# CVEs published 2015-06-18

16 CVEs were published on June 18, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-3422](https://cve.now/CVE-2015-3422.md): Cross-site scripting (XSS) vulnerability in SearchBlox before 8.2.1 allows remote attackers to inject arbitrary web script or HTML via the… (no CVSS)
- [CVE-2015-3897](https://cve.now/CVE-2015-3897.md): Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2015-4139](https://cve.now/CVE-2015-4139.md): Cross-site scripting (XSS) vulnerability in smilies4wp.php in the WP Smiley plugin 1.4.1 for WordPress allows remote authenticated users… (no CVSS)
- [CVE-2015-4140](https://cve.now/CVE-2015-4140.md): Cross-site request forgery (CSRF) vulnerability in the WP Smiley plugin 1.4.1 for WordPress allows remote attackers to hijack the… (no CVSS)
- [CVE-2015-4420](https://cve.now/CVE-2015-4420.md): Multiple cross-site scripting (XSS) vulnerabilities in Opsview 4.6.2 and earlier allow remote attackers to inject arbitrary web script or… (no CVSS)
- [CVE-2015-4587](https://cve.now/CVE-2015-4587.md): Cross-site scripting (XSS) vulnerability in the Alcatel-Lucent CellPipe 7130 router with firmware 1.0.0.20h.HOL allows remote attackers to… (no CVSS)
- [CVE-2015-4654](https://cve.now/CVE-2015-4654.md): SQL injection vulnerability in the EQ Event Calendar component for Joomla! allows remote attackers to execute arbitrary SQL commands via… (no CVSS)
- [CVE-2015-4655](https://cve.now/CVE-2015-4655.md): Cross-site scripting (XSS) vulnerability in Synology DiskStation Manager (DSM) before 5.2-5565 Update 1 allows remote attackers to inject… (no CVSS)
- [CVE-2015-4656](https://cve.now/CVE-2015-4656.md): Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station before 6.3-2945 allow remote attackers to inject arbitrary… (no CVSS)
- [CVE-2015-4657](https://cve.now/CVE-2015-4657.md): Cross-site scripting (XSS) vulnerability in Mailbird 2.0.16.0 and earlier allows remote attackers to inject arbitrary web script or HTML… (no CVSS)
- [CVE-2015-4658](https://cve.now/CVE-2015-4658.md): Multiple SQL injection vulnerabilities in admin/login.php in Milw0rm Clone Script 1.0 allow remote attackers to execute arbitrary SQL… (no CVSS)
- [CVE-2015-4659](https://cve.now/CVE-2015-4659.md): Cross-site request forgery (CSRF) vulnerability in ClickHeat 1.14 and earlier allows remote attackers to hijack the authentication of… (no CVSS)
- [CVE-2015-4660](https://cve.now/CVE-2015-4660.md): Cross-site scripting (XSS) vulnerability in Enhanced SQL Portal 5.0.7961 allows remote attackers to inject arbitrary web script or HTML… (no CVSS)
- [CVE-2015-4661](https://cve.now/CVE-2015-4661.md): Cross-site scripting (XSS) vulnerability in Symphony CMS 2.6.2 allows remote attackers to inject arbitrary web script or HTML via the sort… (no CVSS)
- [CVE-2015-2861](https://cve.now/CVE-2015-2861.md): Cross-site request forgery (CSRF) vulnerability in Vesta Control Panel before 0.9.8-14 allows remote attackers to hijack the… (no CVSS)
- [CVE-2015-4628](https://cve.now/CVE-2015-4628.md): SQL injection vulnerability in application/controllers/admin/questiongroups.php in LimeSurvey before 2.06+ Build 150618 allows remote… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2015-06-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.