# CVEs published 2015-09-18

113 CVEs were published on September 18, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-3962](https://cve.now/CVE-2015-3962.md): Schneider Electric StruxureWare Building Expert MPM before 2.15 does not use encryption for the client-server data stream, which allows… (no CVSS)
- [CVE-2015-6294](https://cve.now/CVE-2015-6294.md): Cisco IOS 15.2(3)E and earlier and IOS XE 3.6(2)E and earlier allow remote attackers to cause a denial of service (functionality loss) via… (no CVSS)
- [CVE-2015-6296](https://cve.now/CVE-2015-6296.md): Cisco Prime Network Registrar (CPNR) 8.1(3.3), 8.2(3), and 8.3(2) has a default account, which allows local users to obtain root access by… (no CVSS)
- [CVE-2015-6297](https://cve.now/CVE-2015-6297.md): The DHCPv6 server in Cisco IOS on ASR 9000 devices with software 5.2.0 Base allows remote attackers to cause a denial of service (process… (no CVSS)
- [CVE-2015-6456](https://cve.now/CVE-2015-6456.md): GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 have hardcoded credentials for a support account, which allows… (no CVSS)
- [CVE-2015-6459](https://cve.now/CVE-2015-6459.md): Absolute path traversal vulnerability in the download feature in FileDownloadServlet in GE Digital Energy MDS PulseNET and MDS PulseNET… (no CVSS)
- [CVE-2015-6460](https://cve.now/CVE-2015-6460.md): Multiple heap-based buffer overflows in 3S-Smart CODESYS Gateway Server before 2.3.9.34 allow remote attackers to execute arbitrary code… (no CVSS, 3S-Smart CODESYS Gateway Server)
- [CVE-2015-6932](https://cve.now/CVE-2015-6932.md): VMware vCenter Server 5.5 before u3 and 6.0 before u1 does not verify X.509 certificates from TLS LDAP servers, which allows… (no CVSS)
- [CVE-2015-6939](https://cve.now/CVE-2015-6939.md): Cross-site scripting (XSS) vulnerability in the login module in Joomla! 3.4.x before 3.4.4 allows remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2015-7243](https://cve.now/CVE-2015-7243.md): Buffer overflow in Boxoft WAV to MP3 Converter allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary… (no CVSS)
- [CVE-2015-4638](https://cve.now/CVE-2015-4638.md): The FastL4 virtual server in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and PEM 11.3.0 through 11.5.2 and 11.6.0… (no CVSS)
- [CVE-2015-5274](https://cve.now/CVE-2015-5274.md): rubygem-openshift-origin-console in Red Hat OpenShift 2.2 allows remote authenticated users to execute arbitrary commands via a crafted… (no CVSS)
- [CVE-2015-7237](https://cve.now/CVE-2015-7237.md): Directory traversal vulnerability in the remote log viewing functionality in McAfee Agent (MA) 5.x before 5.0.2 allows remote attackers to… (no CVSS)
- [CVE-2015-7238](https://cve.now/CVE-2015-7238.md): The Secondary server in Threat Intelligence Exchange (TIE) before 1.2.0 uses weak permissions for unspecified (1) configuration files and… (no CVSS)
- [CVE-2015-7239](https://cve.now/CVE-2015-7239.md): SQL injection vulnerability in the BP\_FIND\_JOBS\_WITH\_PROGRAM function module in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to… (no CVSS)
- [CVE-2014-8611](https://cve.now/CVE-2014-8611.md): The \_\_sflush function in fflush.c in stdio in libc in FreeBSD 10.1 and the kernel in Apple iOS before 9 mishandles failures of the write… (no CVSS)
- [CVE-2015-3801](https://cve.now/CVE-2015-3801.md): The document.cookie API implementation in the CFNetwork Cookies subsystem in WebKit in Apple iOS before 9 allows remote attackers to… (no CVSS)
- [CVE-2015-5764](https://cve.now/CVE-2015-5764.md): The user interface in Safari in Apple iOS before 9 allows remote attackers to spoof URLs via unspecified vectors, a different… (no CVSS)
- [CVE-2015-5765](https://cve.now/CVE-2015-5765.md): The user interface in Safari in Apple iOS before 9 allows remote attackers to spoof URLs via unspecified vectors, a different… (no CVSS)
- [CVE-2015-5767](https://cve.now/CVE-2015-5767.md): The user interface in Safari in Apple iOS before 9 allows remote attackers to spoof URLs via unspecified vectors, a different… (no CVSS)
- [CVE-2015-5788](https://cve.now/CVE-2015-5788.md): The WebKit Canvas implementation in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain sensitive image… (no CVSS)
- [CVE-2015-5789](https://cve.now/CVE-2015-5789.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2015-5790](https://cve.now/CVE-2015-5790.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2015-5791](https://cve.now/CVE-2015-5791.md): WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause… (no CVSS)
