partial Partial Partial
VideoLAN VLC media player 2.2.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted 3GP file, which triggers the freeing of arbitrary pointers.
41 CVE-2015-5786 119 DoS Exec Code Overflow Mem. Corr. 2015-08-25 2016-12-24
6.8
 None Remote Medium Not required Partial Partial Partial
Apple QuickTime before 7.7.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-5785.
42 CVE-2015-5785 119 DoS Exec Code Overflow Mem. Corr. 2015-08-25 2016-12-24
6.8
 None Remote Medium Not required Partial Partial Partial
Apple QuickTime before 7.7.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-5786.
43 CVE-2015-5784 264 Exec Code 2015-08-17 2017-09-21
9.3
 None Remote Medium Not required Complete Complete Complete
runner in Install.framework in the Install Framework Legacy component in Apple OS X before 10.10.5 does not properly drop privileges, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
44 CVE-2015-5783 119 DoS Exec Code Overflow Mem. Corr. 2015-08-17 2017-09-21
9.3
 None Remote Medium Not required Complete Complete Complete
IOGraphics in Apple OS X before 10.10.5 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-3770.
45 CVE-2015-5779 119 DoS Exec Code Overflow Mem. Corr. 2015-08-17 2017-09-21
7.5
 None Remote Low Not required Partial Partial Partial
QuickTime 7 in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-3765, CVE-2015-3779, CVE-2015-3788, CVE-2015-3789, CVE-2015-3790, CVE-2015-3791, CVE-2015-3792, CVE-2015-5751, and CVE-2015-5753.
46 CVE-2015-5778 119 DoS Exec Code Overflow Mem. Corr. 2015-08-17 2016-12-24
6.8
 None Remote Medium Not required Partial Partial Partial
CoreMedia Playback in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-5777.
47 CVE-2015-5777 119 DoS Exec Code Overflow Mem. Corr. 2015-08-17 2016-12-24
6.8
 None Remote Medium Not required Partial Partial Partial
CoreMedia Playback in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-5778.
48 CVE-2015-5776 119 DoS Exec Code Overflow Mem. Corr. 2015-08-17 2016-12-24
7.5
 None Remote Low Not required Partial Partial Partial
Libinfo in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by leveraging use of an AF_INET6 socket.
49 CVE-2015-5775 119 DoS Exec Code Overflow Mem. Corr. 2015-08-17 2016-12-24
7.5
 None Remote Low Not required Partial Partial Partial
FontParser in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted font file, a different vulnerability than CVE-2015-3804 and CVE-2015-5756.
50 CVE-2015-5774 119 Overflow +Priv 2015-08-17 2016-12-24
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in IOHIDFamily in Apple iOS before 8.4.1 and OS X before 10.10.5 allows local users to gain privileges via unspecified vectors.
Total number of vulnerabilities : 426   Page : 1 (This Page)2 3 4 5 6 7 8 9
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.