# CVEs published 2015-06-28 25 CVEs were published on June 28, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2014-4768](https://cve.now/CVE-2014-4768.md): IBM Unified Extensible Firmware Interface (UEFI) on Flex System x880 X6, System x3850 X6, and System x3950 X6 devices allows remote authenti (no CVSS) - [CVE-2015-0115](https://cve.now/CVE-2015-0115.md): Cross-site request forgery (CSRF) vulnerability in IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1 (no CVSS) - [CVE-2015-0116](https://cve.now/CVE-2015-0116.md): IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, an (no CVSS) - [CVE-2015-0118](https://cve.now/CVE-2015-0118.md): IBM WebSphere Message Broker Toolkit 7 before 7007 IF2 and 8 before 8005 IF1 and Integration Toolkit 9 before 9003 IF1 are distributed with (no CVSS) - [CVE-2015-0126](https://cve.now/CVE-2015-0126.md): IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, an (no CVSS) - [CVE-2015-0127](https://cve.now/CVE-2015-0127.md): IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, an (no CVSS) - [CVE-2015-0131](https://cve.now/CVE-2015-0131.md): Cross-site scripting (XSS) vulnerability in IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 (no CVSS) - [CVE-2014-9230](https://cve.now/CVE-2014-9230.md): Cross-site scripting (XSS) vulnerability in the administration console in the Enforce Server in Symantec Data Loss Prevention (DLP) before 1 (no CVSS) - [CVE-2015-0549](https://cve.now/CVE-2015-0549.md): Cross-site scripting (XSS) vulnerability in EMC Documentum D2 before 4.5 allows remote authenticated users to inject arbitrary web script or (no CVSS) - [CVE-2015-0550](https://cve.now/CVE-2015-0550.md): Directory traversal vulnerability in EMC Documentum Thumbnail Server 6.7SP1 before P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, a (no CVSS) - [CVE-2015-1485](https://cve.now/CVE-2015-1485.md): Cross-site request forgery (CSRF) vulnerability in the administration console in the Enforce Server in Symantec Data Loss Prevention (DLP) b (no CVSS) - [CVE-2015-2965](https://cve.now/CVE-2015-2965.md): Directory traversal vulnerability in osCommerce Japanese 2.2ms1j-R8 and earlier allows remote authenticated administrators to read arbitrary (no CVSS) - [CVE-2015-1959](https://cve.now/CVE-2015-1959.md): IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, a (no CVSS) - [CVE-2015-1972](https://cve.now/CVE-2015-1972.md): IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, a (no CVSS) - [CVE-2015-1974](https://cve.now/CVE-2015-1974.md): The web administration tool in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before i (no CVSS) - [CVE-2015-1978](https://cve.now/CVE-2015-1978.md): Cross-site scripting (XSS) vulnerability in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, (no CVSS) - [CVE-2015-2019](https://cve.now/CVE-2015-2019.md): IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, a (no CVSS) - [CVE-2015-0173](https://cve.now/CVE-2015-0173.md): The HTTP connection-management functionality in Internet Pass-Thru (IPT) before 2.1.0.2 in IBM WebSphere MQ, when HTTPS is disabled, does no (no CVSS) - [CVE-2015-1884](https://cve.now/CVE-2015-1884.md): Directory traversal vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, (no CVSS) - [CVE-2015-1901](https://cve.now/CVE-2015-1901.md): The installer in IBM InfoSphere Information Server 8.5 through 11.3 before 11.3.1.2 allows local users to obtain sensitive information via u (no CVSS) - [CVE-2015-1981](https://cve.now/CVE-2015-1981.md): Cross-site scripting (XSS) vulnerability in the web server in IBM Domino 8.5.x before 8.5.3 FP6 IF8 and 9.x before 9.0.1 FP4, when Webmail i (no CVSS) - [CVE-2015-5078](https://cve.now/CVE-2015-5078.md): SQL injection vulnerability in the insert function in application/controllers/admin/dataentry.php in LimeSurvey 2.06+ allows remote authenti (no CVSS) - [CVE-2014-6198](https://cve.now/CVE-2014-6198.md): Cross-site request forgery (CSRF) vulnerability in IBM Security Network Protection 5.3 before 5.3.1 allows remote attackers to hijack the au (no CVSS) - [CVE-2015-0989](https://cve.now/CVE-2015-0989.md): PACTware 4.1 SP3 allows remote attackers to cause a denial of service (application crash) via a crafted file that triggers an internal error (no CVSS) - [CVE-2015-4174](https://cve.now/CVE-2015-4174.md): Cross-site scripting (XSS) vulnerability in the integrated web server on the Siemens Climatix BACnet/IP communication module with firmware b (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-06-28 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.