- [CVE-2015-5792](https://cve.now/CVE-2015-5792.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2015-5793](https://cve.now/CVE-2015-5793.md): WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause… (no CVSS)
- [CVE-2015-5794](https://cve.now/CVE-2015-5794.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2015-5795](https://cve.now/CVE-2015-5795.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2015-5796](https://cve.now/CVE-2015-5796.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2015-5797](https://cve.now/CVE-2015-5797.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2015-5798](https://cve.now/CVE-2015-5798.md): WebKit, as used in Apple iTunes before 12.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service… (no CVSS)
- [CVE-2015-5799](https://cve.now/CVE-2015-5799.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2015-5800](https://cve.now/CVE-2015-5800.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2015-5801](https://cve.now/CVE-2015-5801.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2015-5802](https://cve.now/CVE-2015-5802.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2015-5803](https://cve.now/CVE-2015-5803.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2015-5804](https://cve.now/CVE-2015-5804.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2015-5805](https://cve.now/CVE-2015-5805.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2015-5806](https://cve.now/CVE-2015-5806.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2015-5807](https://cve.now/CVE-2015-5807.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2015-5808](https://cve.now/CVE-2015-5808.md): WebKit, as used in Apple iTunes before 12.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service… (no CVSS)
- [CVE-2015-5809](https://cve.now/CVE-2015-5809.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2015-5810](https://cve.now/CVE-2015-5810.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2015-5811](https://cve.now/CVE-2015-5811.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2015-5812](https://cve.now/CVE-2015-5812.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2015-5813](https://cve.now/CVE-2015-5813.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2015-5814](https://cve.now/CVE-2015-5814.md): WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause… (no CVSS)
- [CVE-2015-5815](https://cve.now/CVE-2015-5815.md): WebKit, as used in Apple iTunes before 12.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service… (no CVSS)
- [CVE-2015-5816](https://cve.now/CVE-2015-5816.md): WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause… (no CVSS)
- [CVE-2015-5817](https://cve.now/CVE-2015-5817.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2015-5818](https://cve.now/CVE-2015-5818.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2015-5819](https://cve.now/CVE-2015-5819.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2015-5820](https://cve.now/CVE-2015-5820.md): WebKit in Apple iOS before 9 allows remote attackers to trigger a dialing action via a crafted (1) tel://, (2) facetime://, or (3)… (no CVSS)
- [CVE-2015-5821](https://cve.now/CVE-2015-5821.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2015-5822](https://cve.now/CVE-2015-5822.md): WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause… (no CVSS)
- [CVE-2015-5823](https://cve.now/CVE-2015-5823.md): WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause… (no CVSS)
- [CVE-2015-5824](https://cve.now/CVE-2015-5824.md): The NSURL implementation in the CFNetwork SSL component in Apple iOS before 9 does not properly verify X.509 certificates from SSL servers… (no CVSS)
- [CVE-2015-5825](https://cve.now/CVE-2015-5825.md): WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain… (no CVSS)
- [CVE-2015-5826](https://cve.now/CVE-2015-5826.md): WebKit in Apple iOS before 9 does not properly select the cases in which a Cascading Style Sheets (CSS) document is required to have the… (no CVSS)
- [CVE-2015-5827](https://cve.now/CVE-2015-5827.md): WebKit in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain an object reference via vectors involving… (no CVSS)
- [CVE-2015-5829](https://cve.now/CVE-2015-5829.md): Data Detectors Engine in Apple iOS before 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory… (no CVSS)
- [CVE-2015-5831](https://cve.now/CVE-2015-5831.md): NetworkExtension in the kernel in Apple iOS before 9 does not properly initialize an unspecified data structure, which allows attackers to… (no CVSS)
- [CVE-2015-5832](https://cve.now/CVE-2015-5832.md): The iTunes Store component in Apple iOS before 9 does not properly delete AppleID credentials from the keychain upon a signout action… (no CVSS)
