Skip to content
OpenAdvisories

Archive

October 2015

Vulnerabilities first published in this month (UTC), newest first.

← September 2015 2015 / October November 2015 →
  1. 136
  2. 27
  3. 324
  4. 417
  5. 520
  6. 630
  7. 7 
  8. 83
  9. 949
  10. 10 
  11. 114
  12. 1216
  13. 133
  14. 14109
  15. 1522
  16. 1621
  17. 17 
  18. 1823
  19. 1918
  20. 20 
  21. 21136
  22. 22 
  23. 2371
  24. 24 
  25. 2511
  26. 2624
  27. 279
  28. 2826
  29. 2922
  30. 3019
  31. 316
All Critical High Medium Low Exploited only Public exploit

726 results · Feed

  • Unscored —
    CVE-2015-6343

    The SIP implementation in Cisco IOS 15.5(3)M on Cisco Unified Border Element (CUBE) devices allows remote attackers to …

  • Unscored —
    CVE-2015-6353

    Multiple cross-site scripting (XSS) vulnerabilities in Cisco FireSight Management Center (MC) 5.3.1.5 and 5.4.x through…

  • Unscored —
    CVE-2015-6032

    Qolsys IQ Panel (aka QOL) before 1.5.1 has hardcoded cryptographic keys, which allows remote attackers to create digita…

  • Unscored —
    CVE-2015-6354

    Multiple cross-site scripting (XSS) vulnerabilities in Cisco FireSight Management Center (MC) 5.4.1.3 and 6.0 allow rem…

  • Unscored —
    CVE-2015-6033

    Qolsys IQ Panel (aka QOL) before 1.5.1 does not verify the digital signatures of software updates, which allows man-in-…

  • Unscored —
    CVE-2015-5667

    Cross-site scripting (XSS) vulnerability in the HTML-Scrubber module before 0.15 for Perl, when the comment feature is …

    libhtml-scrubber-perl libhtml-scrubber-perl Debian Ubuntu
  • Unscored —
    CVE-2015-8030

    SAP 3D Visual Enterprise Viewer (VEV) allows remote attackers to execute arbitrary code via a crafted (1) U3D, (2) LWO,…

  • Unscored —
    CVE-2015-8029

    SAP 3D Visual Enterprise Viewer (VEV) allows remote attackers to execute arbitrary code via a crafted Filmbox document,…

  • Unscored —
    CVE-2015-8028

    Multiple buffer overflows in SAP 3D Visual Enterprise Viewer (VEV) allow remote attackers to execute arbitrary code via…

  • Unscored —
    CVE-2015-7972

    The (1) libxl_set_memory_target function in tools/libxl/libxl.c and (2) libxl__build_post function in tools/libxl/libxl…

    xen xen Debian Ubuntu
  • Unscored —
    CVE-2015-7813

    Xen 4.4.x, 4.5.x, and 4.6.x does not limit the number of printk console messages when reporting unimplemented hypercall…

    xen xen Debian Ubuntu
  • Unscored —
    CVE-2015-7969

    Multiple memory leaks in Xen 4.0 through 4.6.x allow local guest administrators or domains with certain permission to c…

    xen xen Debian Ubuntu
  • Unscored —
    CVE-2015-7970

    The p2m_pod_emergency_sweep function in arch/x86/mm/p2m-pod.c in Xen 3.4.x, 3.5.x, and 3.6.x is not preemptible, which …

    xen xen Debian Ubuntu
  • Unscored —
    CVE-2015-7971

    Xen 3.2.x through 4.6.x does not limit the number of printk console messages when logging certain pmu and profiling hyp…

    xen xen Debian Ubuntu
  • Unscored —
    CVE-2015-7814

    Race condition in the relinquish_memory function in arch/arm/domain.c in Xen 4.6.x and earlier allows local domains wit…

    xen xen Debian Ubuntu
  • Unscored —
    CVE-2015-7835

    The mod_l2_entry function in arch/x86/mm.c in Xen 3.4 through 4.6.x does not properly validate level 2 page table entri…

    xen xen Debian Ubuntu
  • Unscored —
    CVE-2015-6349

    Cross-site scripting (XSS) vulnerability in the web interface in the Solution Engine in Cisco Secure Access Control Ser…

