# CVEs published 2015-08-18

50 CVEs were published on August 18, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-4425](https://cve.now/CVE-2015-4425.md): Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or w (no CVSS)
- [CVE-2015-4426](https://cve.now/CVE-2015-4426.md): SQL injection vulnerability in pimcore before build 3473 allows remote attackers to execute arbitrary SQL commands via the filter parameter (no CVSS)
- [CVE-2015-4670](https://cve.now/CVE-2015-4670.md): Directory traversal vulnerability in the AjaxFileUpload control in DevExpress AJAX Control Toolkit (aka AjaxControlToolkit) before 15.1 allo (no CVSS)
- [CVE-2015-5481](https://cve.now/CVE-2015-5481.md): Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote att (no CVSS)
- [CVE-2015-5482](https://cve.now/CVE-2015-5482.md): Directory traversal vulnerability in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote administrators to include and (no CVSS)
- [CVE-2015-5487](https://cve.now/CVE-2015-5487.md): Cross-site scripting (XSS) vulnerability in the Camtasia Relay module 6.x-2.x before 6.x-3.2 and 7.x-2.x before 7.x-1.3 for Drupal allows re (no CVSS)
- [CVE-2015-5488](https://cve.now/CVE-2015-5488.md): Cross-site scripting (XSS) vulnerability in the MailChimp Signup submodule in the MailChimp module 7.x-3.x before 7.x-3.3 for Drupal allows (no CVSS)
- [CVE-2015-5489](https://cve.now/CVE-2015-5489.md): Cross-site scripting (XSS) vulnerability in the Smart Trim module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with c (no CVSS)
- [CVE-2015-5490](https://cve.now/CVE-2015-5490.md): The \_views\_fetch\_data method in includes/cache.inc in the Views module 7.x-3.5 through 7.x-3.10 for Drupal does not rebuild the full cache i (no CVSS)
- [CVE-2015-5491](https://cve.now/CVE-2015-5491.md): The Dynamic display block module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users to bypass intended access restrictions (no CVSS)
- [CVE-2015-5492](https://cve.now/CVE-2015-5492.md): Cross-site scripting (XSS) vulnerability in the Video Consultation module for Drupal allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2015-5493](https://cve.now/CVE-2015-5493.md): The Entityform Block module 7.x-1.x before 7.x-1.3 for Drupal does not properly check permissions when a form is locked to a role, which all (no CVSS)
- [CVE-2015-5494](https://cve.now/CVE-2015-5494.md): Cross-site scripting (XSS) vulnerability in the Webform Matrix Component module 7.x-4.x before 7.x-4.13 for Drupal allows remote authenticat (no CVSS)
- [CVE-2015-5495](https://cve.now/CVE-2015-5495.md): Cross-site scripting (XSS) vulnerability in the Mobile sliding menu module 7.x-2.x before 7.x-2.1 for Drupal allows remote authenticated use (no CVSS)
- [CVE-2015-5496](https://cve.now/CVE-2015-5496.md): The pass2pdf module for Drupal does not restrict access to generated PDF files, which allows remote attackers to obtain user passwords via u (no CVSS)
- [CVE-2015-5497](https://cve.now/CVE-2015-5497.md): Cross-site scripting (XSS) vulnerability in the Web Links module 6.x-2.x before 6.x-2.6 and 7.x-1.x before 7.x-1.0 for Drupal allows remote (no CVSS)
- [CVE-2015-5498](https://cve.now/CVE-2015-5498.md): The Shipwire API module 7.x-1.x before 7.x-1.03 for Drupal does not check the view permission for the shipments overview (admin/shipwire/shi (no CVSS)
- [CVE-2015-5499](https://cve.now/CVE-2015-5499.md): The Navigate module for Drupal does not properly check permissions, which allows remote authenticated users to modify custom widgets and cre (no CVSS)
- [CVE-2015-5500](https://cve.now/CVE-2015-5500.md): Cross-site scripting (XSS) vulnerability in the Navigate module for Drupal allows remote authenticated users with certain permissions to inj (no CVSS)
- [CVE-2015-5501](https://cve.now/CVE-2015-5501.md): The Hostmaster (Aegir) module 6.x-2.x before 6.x-2.4 and 7.x-3.x before 7.x-3.0-beta2 for Drupal allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2015-5502](https://cve.now/CVE-2015-5502.md): The Storage API module 7.x-1.x before 7.x-1.8 for Drupal does not properly restrict access to Storage API fields attached to entities that a (no CVSS)
- [CVE-2015-5503](https://cve.now/CVE-2015-5503.md): Open redirect vulnerability in the Chamilo integration module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to redirect users to (no CVSS)
- [CVE-2015-5504](https://cve.now/CVE-2015-5504.md): SQL injection vulnerability in the Novalnet Payment Module Ubercart module for Drupal allows remote attackers to execute arbitrary SQL comma (no CVSS)
- [CVE-2015-5505](https://cve.now/CVE-2015-5505.md): The HTTP Strict Transport Security (HSTS) module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.2 for Drupal does not properly implement th (no CVSS)
- [CVE-2015-5506](https://cve.now/CVE-2015-5506.md): The Apache Solr Real-Time module 7.x-1.x before 7.x-1.2 for Drupal does not check the status of an entity when indexing, which allows remote (no CVSS)
