# CVEs published 2015-12-17

15 CVEs were published on December 17, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-4027](https://cve.now/CVE-2015-4027.md): The AcuWVSSchedulerv10 service in Acunetix Web Vulnerability Scanner (WVS) before 10 build 20151125 allows local users to gain privileges… (no CVSS)
- [CVE-2015-5204](https://cve.now/CVE-2015-5204.md): CRLF injection vulnerability in the Apache Cordova File Transfer Plugin (cordova-plugin-file-transfer) for Android before 1.3.0 allows… (no CVSS)
- [CVE-2015-5277](https://cve.now/CVE-2015-5277.md): The get\_contents function in nss\_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) before 2.20… (no CVSS)
- [CVE-2015-7518](https://cve.now/CVE-2015-7518.md): Multiple cross-site scripting (XSS) vulnerabilities in information popups in Foreman before 1.10.0 allow remote attackers to inject… (no CVSS)
- [CVE-2015-7527](https://cve.now/CVE-2015-7527.md): lib/core.php in the Cool Video Gallery plugin 1.9 for WordPress allows remote attackers to execute arbitrary code via shell metacharacters… (no CVSS)
- [CVE-2015-8327](https://cve.now/CVE-2015-8327.md): Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.2.0 and in foomatic-filters in Foomatic 4.0.x… (no CVSS)
- [CVE-2015-8338](https://cve.now/CVE-2015-8338.md): Xen 4.6.x and earlier does not properly enforce limits on page order inputs for the (1) XENMEM\_increase\_reservation, (2)… (no CVSS)
- [CVE-2015-8339](https://cve.now/CVE-2015-8339.md): The memory\_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly hand back pages to a domain, which might… (no CVSS)
- [CVE-2015-8340](https://cve.now/CVE-2015-8340.md): The memory\_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly release locks, which might allow guest OS… (no CVSS)
- [CVE-2015-8341](https://cve.now/CVE-2015-8341.md): The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks… (no CVSS)
- [CVE-2015-8368](https://cve.now/CVE-2015-8368.md): ntopng (aka ntop) before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and… (no CVSS)
- [CVE-2015-8369](https://cve.now/CVE-2015-8369.md): SQL injection vulnerability in include/top\_graph\_header.php in Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary SQL… (no CVSS)
- [CVE-2015-8600](https://cve.now/CVE-2015-8600.md): The SysAdminWebTool servlets in SAP Mobile Platform allow remote attackers to bypass authentication and obtain sensitive information, gain… (no CVSS)
- [CVE-2015-8601](https://cve.now/CVE-2015-8601.md): The Chat Room module 7.x-2.x before 7.x-2.2 for Drupal does not properly check permissions when setting up a websocket for chat messages… (no CVSS)
- [CVE-2015-8602](https://cve.now/CVE-2015-8602.md): The Token Insert Entity module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permissions, which allows remote authenticated… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2015-12-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.