# CVEs published 2015-09-16

18 CVEs were published on September 16, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-6972](https://cve.now/CVE-2015-6972.md): Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2015-6973](https://cve.now/CVE-2015-6973.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentic (no CVSS)
- [CVE-2014-8778](https://cve.now/CVE-2014-8778.md): Checkmarx CxSAST (formerly CxSuite) before 7.1.8 allows remote authenticated users to bypass the CxQL sandbox protection mechanism and execu (no CVSS)
- [CVE-2015-1173](https://cve.now/CVE-2015-1173.md): Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 does not properly restrict access to the (1) Design Mode and (2) Debug Logger mode (no CVSS)
- [CVE-2015-3623](https://cve.now/CVE-2015-3623.md): XML external entity (XXE) vulnerability in QlikTech Qlikview before 11.20 SR12 allows remote attackers to conduct server-side request forger (no CVSS)
- [CVE-2015-5465](https://cve.now/CVE-2015-5465.md): Silicon Integrated Systems WindowsXP Display Manager (aka VGA Driver Manager and VGA Display Manager) 6.14.10.3930 allows local users to gai (no CVSS)
- [CVE-2015-6929](https://cve.now/CVE-2015-6929.md): Multiple cross-site scripting (XSS) vulnerabilities in Nokia Networks (formerly Nokia Solutions and Networks and Nokia Siemens Networks) @va (no CVSS)
- [CVE-2015-2136](https://cve.now/CVE-2015-2136.md): HP ArcSight Logger before 6.0 P2 allows remote authenticated users to bypass the intended authorization policy via unspecified vectors. (no CVSS)
- [CVE-2015-5440](https://cve.now/CVE-2015-5440.md): HP UCMDB 10.00 and 10.01 before 10.01CUP12, 10.10 and 10.11 before 10.11CUP6, and 10.2x before 10.21 allows local users to obtain sensitive (no CVSS)
- [CVE-2015-5956](https://cve.now/CVE-2015-5956.md): The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass (no CVSS, typo3/cms)
- [CVE-2015-6828](https://cve.now/CVE-2015-6828.md): The tweet\_info function in class/\_\_functions.php in the SecureMoz Security Audit plugin 1.0.5 and earlier for WordPress does not use an HTTP (no CVSS)
- [CVE-2015-6829](https://cve.now/CVE-2015-6829.md): Multiple SQL injection vulnerabilities in the getip function in wp-limit-login-attempts.php in the WP Limit Login Attempts plugin before 2.0 (no CVSS)
- [CVE-2015-6965](https://cve.now/CVE-2015-6965.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for WordPress allow remote (no CVSS)
- [CVE-2015-6966](https://cve.now/CVE-2015-6966.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Nibbleblog before 4.0.5 allow remote attackers to hijack the authentication of (no CVSS)
- [CVE-2015-6967](https://cve.now/CVE-2015-6967.md): Unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators to execute arbitrary c (no CVSS)
- [CVE-2015-6968](https://cve.now/CVE-2015-6968.md): Multiple incomplete blacklist vulnerabilities in the serendipity\_isActiveFile function in include/functions\_images.inc.php in Serendipity be (no CVSS)
- [CVE-2015-6969](https://cve.now/CVE-2015-6969.md): Cross-site scripting (XSS) vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject a (no CVSS)
- [CVE-2015-5426](https://cve.now/CVE-2015-5426.md): Unspecified vulnerability in HP LoadRunner Controller before 12.50 allows local users to gain privileges via unknown vectors, aka ZDI-CAN-27 (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-09-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.