# CVEs published 2015-04-21

64 CVEs were published on April 21, 2015: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2015-3378](https://cve.now/CVE-2015-3378.md): Open redirect vulnerability in the Views module before 6.x-2.18, 6.x-3.x before 6.x-3.2, and 7.x-3.x before 7.x-3.10 for Drupal, when the Vi (no CVSS)
- [CVE-2015-3379](https://cve.now/CVE-2015-3379.md): The Views module before 6.x-2.18, 6.x-3.x before 6.x-3.2, and 7.x-3.x before 7.x-3.10 for Drupal does not properly restrict access to the de (no CVSS)
- [CVE-2015-3380](https://cve.now/CVE-2015-3380.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Feature Set module for Drupal allow remote attackers to hijack the authent (no CVSS)
- [CVE-2015-3381](https://cve.now/CVE-2015-3381.md): Cross-site scripting (XSS) vulnerability in the Node basket module for Drupal allows remote authenticated users to inject arbitrary web scri (no CVSS)
- [CVE-2015-3382](https://cve.now/CVE-2015-3382.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Node basket module for Drupal allow remote attackers to hijack the authent (no CVSS)
- [CVE-2015-3383](https://cve.now/CVE-2015-3383.md): Open redirect vulnerability in the Node basket module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduc (no CVSS)
- [CVE-2015-3384](https://cve.now/CVE-2015-3384.md): Cross-site scripting (XSS) vulnerability in the Bank Account Listing Page in the Commerce Balanced Payments module for Drupal allows remote (no CVSS)
- [CVE-2015-3385](https://cve.now/CVE-2015-3385.md): Cross-site scripting (XSS) vulnerability in the Taxonomy Path module before 7.x-1.2 for Drupal allows remote authenticated users to inject a (no CVSS)
- [CVE-2015-3386](https://cve.now/CVE-2015-3386.md): Cross-site scripting (XSS) vulnerability in the Node Access Product module for Drupal allows remote authenticated users to inject arbitrary (no CVSS)
- [CVE-2015-3387](https://cve.now/CVE-2015-3387.md): Multiple cross-site scripting (XSS) vulnerabilities in the Taxonomy Tools module before 7.x-1.4 for Drupal allow remote authenticated users (no CVSS)
- [CVE-2015-3388](https://cve.now/CVE-2015-3388.md): Cross-site request forgery (CSRF) vulnerability in the Commerce Balanced Payments module for Drupal allows remote attackers to hijack the au (no CVSS)
- [CVE-2015-3389](https://cve.now/CVE-2015-3389.md): Cross-site scripting (XSS) vulnerability in the Download counts report page in the Public Download Count module (pubdlcnt) 7.x-1.x-dev and e (no CVSS)
- [CVE-2015-3390](https://cve.now/CVE-2015-3390.md): Cross-site scripting (XSS) vulnerability in the Facebook Album Fetcher module for Drupal allows remote authenticated users with the "access (no CVSS)
- [CVE-2015-3391](https://cve.now/CVE-2015-3391.md): The Path Breadcrumbs module before 7.x-3.2 for Drupal allows remote attackers to bypass intended access restrictions and obtain sensitive no (no CVSS)
- [CVE-2015-3392](https://cve.now/CVE-2015-3392.md): Cross-site scripting (XSS) vulnerability in the Ajax Timeline module before 7.x-1.1 for Drupal allows remote authenticated users to inject a (no CVSS)
- [CVE-2015-3393](https://cve.now/CVE-2015-3393.md): Open redirect vulnerability in the Commerce WeDeal module before 7.x-1.3 for Drupal allows remote attackers to redirect users to arbitrary w (no CVSS)
- [CVE-2014-3586](https://cve.now/CVE-2014-3586.md): The default configuration for the Command Line Interface in Red Hat Enterprise Application Platform before 6.4.0 and WildFly (formerly JBoss (no CVSS)
- [CVE-2014-8111](https://cve.now/CVE-2014-8111.md): Apache Tomcat Connectors (mod\_jk) before 1.2.41 ignores JkUnmount rules for subtrees of previous JkMount rules, which allows remote attacker (no CVSS)
- [CVE-2014-8125](https://cve.now/CVE-2014-8125.md): XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have oth (no CVSS, org.drools:drools-core · org.jbpm:jbpm-bpmn2)
- [CVE-2014-9718](https://cve.now/CVE-2014-9718.md): The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1.0 through 2.1.3 have multiple interpretations of a function's r (no CVSS)
- [CVE-2015-0135](https://cve.now/CVE-2015-0135.md): IBM Domino 8.5 before 8.5.3 FP6 IF4 and 9.0 before 9.0.1 FP3 IF2 allows remote attackers to execute arbitrary code or cause a denial of serv (no CVSS)
