# CVEs published 2015-07-10

18 CVEs were published on July 10, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-4236](https://cve.now/CVE-2015-4236.md): Cisco AsyncOS on Email Security Appliance (ESA) devices with software 8.5.6-073, 8.5.6-074, and 9.0.0-461, when clustering is enabled, allow (no CVSS)
- [CVE-2015-4263](https://cve.now/CVE-2015-4263.md): The Control and Provisioning functionality in Cisco Mobility Services Engine (MSE) 10.0(0.1) allows remote authenticated users to obtain sen (no CVSS)
- [CVE-2015-4526](https://cve.now/CVE-2015-4526.md): EMC RecoverPoint for Virtual Machines (VMs) 4.2 allows local users to obtain root-shell access by bypassing the Installation Manager Boxmgmt (no CVSS)
- [CVE-2015-2963](https://cve.now/CVE-2015-2963.md): The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remot (no CVSS, paperclip)
- [CVE-2015-3650](https://cve.now/CVE-2015-3650.md): vmware-vmx.exe in VMware Workstation 7.x through 10.x before 10.0.7 and 11.x before 11.1.1, VMware Player 5.x and 6.x before 6.0.7 and 7.x b (no CVSS)
- [CVE-2015-4254](https://cve.now/CVE-2015-4254.md): Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence Advanced Media Gateway devices with software 1.1(1.40) allows remote a (no CVSS)
- [CVE-2015-2967](https://cve.now/CVE-2015-2967.md): Cross-site scripting (XSS) vulnerability in settings.php in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2015-2969](https://cve.now/CVE-2015-2969.md): Cross-site scripting (XSS) vulnerability in index.php in LEMON-S PHP Simple Oekaki BBS before 1.21 allows remote attackers to inject arbitra (no CVSS)
- [CVE-2015-2970](https://cve.now/CVE-2015-2970.md): index.php in LEMON-S PHP Simple Oekaki BBS before 1.21 allows remote attackers to delete arbitrary files via the oekakis parameter. (no CVSS)
- [CVE-2015-4259](https://cve.now/CVE-2015-4259.md): The Integrated Management Controller on Cisco Unified Computing System (UCS) C servers with software 1.5(3) and 1.6(0.16) has a default SSL (no CVSS)
- [CVE-2015-4244](https://cve.now/CVE-2015-4244.md): The boot implementation on Cisco ASR 5000 and 5500 devices with software 14.0 allows local users to execute arbitrary Linux commands by leve (no CVSS)
- [CVE-2015-4260](https://cve.now/CVE-2015-4260.md): Cross-site scripting (XSS) vulnerability in Cisco Hosted Collaboration Solution 10.6(1) allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2015-4252](https://cve.now/CVE-2015-4252.md): Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence ISDN Gateway devices with software 2.2(1.106) allows remote attackers (no CVSS)
- [CVE-2015-4253](https://cve.now/CVE-2015-4253.md): Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence Serial Gateway devices with software 1.0(1.42) allows remote attackers (no CVSS)
- [CVE-2015-4255](https://cve.now/CVE-2015-4255.md): Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence IP Gateway devices with software 2.0(3.34) allows remote attackers to (no CVSS)
- [CVE-2015-4256](https://cve.now/CVE-2015-4256.md): Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence IP VCR devices with software 3.0(1.27) allows remote attackers to hija (no CVSS)
- [CVE-2015-4257](https://cve.now/CVE-2015-4257.md): Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence MCU 4500 devices with software 4.5(1.55) allows remote attackers to hi (no CVSS)
- [CVE-2015-4258](https://cve.now/CVE-2015-4258.md): Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence MSE 8000 devices allows remote attackers to hijack the authentication (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-07-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.