# CVEs published 2015-08-17

4 CVEs were published on August 17, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-0277](https://cve.now/CVE-2015-0277.md): The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction (no CVSS)
- [CVE-2015-6254](https://cve.now/CVE-2015-6254.md): The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that the Destination attribute in a (no CVSS)
- [CVE-2014-9743](https://cve.now/CVE-2014-9743.md): Cross-site scripting (XSS) vulnerability in the httpd\_HtmlError function in network/httpd.c in the web interface in VideoLAN VLC Media Playe (no CVSS)
- [CVE-2015-5531](https://cve.now/CVE-2015-5531.md): Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors rela (no CVSS, org.elasticsearch:elasticsearch)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-08-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.