- [CVE-2015-3342](https://cve.now/CVE-2015-3342.md): Open redirect vulnerability in the Ubercart Currency Conversion module before 6.x-1.2 for Drupal allows remote attackers to redirect users t (no CVSS)
- [CVE-2015-3343](https://cve.now/CVE-2015-3343.md): Cross-site request forgery (CSRF) vulnerability in the OPAC module before 7.x-2.3 for Drupal allows remote attackers to hijack the authentic (no CVSS)
- [CVE-2015-3344](https://cve.now/CVE-2015-3344.md): Cross-site scripting (XSS) vulnerability in the Course module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal allows remote aut (no CVSS)
- [CVE-2015-3345](https://cve.now/CVE-2015-3345.md): SQL injection vulnerability in the PHPlist Integration Module before 6.x-1.7 for Drupal allows remote administrators to execute arbitrary SQ (no CVSS)
- [CVE-2015-3346](https://cve.now/CVE-2015-3346.md): SQL injection vulnerability in the WikiWiki module before 6.x-1.2 for Drupal allows remote attackers to execute arbitrary SQL commands via u (no CVSS)
- [CVE-2015-3347](https://cve.now/CVE-2015-3347.md): Cross-site request forgery (CSRF) vulnerability in the Cloudwords for Multilingual Drupal module before 7.x-2.3 for Drupal allows remote att (no CVSS)
- [CVE-2015-3348](https://cve.now/CVE-2015-3348.md): Cross-site scripting (XSS) vulnerability in the Cloudwords for Multilingual Drupal module before 7.x-2.3 for Drupal allows remote authentica (no CVSS)
- [CVE-2015-3349](https://cve.now/CVE-2015-3349.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Htaccess module before 7.x-2.3 for Drupal allow remote attackers to hijack (no CVSS)
- [CVE-2015-3350](https://cve.now/CVE-2015-3350.md): Cross-site request forgery (CSRF) vulnerability in the Todo Filter module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote (no CVSS)
- [CVE-2015-3351](https://cve.now/CVE-2015-3351.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Log Watcher module before 6.x-1.2 for Drupal allow remote attackers to hij (no CVSS)
- [CVE-2015-3352](https://cve.now/CVE-2015-3352.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Jammer module before 6.x-1.8 and 7.x-1.x before 7.x-1.4 for Drupal allow r (no CVSS)
- [CVE-2015-3353](https://cve.now/CVE-2015-3353.md): Cross-site scripting (XSS) vulnerability in the Field Display Label module before 7.x-1.3 for Drupal allows remote authenticated users to in (no CVSS)
- [CVE-2015-3354](https://cve.now/CVE-2015-3354.md): Cross-site request forgery (CSRF) vulnerability in the Wishlist module before 6.x-2.7 and 7.x-2.x before 7.x-2.7 for Drupal allows remote at (no CVSS)
- [CVE-2015-3355](https://cve.now/CVE-2015-3355.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Batch Jobs module before 7.x-1.2 for Drupal allow remote attackers to hija (no CVSS)
- [CVE-2015-3356](https://cve.now/CVE-2015-3356.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Tadaa! module before 7.x-1.4 for Drupal allow remote attackers to hijack t (no CVSS)
- [CVE-2015-3357](https://cve.now/CVE-2015-3357.md): Cross-site scripting (XSS) vulnerability in the Wishlist module before 6.x-2.7 and 7.x-2.x before 7.x-2.7 for Drupal allows remote authentic (no CVSS)
- [CVE-2015-3358](https://cve.now/CVE-2015-3358.md): Multiple open redirect vulnerabilities in the Tadaa! module before 7.x-1.4 for Drupal allow remote attackers to redirect users to arbitrary (no CVSS)
- [CVE-2015-3359](https://cve.now/CVE-2015-3359.md): Multiple cross-site scripting (XSS) vulnerabilities in the Room Reservations module before 7.x-1.1 for Drupal allow remote authenticated use (no CVSS)
- [CVE-2015-3360](https://cve.now/CVE-2015-3360.md): Cross-site scripting (XSS) vulnerability in the Term Merge module before 7.x-1.2 for Drupal allows remote authenticated users to inject arbi (no CVSS)
- [CVE-2015-3361](https://cve.now/CVE-2015-3361.md): Cross-site scripting (XSS) vulnerability in the Linkit module before 7.x-2.7 and 7.x-3.x before 7.x-3.3 for Drupal, when the node search plu (no CVSS)
- [CVE-2015-3362](https://cve.now/CVE-2015-3362.md): Cross-site scripting (XSS) vulnerability in the Video module before 7.x-2.11 for Drupal, when using the video WYSIWYG plugin, allows remote (no CVSS)
