CVEs published July 26, 2015
10 CVEs were published on July 26, 2015: 0 critical, 0 high.
- Published
- 10
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 10
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- activesupport
- 2
- jquery-rails · jquery-ujs
- 1
- rack
- 1
- web-console
- 1
Medium, low and unrated 10
- CVE-2015-1840jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and jquery-rails · jquery-ujs
- CVE-2015-1872The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in FFmpeg before 2.5.4 does not validate the number of components in a JPEG-LS Sta
- CVE-2015-3224request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headerweb-console
- CVE-2015-3225lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attarack
- CVE-2015-3226Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x beforeactivesupport
- CVE-2015-3227The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is eactivesupport
- CVE-2015-2847Honeywell Tuxedo Touch before 5.2.19.0_VA relies on client-side authentication involving JavaScript, which allows remote attackers to bypass
- CVE-2015-2848Cross-site request forgery (CSRF) vulnerability in Honeywell Tuxedo Touch before 5.2.19.0_VA allows remote attackers to hijack the authentic
- CVE-2015-2975Research Artisan Lite before 1.18 does not ensure that a user has authenticated, which allows remote attackers to perform unspecified action
- CVE-2015-4945Unspecified vulnerability in the IBM Maximo Anywhere application 7.5.1 through 7.5.1.2 for Android allows attackers to bypass a passcode pro