# CVEs published 2015-09-21 19 CVEs were published on September 21, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2015-5603](https://cve.now/CVE-2015-5603.md): The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java code via unspecifie (no CVSS) - [CVE-2015-6238](https://cve.now/CVE-2015-6238.md): Multiple cross-site scripting (XSS) vulnerabilities in the Google Analyticator plugin before 6.4.9.6 for WordPress allow remote attackers to (no CVSS) - [CVE-2015-6749](https://cve.now/CVE-2015-6749.md): Buffer overflow in the aiff\_open function in oggenc/audio.c in vorbis-tools 1.4.0 and earlier allows remote attackers to cause a denial of s (no CVSS) - [CVE-2015-6923](https://cve.now/CVE-2015-6923.md): The ndvbs module in VBox Communications Satellite Express Protocol 2.3.17.3 allows local users to write to arbitrary physical memory locatio (no CVSS) - [CVE-2015-6938](https://cve.now/CVE-2015-6938.md): Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Noteboo (no CVSS, notebook ยท ipython) - [CVE-2015-7303](https://cve.now/CVE-2015-7303.md): Use-after-free vulnerability in the Update Manager service in Avira Management Console allows remote attackers to execute arbitrary code via (no CVSS) - [CVE-2015-7304](https://cve.now/CVE-2015-7304.md): Cross-site scripting (XSS) vulnerability in the amoCRM module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to inject arbitrary (no CVSS) - [CVE-2015-7305](https://cve.now/CVE-2015-7305.md): The Scald module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to fields, which allows remote attackers to obtain sens (no CVSS) - [CVE-2015-7306](https://cve.now/CVE-2015-7306.md): The CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal does not properly check access permissions, which allows remote authenticated users (no CVSS) - [CVE-2015-7307](https://cve.now/CVE-2015-7307.md): Cross-site scripting (XSS) vulnerability in the CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbit (no CVSS) - [CVE-2015-2864](https://cve.now/CVE-2015-2864.md): Retrospect and Retrospect Client before 10.0.2.119 on Windows, before 12.0.2.116 on OS X, and before 10.0.2.104 on Linux improperly generate (no CVSS) - [CVE-2015-2914](https://cve.now/CVE-2015-2914.md): Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M use a fixed sourc (no CVSS) - [CVE-2015-2915](https://cve.now/CVE-2015-2915.md): Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M have a default pa (no CVSS) - [CVE-2015-2916](https://cve.now/CVE-2015-2916.md): Cross-site request forgery (CSRF) vulnerability on Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devic (no CVSS) - [CVE-2015-2917](https://cve.now/CVE-2015-2917.md): Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M unintentionally o (no CVSS) - [CVE-2015-5991](https://cve.now/CVE-2015-5991.md): Cross-site request forgery (CSRF) vulnerability in form2WlanSetup.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices w (no CVSS) - [CVE-2015-5992](https://cve.now/CVE-2015-5992.md): Cross-site scripting (XSS) vulnerability in form2WlanSetup.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with fir (no CVSS) - [CVE-2015-5993](https://cve.now/CVE-2015-5993.md): Buffer overflow in form2ping.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH (no CVSS) - [CVE-2015-7296](https://cve.now/CVE-2015-7296.md): Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M use a linear algo (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-09-21 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.