# CVEs published 2015-06-15

67 CVEs were published on June 15, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-3209](https://cve.now/CVE-2015-3209.md): Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTAT (no CVSS)
- [CVE-2015-4093](https://cve.now/CVE-2015-4093.md): Cross-site scripting (XSS) vulnerability in Elasticsearch Kibana 4.x before 4.0.3 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2015-4118](https://cve.now/CVE-2015-4118.md): SQL injection vulnerability in monitor/show\_sys\_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated users with monitor permi (no CVSS)
- [CVE-2015-4119](https://cve.now/CVE-2015-4119.md): Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7 allow remote attackers to hijack the authentication (no CVSS)
- [CVE-2015-4141](https://cve.now/CVE-2015-4141.md): The WPS UPnP function in hostapd, when using WPS AP, and wpa\_supplicant, when using WPS external registrar (ER), 0.7.0 through 2.4 allows re (no CVSS)
- [CVE-2015-4142](https://cve.now/CVE-2015-4142.md): Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa\_supplicant 0.7.0 through 2.4, when used for AP mode ML (no CVSS)
- [CVE-2015-4143](https://cve.now/CVE-2015-4143.md): The EAP-pwd server and peer implementation in hostapd and wpa\_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of servic (no CVSS)
- [CVE-2015-4144](https://cve.now/CVE-2015-4144.md): The EAP-pwd server and peer implementation in hostapd and wpa\_supplicant 1.0 through 2.4 does not validate that a message is long enough to (no CVSS)
- [CVE-2015-4145](https://cve.now/CVE-2015-4145.md): The EAP-pwd server and peer implementation in hostapd and wpa\_supplicant 1.0 through 2.4 does not validate a fragment is already being proce (no CVSS)
- [CVE-2015-4146](https://cve.now/CVE-2015-4146.md): The EAP-pwd peer implementation in hostapd and wpa\_supplicant 1.0 through 2.4 does not clear the L (Length) and M (More) flags before determ (no CVSS)
- [CVE-2015-4152](https://cve.now/CVE-2015-4152.md): Directory traversal vulnerability in the file output plugin in Elasticsearch Logstash before 1.4.3 allows remote attackers to write to arbit (no CVSS)
- [CVE-2015-4163](https://cve.now/CVE-2015-4163.md): GNTTABOP\_swap\_grant\_ref in Xen 4.2 through 4.5 does not check the grant table operation version, which allows local guest domains to cause a (no CVSS)
- [CVE-2015-4164](https://cve.now/CVE-2015-4164.md): The compat\_iret function in Xen 3.1 through 4.5 iterates the wrong way through a loop, which allows local 32-bit PV guest administrators to (no CVSS)
- [CVE-2015-4559](https://cve.now/CVE-2015-4559.md): Cross-site scripting (XSS) vulnerability in the product deployment feature in the Java core web services in Intel McAfee ePolicy Orchestrato (no CVSS)
- [CVE-2015-4344](https://cve.now/CVE-2015-4344.md): The Services Basic Authentication module 7.x-1.x through 7.x-1.3 for Drupal allows remote attackers to bypass intended resource restrictions (no CVSS)
- [CVE-2015-4345](https://cve.now/CVE-2015-4345.md): The RESTWS Basic Auth submodule in the RESTful Web Services module 7.x-1.x before 7.x-1.5 and 7.x-2.x before 7.x-2.3 for Drupal caches pages (no CVSS)
- [CVE-2015-4346](https://cve.now/CVE-2015-4346.md): Cross-site scripting (XSS) vulnerability in the SMS Framework module 6.x-1.x before 6.x-1.1 for Drupal, when the "Send to phone" submodule i (no CVSS)
- [CVE-2015-4347](https://cve.now/CVE-2015-4347.md): Cross-site scripting (XSS) vulnerability in the inLinks Integration module for Drupal allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2015-4348](https://cve.now/CVE-2015-4348.md): SQL injection vulnerability in the Spider Contacts module for Drupal allows remote authenticated users with the "access Spider Contacts cate (no CVSS)
- [CVE-2015-4349](https://cve.now/CVE-2015-4349.md): Cross-site request forgery (CSRF) vulnerability in the Spider Contacts module for Drupal allows remote attackers to hijack the authenticatio (no CVSS)
- [CVE-2015-4350](https://cve.now/CVE-2015-4350.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Spider Catalog module for Drupal allow remote attackers to hijack the auth (no CVSS)
- [CVE-2015-4351](https://cve.now/CVE-2015-4351.md): The Spider Video Player module for Drupal allows remote authenticated users with the "access Spider Video Player administration" permission (no CVSS)
