# CVEs published 2015-06-15

67 CVEs were published on June 15, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-3209](https://cve.now/CVE-2015-3209.md): Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with… (no CVSS)
- [CVE-2015-4093](https://cve.now/CVE-2015-4093.md): Cross-site scripting (XSS) vulnerability in Elasticsearch Kibana 4.x before 4.0.3 allows remote attackers to inject arbitrary web script… (no CVSS)
- [CVE-2015-4118](https://cve.now/CVE-2015-4118.md): SQL injection vulnerability in monitor/show\_sys\_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated users with monitor… (no CVSS)
- [CVE-2015-4119](https://cve.now/CVE-2015-4119.md): Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7 allow remote attackers to hijack the… (no CVSS)
- [CVE-2015-4141](https://cve.now/CVE-2015-4141.md): The WPS UPnP function in hostapd, when using WPS AP, and wpa\_supplicant, when using WPS external registrar (ER), 0.7.0 through 2.4 allows… (no CVSS)
- [CVE-2015-4142](https://cve.now/CVE-2015-4142.md): Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa\_supplicant 0.7.0 through 2.4, when used for AP mode… (no CVSS)
- [CVE-2015-4143](https://cve.now/CVE-2015-4143.md): The EAP-pwd server and peer implementation in hostapd and wpa\_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of… (no CVSS)
- [CVE-2015-4144](https://cve.now/CVE-2015-4144.md): The EAP-pwd server and peer implementation in hostapd and wpa\_supplicant 1.0 through 2.4 does not validate that a message is long enough… (no CVSS)
- [CVE-2015-4145](https://cve.now/CVE-2015-4145.md): The EAP-pwd server and peer implementation in hostapd and wpa\_supplicant 1.0 through 2.4 does not validate a fragment is already being… (no CVSS)
- [CVE-2015-4146](https://cve.now/CVE-2015-4146.md): The EAP-pwd peer implementation in hostapd and wpa\_supplicant 1.0 through 2.4 does not clear the L (Length) and M (More) flags before… (no CVSS)
- [CVE-2015-4152](https://cve.now/CVE-2015-4152.md): Directory traversal vulnerability in the file output plugin in Elasticsearch Logstash before 1.4.3 allows remote attackers to write to… (no CVSS)
- [CVE-2015-4163](https://cve.now/CVE-2015-4163.md): GNTTABOP\_swap\_grant\_ref in Xen 4.2 through 4.5 does not check the grant table operation version, which allows local guest domains to cause… (no CVSS)
- [CVE-2015-4164](https://cve.now/CVE-2015-4164.md): The compat\_iret function in Xen 3.1 through 4.5 iterates the wrong way through a loop, which allows local 32-bit PV guest administrators… (no CVSS)
- [CVE-2015-4559](https://cve.now/CVE-2015-4559.md): Cross-site scripting (XSS) vulnerability in the product deployment feature in the Java core web services in Intel McAfee ePolicy… (no CVSS)
- [CVE-2015-4344](https://cve.now/CVE-2015-4344.md): The Services Basic Authentication module 7.x-1.x through 7.x-1.3 for Drupal allows remote attackers to bypass intended resource… (no CVSS)
- [CVE-2015-4345](https://cve.now/CVE-2015-4345.md): The RESTWS Basic Auth submodule in the RESTful Web Services module 7.x-1.x before 7.x-1.5 and 7.x-2.x before 7.x-2.3 for Drupal caches… (no CVSS)
- [CVE-2015-4346](https://cve.now/CVE-2015-4346.md): Cross-site scripting (XSS) vulnerability in the SMS Framework module 6.x-1.x before 6.x-1.1 for Drupal, when the "Send to phone" submodule… (no CVSS)
- [CVE-2015-4347](https://cve.now/CVE-2015-4347.md): Cross-site scripting (XSS) vulnerability in the inLinks Integration module for Drupal allows remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2015-4348](https://cve.now/CVE-2015-4348.md): SQL injection vulnerability in the Spider Contacts module for Drupal allows remote authenticated users with the "access Spider Contacts… (no CVSS)
- [CVE-2015-4349](https://cve.now/CVE-2015-4349.md): Cross-site request forgery (CSRF) vulnerability in the Spider Contacts module for Drupal allows remote attackers to hijack the… (no CVSS)
- [CVE-2015-4350](https://cve.now/CVE-2015-4350.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Spider Catalog module for Drupal allow remote attackers to hijack the… (no CVSS)
- [CVE-2015-4351](https://cve.now/CVE-2015-4351.md): The Spider Video Player module for Drupal allows remote authenticated users with the "access Spider Video Player administration"… (no CVSS)
