# CVEs published 2015-08-11

13 CVEs were published on August 11, 2015: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2015-1818](https://cve.now/CVE-2015-1818.md): XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl (no CVSS)
- [CVE-2015-2323](https://cve.now/CVE-2015-2323.md): FortiOS 5.0.x before 5.0.12 and 5.2.x before 5.2.4 supports anonymous, export, RC4, and possibly other weak ciphers when using TLS to connec (no CVSS)
- [CVE-2015-3228](https://cve.now/CVE-2015-3228.md): Integer overflow in the gs\_heap\_alloc\_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote attackers to cause a d (no CVSS)
- [CVE-2015-3245](https://cve.now/CVE-2015-3245.md): Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper progra (no CVSS)
- [CVE-2015-3246](https://cve.now/CVE-2015-3246.md): libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, w (CVSS 7.4, KEV)
- [CVE-2015-3267](https://cve.now/CVE-2015-3267.md): Cross-site scripting (XSS) vulnerability in the 404 error page in Red Hat JBoss Operations Network before 3.3.3 allows remote attackers to i (no CVSS)
- [CVE-2015-3626](https://cve.now/CVE-2015-3626.md): Cross-site scripting (XSS) vulnerability in the DHCP Monitor page in the Web User Interface (WebUI) in Fortinet FortiOS before 5.2.4 on Fort (no CVSS)
- [CVE-2015-4634](https://cve.now/CVE-2015-4634.md): SQL injection vulnerability in graphs.php in Cacti before 0.8.8e allows remote attackers to execute arbitrary SQL commands via the local\_gra (no CVSS)
- [CVE-2015-5176](https://cve.now/CVE-2015-5176.md): The PortletRequestDispatcher in PortletBridge, as used in Red Hat JBoss Portal 6.2.0, does not properly enforce the security constraints of (no CVSS)
- [CVE-2015-5369](https://cve.now/CVE-2015-5369.md): Pulse Connect Secure (aka PCS and formerly Juniper PCS) PSC6000, PCS6500, and MAG PSC360 8.1 before 8.1r5, 8.0 before 8.0r13, 7.4 before 7.4 (no CVSS)
- [CVE-2015-5522](https://cve.now/CVE-2015-5522.md): Heap-based buffer overflow in the ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2015-5523](https://cve.now/CVE-2015-5523.md): The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving (no CVSS)
- [CVE-2015-5965](https://cve.now/CVE-2015-5965.md): The SSL-VPN feature in Fortinet FortiOS before 4.3.13 only checks the first byte of the TLS MAC in finished messages, which makes it easier (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-08-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.