# CVEs published 2015-11-25

19 CVEs were published on November 25, 2015: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2014-3665](https://cve.now/CVE-2014-3665.md): Jenkins before 1.587 and LTS before 1.580.1 do not properly ensure trust separation between a master and slaves, which might allow remote… (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2015-5242](https://cve.now/CVE-2015-5242.md): OpenStack Swift-on-File (aka Swiftonfile) does not properly restrict use of the pickle Python module when loading metadata, which allows… (no CVSS)
- [CVE-2015-5306](https://cve.now/CVE-2015-5306.md): OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access… (no CVSS, python-ironic-inspector-client · ironic-inspector)
- [CVE-2015-5317](https://cve.now/CVE-2015-5317.md): The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name in (CVSS 7.5, KEV, org.jenkins-ci.main:jenkins-core)
- [CVE-2015-5318](https://cve.now/CVE-2015-5318.md): Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for… (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2015-5319](https://cve.now/CVE-2015-5319.md): XML external entity (XXE) vulnerability in the create-job CLI command in Jenkins before 1.638 and LTS before 1.625.2 allows remote… (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2015-5320](https://cve.now/CVE-2015-5320.md): Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote… (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2015-5321](https://cve.now/CVE-2015-5321.md): The sidepanel widgets in the CLI command overview and help pages in Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to… (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2015-5322](https://cve.now/CVE-2015-5322.md): Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and… (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2015-5323](https://cve.now/CVE-2015-5323.md): Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain… (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2015-5324](https://cve.now/CVE-2015-5324.md): Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api. (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2015-5325](https://cve.now/CVE-2015-5325.md): Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP… (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2015-5326](https://cve.now/CVE-2015-5326.md): Cross-site scripting (XSS) vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote… (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2015-8103](https://cve.now/CVE-2015-8103.md): The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted… (no CVSS, org.jenkins-ci.main:cli)
- [CVE-2015-6379](https://cve.now/CVE-2015-6379.md): The XML parser in the management interface in Cisco Adaptive Security Appliance (ASA) Software 8.4 allows remote authenticated users to… (no CVSS)
- [CVE-2015-7285](https://cve.now/CVE-2015-7285.md): CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 do not require authentication from Alarm Receiving Center (ARC) servers… (no CVSS)
- [CVE-2015-7286](https://cve.now/CVE-2015-7286.md): CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 rely on a polyalphabetic substitution cipher with hardcoded keys, which… (no CVSS)
- [CVE-2015-7287](https://cve.now/CVE-2015-7287.md): CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 use the same 001984 default PIN across different customers'… (no CVSS)
- [CVE-2015-7288](https://cve.now/CVE-2015-7288.md): CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 allow remote attackers to modify the configuration via a command in an… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2015-11-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.