# CVEs published 2015-05-29

24 CVEs were published on May 29, 2015: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2013-7441](https://cve.now/CVE-2013-7441.md): The modern style negotiation in Network Block Device (nbd-server) 2.9.22 through 3.3 allows remote attackers to cause a denial of service (r (no CVSS)
- [CVE-2014-9727](https://cve.now/CVE-2014-9727.md): AVM Fritz!Box allows remote attackers to execute arbitrary commands via shell metacharacters in the var:lang parameter to cgi-bin/webcm. (no CVSS)
- [CVE-2015-0200](https://cve.now/CVE-2015-0200.md): IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x before 7.0.0.8 IF2 allows local users to obtain sensitive database information via unspe (no CVSS)
- [CVE-2015-0751](https://cve.now/CVE-2015-0751.md): Cisco IP Phone 7861, when firmware from Cisco Unified Communications Manager 10.3(1) is used, allows remote attackers to cause a denial of s (no CVSS)
- [CVE-2015-0752](https://cve.now/CVE-2015-0752.md): Cross-site scripting (XSS) vulnerability in Cisco TelePresence Video Communication Server (VCS) X8.5.1 allows remote attackers to inject arb (no CVSS)
- [CVE-2015-0753](https://cve.now/CVE-2015-0753.md): SQL injection vulnerability in Cisco Unified Email Interaction Manager (EIM) and Unified Web Interaction Manager (WIM) 9.0(2) allows remote (no CVSS)
- [CVE-2015-0754](https://cve.now/CVE-2015-0754.md): Cisco Finesse 10.5(1) allows remote authenticated users to obtain sensitive information or cause a denial of service (CPU and memory consump (no CVSS)
- [CVE-2015-0755](https://cve.now/CVE-2015-0755.md): The Posture module for Cisco Identity Services Engine (ISE), as distributed in Cisco AnyConnect Secure Mobility Client 4.0(64), allows local (no CVSS)
- [CVE-2015-0756](https://cve.now/CVE-2015-0756.md): Cisco Wireless LAN Controller (WLC) devices with software 7.4(1.1) allow remote attackers to cause a denial of service (wireless-networking (no CVSS)
- [CVE-2015-0757](https://cve.now/CVE-2015-0757.md): The web framework in Cisco Identity Services Engine (ISE) 1.2(1.901) and 1.3(0.722) does not properly implement session handlers, which allo (no CVSS)
- [CVE-2015-0847](https://cve.now/CVE-2015-0847.md): nbd-server.c in Network Block Device (nbd-server) before 3.11 does not properly handle signals, which allows remote attackers to cause a den (no CVSS)
- [CVE-2015-1833](https://cve.now/CVE-2015-1833.md): XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8. (no CVSS, org.apache.jackrabbit:jackrabbit-core)
- [CVE-2015-3994](https://cve.now/CVE-2015-3994.md): The grant.xsfunc application in testApps/grantAccess/ in the XS Engine in SAP HANA DB 1.00.73.00.389160 (NewDB100\_REL) allows remote authent (no CVSS)
- [CVE-2015-3995](https://cve.now/CVE-2015-3995.md): SAP HANA DB 1.00.73.00.389160 (NewDB100\_REL) allows remote authenticated users to read arbitrary files via an IMPORT FROM SQL statement, aka (no CVSS)
- [CVE-2015-4031](https://cve.now/CVE-2015-4031.md): Directory traversal vulnerability in saveFile.jsp in the development installation in Visual Mining NetChart allows remote attackers to write (no CVSS)
- [CVE-2015-4032](https://cve.now/CVE-2015-4032.md): projectContents.jsp in the Developer tools in Visual Mining NetCharts Server allows remote attackers to rename arbitrary files, and conseque (no CVSS)
- [CVE-2015-4047](https://cve.now/CVE-2015-4047.md): racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) vi (no CVSS)
- [CVE-2015-4059](https://cve.now/CVE-2015-4059.md): Heap-based buffer overflow in the License Server (LicenseServer.exe) in Wavelink Terminal Emulation (TE) allows remote attackers to execute (no CVSS)
- [CVE-2015-4060](https://cve.now/CVE-2015-4060.md): Heap-based buffer overflow in the TermProxy (WLTermProxyService.exe) service in Wavelink ConnectPro allows remote attackers to execute arbit (no CVSS)
- [CVE-2015-4067](https://cve.now/CVE-2015-4067.md): Integer overflow in the libnv6 module in Dell NetVault Backup before 10.0.5 allows remote attackers to execute arbitrary code via crafted te (no CVSS)
- [CVE-2015-4068](https://cve.now/CVE-2015-4068.md): Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a den (CVSS 9.1, KEV)
- [CVE-2015-4069](https://cve.now/CVE-2015-4069.md): The EdgeServiceImpl web service in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive credentials via a crafted SO (no CVSS)
- [CVE-2015-3904](https://cve.now/CVE-2015-3904.md): Multiple cross-site scripting (XSS) vulnerabilities in roomcloud.php in the Roomcloud plugin before 1.3 for WordPress allow remote attackers (no CVSS)
- [CVE-2015-4137](https://cve.now/CVE-2015-4137.md): SQL injection vulnerability in related.php in Milw0rm Clone Script 1.0 allows remote attackers to execute arbitrary SQL commands via the pro (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-05-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.