# CVEs published 2015-06-16

15 CVEs were published on June 16, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-4374](https://cve.now/CVE-2015-4374.md): Cross-site scripting (XSS) vulnerability in the Webform module before 6.x-3.23, 7.x-3.x before 7.x-3.23, and 7.x-4.x before 7.x-4.5 for Drup (no CVSS)
- [CVE-2015-4398](https://cve.now/CVE-2015-4398.md): Open redirect vulnerability in the Chaos tool suite (ctools) module before 6.x-1.12 and 7.x-1.x before 7.x-1.7 for Drupal allows remote atta (no CVSS)
- [CVE-2015-2804](https://cve.now/CVE-2015-2804.md): The management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400, and 6855 with firmware before 6.6.4.309.R01 and 6. (no CVSS)
- [CVE-2015-2805](https://cve.now/CVE-2015-2805.md): Cross-site request forgery (CSRF) vulnerability in sec/content/sec\_asa\_users\_local\_db\_add.html in the management web interface in Alcatel-Lu (no CVSS)
- [CVE-2015-3010](https://cve.now/CVE-2015-3010.md): ceph-deploy before 1.5.23 uses weak permissions (644) for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive infor (no CVSS, ceph-deploy)
- [CVE-2015-3205](https://cve.now/CVE-2015-3205.md): libmimedir allows remote attackers to execute arbitrary code via a VCF file with two NULL bytes at the end of the file, related to "free" fu (no CVSS)
- [CVE-2015-3395](https://cve.now/CVE-2015-3395.md): The msrle\_decode\_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x b (no CVSS)
- [CVE-2015-4606](https://cve.now/CVE-2015-4606.md): Unrestricted file upload vulnerability in the Job Fair (jobfair) extension before 1.0.1 for TYPO3, when using Apache with mod\_mime, allows r (no CVSS)
- [CVE-2015-4607](https://cve.now/CVE-2015-4607.md): Unrestricted file upload vulnerability in the Frontend User Upload (feupload) extension 0.5.0 and earlier for TYPO3 allows remote attackers (no CVSS)
- [CVE-2015-4608](https://cve.now/CVE-2015-4608.md): Cross-site scripting (XSS) vulnerability in the BE User Log (beko\_beuserlog) extension 1.1.1 and earlier for TYPO3 allows remote authenticat (no CVSS)
- [CVE-2015-4609](https://cve.now/CVE-2015-4609.md): SQL injection vulnerability in the wt\_directory extension before 1.4.2 for TYPO3 allows remote authenticated users to execute arbitrary SQL (no CVSS)
- [CVE-2015-4610](https://cve.now/CVE-2015-4610.md): SQL injection vulnerability in the Store Locator (locator) extension before 3.3.1 for TYPO3 allows remote authenticated users to execute arb (no CVSS)
- [CVE-2015-4611](https://cve.now/CVE-2015-4611.md): SQL injection vulnerability in the Smoelenboek (ncgov\_smoelenboek) extension before 1.0.9 for TYPO3 allows remote authenticated users to exe (no CVSS)
- [CVE-2015-4612](https://cve.now/CVE-2015-4612.md): SQL injection vulnerability in the "FAQ - Frequently Asked Questions" (js\_faq) extension before 1.2.1 for TYPO3 allows remote authenticated (no CVSS)
- [CVE-2015-4613](https://cve.now/CVE-2015-4613.md): SQL injection vulnerability in the backend module in the Developer Log (devlog) extension before 2.11.4 for TYPO3 allows remote editors to e (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-06-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.