- [CVE-2015-3363](https://cve.now/CVE-2015-3363.md): Cross-site request forgery (CSRF) vulnerability in the Contact Form Fields module before 6.x-2.3 for Drupal allows remote attackers to hijac (no CVSS)
- [CVE-2015-3364](https://cve.now/CVE-2015-3364.md): Cross-site scripting (XSS) vulnerability in the Content Analysis module before 6.x-1.7 for Drupal allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2015-3365](https://cve.now/CVE-2015-3365.md): Cross-site scripting (XSS) vulnerability in the nodeauthor module for Drupal allows remote authenticated users to inject arbitrary web scrip (no CVSS)
- [CVE-2015-3366](https://cve.now/CVE-2015-3366.md): Cross-site request forgery (CSRF) vulnerability in the Alfresco module before 6.x-1.3 for Drupal allows remote attackers to hijack the authe (no CVSS)
- [CVE-2015-3367](https://cve.now/CVE-2015-3367.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Patterns module before 7.x-2.2 for Drupal allow remote attackers to hijack (no CVSS)
- [CVE-2015-3368](https://cve.now/CVE-2015-3368.md): Cross-site scripting (XSS) vulnerability in the administration user interface in the Classified Ads module before 6.x-3.1 and 7.x-3.x before (no CVSS)
- [CVE-2015-3369](https://cve.now/CVE-2015-3369.md): Cross-site scripting (XSS) vulnerability in the Taxonews module before 6.x-1.2 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authentic (no CVSS)
- [CVE-2015-3370](https://cve.now/CVE-2015-3370.md): Cross-site request forgery (CSRF) vulnerability in the Node Invite module before 6.x-2.5 for Drupal allows remote attackers to hijack the au (no CVSS)
- [CVE-2015-3371](https://cve.now/CVE-2015-3371.md): Open redirect vulnerability in the Node Invite module before 6.x-2.5 for Drupal allows remote attackers to redirect users to arbitrary web s (no CVSS)
- [CVE-2015-3372](https://cve.now/CVE-2015-3372.md): Cross-site scripting (XSS) vulnerability in the Node Invite module before 6.x-2.5 for Drupal allows remote authenticated users to inject arb (no CVSS)
- [CVE-2015-3373](https://cve.now/CVE-2015-3373.md): The Amazon AWS module before 7.x-1.3 for Drupal uses the base URL and AWS access key to generate the access token, which makes it easier for (no CVSS)
- [CVE-2015-3374](https://cve.now/CVE-2015-3374.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Corner module for Drupal allow remote attackers to hijack the authenticati (no CVSS)
- [CVE-2015-3375](https://cve.now/CVE-2015-3375.md): Cross-site request forgery (CSRF) vulnerability in the Shibboleth Authentication module before 6.x-4.1 and 7.x-4.x before 7.x-4.1 for Drupal (no CVSS)
- [CVE-2015-3376](https://cve.now/CVE-2015-3376.md): Cross-site scripting (XSS) vulnerability in the Quizzler module before 7-x.1.16 for Drupal allows remote authenticated users to inject arbit (no CVSS)
- [CVE-2014-5361](https://cve.now/CVE-2014-5361.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Landesk Management Suite 9.6 and earlier allow remote attackers to hijack the (no CVSS)
- [CVE-2014-5370](https://cve.now/CVE-2014-5370.md): Directory traversal vulnerability in the CFChart servlet (com.naryx.tagfusion.cfm.cfchartServlet) in New Atlanta BlueDragon before 7.1.1.185 (no CVSS)
- [CVE-2015-2825](https://cve.now/CVE-2015-2825.md): Unrestricted file upload vulnerability in sam-ajax-admin.php in the Simple Ads Manager plugin before 2.5.96 for WordPress allows remote atta (no CVSS)
- [CVE-2015-1701](https://cve.now/CVE-2015-1701.md): Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privil (CVSS 7.8, KEV)
- [CVE-2015-2041](https://cve.now/CVE-2015-2041.md): net/llc/sysctl\_net\_llc.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table, which allows local users to obtain p (no CVSS)
- [CVE-2015-2042](https://cve.now/CVE-2015-2042.md): net/rds/sysctl.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table, which allows local users to obtain potential (no CVSS)
- [CVE-2015-0702](https://cve.now/CVE-2015-0702.md): Unrestricted file upload vulnerability in the Custom Prompts upload implementation in Cisco Unified MeetingPlace 8.6(1.9) allows remote auth (no CVSS)
- [CVE-2015-0703](https://cve.now/CVE-2015-0703.md): Cross-site scripting (XSS) vulnerability in the administrative web interface in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-04-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.