  • Unscored —
    CVE-2015-6350

    SQL injection vulnerability in the web framework in Cisco Prime Service Catalog 11.0 allows remote authenticated users …

  • Unscored —
    CVE-2015-6352

    Cisco Unified Communications Domain Manager before 10.6(1) provides different error messages for pathname access attemp…

  • Unscored —
    CVE-2015-6344

    The web-based GUI in Cisco Adaptive Security Appliance (ASA) CX Context-Aware Security 9.3(4.1.11) allows remote authen…

  • Unscored —
    CVE-2015-6347

    The Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote authenticated users to bypass i…

  • Unscored —
    CVE-2015-6346

    Cross-site scripting (XSS) vulnerability in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote attackers …

  • Unscored —
    CVE-2015-6351

    Cisco ASR 5500 System Architecture Evolution (SAE) Gateway devices with software 19.1.0.61559 and 19.2.0 allow remote a…

  • Unscored —
    CVE-2015-6348

    The report-generation web interface in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows…

  • Unscored —
    CVE-2015-6345

    SQL injection vulnerability in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote …

  • Unscored —
    CVE-2015-7859

    The com_contenthistory component in Joomla! 3.2 before 3.4.5 does not properly check ACLs, which allows remote attacker…

  • Unscored —
    CVE-2015-7899

    The com_content component in Joomla! 3.x before 3.4.5 does not properly check ACLs, which allows remote attackers to ob…

  • Medium —
    CVE-2015-7713

    OpenStack Compute (Nova) allows remote attackers to bypass intended restriction

    OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do not properly apply security group changes, which allows remote attackers to bypass intended restriction by leveraging an instance that was running when the change was made.

    nova nova nova Debian Ubuntu PyPI
  • Unscored —
    CVE-2015-7858 Public exploit EPSS 86%

    SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via u…

  • Unscored —
    CVE-2015-7857 Public exploit EPSS 94%

    SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.…

  • Unscored —
    CVE-2015-7297 Public exploit EPSS 100%

    SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via u…

  • Unscored —
    CVE-2015-3230

    389 Directory Server (formerly Fedora Directory Server) before 1.3.3.12 does not enforce the nsSSL3Ciphers preference w…

    389-ds-base 389-ds-base Debian Ubuntu
  • Unscored —
    CVE-2015-5955

    ownCloud iOS app before 3.4.4 does not properly switch state between multiple instances, which might allow remote insta…

  • Critical 9.8
    CVE-2015-5285 Public exploit

    Kallithea CRLF injection vulnerability

    CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the came_from parameter to _admin/login.

    kallithea PyPI
  • Unscored —
    CVE-2015-5292

    Memory leak in the Privilege Attribute Certificate (PAC) responder plugin (sssd_pac_plugin.so) in System Security Servi…

    sssd Debian
  • Unscored —
    CVE-2015-4997

    IBM WebSphere Portal 8.5.0 before CF08 allows remote attackers to bypass intended access restrictions via a crafted req…

  • Unscored —
    CVE-2015-4994

    Buffer overflow in IBM Domino 8.5.1 through 8.5.3 before 8.5.3 FP6 IF10 and 9.x before 9.0.1 FP4 IF3 allows remote atta…

  • Unscored —
    CVE-2015-6006

    The AddUserFinding implementation in Medicomp MEDCIN Engine 2.22.20153.x before 2.22.20153.226 might allow remote attac…

  • Unscored —
    CVE-2015-2901

    Multiple stack-based buffer overflows in Medicomp MEDCIN Engine 2.22.20142.166 might allow remote attackers to execute …

  • Unscored —
    CVE-2015-2900 Public exploit

    The AddUserFinding add_userfinding2 function in Medicomp MEDCIN Engine before 2.22.20153.226 allows remote attackers to…