# CVEs published 2015-10-28

26 CVEs were published on October 28, 2015: 1 critical, 1 high. Days are UTC.

- [CVE-2014-8912](https://cve.now/CVE-2014-8912.md): IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 through 8.0.0.1 CF18, and… (no CVSS)
- [CVE-2015-6034](https://cve.now/CVE-2015-6034.md): EPSON Network Utility 4.10 uses weak permissions (Everyone: Full Control) for eEBSVC.exe, which allows local users to gain privileges via… (no CVSS)
- [CVE-2015-7649](https://cve.now/CVE-2015-7649.md): Adobe Shockwave Player before 12.2.1.171 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via… (no CVSS)
- [CVE-2015-3967](https://cve.now/CVE-2015-3967.md): Cross-site request forgery (CSRF) vulnerability on Janitza UMG 508, 509, 511, 604, and 605 devices allows remote attackers to hijack the… (no CVSS)
- [CVE-2015-3968](https://cve.now/CVE-2015-3968.md): The FTP service on Janitza UMG 508, 509, 511, 604, and 605 devices has a default password, which makes it easier for remote attackers to… (no CVSS)
- [CVE-2015-3969](https://cve.now/CVE-2015-3969.md): Janitza UMG 508, 509, 511, 604, and 605 devices allow remote attackers to obtain sensitive network-connection information via a request to… (no CVSS)
- [CVE-2015-3970](https://cve.now/CVE-2015-3970.md): Multiple cross-site scripting (XSS) vulnerabilities in the web interface on Janitza UMG 508, 509, 511, 604, and 605 devices allow remote… (no CVSS)
- [CVE-2015-3971](https://cve.now/CVE-2015-3971.md): The debug interface on Janitza UMG 508, 509, 511, 604, and 605 devices does not require authentication, which allows remote attackers to… (no CVSS)
- [CVE-2015-3972](https://cve.now/CVE-2015-3972.md): The web interface on Janitza UMG 508, 509, 511, 604, and 605 devices supports only short PIN values for authentication, which makes it… (no CVSS)
- [CVE-2015-3973](https://cve.now/CVE-2015-3973.md): Janitza UMG 508, 509, 511, 604, and 605 devices improperly generate session tokens, which makes it easier for remote attackers to… (no CVSS)
- [CVE-2015-5712](https://cve.now/CVE-2015-5712.md): Spotfire Parsing Library and Spotfire Security Filter in TIBCO Spotfire Server 5.5.x before 5.5.4, 6.0.x before 6.0.5, 6.5.x before 6.5.4… (no CVSS)
- [CVE-2015-5713](https://cve.now/CVE-2015-5713.md): Spotfire Parsing Library and Spotfire Security Filter in TIBCO Spotfire Server 5.5.x before 5.5.4, 6.0.x before 6.0.5, 6.5.x before 6.5.4… (no CVSS)
- [CVE-2015-6486](https://cve.now/CVE-2015-6486.md): SQL injection vulnerability on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allows… (no CVSS)
- [CVE-2015-6488](https://cve.now/CVE-2015-6488.md): Cross-site scripting (XSS) vulnerability in the web server on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices… (no CVSS)
- [CVE-2015-6490](https://cve.now/CVE-2015-6490.md): Stack-based buffer overflow on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices through B FRN 15.003 allows… (CVSS 9.8)
- [CVE-2015-6491](https://cve.now/CVE-2015-6491.md): Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allow remote authenticated users to insert… (no CVSS)
- [CVE-2015-6492](https://cve.now/CVE-2015-6492.md): Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allow remote attackers to cause a denial of… (CVSS 7.5)
- [CVE-2015-6493](https://cve.now/CVE-2015-6493.md): Cross-site request forgery (CSRF) vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430 allows… (no CVSS)
- [CVE-2015-6494](https://cve.now/CVE-2015-6494.md): Cross-site scripting (XSS) vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote… (no CVSS)
- [CVE-2015-7836](https://cve.now/CVE-2015-7836.md): Siemens RUGGEDCOM ROS before 4.2.1 allows remote attackers to obtain sensitive information by sniffing the network for VLAN data within… (no CVSS)
- [CVE-2015-7873](https://cve.now/CVE-2015-7873.md): The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via… (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2015-7900](https://cve.now/CVE-2015-7900.md): Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote attackers to obtain sensitive debugging… (no CVSS)
- [CVE-2015-7901](https://cve.now/CVE-2015-7901.md): Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430 allows remote authenticated users to execute arbitrary OS… (no CVSS)
- [CVE-2015-7902](https://cve.now/CVE-2015-7902.md): Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 provides different error messages for failed login attempts in… (no CVSS)
- [CVE-2015-7903](https://cve.now/CVE-2015-7903.md): SQL injection vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated… (no CVSS)
- [CVE-2015-7904](https://cve.now/CVE-2015-7904.md): Unrestricted file upload vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2015-10-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.