# CVEs published 2015-09-15

8 CVEs were published on September 15, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-5472](https://cve.now/CVE-2015-5472.md): Absolute path traversal vulnerability in lib/download.php in the IBS Mappro plugin before 1.0 for WordPress allows remote attackers to read (no CVSS)
- [CVE-2015-6943](https://cve.now/CVE-2015-6943.md): SQL injection vulnerability in the serendipity\_checkCommentToken function in include/functions\_comments.inc.php in Serendipity before 2.0.2, (no CVSS)
- [CVE-2015-6944](https://cve.now/CVE-2015-6944.md): Cross-site request forgery (CSRF) vulnerability in JSP/MySQL Administrador Web 1 allows remote attackers to hijack the authentication of use (no CVSS)
- [CVE-2015-6945](https://cve.now/CVE-2015-6945.md): Cross-site scripting (XSS) vulnerability in JSP/MySQL Administrador Web 1 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2015-6946](https://cve.now/CVE-2015-6946.md): Multiple stack-based buffer overflows in the Reprise License Manager service in Borland AccuRev allow remote attackers to execute arbitrary (no CVSS)
- [CVE-2015-6948](https://cve.now/CVE-2015-6948.md): Heap-based buffer overflow in the Microsoft Word document conversion feature in Corel WordPerfect allows remote attackers to execute arbitra (no CVSS)
- [CVE-2015-6949](https://cve.now/CVE-2015-6949.md): Stack-based buffer overflow in the ASUS TM-AC1900 router allows remote attackers to execute arbitrary code via crafted HTTP header values. (no CVSS)
- [CVE-2015-4947](https://cve.now/CVE-2015-4947.md): Stack-based buffer overflow in the Administration Server in IBM HTTP Server 6.1.0.x through 6.1.0.47, 7.0.0.x before 7.0.0.39, 8.0.0.x befor (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-09-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.