# CVEs published 2015-12-30

16 CVEs were published on December 30, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-5663](https://cve.now/CVE-2015-5663.md): The file-execution functionality in WinRAR before 5.30 beta 5 allows local users to gain privileges via a Trojan horse file with a name… (no CVSS)
- [CVE-2015-7248](https://cve.now/CVE-2015-7248.md): ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k\_PE allow remote attackers to discover usernames and password hashes by reading… (no CVSS)
- [CVE-2015-7249](https://cve.now/CVE-2015-7249.md): ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k\_PE allow remote authenticated users to bypass intended access restrictions via a… (no CVSS)
- [CVE-2015-7250](https://cve.now/CVE-2015-7250.md): Absolute path traversal vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k\_PE allows remote… (no CVSS)
- [CVE-2015-7251](https://cve.now/CVE-2015-7251.md): ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k\_PE have a hardcoded password of root for the root account, which allows remote… (no CVSS)
- [CVE-2015-7252](https://cve.now/CVE-2015-7252.md): Cross-site scripting (XSS) vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k\_PE allows remote… (no CVSS)
- [CVE-2015-7782](https://cve.now/CVE-2015-7782.md): Cross-site scripting (XSS) vulnerability in Let's PHP! Frame high-speed chat before 2015-09-22 allows remote attackers to inject arbitrary… (no CVSS)
- [CVE-2015-7784](https://cve.now/CVE-2015-7784.md): SQL injection vulnerability in the BOKUBLOCK (1) BbAdminViewsControl213 plugin before 1.1 and (2) BbAdminViewsControl plugin before 2.1… (no CVSS)
- [CVE-2015-7787](https://cve.now/CVE-2015-7787.md): ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to discover the WPA2-PSK passphrase via unspecified… (no CVSS)
- [CVE-2015-7788](https://cve.now/CVE-2015-7788.md): ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to execute arbitrary commands via unspecified vectors. (no CVSS)
- [CVE-2015-7789](https://cve.now/CVE-2015-7789.md): ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to cause a denial of service via unspecified vectors. (no CVSS)
- [CVE-2015-7790](https://cve.now/CVE-2015-7790.md): Cross-site scripting (XSS) vulnerability on ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allows remote attackers to inject… (no CVSS)
- [CVE-2015-7792](https://cve.now/CVE-2015-7792.md): Corega CG-WLBARGS devices allow remote attackers to perform administrative operations via unspecified vectors. (no CVSS)
- [CVE-2015-7793](https://cve.now/CVE-2015-7793.md): Corega CG-WLBARAGM devices provide an open proxy service, which allows remote attackers to trigger outbound network traffic via… (no CVSS)
- [CVE-2015-7794](https://cve.now/CVE-2015-7794.md): Corega CG-WLNCM4G devices provide an open DNS resolver, which allows remote attackers to cause a denial of service (traffic amplification)… (no CVSS)
- [CVE-2015-8703](https://cve.now/CVE-2015-8703.md): ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k\_PE and ZXV10 W300 devices W300V1.0.0f\_ER1\_PE allow remote authenticated users to… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2015-12-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.