# CVEs published 2015-06-24

27 CVEs were published on June 24, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2013-7397](https://cve.now/CVE-2013-7397.md): Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a tru (no CVSS, com.ning:async-http-client)
- [CVE-2013-7398](https://cve.now/CVE-2013-7398.md): main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require (no CVSS, com.ning:async-http-client)
- [CVE-2015-2169](https://cve.now/CVE-2015-2169.md): Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2015-3900](https://cve.now/CVE-2015-3900.md): RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API req (no CVSS, rubygems-update)
- [CVE-2015-4413](https://cve.now/CVE-2015-4413.md): Cross-site scripting (XSS) vulnerability in the new\_fb\_sign\_button function in nextend-facebook-connect.php in Nextend Facebook Connect plug (no CVSS)
- [CVE-2015-5061](https://cve.now/CVE-2015-5061.md): Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 and earlier allows remote authenticated us (no CVSS)
- [CVE-2015-5062](https://cve.now/CVE-2015-5062.md): Open redirect vulnerability in SilverStripe CMS & Framework 3.1.13 allows remote attackers to redirect users to arbitrary web sites and cond (no CVSS, silverstripe/cms · silverstripe/framework)
- [CVE-2015-5063](https://cve.now/CVE-2015-5063.md): Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework 3.1.13 allow remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2015-5064](https://cve.now/CVE-2015-5064.md): Multiple cross-site scripting (XSS) vulnerabilities in MySql Lite Administrator (mysql-lite-administrator) beta-1 allow remote attackers to (no CVSS)
- [CVE-2015-5065](https://cve.now/CVE-2015-5065.md): Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plug (no CVSS)
- [CVE-2015-5066](https://cve.now/CVE-2015-5066.md): Multiple cross-site scripting (XSS) vulnerabilities in the MetalGenix GeniXCMS 0.0.3 allow remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2015-5067](https://cve.now/CVE-2015-5067.md): The (1) Cross-System Tools and (2) Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, which allows remote attackers to obt (no CVSS)
- [CVE-2015-5068](https://cve.now/CVE-2015-5068.md): XML external entity (XXE) vulnerability in SAP Mobile Platform 3 allows remote attackers to read arbitrary files or possibly have other unsp (no CVSS)
- [CVE-2014-4875](https://cve.now/CVE-2014-4875.md): CreateBossCredentials.jar in Toshiba CHEC before 6.6 build 4014 and 6.7 before build 4329 contains a hardcoded AES key, which allows attacke (no CVSS)
- [CVE-2015-2308](https://cve.now/CVE-2015-2308.md): Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x bef (no CVSS, symfony/symfony · symfony/http-kernel)
- [CVE-2015-3109](https://cve.now/CVE-2015-3109.md): Adobe Photoshop CC before 16.0 (aka 2015.0.0) allows attackers to execute arbitrary code or cause a denial of service (memory corruption) vi (no CVSS)
- [CVE-2015-3110](https://cve.now/CVE-2015-3110.md): Integer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attackers to execute arbitrary code (no CVSS)
- [CVE-2015-3111](https://cve.now/CVE-2015-3111.md): Heap-based buffer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attackers to execute arbi (no CVSS)
- [CVE-2015-3112](https://cve.now/CVE-2015-3112.md): Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allow attackers to execute arbitrary code or cause a denial of (no CVSS)
- [CVE-2015-4208](https://cve.now/CVE-2015-4208.md): Cisco WebEx Meeting Center does not properly restrict the content of URLs in GET requests, which allows remote attackers to obtain sensitive (no CVSS)
- [CVE-2015-4211](https://cve.now/CVE-2015-4211.md): Cisco AnyConnect Secure Mobility Client 3.1(60) on Windows does not properly validate pathnames, which allows local users to gain privileges (no CVSS)
- [CVE-2015-4212](https://cve.now/CVE-2015-4212.md): Cisco WebEx Meeting Center allows remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by discovering c (no CVSS)
- [CVE-2015-4213](https://cve.now/CVE-2015-4213.md): Cisco NX-OS 1.1(1g) on Nexus 9000 devices allows remote authenticated users to discover cleartext passwords by leveraging the existence of a (no CVSS)
- [CVE-2015-4214](https://cve.now/CVE-2015-4214.md): Cisco Unified MeetingPlace 8.6(1.2) and 8.6(1.9) allows remote authenticated users to discover cleartext passwords by reading HTML source co (no CVSS)
- [CVE-2015-4215](https://cve.now/CVE-2015-4215.md): Cisco Wireless LAN Controller (WLC) devices with software 7.5(102.0) and 7.6(1.62) allow remote attackers to cause a denial of service (devi (no CVSS)
- [CVE-2015-4218](https://cve.now/CVE-2015-4218.md): The web-based user interface in Cisco Jabber through 9.6(3) and 9.7 through 9.7(5) on Windows allows remote attackers to obtain sensitive in (no CVSS)
- [CVE-2015-4219](https://cve.now/CVE-2015-4219.md): Cisco Secure Access Control System before 5.4(0.46.2) and 5.5 before 5.5(0.46) and Cisco Identity Services Engine 1.0(4.573) do not properly (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-06-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.