# CVEs published 2015-06-22 10 CVEs were published on June 22, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2015-3231](https://cve.now/CVE-2015-3231.md): The Render cache system in Drupal 7.x before 7.38, when used to cache content by user role, allows remote authenticated users to obtain priv (no CVSS) - [CVE-2015-3232](https://cve.now/CVE-2015-3232.md): Open redirect vulnerability in the Field UI module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web site (no CVSS) - [CVE-2015-3233](https://cve.now/CVE-2015-3233.md): Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites (no CVSS) - [CVE-2015-3234](https://cve.now/CVE-2015-3234.md): The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an O (no CVSS) - [CVE-2015-3236](https://cve.now/CVE-2015-3236.md): cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl\_e (no CVSS) - [CVE-2015-3237](https://cve.now/CVE-2015-3237.md): The smb\_request\_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memo (no CVSS) - [CVE-2015-4590](https://cve.now/CVE-2015-4590.md): The extractFrom function in Internals/QuotedString.cpp in Arduino JSON before 4.5 allows remote attackers to cause a denial of service (cras (no CVSS) - [CVE-2015-4713](https://cve.now/CVE-2015-4713.md): SQL injection vulnerability in ApPHP Hotel Site 3.x.x allows remote editors to execute arbitrary SQL commands via the pid parameter to index (no CVSS) - [CVE-2015-4714](https://cve.now/CVE-2015-4714.md): Cross-site scripting (XSS) vulnerability in the DreamBox DM500-S allows remote attackers to inject arbitrary web script or HTML via the mode (no CVSS) - [CVE-2015-0526](https://cve.now/CVE-2015-0526.md): Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Validation Manager (RVM) 3.2 before build 201 allow remote attackers to injec (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-06-22 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.