- [CVE-2015-4352](https://cve.now/CVE-2015-4352.md): Cross-site request forgery (CSRF) vulnerability in the Spider Video Player module for Drupal allows remote attackers to hijack the… (no CVSS)
- [CVE-2015-4353](https://cve.now/CVE-2015-4353.md): Cross-site request forgery (CSRF) vulnerability in the Custom Sitemap module for Drupal allows remote attackers to hijack the… (no CVSS)
- [CVE-2015-4354](https://cve.now/CVE-2015-4354.md): Cross-site scripting (XSS) vulnerability in the Ubercart Webform Integration module before 6.x-1.8 and 7.x before 7.x-2.4 for Drupal… (no CVSS)
- [CVE-2015-4355](https://cve.now/CVE-2015-4355.md): Cross-site request forgery (CSRF) vulnerability in the Watchdog Aggregator module for Drupal allows remote attackers to hijack the… (no CVSS)
- [CVE-2015-4356](https://cve.now/CVE-2015-4356.md): Cross-site scripting (XSS) vulnerability in the view-based webform results table in the Webform module 7.x-4.x before 7.x-4.4 for Drupal… (no CVSS)
- [CVE-2015-4357](https://cve.now/CVE-2015-4357.md): Cross-site scripting (XSS) vulnerability in the Webform module before 6.x-3.22, 7.x-3.x before 7.x-3.22, and 7.x-4.x before 7.x-4.4 for… (no CVSS)
- [CVE-2015-4358](https://cve.now/CVE-2015-4358.md): Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Ubercart Discount Coupons module 6.x-1.x before… (no CVSS)
- [CVE-2015-4359](https://cve.now/CVE-2015-4359.md): Multiple cross-site scripting (XSS) vulnerabilities in the Registration codes module before 6.x-1.6, 6.x-2.x before 6.x-2.8, and 7.x-1.x… (no CVSS)
- [CVE-2015-4360](https://cve.now/CVE-2015-4360.md): Cross-site request forgery (CSRF) vulnerability in the Registration codes module before 6.x-1.6, 6.x-2.x before 6.x-2.8, and 7.x-1.x… (no CVSS)
- [CVE-2015-4361](https://cve.now/CVE-2015-4361.md): Cross-site request forgery (CSRF) vulnerability in the Registration codes module before 6.x-1.6 for Drupal allows remote attackers to… (no CVSS)
- [CVE-2015-4362](https://cve.now/CVE-2015-4362.md): Cross-site request forgery (CSRF) vulnerability in tracking\_code.admin.inc in the Tracking Code module 7.x-1.x before 7.x-1.6 for Drupal… (no CVSS)
- [CVE-2015-4363](https://cve.now/CVE-2015-4363.md): Open redirect vulnerability in the finder\_form\_goto function in the Finder module for Drupal allows remote attackers to redirect users to… (no CVSS)
- [CVE-2015-4364](https://cve.now/CVE-2015-4364.md): Multiple cross-site request forgery (CSRF) vulnerabilities in includes/campaignmonitor\_lists.admin.inc in the Campaign Monitor module… (no CVSS)
- [CVE-2015-4365](https://cve.now/CVE-2015-4365.md): Cross-site scripting (XSS) vulnerability in the Taxonomy Accordion module for Drupal allows remote authenticated users with certain… (no CVSS)
- [CVE-2015-4366](https://cve.now/CVE-2015-4366.md): Cross-site scripting (XSS) vulnerability in the Mover module 6.x-1.0 for Drupal allows remote authenticated users with certain permissions… (no CVSS)
- [CVE-2015-4367](https://cve.now/CVE-2015-4367.md): Cross-site scripting (XSS) vulnerability in the Simple Subscription module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows… (no CVSS)
- [CVE-2015-4368](https://cve.now/CVE-2015-4368.md): The Commerce Ogone module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to complete the checkout for an order without paying… (no CVSS)
- [CVE-2015-4369](https://cve.now/CVE-2015-4369.md): Cross-site scripting (XSS) vulnerability in the Trick Question module before 6.x-1.5 and 7.x-1.x before 7.x-1.5 for Drupal allows remote… (no CVSS)
- [CVE-2015-4370](https://cve.now/CVE-2015-4370.md): Cross-site scripting (XSS) vulnerability in the Site Documentation module before 6.x-1.5 for Drupal allows remote authenticated users with… (no CVSS)
- [CVE-2015-4371](https://cve.now/CVE-2015-4371.md): Open redirect vulnerability in the Perfecto module before 7.x-1.2 for Drupal allows remote attackers to redirect users to arbitrary web… (no CVSS)
- [CVE-2015-4372](https://cve.now/CVE-2015-4372.md): Cross-site scripting (XSS) vulnerability in the Image Title module before 7.x-1.1 for Drupal allows remote authenticated users with… (no CVSS)
- [CVE-2015-4373](https://cve.now/CVE-2015-4373.md): Cross-site scripting (XSS) vulnerability in the OG tabs module before 7.x-1.1 for Drupal allows remote authenticated users with certain… (no CVSS)
