CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In June 2015 (CVSS score >= 7)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2015-5148 89 Exec Code Sql 2015-06-30 2015-07-01
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in LivelyCart 1.2.0 allows remote attackers to execute arbitrary SQL commands via the search_query parameter to product/search.
2 CVE-2015-5068 2015-06-24 2018-12-10
7.5
 None Remote Low Not required Partial Partial Partial
XML external entity (XXE) vulnerability in SAP Mobile Platform 3 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML request, aka SAP Security Note 2159601.
3 CVE-2015-5067 255 2015-06-24 2018-12-10
7.5
 None Remote Low Not required Partial Partial Partial
The (1) Cross-System Tools and (2) Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, which allows remote attackers to obtain access via unspecified vectors, aka SAP Security Notes 2059659 and 2057982.
4 CVE-2015-4726 94 Exec Code File Inclusion 2015-06-23 2016-12-07
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in ajax/myajaxphp.php in AudioShare 2.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the config['basedir'] parameter.
5 CVE-2015-4678 89 Exec Code Sql 2015-06-19 2016-12-07
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Persian Car CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to the default URI.
6 CVE-2015-4675 119 DoS Exec Code Overflow 2015-06-19 2016-12-07
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the Tiny SRP library (aka TinySRP) allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted size value for the username field.
7 CVE-2015-4658 89 Exec Code Sql 2015-06-18 2015-06-19
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in admin/login.php in Milw0rm Clone Script 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) usr or (2) pwd parameter.
8 CVE-2015-4654 89 Exec Code Sql 2015-06-18 2016-12-07
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the EQ Event Calendar component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to eqfullevent.
9 CVE-2015-4607 Exec Code 2015-06-16 2016-12-07
7.5
 None Remote Low Not required Partial Partial Partial
Unrestricted file upload vulnerability in the Frontend User Upload (feupload) extension 0.5.0 and earlier for TYPO3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension using a frontend form, then accessing it via a direct request to the file in the fileadmin folder.
10 CVE-2015-4606 Exec Code 2015-06-16 2016-12-07
7.5
 None Remote Low Not required Partial Partial Partial
Unrestricted file upload vulnerability in the Job Fair (jobfair) extension before 1.0.1 for TYPO3, when using Apache with mod_mime, allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the extension upload folder.
11 CVE-2015-4454 89 Exec Code Sql 2015-06-17 2017-11-04
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php.
12 CVE-2015-4342 89 Exec Code Sql 2015-06-17 2017-11-08
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id.
13 CVE-2015-4335 17 Exec Code 2015-06-09 2018-08-13
10.0
 None Remote Low Not required Complete Complete Complete
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
14 CVE-2015-4227 399 DoS 2015-06-30 2016-12-28
7.8
 None Remote Low Not required None None Complete
Memory leak in Cisco Headend System Release allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, aka Bug ID CSCus91838.
15 CVE-2015-4226 399 DoS 2015-06-30 2017-01-04
7.1
 None Remote Medium Not required None None Complete
The packet-storing feature on Cisco 9900 phones with firmware 9.3(2) does not properly support the RTP protocol, which allows remote attackers to cause a denial of service (device hang) by sending malformed RTP packets after a call is answered, aka Bug ID CSCur39976.
16 CVE-2015-4224 78 Exec Code 2015-06-26 2016-12-28
7.2
 None Local Low Not required Complete Complete Complete
Cisco Wireless LAN Controller (WLC) devices with software 7.0(240.0) allow local users to execute arbitrary OS commands in a privileged context via crafted CLI commands, aka Bug ID CSCuj39474.
17 CVE-2015-4211 264 +Priv 2015-06-24 2016-12-29
7.2
 None Local Low Not required Complete Complete Complete
Cisco AnyConnect Secure Mobility Client 3.1(60) on Windows does not properly validate pathnames, which allows local users to gain privileges via a crafted INF file, aka Bug ID CSCus65862.
18 CVE-2015-4208 200 Sql +Info 2015-06-24 2016-12-28
7.5
 None Remote Low Not required Partial Partial Partial
Cisco WebEx Meeting Center does not properly restrict the content of URLs in GET requests, which allows remote attackers to obtain sensitive information or conduct SQL injection attacks via vectors involving read access to a request, aka Bug ID CSCup88398.
