# CVEs published 2015-07-08

22 CVEs were published on July 8, 2015: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2015-4614](https://cve.now/CVE-2015-4614.md): Multiple SQL injection vulnerabilities in includes/Function.php in the Easy2Map plugin before 1.2.5 for WordPress allow remote attackers to (no CVSS)
- [CVE-2015-4616](https://cve.now/CVE-2015-4616.md): Directory traversal vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.2.5 for WordPress allows remote attackers (no CVSS)
- [CVE-2015-5460](https://cve.now/CVE-2015-5460.md): Cross-site scripting (XSS) vulnerability in app/views/events/\_menu.html.erb in Snorby 2.6.2 allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2015-5461](https://cve.now/CVE-2015-5461.md): Open redirect vulnerability in the Redirect function in stageshow\_redirect.php in the StageShow plugin before 5.0.9 for WordPress allows rem (no CVSS)
- [CVE-2014-8175](https://cve.now/CVE-2014-8175.md): Red Hat JBoss Fuse before 6.2.0 allows remote authenticated users to bypass intended restrictions and access the HawtIO console by leveragin (no CVSS)
- [CVE-2014-9741](https://cve.now/CVE-2014-9741.md): Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Desktop, ArcGIS for Engine, and ArcGIS for Server 10.2.2 and earlier (no CVSS)
- [CVE-2015-1796](https://cve.now/CVE-2015-1796.md): The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 creden (no CVSS, org.opensaml:opensaml · edu.internet2.middleware:shibboleth…)
- [CVE-2015-5452](https://cve.now/CVE-2015-5452.md): SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2015-5453](https://cve.now/CVE-2015-5453.md): Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell metacharacters in t (no CVSS)
- [CVE-2015-5454](https://cve.now/CVE-2015-5454.md): Cross-site scripting (XSS) vulnerability in Nucleus CMS allows remote attackers to inject arbitrary web script or HTML via the title paramet (no CVSS)
- [CVE-2015-5455](https://cve.now/CVE-2015-5455.md): Cross-site scripting (XSS) vulnerability in X-Cart 4.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unsp (no CVSS)
- [CVE-2015-5456](https://cve.now/CVE-2015-5456.md): Cross-site scripting (XSS) vulnerability in the form method in modules/formclass.php in PivotX before 2.3.11 allows remote attackers to inje (no CVSS)
- [CVE-2015-5457](https://cve.now/CVE-2015-5457.md): PivotX before 2.3.11 does not validate the new file extension when renaming a file with multiple extensions, which allows remote attackers t (no CVSS)
- [CVE-2015-5458](https://cve.now/CVE-2015-5458.md): Session fixation vulnerability in fileupload.php in PivotX before 2.3.11 allows remote attackers to hijack web sessions via the sess paramet (no CVSS)
- [CVE-2015-5459](https://cve.now/CVE-2015-5459.md): SQL injection vulnerability in the AdvanceSearch.class in AdventNetPassTrix.jar in ManageEngine Password Manager Pro (PMP) before 8.1 Build (no CVSS)
- [CVE-2015-2866](https://cve.now/CVE-2015-2866.md): SQL injection vulnerability on the Grandstream GXV3611\_HD camera with firmware before 1.0.3.9 beta allows remote attackers to execute arbitr (no CVSS)
- [CVE-2015-4240](https://cve.now/CVE-2015-4240.md): Cisco IP Communicator 8.6(4) allows remote attackers to cause a denial of service (service outage) via an unspecified URL in a GET request, (no CVSS)
- [CVE-2015-4241](https://cve.now/CVE-2015-4241.md): Cisco Adaptive Security Appliance (ASA) Software 9.3(2) allows remote attackers to cause a denial of service (system reload) by sending craf (no CVSS)
- [CVE-2015-4242](https://cve.now/CVE-2015-4242.md): Cross-site request forgery (CSRF) vulnerability in Cisco FireSIGHT System Software 5.4.1.2 and 6.0.0 in FireSIGHT Management Center allows r (no CVSS)
- [CVE-2015-4243](https://cve.now/CVE-2015-4243.md): The PPPoE establishment implementation in Cisco IOS XE 3.5.0S on ASR 1000 devices allows remote attackers to cause a denial of service (devi (no CVSS)
- [CVE-2015-4620](https://cve.now/CVE-2015-4620.md): name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DN (no CVSS)
- [CVE-2015-5119](https://cve.now/CVE-2015-5119.md): Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 (CVSS 7.8, KEV)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-07-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.