# CVEs published 2015-08-31

44 CVEs were published on August 31, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-2135](https://cve.now/CVE-2015-2135.md): Unspecified vulnerability in HP Intelligent Provisioning 1.00 through 1.62(a), 2.00, and 2.10 allows remote attackers to execute arbitrary c (no CVSS)
- [CVE-2015-4036](https://cve.now/CVE-2015-4036.md): Array index error in the tcm\_vhost\_make\_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to ca (no CVSS)
- [CVE-2015-6269](https://cve.now/CVE-2015-6269.md): Cisco IOS XE before 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a (no CVSS)
- [CVE-2015-6270](https://cve.now/CVE-2015-6270.md): Cisco IOS XE before 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a (no CVSS)
- [CVE-2015-6271](https://cve.now/CVE-2015-6271.md): Cisco IOS XE 2.1.0 through 2.4.3 and 2.5.0 on ASR 1000 devices, when NAT Application Layer Gateway is used, allows remote attackers to cause (no CVSS)
- [CVE-2015-6272](https://cve.now/CVE-2015-6272.md): Cisco IOS XE 2.1.0 through 2.2.3 and 2.3.0 on ASR 1000 devices, when NAT Application Layer Gateway is used, allows remote attackers to cause (no CVSS)
- [CVE-2015-6526](https://cve.now/CVE-2015-6526.md): The perf\_callchain\_user\_64 function in arch/powerpc/perf/callchain.c in the Linux kernel before 4.0.2 on ppc64 platforms allows local users (no CVSS)
- [CVE-2015-6655](https://cve.now/CVE-2015-6655.md): Cross-site request forgery (CSRF) vulnerability in Pligg CMS 2.0.2 allows remote attackers to hijack the authentication of administrators fo (no CVSS)
- [CVE-2015-6753](https://cve.now/CVE-2015-6753.md): Multiple cross-site scripting (XSS) vulnerabilities in the Quick Edit module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated us (no CVSS)
- [CVE-2015-6754](https://cve.now/CVE-2015-6754.md): Cross-site scripting (XSS) vulnerability in the administration interface in the Path Breadcrumbs module 7.x-3.x before 7.x-3.3 for Drupal al (no CVSS)
- [CVE-2014-2329](https://cve.now/CVE-2014-2329.md): Multiple cross-site scripting (XSS) vulnerabilities in Check\_MK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allow remote authenticated users to (no CVSS)
- [CVE-2014-2330](https://cve.now/CVE-2014-2330.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Multisite GUI in Check\_MK before 1.2.5i2 allow remote attackers to hijack (no CVSS)
- [CVE-2014-2331](https://cve.now/CVE-2014-2331.md): Check\_MK 1.2.2p2, 1.2.2p3, and 1.2.3i5 allows remote authenticated users to execute arbitrary Python code via a crafted rules.mk file in a s (no CVSS)
- [CVE-2014-2332](https://cve.now/CVE-2014-2332.md): Check\_MK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allows remote authenticated users to delete arbitrary files via a request to an unspecifie (no CVSS)
- [CVE-2014-2570](https://cve.now/CVE-2014-2570.md): Cross-site scripting (XSS) vulnerability in www/make\_subset.php in PHP Font Lib before 0.3.1 allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2014-3148](https://cve.now/CVE-2014-3148.md): Cross-site scripting (XSS) vulnerability in libahttp/err.c in OkCupid OKWS (OK Web Server) allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2014-6616](https://cve.now/CVE-2014-6616.md): Cross-site scripting (XSS) vulnerability in Softing FG-100 PROFIBUS Single Channel (FG-100-PB) with firmware FG-x00-PB\_V2.02.0.00 allows rem (no CVSS)
- [CVE-2015-6535](https://cve.now/CVE-2015-6535.md): Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remo (no CVSS)
- [CVE-2015-6751](https://cve.now/CVE-2015-6751.md): Multiple cross-site scripting (XSS) vulnerabilities in the Time Tracker module 7.x-1.x before 7.x-1.4 for Drupal allow remote authenticated (no CVSS)
- [CVE-2015-6752](https://cve.now/CVE-2015-6752.md): Cross-site scripting (XSS) vulnerability in the Search API Autocomplete module 7.x-1.x before 7.x-1.3 for Drupal, when the search index is c (no CVSS)
- [CVE-2015-6750](https://cve.now/CVE-2015-6750.md): Buffer overflow in Ricoh DL FTP Server 1.1.0.6 and earlier allows remote attackers to execute arbitrary code via a long USER command. (no CVSS)
- [CVE-2015-0943](https://cve.now/CVE-2015-0943.md): Basware Banking (Maksuliikenne) before 9.10.0.0 does not encrypt communication between the client and the backend server, which allows man-i (no CVSS)
