# CVEs published 2015-06-02 19 CVEs were published on June 2, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2014-0999](https://cve.now/CVE-2014-0999.md): Sendio before 7.2.4 includes the session identifier in URLs in emails, which allows remote attackers to obtain sensitive information and hij (no CVSS) - [CVE-2014-8391](https://cve.now/CVE-2014-8391.md): The Web interface in Sendio before 7.2.4 does not properly handle sessions, which allows remote authenticated users to obtain sensitive info (no CVSS) - [CVE-2015-0759](https://cve.now/CVE-2015-0759.md): Cross-site request forgery (CSRF) vulnerability in Cisco Headend Digital Broadband Delivery System allows remote attackers to hijack the aut (no CVSS) - [CVE-2015-0850](https://cve.now/CVE-2015-0850.md): The Git plugin for FusionForge before 6.0rc4 allows remote attackers to execute arbitrary code via an unspecified parameter when creating a (no CVSS) - [CVE-2015-1945](https://cve.now/CVE-2015-1945.md): Unspecified vulnerability in the Reference Data Management component in IBM InfoSphere Master Data Management 10.1, 11.0, 11.3 before FP3, a (no CVSS) - [CVE-2015-2278](https://cve.now/CVE-2015-2278.md): The LZH decompression implementation (CsObjectInt::BuildHufTree function in vpa108csulzh.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Applicatio (no CVSS) - [CVE-2015-2282](https://cve.now/CVE-2015-2282.md): Stack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp) in SAP MaxDB 7.5 (no CVSS) - [CVE-2015-2944](https://cve.now/CVE-2015-2944.md): Multiple cross-site scripting (XSS) vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remot (no CVSS, org.apache.sling:org.apache.sling.api · org.apache.sling:or…) - [CVE-2015-3982](https://cve.now/CVE-2015-3982.md): The session.flush function in the cached\_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote at (no CVSS, django) - [CVE-2015-4050](https://cve.now/CVE-2015-4050.md): FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through (no CVSS, symfony/http-kernel · symfony/symfony) - [CVE-2015-4094](https://cve.now/CVE-2015-4094.md): The Thycotic Password Manager Secret Server application through 2.3 for iOS does not verify X.509 certificates from SSL servers, which allow (no CVSS) - [CVE-2015-4155](https://cve.now/CVE-2015-4155.md): GNU Parallel before 20150422, when using (1) --pipe, (2) --tmux, (3) --cat, (4) --fifo, or (5) --compress, allows local users to write to ar (no CVSS) - [CVE-2015-4156](https://cve.now/CVE-2015-4156.md): GNU Parallel before 20150522 (Nepal), when using (1) --cat or (2) --fifo with --sshlogin, allows local users to write to arbitrary files via (no CVSS) - [CVE-2015-4157](https://cve.now/CVE-2015-4157.md): SAP Content Server allows remote attackers to cause a denial of service (service termination) via unspecified vectors, aka SAP Security Note (no CVSS) - [CVE-2015-4158](https://cve.now/CVE-2015-4158.md): SAP ABAP & Java Server allows remote attackers to cause a denial of service (service termination) via unspecified vectors, aka SAP Security (no CVSS) - [CVE-2015-4159](https://cve.now/CVE-2015-4159.md): SQL injection vulnerability in SAP HANA Web-based Development Workbench allows remote attackers to execute arbitrary SQL commands via unspec (no CVSS) - [CVE-2015-4160](https://cve.now/CVE-2015-4160.md): SQL injection vulnerability in SAP ASE Database Platform allows remote attackers to execute arbitrary SQL commands via unspecified vectors, (no CVSS) - [CVE-2015-4161](https://cve.now/CVE-2015-4161.md): SAP Afaria does not properly restrict access to unspecified functionality, which allows remote attackers to obtain sensitive information, ga (no CVSS) - [CVE-2015-4162](https://cve.now/CVE-2015-4162.md): XML external entity (XXE) vulnerability in the management interface in PAN-OS before 5.0.16, 6.x before 6.0.8, and 6.1.x before 6.1.4 allows (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-06-02 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.