- [CVE-2015-5834](https://cve.now/CVE-2015-5834.md): IOAcceleratorFamily in Apple iOS before 9 allows attackers to obtain sensitive kernel memory-layout information via a crafted app. (no CVSS)
- [CVE-2015-5835](https://cve.now/CVE-2015-5835.md): Apple iOS before 9 allows attackers to obtain sensitive information about inter-app communication via a crafted app that conducts an… (no CVSS)
- [CVE-2015-5837](https://cve.now/CVE-2015-5837.md): PluginKit in Apple iOS before 9 allows attackers to bypass an intended app-trust requirement and install arbitrary extensions via a… (no CVSS)
- [CVE-2015-5838](https://cve.now/CVE-2015-5838.md): SpringBoard in Apple iOS before 9 does not properly restrict access to privileged API calls, which allows attackers to spoof the dialog… (no CVSS)
- [CVE-2015-5839](https://cve.now/CVE-2015-5839.md): dyld in Apple iOS before 9 allows attackers to bypass a code-signing protection mechanism via an app that places a crafted signature in an… (no CVSS)
- [CVE-2015-5840](https://cve.now/CVE-2015-5840.md): The checkint division routines in removefile in Apple iOS before 9 allow attackers to cause a denial of service (overflow fault and app… (no CVSS)
- [CVE-2015-5841](https://cve.now/CVE-2015-5841.md): The CFNetwork Proxies component in Apple iOS before 9 does not properly handle a Set-Cookie header within a response to an HTTP CONNECT… (no CVSS)
- [CVE-2015-5842](https://cve.now/CVE-2015-5842.md): XNU in the kernel in Apple iOS before 9 does not properly initialize an unspecified data structure, which allows local users to obtain… (no CVSS)
- [CVE-2015-5843](https://cve.now/CVE-2015-5843.md): IOMobileFrameBuffer in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via… (no CVSS)
- [CVE-2015-5844](https://cve.now/CVE-2015-5844.md): IOKit in the kernel in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service… (no CVSS)
- [CVE-2015-5845](https://cve.now/CVE-2015-5845.md): IOKit in the kernel in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service… (no CVSS)
- [CVE-2015-5846](https://cve.now/CVE-2015-5846.md): IOKit in the kernel in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service… (no CVSS)
- [CVE-2015-5847](https://cve.now/CVE-2015-5847.md): The Disk Images component in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via… (no CVSS)
- [CVE-2015-5848](https://cve.now/CVE-2015-5848.md): IOAcceleratorFamily in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via… (no CVSS)
- [CVE-2015-5850](https://cve.now/CVE-2015-5850.md): AppleKeyStore in Apple iOS before 9 allows physically proximate attackers to reset the count of incorrect passcode attempts via a device… (no CVSS)
- [CVE-2015-5851](https://cve.now/CVE-2015-5851.md): The convenience initializer in the Multipeer Connectivity component in Apple iOS before 9 does not require an encrypted session, which… (no CVSS)
- [CVE-2015-5855](https://cve.now/CVE-2015-5855.md): Apple iOS before 9 allows attackers to discover the e-mail address of a player via a crafted Game Center app. (no CVSS)
- [CVE-2015-5856](https://cve.now/CVE-2015-5856.md): The Application Store component in Apple iOS before 9 allows remote attackers to cause a denial of service to an enterprise-signed app via… (no CVSS)
- [CVE-2015-5857](https://cve.now/CVE-2015-5857.md): Mail in Apple iOS before 9 allows remote attackers to use an address-book contact as a spoofed e-mail sender address via unspecified… (no CVSS)
- [CVE-2015-5858](https://cve.now/CVE-2015-5858.md): The CFNetwork HTTPProtocol component in Apple iOS before 9 allows remote attackers to bypass the HSTS protection mechanism, and… (no CVSS)
- [CVE-2015-5860](https://cve.now/CVE-2015-5860.md): The CFNetwork HTTPProtocol component in Apple iOS before 9 mishandles HSTS state, which allows remote attackers to bypass the Safari… (no CVSS)
- [CVE-2015-5861](https://cve.now/CVE-2015-5861.md): SpringBoard in Apple iOS before 9 allows physically proximate attackers to bypass a lock-screen preview-disabled setting, and reply to an… (no CVSS)
- [CVE-2015-5862](https://cve.now/CVE-2015-5862.md): The Audio component in Apple iOS before 9 allows remote attackers to cause a denial of service (memory corruption and application crash)… (no CVSS)
- [CVE-2015-5863](https://cve.now/CVE-2015-5863.md): IOStorageFamily in Apple iOS before 9 does not properly initialize an unspecified data structure, which allows local users to obtain… (no CVSS)
- [CVE-2015-5867](https://cve.now/CVE-2015-5867.md): IOHIDFamily in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory… (no CVSS)
- [CVE-2015-5868](https://cve.now/CVE-2015-5868.md): The kernel in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified… (no CVSS)