- [CVE-2015-6742](https://cve.now/CVE-2015-6742.md): Basware Banking (Maksuliikenne) before 8.90.07.X uses a hardcoded password for the ANCO account, which allows remote authenticated users to (no CVSS)
- [CVE-2015-6743](https://cve.now/CVE-2015-6743.md): Basware Banking (Maksuliikenne) 8.90.07.X uses a hardcoded password for an unspecified account, which allows remote authenticated users to b (no CVSS)
- [CVE-2015-6744](https://cve.now/CVE-2015-6744.md): Basware Banking (Maksuliikenne) before 8.90.07.X relies on the client to enforce (1) login verification, (2) audit trail creation, and (3) a (no CVSS)
- [CVE-2015-6745](https://cve.now/CVE-2015-6745.md): Basware Banking (Maksuliikenne) 8.90.07.X relies on the client to enforce account locking, which allows local users to bypass that security (no CVSS)
- [CVE-2015-6746](https://cve.now/CVE-2015-6746.md): Basware Banking (Maksuliikenne) before 8.90.07.X stores private keys in plaintext in the SQL database, which allows remote attackers to spoo (no CVSS)
- [CVE-2015-6747](https://cve.now/CVE-2015-6747.md): Basware Banking (Maksuliikenne) 8.90.07.X does not properly prevent access to private keys, which allows remote attackers to spoof communica (no CVSS)
- [CVE-2014-9728](https://cve.now/CVE-2014-9728.md): The UDF filesystem implementation in the Linux kernel before 3.18.2 does not validate certain lengths, which allows local users to cause a d (no CVSS)
- [CVE-2014-9729](https://cve.now/CVE-2014-9729.md): The udf\_read\_inode function in fs/udf/inode.c in the Linux kernel before 3.18.2 does not ensure a certain data-structure size consistency, w (no CVSS)
- [CVE-2014-9730](https://cve.now/CVE-2014-9730.md): The udf\_pc\_to\_char function in fs/udf/symlink.c in the Linux kernel before 3.18.2 relies on component lengths that are unused, which allows (no CVSS)
- [CVE-2014-9731](https://cve.now/CVE-2014-9731.md): The UDF filesystem implementation in the Linux kernel before 3.18.2 does not ensure that space is available for storing a symlink target's n (no CVSS)
- [CVE-2015-1333](https://cve.now/CVE-2015-1333.md): Memory leak in the \_\_key\_link\_end function in security/keys/keyring.c in the Linux kernel before 4.1.4 allows local users to cause a denial (no CVSS)
- [CVE-2015-3212](https://cve.now/CVE-2015-3212.md): Race condition in net/sctp/socket.c in the Linux kernel before 4.1.2 allows local users to cause a denial of service (list corruption and pa (no CVSS)
- [CVE-2015-3214](https://cve.now/CVE-2015-3214.md): The pit\_ioport\_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write l (no CVSS)
- [CVE-2015-3290](https://cve.now/CVE-2015-3290.md): arch/x86/entry/entry\_64.S in the Linux kernel before 4.1.6 on the x86\_64 platform improperly relies on espfix64 during nested NMI processing (no CVSS)
- [CVE-2015-3291](https://cve.now/CVE-2015-3291.md): arch/x86/entry/entry\_64.S in the Linux kernel before 4.1.6 on the x86\_64 platform does not properly determine when nested NMI processing is (no CVSS)
- [CVE-2015-4700](https://cve.now/CVE-2015-4700.md): The bpf\_int\_jit\_compile function in arch/x86/net/bpf\_jit\_comp.c in the Linux kernel before 4.0.6 allows local users to cause a denial of ser (no CVSS)
- [CVE-2015-5157](https://cve.now/CVE-2015-5157.md): arch/x86/entry/entry\_64.S in the Linux kernel before 4.1.6 on the x86\_64 platform mishandles IRET faults in processing NMIs that occurred du (no CVSS)
- [CVE-2015-5364](https://cve.now/CVE-2015-5364.md): The (1) udp\_recvmsg and (2) udpv6\_recvmsg functions in the Linux kernel before 4.0.6 do not properly consider yielding a processor, which al (no CVSS)
- [CVE-2015-5366](https://cve.now/CVE-2015-5366.md): The (1) udp\_recvmsg and (2) udpv6\_recvmsg functions in the Linux kernel before 4.0.6 provide inappropriate -EAGAIN return values, which allo (no CVSS)
- [CVE-2015-5697](https://cve.now/CVE-2015-5697.md): The get\_bitmap\_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a certain bitmap data structure, which (no CVSS)
- [CVE-2015-5706](https://cve.now/CVE-2015-5706.md): Use-after-free vulnerability in the path\_openat function in fs/namei.c in the Linux kernel 3.x and 4.x before 4.0.4 allows local users to ca (no CVSS)
- [CVE-2015-5717](https://cve.now/CVE-2015-5717.md): The Siemens COMPAS Mobile application before 1.6 for Android does not properly verify X.509 certificates from SSL servers, which allows man- (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-08-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.