- [CVE-2015-4352](https://cve.now/CVE-2015-4352.md): Cross-site request forgery (CSRF) vulnerability in the Spider Video Player module for Drupal allows remote attackers to hijack the authentic (no CVSS)
- [CVE-2015-4353](https://cve.now/CVE-2015-4353.md): Cross-site request forgery (CSRF) vulnerability in the Custom Sitemap module for Drupal allows remote attackers to hijack the authentication (no CVSS)
- [CVE-2015-4354](https://cve.now/CVE-2015-4354.md): Cross-site scripting (XSS) vulnerability in the Ubercart Webform Integration module before 6.x-1.8 and 7.x before 7.x-2.4 for Drupal allows (no CVSS)
- [CVE-2015-4355](https://cve.now/CVE-2015-4355.md): Cross-site request forgery (CSRF) vulnerability in the Watchdog Aggregator module for Drupal allows remote attackers to hijack the authentic (no CVSS)
- [CVE-2015-4356](https://cve.now/CVE-2015-4356.md): Cross-site scripting (XSS) vulnerability in the view-based webform results table in the Webform module 7.x-4.x before 7.x-4.4 for Drupal all (no CVSS)
- [CVE-2015-4357](https://cve.now/CVE-2015-4357.md): Cross-site scripting (XSS) vulnerability in the Webform module before 6.x-3.22, 7.x-3.x before 7.x-3.22, and 7.x-4.x before 7.x-4.4 for Drup (no CVSS)
- [CVE-2015-4358](https://cve.now/CVE-2015-4358.md): Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Ubercart Discount Coupons module 6.x-1.x before 6.x-1.8 (no CVSS)
- [CVE-2015-4359](https://cve.now/CVE-2015-4359.md): Multiple cross-site scripting (XSS) vulnerabilities in the Registration codes module before 6.x-1.6, 6.x-2.x before 6.x-2.8, and 7.x-1.x bef (no CVSS)
- [CVE-2015-4360](https://cve.now/CVE-2015-4360.md): Cross-site request forgery (CSRF) vulnerability in the Registration codes module before 6.x-1.6, 6.x-2.x before 6.x-2.8, and 7.x-1.x before (no CVSS)
- [CVE-2015-4361](https://cve.now/CVE-2015-4361.md): Cross-site request forgery (CSRF) vulnerability in the Registration codes module before 6.x-1.6 for Drupal allows remote attackers to hijack (no CVSS)
- [CVE-2015-4362](https://cve.now/CVE-2015-4362.md): Cross-site request forgery (CSRF) vulnerability in tracking\_code.admin.inc in the Tracking Code module 7.x-1.x before 7.x-1.6 for Drupal all (no CVSS)
- [CVE-2015-4363](https://cve.now/CVE-2015-4363.md): Open redirect vulnerability in the finder\_form\_goto function in the Finder module for Drupal allows remote attackers to redirect users to ar (no CVSS)
- [CVE-2015-4364](https://cve.now/CVE-2015-4364.md): Multiple cross-site request forgery (CSRF) vulnerabilities in includes/campaignmonitor\_lists.admin.inc in the Campaign Monitor module 7.x-1. (no CVSS)
- [CVE-2015-4365](https://cve.now/CVE-2015-4365.md): Cross-site scripting (XSS) vulnerability in the Taxonomy Accordion module for Drupal allows remote authenticated users with certain permissi (no CVSS)
- [CVE-2015-4366](https://cve.now/CVE-2015-4366.md): Cross-site scripting (XSS) vulnerability in the Mover module 6.x-1.0 for Drupal allows remote authenticated users with certain permissions t (no CVSS)
- [CVE-2015-4367](https://cve.now/CVE-2015-4367.md): Cross-site scripting (XSS) vulnerability in the Simple Subscription module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remot (no CVSS)
- [CVE-2015-4368](https://cve.now/CVE-2015-4368.md): The Commerce Ogone module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to complete the checkout for an order without paying via (no CVSS)
- [CVE-2015-4369](https://cve.now/CVE-2015-4369.md): Cross-site scripting (XSS) vulnerability in the Trick Question module before 6.x-1.5 and 7.x-1.x before 7.x-1.5 for Drupal allows remote aut (no CVSS)
- [CVE-2015-4370](https://cve.now/CVE-2015-4370.md): Cross-site scripting (XSS) vulnerability in the Site Documentation module before 6.x-1.5 for Drupal allows remote authenticated users with c (no CVSS)
- [CVE-2015-4371](https://cve.now/CVE-2015-4371.md): Open redirect vulnerability in the Perfecto module before 7.x-1.2 for Drupal allows remote attackers to redirect users to arbitrary web site (no CVSS)
- [CVE-2015-4372](https://cve.now/CVE-2015-4372.md): Cross-site scripting (XSS) vulnerability in the Image Title module before 7.x-1.1 for Drupal allows remote authenticated users with certain (no CVSS)
- [CVE-2015-4373](https://cve.now/CVE-2015-4373.md): Cross-site scripting (XSS) vulnerability in the OG tabs module before 7.x-1.1 for Drupal allows remote authenticated users with certain perm (no CVSS)
