Skip to content
OpenAdvisories

Archive

December 2015

Vulnerabilities first published in this month (UTC), newest first.

← November 2015 2015 / December January 2016 →
  1. 12
  2. 219
  3. 38
  4. 4 
  5. 56
  6. 632
  7. 717
  8. 822
  9. 958
  10. 1079
  11. 1172
  12. 125
  13. 139
  14. 1411
  15. 1523
  16. 1638
  17. 1715
  18. 185
  19. 193
  20. 20 
  21. 2116
  22. 221
  23. 2313
  24. 2410
  25. 25 
  26. 262
  27. 2711
  28. 2830
  29. 299
  30. 3016
  31. 3133
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • High 8.8
    CVE-2015-2912

    OrientDB-Server vulnerable to Cross-Site Request Forgery

    The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sen…

    com.orientechnologies:orientdb-studio Maven
  • High 8.8
    CVE-2015-8651 Exploited EPSS 68%

    Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and be…

    flashplugin-nonfree Ubuntu
    KEV May 25, 2022
  • High 7.3
    CVE-2015-1772

    Improper Authentication in org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service

    The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows re…

    org.apache.hive:hive-exec org.apache.hive:hive org.apache.hive:hive-service Maven
  • High 7.3
    CVE-2015-1836

    High severity vulnerability that affects org.apache.hbase:hbase

    Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect ACLs for ZooKeeper coordination state, which allows remote attackers to cause a …

    org.apache.hbase:hbase Maven
  • High —
    CVE-2015-8566 Public exploit

    Joomla! Framework Remote Code Injection Vulnerability

    The Session package 1.x before 1.3.1 for Joomla! Framework allows remote attackers to execute arbitrary code via unspecified session values.

    joomla/session Packagist
  • High 7.4
    CVE-2015-8370

    Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, o…

    grub2 grub2 Debian Ubuntu
  • High —
    CVE-2015-5312

    Nokogiri subject to DoS via libxml2 vulnerability

    The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability tha…

    libxml2 libxml2 nokogiri Debian Ubuntu RubyGems
  • High 7.8
    CVE-2015-6175 Exploited

    The kernel in Microsoft Windows 10 Gold allows local users to gain privileges via a crafted application, aka "Windows K…

    KEV May 25, 2022
  • High —
    CVE-2015-8125

    Symfony Vulnerable to Timing Attack

    Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Sym…

    symfony/symfony symfony symfony/security-http symfony/security Debian Packagist
  • High 7.8
    CVE-2015-5287 Exploited Public exploit

    The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain per…

    KEV Aug 26, 2026