# CVEs published 2015-09-21

19 CVEs were published on September 21, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-5603](https://cve.now/CVE-2015-5603.md): The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java code via… (no CVSS)
- [CVE-2015-6238](https://cve.now/CVE-2015-6238.md): Multiple cross-site scripting (XSS) vulnerabilities in the Google Analyticator plugin before 6.4.9.6 for WordPress allow remote attackers… (no CVSS)
- [CVE-2015-6749](https://cve.now/CVE-2015-6749.md): Buffer overflow in the aiff\_open function in oggenc/audio.c in vorbis-tools 1.4.0 and earlier allows remote attackers to cause a denial of… (no CVSS)
- [CVE-2015-6923](https://cve.now/CVE-2015-6923.md): The ndvbs module in VBox Communications Satellite Express Protocol 2.3.17.3 allows local users to write to arbitrary physical memory… (no CVSS)
- [CVE-2015-6938](https://cve.now/CVE-2015-6938.md): Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter… (no CVSS, notebook · ipython)
- [CVE-2015-7303](https://cve.now/CVE-2015-7303.md): Use-after-free vulnerability in the Update Manager service in Avira Management Console allows remote attackers to execute arbitrary code… (no CVSS)
- [CVE-2015-7304](https://cve.now/CVE-2015-7304.md): Cross-site scripting (XSS) vulnerability in the amoCRM module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to inject… (no CVSS)
- [CVE-2015-7305](https://cve.now/CVE-2015-7305.md): The Scald module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to fields, which allows remote attackers to obtain… (no CVSS)
- [CVE-2015-7306](https://cve.now/CVE-2015-7306.md): The CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal does not properly check access permissions, which allows remote authenticated… (no CVSS)
- [CVE-2015-7307](https://cve.now/CVE-2015-7307.md): Cross-site scripting (XSS) vulnerability in the CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject… (no CVSS)
- [CVE-2015-2864](https://cve.now/CVE-2015-2864.md): Retrospect and Retrospect Client before 10.0.2.119 on Windows, before 12.0.2.116 on OS X, and before 10.0.2.104 on Linux improperly… (no CVSS)
- [CVE-2015-2914](https://cve.now/CVE-2015-2914.md): Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M use a fixed… (no CVSS)
- [CVE-2015-2915](https://cve.now/CVE-2015-2915.md): Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M have a default… (no CVSS)
- [CVE-2015-2916](https://cve.now/CVE-2015-2916.md): Cross-site request forgery (CSRF) vulnerability on Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015… (no CVSS)
- [CVE-2015-2917](https://cve.now/CVE-2015-2917.md): Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M unintentionally… (no CVSS)
- [CVE-2015-5991](https://cve.now/CVE-2015-5991.md): Cross-site request forgery (CSRF) vulnerability in form2WlanSetup.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices… (no CVSS)
- [CVE-2015-5992](https://cve.now/CVE-2015-5992.md): Cross-site scripting (XSS) vulnerability in form2WlanSetup.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with… (no CVSS)
- [CVE-2015-5993](https://cve.now/CVE-2015-5993.md): Buffer overflow in form2ping.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware… (no CVSS)
- [CVE-2015-7296](https://cve.now/CVE-2015-7296.md): Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M use a linear… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2015-09-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.