# CVEs published 2015-07-01

17 CVEs were published on July 1, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-5353](https://cve.now/CVE-2015-5353.md): Directory traversal vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to include and execute arbitrary local files via a .. (no CVSS)
- [CVE-2015-5354](https://cve.now/CVE-2015-5354.md): Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites and conduct phishing (no CVSS)
- [CVE-2015-5355](https://cve.now/CVE-2015-5355.md): Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.3.6 allow remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2015-5356](https://cve.now/CVE-2015-5356.md): Cross-site scripting (XSS) vulnerability in admin/filebrowser.php in GetSimple CMS before 3.3.6 allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2014-1750](https://cve.now/CVE-2014-1750.md): Open redirect vulnerability in nokia-mapsplaces.php in the Nokia Maps & Places plugin 1.6.6 for WordPress allows remote attackers to redirec (no CVSS)
- [CVE-2014-1836](https://cve.now/CVE-2014-1836.md): Absolute path traversal vulnerability in htdocs/libraries/image-editor/image-edit.php in ImpressCMS before 1.3.6 allows remote attackers to (no CVSS, impresscms/impresscms)
- [CVE-2015-0848](https://cve.now/CVE-2015-0848.md): Heap-based buffer overflow in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code (no CVSS)
- [CVE-2015-1330](https://cve.now/CVE-2015-1330.md): unattended-upgrades before 0.86.1 does not properly authenticate packages when the (1) force-confold or (2) force-confnew dpkg options are e (no CVSS)
- [CVE-2015-2141](https://cve.now/CVE-2015-2141.md): The InvertibleRWFunction::CalculateInverse function in rw.cpp in libcrypt++ 5.6.2 does not properly blind private key operations for the Rab (no CVSS)
- [CVE-2015-3164](https://cve.now/CVE-2015-3164.md): The authentication setup in XWayland 1.16.x and 1.17.x before 1.17.2 starts the server in non-authenticating mode, which allows local users (no CVSS)
- [CVE-2015-3204](https://cve.now/CVE-2015-3204.md): libreswan 3.9 through 3.12 allows remote attackers to cause a denial of service (daemon restart) via an IKEv1 packet with (1) unassigned bit (no CVSS)
- [CVE-2015-4588](https://cve.now/CVE-2015-4588.md): Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or pos (no CVSS)
- [CVE-2015-4695](https://cve.now/CVE-2015-4695.md): meta.h in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WMF file. (no CVSS)
- [CVE-2015-4696](https://cve.now/CVE-2015-4696.md): Use-after-free vulnerability in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) via a crafted WMF file to the (1 (no CVSS)
- [CVE-2015-1950](https://cve.now/CVE-2015-1950.md): IBM PowerVC Standard Edition 1.2.2.1 through 1.2.2.2 does not require authentication for access to the Python interpreter with nova credenti (no CVSS)
- [CVE-2015-1951](https://cve.now/CVE-2015-1951.md): IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX001, and 7.6.0 before 7.6.0.0 IFIX005 does not prevent caching of (no CVSS)
- [CVE-2015-1967](https://cve.now/CVE-2015-1967.md): MQ Explorer in IBM WebSphere MQ before 8.0.0.3 does not recognize the absence of the compatibility-mode option, which allows remote attacker (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-07-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.