# CVEs published 2015-07-26 10 CVEs were published on July 26, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2015-1840](https://cve.now/CVE-2015-1840.md): jquery\_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and (no CVSS, jquery-rails ยท jquery-ujs) - [CVE-2015-1872](https://cve.now/CVE-2015-1872.md): The ff\_mjpeg\_decode\_sof function in libavcodec/mjpegdec.c in FFmpeg before 2.5.4 does not validate the number of components in a JPEG-LS Sta (no CVSS) - [CVE-2015-3224](https://cve.now/CVE-2015-3224.md): request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For header (no CVSS, web-console) - [CVE-2015-3225](https://cve.now/CVE-2015-3225.md): lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote atta (no CVSS, rack) - [CVE-2015-3226](https://cve.now/CVE-2015-3226.md): Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before (no CVSS, activesupport) - [CVE-2015-3227](https://cve.now/CVE-2015-3227.md): The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is e (no CVSS, activesupport) - [CVE-2015-2847](https://cve.now/CVE-2015-2847.md): Honeywell Tuxedo Touch before 5.2.19.0\_VA relies on client-side authentication involving JavaScript, which allows remote attackers to bypass (no CVSS) - [CVE-2015-2848](https://cve.now/CVE-2015-2848.md): Cross-site request forgery (CSRF) vulnerability in Honeywell Tuxedo Touch before 5.2.19.0\_VA allows remote attackers to hijack the authentic (no CVSS) - [CVE-2015-2975](https://cve.now/CVE-2015-2975.md): Research Artisan Lite before 1.18 does not ensure that a user has authenticated, which allows remote attackers to perform unspecified action (no CVSS) - [CVE-2015-4945](https://cve.now/CVE-2015-4945.md): Unspecified vulnerability in the IBM Maximo Anywhere application 7.5.1 through 7.5.1.2 for Android allows attackers to bypass a passcode pro (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-07-26 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.