# CVEs published 2015-09-25

17 CVEs were published on September 25, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-7374](https://cve.now/CVE-2015-7374.md): The Remote Agent component in Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code via unspec (no CVSS)
- [CVE-2015-7375](https://cve.now/CVE-2015-7375.md): Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code or cause a denial of service (unhandled (no CVSS)
- [CVE-2015-4539](https://cve.now/CVE-2015-4539.md): Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Identity Management & Governance (IMG) before 7.0.0 allow remote attackers to (no CVSS)
- [CVE-2015-4540](https://cve.now/CVE-2015-4540.md): Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Identity Management & Governance (IMG) before 6.8.1 P18 and 6.9.x before 6.9. (no CVSS)
- [CVE-2015-4541](https://cve.now/CVE-2015-4541.md): Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Archer GRC 5.x before 5.5.3 allow remote authenticated users to inject arbitr (no CVSS)
- [CVE-2015-4542](https://cve.now/CVE-2015-4542.md): EMC RSA Archer GRC 5.x before 5.5.3 allows remote authenticated users to bypass intended access restrictions, and read or modify Discussion (no CVSS)
- [CVE-2015-4543](https://cve.now/CVE-2015-4543.md): EMC RSA Archer GRC 5.x before 5.5.3 uses cleartext for stored passwords in unspecified circumstances, which allows remote authenticated user (no CVSS)
- [CVE-2015-6282](https://cve.now/CVE-2015-6282.md): Cisco IOS XE 2.x and 3.x before 3.10.6S, 3.11.xS through 3.13.xS before 3.13.3S, and 3.14.xS through 3.15.xS before 3.15.1S allows remote at (no CVSS)
- [CVE-2015-6302](https://cve.now/CVE-2015-6302.md): The RADIUS functionality on Cisco Wireless LAN Controller (WLC) devices with software 7.0(250.0) and 7.0(252.0) allows remote attackers to d (no CVSS)
- [CVE-2015-6305](https://cve.now/CVE-2015-6305.md): Untrusted search path vulnerability in the CMainThread::launchDownloader function in vpndownloader.exe in Cisco AnyConnect Secure Mobility C (no CVSS)
- [CVE-2015-6306](https://cve.now/CVE-2015-6306.md): Cisco AnyConnect Secure Mobility Client 4.1(8) on OS X and Linux does not verify pathnames before installation actions, which allows local u (no CVSS)
- [CVE-2015-6454](https://cve.now/CVE-2015-6454.md): Everest PeakHMI before 8.7.0.2, when the video server is used, allows remote attackers to cause a denial of service (incorrect pointer deref (no CVSS)
- [CVE-2015-6468](https://cve.now/CVE-2015-6468.md): Cross-site request forgery (CSRF) vulnerability in Resource Data Management Data Manager before 2.2 allows remote attackers to hijack the au (no CVSS)
- [CVE-2015-6469](https://cve.now/CVE-2015-6469.md): The interpreter in IBC Solar ServeMaster TLP+ and Danfoss TLX Pro+ allows remote attackers to discover script source code via unspecified ve (no CVSS)
- [CVE-2015-6470](https://cve.now/CVE-2015-6470.md): Resource Data Management Data Manager before 2.2 allows remote authenticated users to modify arbitrary passwords via unspecified vectors. (no CVSS)
- [CVE-2015-6474](https://cve.now/CVE-2015-6474.md): IBC Solar ServeMaster TLP+ and Danfoss TLX Pro+ allow remote attackers to discover cleartext passwords by reading HTML source code. (no CVSS)
- [CVE-2015-6475](https://cve.now/CVE-2015-6475.md): Multiple cross-site scripting (XSS) vulnerabilities in IBC Solar ServeMaster TLP+ and Danfoss TLX Pro+ allow remote attackers to inject arbi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-09-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.