# CVEs published 2015-08-18

50 CVEs were published on August 18, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-4425](https://cve.now/CVE-2015-4425.md): Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or… (no CVSS)
- [CVE-2015-4426](https://cve.now/CVE-2015-4426.md): SQL injection vulnerability in pimcore before build 3473 allows remote attackers to execute arbitrary SQL commands via the filter… (no CVSS)
- [CVE-2015-4670](https://cve.now/CVE-2015-4670.md): Directory traversal vulnerability in the AjaxFileUpload control in DevExpress AJAX Control Toolkit (aka AjaxControlToolkit) before 15.1… (no CVSS)
- [CVE-2015-5481](https://cve.now/CVE-2015-5481.md): Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote… (no CVSS)
- [CVE-2015-5482](https://cve.now/CVE-2015-5482.md): Directory traversal vulnerability in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote administrators to include… (no CVSS)
- [CVE-2015-5487](https://cve.now/CVE-2015-5487.md): Cross-site scripting (XSS) vulnerability in the Camtasia Relay module 6.x-2.x before 6.x-3.2 and 7.x-2.x before 7.x-1.3 for Drupal allows… (no CVSS)
- [CVE-2015-5488](https://cve.now/CVE-2015-5488.md): Cross-site scripting (XSS) vulnerability in the MailChimp Signup submodule in the MailChimp module 7.x-3.x before 7.x-3.3 for Drupal… (no CVSS)
- [CVE-2015-5489](https://cve.now/CVE-2015-5489.md): Cross-site scripting (XSS) vulnerability in the Smart Trim module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with… (no CVSS)
- [CVE-2015-5490](https://cve.now/CVE-2015-5490.md): The \_views\_fetch\_data method in includes/cache.inc in the Views module 7.x-3.5 through 7.x-3.10 for Drupal does not rebuild the full cache… (no CVSS)
- [CVE-2015-5491](https://cve.now/CVE-2015-5491.md): The Dynamic display block module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users to bypass intended access… (no CVSS)
- [CVE-2015-5492](https://cve.now/CVE-2015-5492.md): Cross-site scripting (XSS) vulnerability in the Video Consultation module for Drupal allows remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2015-5493](https://cve.now/CVE-2015-5493.md): The Entityform Block module 7.x-1.x before 7.x-1.3 for Drupal does not properly check permissions when a form is locked to a role, which… (no CVSS)
- [CVE-2015-5494](https://cve.now/CVE-2015-5494.md): Cross-site scripting (XSS) vulnerability in the Webform Matrix Component module 7.x-4.x before 7.x-4.13 for Drupal allows remote… (no CVSS)
- [CVE-2015-5495](https://cve.now/CVE-2015-5495.md): Cross-site scripting (XSS) vulnerability in the Mobile sliding menu module 7.x-2.x before 7.x-2.1 for Drupal allows remote authenticated… (no CVSS)
- [CVE-2015-5496](https://cve.now/CVE-2015-5496.md): The pass2pdf module for Drupal does not restrict access to generated PDF files, which allows remote attackers to obtain user passwords via… (no CVSS)
- [CVE-2015-5497](https://cve.now/CVE-2015-5497.md): Cross-site scripting (XSS) vulnerability in the Web Links module 6.x-2.x before 6.x-2.6 and 7.x-1.x before 7.x-1.0 for Drupal allows… (no CVSS)
- [CVE-2015-5498](https://cve.now/CVE-2015-5498.md): The Shipwire API module 7.x-1.x before 7.x-1.03 for Drupal does not check the view permission for the shipments overview… (no CVSS)
- [CVE-2015-5499](https://cve.now/CVE-2015-5499.md): The Navigate module for Drupal does not properly check permissions, which allows remote authenticated users to modify custom widgets and… (no CVSS)
- [CVE-2015-5500](https://cve.now/CVE-2015-5500.md): Cross-site scripting (XSS) vulnerability in the Navigate module for Drupal allows remote authenticated users with certain permissions to… (no CVSS)
- [CVE-2015-5501](https://cve.now/CVE-2015-5501.md): The Hostmaster (Aegir) module 6.x-2.x before 6.x-2.4 and 7.x-3.x before 7.x-3.0-beta2 for Drupal allows remote attackers to execute… (no CVSS)
- [CVE-2015-5502](https://cve.now/CVE-2015-5502.md): The Storage API module 7.x-1.x before 7.x-1.8 for Drupal does not properly restrict access to Storage API fields attached to entities that… (no CVSS)
- [CVE-2015-5503](https://cve.now/CVE-2015-5503.md): Open redirect vulnerability in the Chamilo integration module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to redirect users… (no CVSS)
- [CVE-2015-5504](https://cve.now/CVE-2015-5504.md): SQL injection vulnerability in the Novalnet Payment Module Ubercart module for Drupal allows remote attackers to execute arbitrary SQL… (no CVSS)
- [CVE-2015-5505](https://cve.now/CVE-2015-5505.md): The HTTP Strict Transport Security (HSTS) module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.2 for Drupal does not properly implement… (no CVSS)
- [CVE-2015-5506](https://cve.now/CVE-2015-5506.md): The Apache Solr Real-Time module 7.x-1.x before 7.x-1.2 for Drupal does not check the status of an entity when indexing, which allows… (no CVSS)