- [CVE-2015-5869](https://cve.now/CVE-2015-5869.md): The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in Apple iOS before 9 allows remote attackers to reconfigure a… (no CVSS)
- [CVE-2015-5874](https://cve.now/CVE-2015-5874.md): CoreText in Apple iOS before 9 and iTunes before 12.3 allows remote attackers to execute arbitrary code or cause a denial of service… (no CVSS)
- [CVE-2015-5876](https://cve.now/CVE-2015-5876.md): dyld in Dev Tools in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service… (no CVSS)
- [CVE-2015-5879](https://cve.now/CVE-2015-5879.md): XNU in the kernel in Apple iOS before 9 does not properly validate the headers of TCP packets, which allows remote attackers to bypass the… (no CVSS)
- [CVE-2015-5880](https://cve.now/CVE-2015-5880.md): CoreAnimation in Apple iOS before 9 allows attackers to bypass intended IOSurface restrictions and obtain screen-framebuffer access via a… (no CVSS)
- [CVE-2015-5882](https://cve.now/CVE-2015-5882.md): The processor\_set\_tasks API implementation in Apple iOS before 9 allows local users to bypass an entitlement protection mechanism and… (no CVSS)
- [CVE-2015-5885](https://cve.now/CVE-2015-5885.md): The CFNetwork Cookies component in Apple iOS before 9 allows remote attackers to track users via vectors involving a cookie for a… (no CVSS)
- [CVE-2015-5892](https://cve.now/CVE-2015-5892.md): Siri in Apple iOS before 9 allows physically proximate attackers to bypass an intended client-side protection mechanism and obtain… (no CVSS)
- [CVE-2015-5895](https://cve.now/CVE-2015-5895.md): Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and attack vectors. (no CVSS)
- [CVE-2015-5896](https://cve.now/CVE-2015-5896.md): The kernel in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified… (no CVSS)
- [CVE-2015-5898](https://cve.now/CVE-2015-5898.md): CFNetwork in Apple iOS before 9 relies on the hardware UID for its cache encryption key, which makes it easier for physically proximate… (no CVSS)
- [CVE-2015-5899](https://cve.now/CVE-2015-5899.md): libpthread in the kernel in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via… (no CVSS)
- [CVE-2015-5903](https://cve.now/CVE-2015-5903.md): The kernel in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified… (no CVSS)
- [CVE-2015-5904](https://cve.now/CVE-2015-5904.md): Safari in Apple iOS before 9 allows remote attackers to spoof the relationship between URLs and web content via a crafted web site. (no CVSS)
- [CVE-2015-5905](https://cve.now/CVE-2015-5905.md): Safari in Apple iOS before 9 allows remote attackers to spoof the relationship between URLs and web content via a crafted window opener on… (no CVSS)
- [CVE-2015-5906](https://cve.now/CVE-2015-5906.md): The HTML form implementation in WebKit in Apple iOS before 9 does not prevent QuickType access to the final character of a password, which… (no CVSS)
- [CVE-2015-5907](https://cve.now/CVE-2015-5907.md): WebKit in Apple iOS before 9 allows man-in-the-middle attackers to conduct redirection attacks by leveraging the mishandling of the… (no CVSS)
- [CVE-2015-5909](https://cve.now/CVE-2015-5909.md): IDE Xcode Server in Apple Xcode before 7.0 does not properly restrict access to repository e-mail lists, which allows remote attackers to… (no CVSS)
- [CVE-2015-5910](https://cve.now/CVE-2015-5910.md): IDE Xcode Server in Apple Xcode before 7.0 does not ensure that server traffic is encrypted, which allows remote attackers to obtain… (no CVSS)
- [CVE-2015-5911](https://cve.now/CVE-2015-5911.md): Multiple unspecified vulnerabilities in Twisted in Wiki Server in Apple OS X Server before 5.0.3 allow attackers to have an unknown impact… (no CVSS)
- [CVE-2015-5912](https://cve.now/CVE-2015-5912.md): The CFNetwork FTPProtocol component in Apple iOS before 9 allows remote FTP proxy servers to trigger TCP connection attempts to intranet… (no CVSS)
- [CVE-2015-5916](https://cve.now/CVE-2015-5916.md): The Apple Pay component in Apple iOS before 9 allows remote terminals to obtain sensitive recent-transaction information during payments… (no CVSS)
- [CVE-2015-5920](https://cve.now/CVE-2015-5920.md): The Software Update component in Apple iTunes before 12.3 does not properly handle redirection, which allows man-in-the-middle attackers… (no CVSS)
- [CVE-2015-5921](https://cve.now/CVE-2015-5921.md): WebKit in Apple iOS before 9 mishandles "Content-Disposition: attachment" HTTP headers, which might allow man-in-the-middle attackers to… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2015-09-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.