- [CVE-2015-4375](https://cve.now/CVE-2015-4375.md): The Chaos tool suite (ctools) module 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to obtain sensitive node titles via (1) an… (no CVSS)
- [CVE-2015-4376](https://cve.now/CVE-2015-4376.md): Cross-site scripting (XSS) vulnerability in the Profile2 Privacy module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated… (no CVSS)
- [CVE-2015-4377](https://cve.now/CVE-2015-4377.md): Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Petition module 6.x-1.x before 6.x-1.3 for Drupal… (no CVSS)
- [CVE-2015-4378](https://cve.now/CVE-2015-4378.md): Cross-site scripting (XSS) vulnerability in the Crumbs module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with the… (no CVSS)
- [CVE-2015-4379](https://cve.now/CVE-2015-4379.md): Cross-site request forgery (CSRF) vulnerability in the Webform Multiple File Upload module 6.x-1.x before 6.x-1.3 and 7.x-1.x before… (no CVSS)
- [CVE-2015-4380](https://cve.now/CVE-2015-4380.md): Cross-site scripting (XSS) vulnerability in the Linear Case module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users… (no CVSS)
- [CVE-2015-4381](https://cve.now/CVE-2015-4381.md): Cross-site scripting (XSS) vulnerability in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote… (no CVSS)
- [CVE-2015-4382](https://cve.now/CVE-2015-4382.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for… (no CVSS)
- [CVE-2015-4383](https://cve.now/CVE-2015-4383.md): Cross-site request forgery (CSRF) vulnerability in the Decisions module for Drupal allows remote attackers to hijack the authentication of… (no CVSS)
- [CVE-2015-4384](https://cve.now/CVE-2015-4384.md): Cross-site scripting (XSS) vulnerability in the Ubercart Webform Checkout Pane module 6.x-3.x before 6.x-3.10 and 7.x-3.x before 7.x-3.11… (no CVSS)
- [CVE-2015-4385](https://cve.now/CVE-2015-4385.md): Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Imagefield Info module 7.x-1.x before 7.x-1.2 for… (no CVSS)
- [CVE-2015-4386](https://cve.now/CVE-2015-4386.md): Multiple cross-site scripting (XSS) vulnerabilities in unspecified administration pages in the EntityBulkDelete module 7.x-1.0 for Drupal… (no CVSS)
- [CVE-2015-4387](https://cve.now/CVE-2015-4387.md): Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Password Policy module 6.x-1.x before 6.x-1.11 and… (no CVSS)
- [CVE-2015-4388](https://cve.now/CVE-2015-4388.md): Cross-site scripting (XSS) vulnerability in the Current Search Links module 7.x-1.x before 7.x-1.1 for Drupal, when the "Append the… (no CVSS)
- [CVE-2015-4389](https://cve.now/CVE-2015-4389.md): The Open Graph Importer (og\_tag\_importer) 7.x-1.x for Drupal does not properly check the create permission for content types created… (no CVSS)
- [CVE-2015-4390](https://cve.now/CVE-2015-4390.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the User Import module 6.x-4.x before 6.x-4.4 and 7.x-2.x before 7.x-2.3 for… (no CVSS)
- [CVE-2015-4391](https://cve.now/CVE-2015-4391.md): Cross-site request forgery (CSRF) vulnerability in the CiviCRM private report module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for… (no CVSS)
- [CVE-2015-4392](https://cve.now/CVE-2015-4392.md): Cross-site scripting (XSS) vulnerability in the Display Suite module 7.x-2.7 for Drupal allows remote authenticated users to inject… (no CVSS)
- [CVE-2015-4393](https://cve.now/CVE-2015-4393.md): The resource/endpoint for uploading files in the Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote authenticated users with… (no CVSS)
- [CVE-2015-4394](https://cve.now/CVE-2015-4394.md): The Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote attackers to bypass the field\_access restriction and obtain sensitive… (no CVSS)
- [CVE-2015-4395](https://cve.now/CVE-2015-4395.md): The HybridAuth Social Login module 7.x-2.x before 7.x-2.10 for Drupal stores passwords in plaintext when the "Ask user for a password when… (no CVSS)
- [CVE-2015-4396](https://cve.now/CVE-2015-4396.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Keyword Research module 6.x-1.x before 6.x-1.2 for Drupal allow remote… (no CVSS)
- [CVE-2015-4397](https://cve.now/CVE-2015-4397.md): Cross-site request forgery (CSRF) vulnerability in the Node Template module for Drupal allows remote attackers to hijack the… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2015-06-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.