- [CVE-2015-5507](https://cve.now/CVE-2015-5507.md): Cross-site scripting (XSS) vulnerability in the Inline Entity Form module 7.x-1.x before 7.x-1.6 for Drupal allows remote authenticated user (no CVSS)
- [CVE-2015-5508](https://cve.now/CVE-2015-5508.md): Cross-site request forgery (CSRF) vulnerability in the XC NCIP Provider module in the eXtensible Catalog (XC) Drupal Toolkit allows remote a (no CVSS)
- [CVE-2015-5509](https://cve.now/CVE-2015-5509.md): The Administration Views module 7.x-1.x before 7.x-1.4 for Drupal, when used with other unspecified modules, does not properly grant access (no CVSS)
- [CVE-2015-5510](https://cve.now/CVE-2015-5510.md): Open redirect vulnerability in the Content Construction Kit (CCK) 6.x-2.x before 6.x-2.10 for Drupal allows remote attackers to redirect use (no CVSS)
- [CVE-2015-5511](https://cve.now/CVE-2015-5511.md): The HybridAuth Social Login module 7.x-2.x before 7.x-2.13 for Drupal allows remote attackers to bypass the user registration by administrat (no CVSS)
- [CVE-2015-5512](https://cve.now/CVE-2015-5512.md): The me aliases module 6.x-2.x before 6.x-2.10 and 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to access Views using the "me" u (no CVSS)
- [CVE-2015-5513](https://cve.now/CVE-2015-5513.md): Cross-site scripting (XSS) vulnerability in the Shibboleth authentication module 6.x-4.x before 6.x-4.2 and 7.x-4.x before 7.x-4.2 for Drupa (no CVSS)
- [CVE-2015-5514](https://cve.now/CVE-2015-5514.md): Cross-site scripting (XSS) vulnerability in the Migrate module 7.x-2.x before 7.x-2.8 for Drupal, when the migrate\_ui submodule is enabled, (no CVSS)
- [CVE-2015-5515](https://cve.now/CVE-2015-5515.md): The Views Bulk Operations (VBO) module 6.x-1.x and 7.x-3.x before 7.x-3.3 for Drupal, when the bulk operation for changing Roles is enabled, (no CVSS)
- [CVE-2015-6517](https://cve.now/CVE-2015-6517.md): Cross-site request forgery (CSRF) vulnerability in phpLiteAdmin 1.1 allows remote attackers to hijack the authentication of users for reques (no CVSS)
- [CVE-2015-6518](https://cve.now/CVE-2015-6518.md): Multiple cross-site scripting (XSS) vulnerabilities in phpLiteAdmin 1.1 allow remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2015-6519](https://cve.now/CVE-2015-6519.md): SQL injection vulnerability in Arab Portal 3 allows remote attackers to execute arbitrary SQL commands via the showemail parameter in a sign (no CVSS)
- [CVE-2015-4029](https://cve.now/CVE-2015-4029.md): Cross-site scripting (XSS) vulnerability in the WebGUI in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2015-5485](https://cve.now/CVE-2015-5485.md): Cross-site scripting (XSS) vulnerability in the Event Import page (import-eventbrite-events.php) in the Modern Tribe Eventbrite Tickets plug (no CVSS)
- [CVE-2015-5599](https://cve.now/CVE-2015-5599.md): Multiple SQL injection vulnerabilities in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allow remote attackers to execute arb (no CVSS)
- [CVE-2015-5681](https://cve.now/CVE-2015-5681.md): Unrestricted file upload vulnerability in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to execute ar (no CVSS)
- [CVE-2015-6508](https://cve.now/CVE-2015-6508.md): Cross-site scripting (XSS) vulnerability in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the desc (no CVSS)
- [CVE-2015-6509](https://cve.now/CVE-2015-6509.md): Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2015-6510](https://cve.now/CVE-2015-6510.md): Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2015-6511](https://cve.now/CVE-2015-6511.md): Cross-site scripting (XSS) vulnerability in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the serv (no CVSS)
- [CVE-2015-6512](https://cve.now/CVE-2015-6512.md): SQL injection vulnerability in the get\_messages function in server/plugins/chatroom/chatroom.php in FreiChat 9.6 allows remote attackers to (no CVSS)
- [CVE-2015-6513](https://cve.now/CVE-2015-6513.md): Multiple SQL injection vulnerabilities in the J2Store (com\_j2store) extension before 3.1.7 for Joomla! allow remote attackers to execute arb (no CVSS)
- [CVE-2015-6514](https://cve.now/CVE-2015-6514.md): Cross-site scripting (XSS) vulnerability in the Dashboard in Splunk Enterprise 6.2.x before 6.2.4 and Splunk Light 6.2.x before 6.2.4 allows (no CVSS)
- [CVE-2015-6515](https://cve.now/CVE-2015-6515.md): Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.2.x before 6.2.4, 6.1.x before 6.1.8, 6.0.x before 6.0.9, and (no CVSS)
- [CVE-2015-6516](https://cve.now/CVE-2015-6516.md): SQL injection vulnerability in cygnux.org sysPass 1.0.9 and earlier allows remote authenticated users to execute arbitrary SQL commands via (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-08-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.