# CVEs published 2015-11-09 24 CVEs were published on November 9, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2015-8001](https://cve.now/CVE-2015-8001.md): The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not restrict the… (no CVSS) - [CVE-2015-8002](https://cve.now/CVE-2015-8002.md): The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated… (no CVSS) - [CVE-2015-8003](https://cve.now/CVE-2015-8003.md): MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not throttle file uploads, which allows remote authenticated… (no CVSS) - [CVE-2015-8004](https://cve.now/CVE-2015-8004.md): MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not properly restrict access to revisions, which allows… (no CVSS) - [CVE-2015-8005](https://cve.now/CVE-2015-8005.md): MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 uses the thumbnail ImageMagick command line argument, which… (no CVSS) - [CVE-2015-8006](https://cve.now/CVE-2015-8006.md): Cross-site scripting (XSS) vulnerability in the PageTriage toolbar in the PageTriage extension for MediWiki allows remote attackers to… (no CVSS) - [CVE-2015-8007](https://cve.now/CVE-2015-8007.md): The Echo extension for MediWiki does not properly implement the hideuser functionality, which allows remote authenticated users to see… (no CVSS) - [CVE-2014-8873](https://cve.now/CVE-2014-8873.md): A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by… (no CVSS) - [CVE-2015-3240](https://cve.now/CVE-2015-3240.md): The pluto IKE daemon in libreswan before 3.15 and Openswan before 2.6.45, when built with NSS, allows remote attackers to cause a denial… (no CVSS) - [CVE-2015-5218](https://cve.now/CVE-2015-5218.md): Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a… (no CVSS) - [CVE-2015-7295](https://cve.now/CVE-2015-7295.md): hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported… (no CVSS) - [CVE-2015-7940](https://cve.now/CVE-2015-7940.md): The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote… (no CVSS, org.bouncycastle:bcprov-jdk15 · org.bouncycastle:bcprov-… +1) - [CVE-2015-8041](https://cve.now/CVE-2015-8041.md): Multiple integer overflows in the NDEF record parser in hostapd before 2.5 and wpa\_supplicant before 2.5 allow remote attackers to cause a… (no CVSS) - [CVE-2015-8095](https://cve.now/CVE-2015-8095.md): The recycle bin feature in the Monster Menus module 7.x-1.21 before 7.x-1.24 for Drupal does not properly remove nodes from view, which… (no CVSS) - [CVE-2015-8096](https://cve.now/CVE-2015-8096.md): Integer overflow in Google Picasa 3.9.140 Build 239 and Build 248 allows remote attackers to execute arbitrary code via unspecified… (no CVSS) - [CVE-2015-2213](https://cve.now/CVE-2015-2213.md): SQL injection vulnerability in the wp\_untrash\_post\_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote… (no CVSS) - [CVE-2015-5730](https://cve.now/CVE-2015-5730.md): The sanitize\_widget\_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time… (no CVSS) - [CVE-2015-5731](https://cve.now/CVE-2015-5731.md): Cross-site request forgery (CSRF) vulnerability in wp-admin/post.php in WordPress before 4.2.4 allows remote attackers to hijack the… (no CVSS) - [CVE-2015-5732](https://cve.now/CVE-2015-5732.md): Cross-site scripting (XSS) vulnerability in the form function in the WP\_Nav\_Menu\_Widget class in wp-includes/default-widgets.php in… (no CVSS) - [CVE-2015-5733](https://cve.now/CVE-2015-5733.md): Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before… (no CVSS) - [CVE-2015-5734](https://cve.now/CVE-2015-5734.md): Cross-site scripting (XSS) vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4… (no CVSS) - [CVE-2015-2695](https://cve.now/CVE-2015-2695.md): lib/gssapi/spnego/spnego\_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote… (no CVSS) - [CVE-2015-2696](https://cve.now/CVE-2015-2696.md): lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers… (no CVSS) - [CVE-2015-2697](https://cve.now/CVE-2015-2697.md): The build\_principal\_va function in lib/krb5/krb/bld\_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to… (no CVSS) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/archive/2015-11-09 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.