- [CVE-2015-4375](https://cve.now/CVE-2015-4375.md): The Chaos tool suite (ctools) module 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to obtain sensitive node titles via (1) an au (no CVSS)
- [CVE-2015-4376](https://cve.now/CVE-2015-4376.md): Cross-site scripting (XSS) vulnerability in the Profile2 Privacy module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users (no CVSS)
- [CVE-2015-4377](https://cve.now/CVE-2015-4377.md): Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Petition module 6.x-1.x before 6.x-1.3 for Drupal allows (no CVSS)
- [CVE-2015-4378](https://cve.now/CVE-2015-4378.md): Cross-site scripting (XSS) vulnerability in the Crumbs module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with the " (no CVSS)
- [CVE-2015-4379](https://cve.now/CVE-2015-4379.md): Cross-site request forgery (CSRF) vulnerability in the Webform Multiple File Upload module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 (no CVSS)
- [CVE-2015-4380](https://cve.now/CVE-2015-4380.md): Cross-site scripting (XSS) vulnerability in the Linear Case module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users with (no CVSS)
- [CVE-2015-4381](https://cve.now/CVE-2015-4381.md): Cross-site scripting (XSS) vulnerability in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote au (no CVSS)
- [CVE-2015-4382](https://cve.now/CVE-2015-4382.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupa (no CVSS)
- [CVE-2015-4383](https://cve.now/CVE-2015-4383.md): Cross-site request forgery (CSRF) vulnerability in the Decisions module for Drupal allows remote attackers to hijack the authentication of a (no CVSS)
- [CVE-2015-4384](https://cve.now/CVE-2015-4384.md): Cross-site scripting (XSS) vulnerability in the Ubercart Webform Checkout Pane module 6.x-3.x before 6.x-3.10 and 7.x-3.x before 7.x-3.11 fo (no CVSS)
- [CVE-2015-4385](https://cve.now/CVE-2015-4385.md): Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Imagefield Info module 7.x-1.x before 7.x-1.2 for Drupal (no CVSS)
- [CVE-2015-4386](https://cve.now/CVE-2015-4386.md): Multiple cross-site scripting (XSS) vulnerabilities in unspecified administration pages in the EntityBulkDelete module 7.x-1.0 for Drupal al (no CVSS)
- [CVE-2015-4387](https://cve.now/CVE-2015-4387.md): Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Password Policy module 6.x-1.x before 6.x-1.11 and 7.x-1 (no CVSS)
- [CVE-2015-4388](https://cve.now/CVE-2015-4388.md): Cross-site scripting (XSS) vulnerability in the Current Search Links module 7.x-1.x before 7.x-1.1 for Drupal, when the "Append the keywords (no CVSS)
- [CVE-2015-4389](https://cve.now/CVE-2015-4389.md): The Open Graph Importer (og\_tag\_importer) 7.x-1.x for Drupal does not properly check the create permission for content types created during (no CVSS)
- [CVE-2015-4390](https://cve.now/CVE-2015-4390.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the User Import module 6.x-4.x before 6.x-4.4 and 7.x-2.x before 7.x-2.3 for D (no CVSS)
- [CVE-2015-4391](https://cve.now/CVE-2015-4391.md): Cross-site request forgery (CSRF) vulnerability in the CiviCRM private report module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for D (no CVSS)
- [CVE-2015-4392](https://cve.now/CVE-2015-4392.md): Cross-site scripting (XSS) vulnerability in the Display Suite module 7.x-2.7 for Drupal allows remote authenticated users to inject arbitrar (no CVSS)
- [CVE-2015-4393](https://cve.now/CVE-2015-4393.md): The resource/endpoint for uploading files in the Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote authenticated users with t (no CVSS)
- [CVE-2015-4394](https://cve.now/CVE-2015-4394.md): The Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote attackers to bypass the field\_access restriction and obtain sensitive p (no CVSS)
- [CVE-2015-4395](https://cve.now/CVE-2015-4395.md): The HybridAuth Social Login module 7.x-2.x before 7.x-2.10 for Drupal stores passwords in plaintext when the "Ask user for a password when r (no CVSS)
- [CVE-2015-4396](https://cve.now/CVE-2015-4396.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Keyword Research module 6.x-1.x before 6.x-1.2 for Drupal allow remote att (no CVSS)
- [CVE-2015-4397](https://cve.now/CVE-2015-4397.md): Cross-site request forgery (CSRF) vulnerability in the Node Template module for Drupal allows remote attackers to hijack the authentication (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-06-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.