# CVEs published 2015-07-06

39 CVEs were published on July 6, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2014-5406](https://cve.now/CVE-2014-5406.md): Hospira LifeCare PCA Infusion System (no CVSS, Hospira LifeCare PCA Infusion System)
- [CVE-2015-1011](https://cve.now/CVE-2015-1011.md): Hospira LifeCare PCA Infusion System before 7.0 has hardcoded credentials, which makes it easier for remote attackers to obtain access via u (no CVSS)
- [CVE-2015-3955](https://cve.now/CVE-2015-3955.md): Stack-based buffer overflow in Hospira LifeCare PCA Infusion System 5.0 and earlier, and possibly other versions, allows remote attackers to (no CVSS)
- [CVE-2015-3957](https://cve.now/CVE-2015-3957.md): Hospira LifeCare PCA Infusion System before 7.0 stores private keys and certificates, which has unspecified impact and attack vectors. (no CVSS)
- [CVE-2015-3958](https://cve.now/CVE-2015-3958.md): Hospira LifeCare PCA Infusion System 5.0 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (for (no CVSS)
- [CVE-2014-3653](https://cve.now/CVE-2014-3653.md): Cross-site scripting (XSS) vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2014-9737](https://cve.now/CVE-2014-9737.md): Open redirect vulnerability in the Language Switcher Dropdown module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to redirect u (no CVSS)
- [CVE-2014-9738](https://cve.now/CVE-2014-9738.md): Multiple cross-site scripting (XSS) vulnerabilities in the Tournament module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated us (no CVSS)
- [CVE-2014-9739](https://cve.now/CVE-2014-9739.md): Cross-site scripting (XSS) vulnerability in the Node Field module 7.x-2.x before 7.x-2.45 for Drupal allows remote authenticated users with (no CVSS)
- [CVE-2014-9740](https://cve.now/CVE-2014-9740.md): Cross-site scripting (XSS) vulnerability in the Rules Link module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with t (no CVSS)
- [CVE-2015-3281](https://cve.now/CVE-2015-3281.md): The buffer\_slow\_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outg (no CVSS)
- [CVE-2015-2126](https://cve.now/CVE-2015-2126.md): Unspecified vulnerability in pppoec in HP HP-UX 11iv2 and 11iv3 allows local users to gain privileges by leveraging setuid permissions. (no CVSS)
- [CVE-2015-4033](https://cve.now/CVE-2015-4033.md): Samsung SBeam allows remote attackers to read arbitrary images by leveraging an NFC connection to access the HTTP server on port 15000. (no CVSS)
- [CVE-2015-4034](https://cve.now/CVE-2015-4034.md): The createFromParcel method in the com.absolute.android.persistence.MethodSpec class in Samsung Galaxy S5s allows remote attackers to execut (no CVSS)
- [CVE-2015-4230](https://cve.now/CVE-2015-4230.md): Memory leak in Cisco Headend System Release allows remote attackers to cause a denial of service (memory consumption) via unspecified vector (no CVSS)
- [CVE-2015-4647](https://cve.now/CVE-2015-4647.md): Multiple stack-based buffer overflows in Ipropsapi in Panasonic Security API (PS-API) ActiveX SDK before 8.10.18 allow remote attackers to e (no CVSS)
- [CVE-2015-4648](https://cve.now/CVE-2015-4648.md): Stack-based buffer overflow in the Ipropsapi.ipropsapiCtrl.1 ActiveX control in ipropsapivideo in Panasonic Security API (PS-API) ActiveX SD (no CVSS)
- [CVE-2015-5371](https://cve.now/CVE-2015-5371.md): The AuthenticationFilter class in SolarWinds Storage Manager allows remote attackers to upload and execute arbitrary scripts via unspecified (no CVSS)
- [CVE-2015-2721](https://cve.now/CVE-2015-2721.md): Mozilla Network Security Services (NSS) before 3.19, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38 (no CVSS)
- [CVE-2015-2722](https://cve.now/CVE-2015-2722.md): Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 an (no CVSS)
- [CVE-2015-2724](https://cve.now/CVE-2015-2724.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1 (no CVSS)
- [CVE-2015-2725](https://cve.now/CVE-2015-2725.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird bef (no CVSS)
- [CVE-2015-2726](https://cve.now/CVE-2015-2726.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0 allow remote attackers to cause a denial of servic (no CVSS)
- [CVE-2015-2727](https://cve.now/CVE-2015-2727.md): Mozilla Firefox 38.0 and Firefox ESR 38.0 allow user-assisted remote attackers to read arbitrary files or execute arbitrary JavaScript code (no CVSS)
- [CVE-2015-2728](https://cve.now/CVE-2015-2728.md): The IndexedDatabaseManager class in the IndexedDB implementation in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x be (no CVSS)
- [CVE-2015-2729](https://cve.now/CVE-2015-2729.md): The AudioParamTimeline::AudioNodeInputValue function in the Web Audio implementation in Mozilla Firefox before 39.0 and Firefox ESR 38.x bef (no CVSS)
- [CVE-2015-2730](https://cve.now/CVE-2015-2730.md): Mozilla Network Security Services (NSS) before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before (no CVSS)
- [CVE-2015-2731](https://cve.now/CVE-2015-2731.md): Use-after-free vulnerability in the CSPService::ShouldLoad function in the microtask implementation in Mozilla Firefox before 39.0, Firefox (no CVSS)
- [CVE-2015-2733](https://cve.now/CVE-2015-2733.md): Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 an (no CVSS)
- [CVE-2015-2734](https://cve.now/CVE-2015-2734.md): The CairoTextureClientD3D9::BorrowDrawTarget function in the Direct3D 9 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x befo (no CVSS)
- [CVE-2015-2735](https://cve.now/CVE-2015-2735.md): nsZipArchive.cpp in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses uni (no CVSS)
- [CVE-2015-2736](https://cve.now/CVE-2015-2736.md): The nsZipArchive::BuildFileList function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird (no CVSS)
- [CVE-2015-2737](https://cve.now/CVE-2015-2737.md): The rx::d3d11::SetBufferData function in the Direct3D 11 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38. (no CVSS)
- [CVE-2015-2738](https://cve.now/CVE-2015-2738.md): The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x be (no CVSS)
- [CVE-2015-2739](https://cve.now/CVE-2015-2739.md): The ArrayBufferBuilder::append function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird b (no CVSS)
- [CVE-2015-2740](https://cve.now/CVE-2015-2740.md): Buffer overflow in the nsXMLHttpRequest::AppendToResponseText function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x (no CVSS)
- [CVE-2015-2741](https://cve.now/CVE-2015-2741.md): Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 do not enforce key pinning upon encountering an X.509 (no CVSS)
- [CVE-2015-2742](https://cve.now/CVE-2015-2742.md): Mozilla Firefox before 39.0 on OS X includes native key press information during the logging of crashes, which allows remote attackers to ob (no CVSS)
- [CVE-2015-2743](https://cve.now/CVE-2015-2743.md): PDF.js in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 enables excessive privileges for internal Worker (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-07-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.