- [CVE-2015-5507](https://cve.now/CVE-2015-5507.md): Cross-site scripting (XSS) vulnerability in the Inline Entity Form module 7.x-1.x before 7.x-1.6 for Drupal allows remote authenticated… (no CVSS)
- [CVE-2015-5508](https://cve.now/CVE-2015-5508.md): Cross-site request forgery (CSRF) vulnerability in the XC NCIP Provider module in the eXtensible Catalog (XC) Drupal Toolkit allows remote… (no CVSS)
- [CVE-2015-5509](https://cve.now/CVE-2015-5509.md): The Administration Views module 7.x-1.x before 7.x-1.4 for Drupal, when used with other unspecified modules, does not properly grant… (no CVSS)
- [CVE-2015-5510](https://cve.now/CVE-2015-5510.md): Open redirect vulnerability in the Content Construction Kit (CCK) 6.x-2.x before 6.x-2.10 for Drupal allows remote attackers to redirect… (no CVSS)
- [CVE-2015-5511](https://cve.now/CVE-2015-5511.md): The HybridAuth Social Login module 7.x-2.x before 7.x-2.13 for Drupal allows remote attackers to bypass the user registration by… (no CVSS)
- [CVE-2015-5512](https://cve.now/CVE-2015-5512.md): The me aliases module 6.x-2.x before 6.x-2.10 and 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to access Views using the "me"… (no CVSS)
- [CVE-2015-5513](https://cve.now/CVE-2015-5513.md): Cross-site scripting (XSS) vulnerability in the Shibboleth authentication module 6.x-4.x before 6.x-4.2 and 7.x-4.x before 7.x-4.2 for… (no CVSS)
- [CVE-2015-5514](https://cve.now/CVE-2015-5514.md): Cross-site scripting (XSS) vulnerability in the Migrate module 7.x-2.x before 7.x-2.8 for Drupal, when the migrate\_ui submodule is… (no CVSS)
- [CVE-2015-5515](https://cve.now/CVE-2015-5515.md): The Views Bulk Operations (VBO) module 6.x-1.x and 7.x-3.x before 7.x-3.3 for Drupal, when the bulk operation for changing Roles is… (no CVSS)
- [CVE-2015-6517](https://cve.now/CVE-2015-6517.md): Cross-site request forgery (CSRF) vulnerability in phpLiteAdmin 1.1 allows remote attackers to hijack the authentication of users for… (no CVSS)
- [CVE-2015-6518](https://cve.now/CVE-2015-6518.md): Multiple cross-site scripting (XSS) vulnerabilities in phpLiteAdmin 1.1 allow remote attackers to inject arbitrary web script or HTML via… (no CVSS)
- [CVE-2015-6519](https://cve.now/CVE-2015-6519.md): SQL injection vulnerability in Arab Portal 3 allows remote attackers to execute arbitrary SQL commands via the showemail parameter in a… (no CVSS)
- [CVE-2015-4029](https://cve.now/CVE-2015-4029.md): Cross-site scripting (XSS) vulnerability in the WebGUI in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or… (no CVSS)
- [CVE-2015-5485](https://cve.now/CVE-2015-5485.md): Cross-site scripting (XSS) vulnerability in the Event Import page (import-eventbrite-events.php) in the Modern Tribe Eventbrite Tickets… (no CVSS)
- [CVE-2015-5599](https://cve.now/CVE-2015-5599.md): Multiple SQL injection vulnerabilities in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allow remote attackers to execute… (no CVSS)
- [CVE-2015-5681](https://cve.now/CVE-2015-5681.md): Unrestricted file upload vulnerability in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to execute… (no CVSS)
- [CVE-2015-6508](https://cve.now/CVE-2015-6508.md): Cross-site scripting (XSS) vulnerability in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the… (no CVSS)
- [CVE-2015-6509](https://cve.now/CVE-2015-6509.md): Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML… (no CVSS)
- [CVE-2015-6510](https://cve.now/CVE-2015-6510.md): Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML… (no CVSS)
- [CVE-2015-6511](https://cve.now/CVE-2015-6511.md): Cross-site scripting (XSS) vulnerability in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the… (no CVSS)
- [CVE-2015-6512](https://cve.now/CVE-2015-6512.md): SQL injection vulnerability in the get\_messages function in server/plugins/chatroom/chatroom.php in FreiChat 9.6 allows remote attackers… (no CVSS)
- [CVE-2015-6513](https://cve.now/CVE-2015-6513.md): Multiple SQL injection vulnerabilities in the J2Store (com\_j2store) extension before 3.1.7 for Joomla! allow remote attackers to execute… (no CVSS)
- [CVE-2015-6514](https://cve.now/CVE-2015-6514.md): Cross-site scripting (XSS) vulnerability in the Dashboard in Splunk Enterprise 6.2.x before 6.2.4 and Splunk Light 6.2.x before 6.2.4… (no CVSS)
- [CVE-2015-6515](https://cve.now/CVE-2015-6515.md): Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.2.x before 6.2.4, 6.1.x before 6.1.8, 6.0.x before 6.0.9… (no CVSS)
- [CVE-2015-6516](https://cve.now/CVE-2015-6516.md): SQL injection vulnerability in cygnux.org sysPass 1.0.9 and earlier allows remote authenticated users to execute arbitrary SQL commands… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2015-08-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.