19 CVE-2015-4200 399 DoS 2015-06-23 2016-12-28
7.8
 None Remote Low Not required None None Complete
Memory leak in the IPv6-to-IPv4 functionality in Cisco IOS 15.3S in the Performance Routing Engine (PRE) module on UBR devices allows remote attackers to cause a denial of service (memory consumption) by triggering an error during CPE negotiation, aka Bug ID CSCug00885.
20 CVE-2015-4199 362 DoS 2015-06-27 2016-12-28
7.1
 None Remote Medium Not required None None Complete
Race condition in the IPv6-to-IPv4 functionality in Cisco IOS 15.3S in the Performance Routing Engine (PRE) module on UBR devices allows remote attackers to cause a denial of service (NULL pointer free and module crash) by triggering intermittent connectivity with many IPv6 CPE devices, aka Bug ID CSCug47366.
21 CVE-2015-4186 78 Exec Code +Priv 2015-06-17 2016-12-07
7.2
 None Local Low Not required Complete Complete Complete
The diagnostics subsystem in the administrative web interface on Cisco Virtualization Experience (aka VXC) Client 6215 devices with firmware 11.2(27.4) allows local users to gain privileges for OS command execution via a crafted option value, aka Bug ID CSCug54412.
22 CVE-2015-4183 78 Exec Code +Priv 2015-06-17 2016-12-07
7.2
 None Local Low Not required Complete Complete Complete
Cisco UCS Central Software 1.2(1a) allows local users to gain privileges for OS command execution via a crafted CLI parameter, aka Bug ID CSCut32795.
23 CVE-2015-4161 264 +Priv +Info 2015-06-02 2016-12-31
7.5
 None Remote Low Not required Partial Partial Partial
SAP Afaria does not properly restrict access to unspecified functionality, which allows remote attackers to obtain sensitive information, gain privileges, or have other unspecified impact via unknown vectors, SAP Security Note 2155690.
24 CVE-2015-4160 89 Exec Code Sql 2015-06-02 2016-11-28
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in SAP ASE Database Platform allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Notes: 2152278.
25 CVE-2015-4159 89 Exec Code Sql 2015-06-02 2016-11-28
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in SAP HANA Web-based Development Workbench allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Notes 2153892.
26 CVE-2015-4147 19 Exec Code 2015-06-09 2018-01-05
7.5
 None Remote Low Not required Partial Partial Partial
The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a "type confusion" issue.
27 CVE-2015-4109 89 Exec Code Sql 2015-06-09 2018-10-09
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin before 1.5.16 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) data_target or (2) data_vote parameter in a rating_vote (wp_ajax_nopriv_rating_vote) action to wp-admin/admin-ajax.php.
28 CVE-2015-4104 264 DoS 2015-06-03 2017-11-15
7.8
 None Remote Low Not required None None Complete
Xen 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask bits, which allows local x86 HVM guest users to cause a denial of service (unexpected interrupt and host crash) via unspecified vectors.
29 CVE-2015-4051 284 DoS 2015-06-08 2016-12-31
9.0
 None Remote Low Not required Partial Partial Complete
Beckhoff IPC Diagnostics before 1.8 does not properly restrict access to functions in /config, which allows remote attackers to cause a denial of service (reboot or shutdown), create arbitrary users, or possibly have unspecified other impact via a crafted request, as demonstrated by a beckhoff.com:service:cxconfig:1#Write SOAP action to /upnpisapi.
30 CVE-2015-4026 19 Bypass 2015-06-09 2019-04-22
7.5
 None Remote Low Not required Partial Partial Partial
The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character, which might allow remote attackers to bypass intended extension restrictions and execute files with unexpected names via a crafted first argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.
31 CVE-2015-4025 19 Bypass 2015-06-09 2019-04-22
7.5
 None Remote Low Not required Partial Partial Partial
PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character in certain situations, which allows remote attackers to bypass intended extension restrictions and access files or directories with unexpected names via a crafted argument to (1) set_include_path, (2) tempnam, (3) rmdir, or (4) readlink. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.
32 CVE-2015-4022 189 Exec Code Overflow 2015-06-09 2019-04-22
7.5
 None Remote Low Not required Partial Partial Partial
Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow.
