# CVEs published 2015-06-09 26 CVEs were published on June 9, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2015-2783](https://cve.now/CVE-2015-2783.md): ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information fr (no CVSS) - [CVE-2015-3307](https://cve.now/CVE-2015-3307.md): The phar\_parse\_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attacker (no CVSS) - [CVE-2015-3329](https://cve.now/CVE-2015-3329.md): Multiple stack-based buffer overflows in the phar\_set\_inode function in phar\_internal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x (no CVSS) - [CVE-2015-3330](https://cve.now/CVE-2015-3330.md): The php\_handler function in sapi/apache2handler/sapi\_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the A (no CVSS) - [CVE-2015-4021](https://cve.now/CVE-2015-4021.md): The phar\_parse\_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the (no CVSS) - [CVE-2015-4022](https://cve.now/CVE-2015-4022.md): Integer overflow in the ftp\_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remot (no CVSS) - [CVE-2015-4024](https://cve.now/CVE-2015-4024.md): Algorithmic complexity vulnerability in the multipart\_buffer\_headers function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, a (no CVSS) - [CVE-2015-4025](https://cve.now/CVE-2015-4025.md): PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \\x00 character in certain situations (no CVSS) - [CVE-2015-4026](https://cve.now/CVE-2015-4026.md): The pcntl\_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \\x0 (no CVSS) - [CVE-2015-4147](https://cve.now/CVE-2015-4147.md): The SoapClient::\_\_call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that \_\_de (no CVSS) - [CVE-2015-4148](https://cve.now/CVE-2015-4148.md): The do\_soap\_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri (no CVSS) - [CVE-2014-7872](https://cve.now/CVE-2014-7872.md): Comodo GeekBuddy before 4.18.121 does not restrict access to the VNC server, which allows local users to gain privileges by connecting to th (no CVSS) - [CVE-2015-3200](https://cve.now/CVE-2015-3200.md): mod\_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a (no CVSS) - [CVE-2015-3436](https://cve.now/CVE-2015-3436.md): provider/server/ECServer.cpp in Zarafa Collaboration Platform (ZCP) before 7.1.13 and 7.2.x before 7.2.1 allows local users to write to arbi (no CVSS) - [CVE-2015-3624](https://cve.now/CVE-2015-3624.md): Cross-site request forgery (CSRF) vulnerability in Test/WorkArea/DmsMenu/menuActions/MenuActions.aspx in Ektron Content Management System (C (no CVSS) - [CVE-2015-3648](https://cve.now/CVE-2015-3648.md): Directory traversal vulnerability in pages/setup.php in Montala Limited ResourceSpace before 7.2.6727 allows remote attackers to include and (no CVSS) - [CVE-2015-4010](https://cve.now/CVE-2015-4010.md): Cross-site request forgery (CSRF) vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows remote attackers to hij (no CVSS) - [CVE-2015-4080](https://cve.now/CVE-2015-4080.md): The Kankun Smart Socket device and mobile application uses a hardcoded AES 256 bit key, which makes it easier for remote attackers to (1) ob (no CVSS) - [CVE-2015-4109](https://cve.now/CVE-2015-4109.md): Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin before 1.5.16 for WordPress allow remote attackers to (no CVSS) - [CVE-2015-4335](https://cve.now/CVE-2015-4335.md): Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command. (no CVSS) - [CVE-2015-4427](https://cve.now/CVE-2015-4427.md): Multiple cross-site scripting (XSS) vulnerabilities in Test/WorkArea/workarea.aspx in Ektron Content Management System (CMS) before 9.10 SP1 (no CVSS) - [CVE-2014-9284](https://cve.now/CVE-2014-9284.md): The Buffalo WHR-1166DHP 1.60 and earlier, WSR-600DHP 1.60 and earlier, WHR-600D 1.60 and earlier, WHR-300HP2 1.60 and earlier, WMR-300 1.60 (no CVSS) - [CVE-2015-2959](https://cve.now/CVE-2015-2959.md): Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensi (no CVSS) - [CVE-2015-2960](https://cve.now/CVE-2015-2960.md): Cross-site scripting (XSS) vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to inject arbitrary web sc (no CVSS) - [CVE-2015-2961](https://cve.now/CVE-2015-2961.md): Cross-site request forgery (CSRF) vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to hijack the authe (no CVSS) - [CVE-2015-4418](https://cve.now/CVE-2015-4418.md): Zoho NetFlow Analyzer build 10250 and earlier does not have an off autocomplete attribute for a password field, which makes it easier for re (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-06-09 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.