Skip to content
OpenAdvisories

Archive

October 2015

Vulnerabilities first published in this month (UTC), newest first.

← September 2015 2015 / October November 2015 →
  1. 136
  2. 27
  3. 324
  4. 417
  5. 520
  6. 630
  7. 7 
  8. 83
  9. 949
  10. 10 
  11. 114
  12. 1216
  13. 133
  14. 14109
  15. 1522
  16. 1621
  17. 17 
  18. 1823
  19. 1918
  20. 20 
  21. 21136
  22. 22 
  23. 2371
  24. 24 
  25. 2511
  26. 2624
  27. 279
  28. 2826
  29. 2922
  30. 3019
  31. 316
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Medium —
    CVE-2015-7713

    OpenStack Compute (Nova) allows remote attackers to bypass intended restriction

    OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do not properly apply security group changes, which allows remote attackers to bypass intended restriction by leveraging an instance that was running when the change was made.

    nova nova nova Debian Ubuntu PyPI
  • Medium —
    CVE-2015-5262 EPSS 19%

    Denial of service vulnerability in org.apache.httpcomponents:httpclient

    http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unsp…

    org.apache.httpcomponents:httpclient httpcomponents-client httpcomponents-client commons-httpclient Debian Ubuntu Maven
  • Medium —
    CVE-2015-3280

    OpenStack Compute (nova) allows remote authenticated users to cause a denial of service

    OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service (disk consumption) by deleting instances while in t…

    nova nova nova Debian Ubuntu PyPI
  • Medium —
    CVE-2015-5223

    OpenStack Object Storage (Swift) Sensitive Data Exposure

    OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container.

    swift swift swift Debian Ubuntu PyPI
  • Medium —
    CVE-2015-5251

    OpenStack Image Service (Glance) allows remote authenticated users to bypass access restrictions

    OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.

    glance glance glance Debian Ubuntu PyPI
  • Medium —
    CVE-2015-5286

    OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service

    OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token…

    glance glance glance Debian Ubuntu PyPI
  • Medium 5.3
    CVE-2015-4902 Exploited EPSS 14%

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unkno…

    KEV Mar 3, 2022
  • Medium 6.1
    CVE-2015-6477 EPSS 12%

    Multiple cross-site scripting (XSS) vulnerabilities in the Wind Farm Portal application in Nordex Control 2 (NC2) SCADA…

  • Medium —
    CVE-2015-1810

    Jenkins does not Restrict Reserved Names Allowing for Privilege Escalation

    The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2015-1812

    Jenkins Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1813.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2015-1806

    Jenkins allows for Privilege Escalation by Remote Authenticated Users

    The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2015-1814

    Jenkins allows for Privilege Escalation by Remote Authenticated Users

    The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token change" involving anonymous users.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 5.4
    CVE-2015-5654

    Cross-Site Scripting in dojo

    Cross-site scripting (XSS) vulnerability in Dojo Toolkit before 1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    dojo npm
  • Medium —
    CVE-2015-7314

    Gollum Exposure of Sensitive Information

    The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.

    gollum RubyGems
  • Medium —
    CVE-2015-5640

    baserCMS Access Control Bypass

    baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request.

    baserproject/basercms Packagist