33 CVE-2015-4004 119 DoS Overflow +Info 2015-06-07 2016-11-28
8.5
 None Remote Low Not required Partial None Complete
The OZWPAN driver in the Linux kernel through 4.0.5 relies on an untrusted length field during packet parsing, which allows remote attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via a crafted packet.
34 CVE-2015-4003 189 DoS 2015-06-07 2016-12-28
7.8
 None Remote Low Not required None None Complete
The oz_usb_handle_ep_data function in drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 allows remote attackers to cause a denial of service (divide-by-zero error and system crash) via a crafted packet.
35 CVE-2015-4002 119 DoS Exec Code Overflow 2015-06-07 2016-12-28
9.0
 None Remote Low Not required Partial Partial Complete
drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 does not ensure that certain length values are sufficiently large, which allows remote attackers to cause a denial of service (system crash or large loop) or possibly execute arbitrary code via a crafted packet, related to the (1) oz_usb_rx and (2) oz_usb_handle_ep_data functions.
36 CVE-2015-4001 189 DoS Exec Code 2015-06-07 2016-12-28
9.0
 None Remote Low Not required Partial Partial Complete
Integer signedness error in the oz_hcd_get_desc_cnf function in drivers/staging/ozwpan/ozhcd.c in the OZWPAN driver in the Linux kernel through 4.0.5 allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted packet.
37 CVE-2015-3905 119 DoS Exec Code Overflow 2015-06-08 2016-12-31
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the set_cs_start function in t1disasm.c in t1utils before 1.39 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.
38 CVE-2015-3648 22 Dir. Trav. 2015-06-09 2018-10-09
7.5
 None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in pages/setup.php in Montala Limited ResourceSpace before 7.2.6727 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the defaultlanguage parameter.
39 CVE-2015-3329 119 Exec Code Overflow 2015-06-09 2019-12-27
7.5
 None Remote Low Not required Partial Partial Partial
Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a crafted length value in a (1) tar, (2) phar, or (3) ZIP archive.
40 CVE-2015-3307 119 DoS Overflow 2015-06-09 2019-04-22
7.5
 None Remote Low Not required Partial Partial Partial
The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive.
41 CVE-2015-3209 787 Exec Code Overflow 2015-06-15 2022-02-11
7.5
 None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.
42 CVE-2015-3205 74 Exec Code 2015-06-16 2016-12-03
7.5
 None Remote Low Not required Partial Partial Partial
libmimedir allows remote attackers to execute arbitrary code via a VCF file with two NULL bytes at the end of the file, related to "free" function calls in the "lexer's memory clean-up procedure."
43 CVE-2015-3113 119 Exec Code Overflow 2015-06-23 2017-11-08
10.0
 None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.
44 CVE-2015-3112 119 DoS Exec Code Overflow Mem. Corr. 2015-06-24 2016-12-28
10.0
 None Remote Low Not required Complete Complete Complete
Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
45 CVE-2015-3111 119 Exec Code Overflow 2015-06-24 2016-12-28
10.0
 None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attackers to execute arbitrary code via unspecified vectors.
46 CVE-2015-3110 189 Exec Code Overflow 2015-06-24 2016-12-28
10.0
 None Remote Low Not required Complete Complete Complete
Integer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attackers to execute arbitrary code via unspecified vectors.
47 CVE-2015-3109 119 DoS Exec Code Overflow Mem. Corr. 2015-06-24 2016-12-28
10.0
 None Remote Low Not required Complete Complete Complete
Adobe Photoshop CC before 16.0 (aka 2015.0.0) allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
48 CVE-2015-3107 Exec Code 2015-06-10 2017-09-17
10.0
 None Remote Low Not required Complete Complete Complete
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3103 and CVE-2015-3106.
49 CVE-2015-3106 Exec Code 2015-06-10 2017-09-17
10.0
 None Remote Low Not required Complete Complete Complete
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3103 and CVE-2015-3107.
50 CVE-2015-3105 119 DoS Exec Code Overflow Mem. Corr. 2015-06-10 2016-12-31
10.0
 None Remote Low Not required Complete Complete Complete
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Total number of vulnerabilities : 138   Page : 1 (This Page)2 3
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.