Skip to content
OpenAdvisories

Archive

June 2015

Vulnerabilities first published in this month (UTC), newest first.

← May 2015 2015 / June July 2015 →
  1. 125
  2. 219
  3. 38
  4. 47
  5. 57
  6. 6 
  7. 716
  8. 814
  9. 926
  10. 1070
  11. 117
  12. 1216
  13. 1322
  14. 14 
  15. 1567
  16. 1615
  17. 1719
  18. 1816
  19. 1911
  20. 204
  21. 21 
  22. 2210
  23. 2316
  24. 2427
  25. 253
  26. 2611
  27. 272
  28. 2825
  29. 293
  30. 3029
All Critical High Medium Low Exploited only Public exploit

495 results · Feed

  • Unscored —
    CVE-2015-0549

    Cross-site scripting (XSS) vulnerability in EMC Documentum D2 before 4.5 allows remote authenticated users to inject ar…

  • Unscored —
    CVE-2015-1485

    Cross-site request forgery (CSRF) vulnerability in the administration console in the Enforce Server in Symantec Data Lo…

  • Unscored —
    CVE-2015-2965

    Directory traversal vulnerability in osCommerce Japanese 2.2ms1j-R8 and earlier allows remote authenticated administrat…

  • Unscored —
    CVE-2014-9230

    Cross-site scripting (XSS) vulnerability in the administration console in the Enforce Server in Symantec Data Loss Prev…

  • Unscored —
    CVE-2015-1978

    Cross-site scripting (XSS) vulnerability in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68…

  • Unscored —
    CVE-2015-1972

    IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.…

  • Unscored —
    CVE-2015-1974

    The web administration tool in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before …

  • Unscored —
    CVE-2015-1959

    IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.…

  • Unscored —
    CVE-2015-2019

    IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.…

  • Unscored —
    CVE-2015-0173

    The HTTP connection-management functionality in Internet Pass-Thru (IPT) before 2.1.0.2 in IBM WebSphere MQ, when HTTPS…

  • Unscored —
    CVE-2015-1981

    Cross-site scripting (XSS) vulnerability in the web server in IBM Domino 8.5.x before 8.5.3 FP6 IF8 and 9.x before 9.0.…

  • Unscored —
    CVE-2015-1884

    Directory traversal vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8…

  • Unscored —
    CVE-2015-1901

    The installer in IBM InfoSphere Information Server 8.5 through 11.3 before 11.3.1.2 allows local users to obtain sensit…

  • Unscored —
    CVE-2015-5078

    SQL injection vulnerability in the insert function in application/controllers/admin/dataentry.php in LimeSurvey 2.06+ a…

  • Unscored —
    CVE-2015-0989

    PACTware 4.1 SP3 allows remote attackers to cause a denial of service (application crash) via a crafted file that trigg…

  • Unscored —
    CVE-2015-4174

    Cross-site scripting (XSS) vulnerability in the integrated web server on the Siemens Climatix BACnet/IP communication m…

  • Unscored —
    CVE-2014-6198

    Cross-site request forgery (CSRF) vulnerability in IBM Security Network Protection 5.3 before 5.3.1 allows remote attac…

  • Unscored —
    CVE-2015-4199

    Race condition in the IPv6-to-IPv4 functionality in Cisco IOS 15.3S in the Performance Routing Engine (PRE) module on U…

  • Unscored —
    CVE-2015-4225

    Cisco Application Policy Infrastructure Controller (APIC) 1.0(1.110a) and 1.0(1e) on Nexus 9000 devices does not proper…

  • Unscored —
    CVE-2015-1267

    Blink, as used in Google Chrome before 43.0.2357.130, does not properly restrict the creation context during creation o…

    chromium-browser oxide-qt Ubuntu
  • Unscored —
    CVE-2015-1266

    content/browser/webui/content_web_ui_controller_factory.cc in Google Chrome before 43.0.2357.130 does not properly cons…

    chromium-browser oxide-qt Ubuntu
  • Unscored —
    CVE-2015-1268

    bindings/scripts/v8_types.py in Blink, as used in Google Chrome before 43.0.2357.130, does not properly select a creati…

    chromium-browser oxide-qt Ubuntu
  • Unscored —
    CVE-2015-1269

    The DecodeHSTSPreloadRaw function in net/http/transport_security_state.cc in Google Chrome before 43.0.2357.130 does no…

    chromium-browser oxide-qt Ubuntu
  • Unscored —
    CVE-2015-1159

    Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the template engine in CUPS …

    cups cups Debian Ubuntu
  • Unscored —
    CVE-2015-1158 Public exploit EPSS 30%

    The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-v…

    cups cups Debian Ubuntu
  • Unscored —
    CVE-2015-4216

    The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and…

  • Unscored —
    CVE-2015-4221

    Cisco Unified Communications Manager IM and Presence Service 9.1(1) does not properly restrict access to encrypted pass…

  • Unscored —
    CVE-2015-4224

    Cisco Wireless LAN Controller (WLC) devices with software 7.0(240.0) allow local users to execute arbitrary OS commands…

  • Unscored —
    CVE-2015-4222

    SQL injection vulnerability in Cisco Unified Communications Manager IM and Presence Service 9.1(1) allows remote authen…

  • Unscored —
    CVE-2015-4217

    The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and…

  • Medium —
    CVE-2015-1851

    OpenStack Cinder file disclosure in image convert

    OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command.

    cinder cinder Debian PyPI
  • Unscored —
    CVE-2015-4223

    Cisco IOS XR 5.1.3 allows remote attackers to cause a denial of service (process reload) via crafted MPLS Label Distrib…

  • Unscored —
    CVE-2015-4220

    Cross-site scripting (XSS) vulnerability in Cisco Unified Presence Server 9.1(1) allows remote attackers to inject arbi…

  • Medium —
    CVE-2013-7397

    Insufficient Verification of Data Authenticity in Async Http Client

    Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an a…

    async-http-client async-http-client com.ning:async-http-client Debian Ubuntu Maven
  • Medium —
    CVE-2013-7398

    Insufficient Verification of Data Authenticity in Async Http Client

    main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS ser…

    com.ning:async-http-client Maven
  • Unscored —
    CVE-2015-4413

    Cross-site scripting (XSS) vulnerability in the new_fb_sign_button function in nextend-facebook-connect.php in Nextend …

  • High —
    CVE-2015-3900

    RubyGems vulnerable to DNS hijack attack

    RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS…

    jruby rubygems-update Debian RubyGems
  • Unscored —
    CVE-2015-2169 Public exploit

    Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 allows remote attacke…

  • Unscored —
    CVE-2015-5066 Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in the MetalGenix GeniXCMS 0.0.3 allow remote attackers to inject a…

  • Unscored —
    CVE-2015-5061

    Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 and earlier allows re…