# CVEs published 2015-09-28 31 CVEs were published on September 28, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2015-1781](https://cve.now/CVE-2015-1781.md): Buffer overflow in the gethostbyname\_r and other unspecified NSS functions in the GNU C Library (aka glibc or libc6) before 2.22 allows cont (no CVSS) - [CVE-2015-5185](https://cve.now/CVE-2015-5185.md): The lookupProviders function in providerMgr.c in sblim-sfcb 1.3.4 and 1.3.18 allows remote attackers to cause a denial of service (NULL poin (no CVSS) - [CVE-2015-5400](https://cve.now/CVE-2015-5400.md): Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cache\_peer, which allows remote attackers to (no CVSS) - [CVE-2015-5957](https://cve.now/CVE-2015-5957.md): Buffer overflow in the DumpSysVar function in var.c in Remind before 3.1.15 allows attackers to have unspecified impact via a long name. (no CVSS) - [CVE-2015-6806](https://cve.now/CVE-2015-6806.md): The MScrollV function in ansi.c in GNU screen 4.3.1 and earlier does not properly limit recursion, which allows remote attackers to cause a (no CVSS) - [CVE-2015-6927](https://cve.now/CVE-2015-6927.md): vzctl before 4.9.4 determines the virtual environment (VE) layout based on the presence of root.hdd/DiskDescriptor.xml in the VE private dir (no CVSS) - [CVE-2015-3203](https://cve.now/CVE-2015-3203.md): Unrestricted file upload vulnerability in h5ai before 0.25.0 allows remote attackers to execute arbitrary code by uploading a file with an e (no CVSS) - [CVE-2015-5279](https://cve.now/CVE-2015-5279.md): Heap-based buffer overflow in the ne2000\_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial (no CVSS) - [CVE-2015-5372](https://cve.now/CVE-2015-5372.md): The SAML 2.0 implementation in AdNovum nevisAuth 4.13.0.0 before 4.18.3.1, when using SAML POST-Binding, does not match all attributes of th (no CVSS) - [CVE-2015-5375](https://cve.now/CVE-2015-5375.md): Cross-site scripting (XSS) vulnerability in unspecified dialogs for printing content in the Front End in Open-Xchange Server 6 and OX App Su (no CVSS) - [CVE-2015-5703](https://cve.now/CVE-2015-5703.md): SQL injection vulnerability in the public key discovery API call in Open-Xchange OX Guard before 2.0.0-rev8 allows remote authenticated user (no CVSS) - [CVE-2015-5082](https://cve.now/CVE-2015-5082.md): Endian Firewall before 3.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) NEW\_PASSWORD\_1 or (2) N (no CVSS) - [CVE-2015-6928](https://cve.now/CVE-2015-6928.md): classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a password reset request was (no CVSS) - [CVE-2015-7386](https://cve.now/CVE-2015-7386.md): Multiple cross-site scripting (XSS) vulnerabilities in includes/metaboxes.php in the Gallery - Photo Albums - Portfolio plugin 1.3.47 for Wo (no CVSS) - [CVE-2015-7387](https://cve.now/CVE-2015-7387.md): ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitra (no CVSS) - [CVE-2014-9202](https://cve.now/CVE-2014-9202.md): Multiple stack-based buffer overflows in an unspecified DLL file in Advantech WebAccess before 8.0\_20150816 allow remote attackers to execut (no CVSS) - [CVE-2015-3974](https://cve.now/CVE-2015-3974.md): EasyIO EasyIO-30P-SF controllers with firmware before 0.5.21 and 2.x before 2.0.5.21, as used in Accutrol, Bar-Tech Automation, Infocon/Easy (no CVSS) - [CVE-2015-6007](https://cve.now/CVE-2015-6007.md): Cross-site request forgery (CSRF) vulnerability in Web Reference Database (aka refbase) through 0.9.6 allows remote attackers to hijack the (no CVSS) - [CVE-2015-6008](https://cve.now/CVE-2015-6008.md): install.php in Web Reference Database (aka refbase) through 0.9.6 allows remote attackers to execute arbitrary commands via the adminPasswor (no CVSS) - [CVE-2015-6009](https://cve.now/CVE-2015-6009.md): Multiple SQL injection vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 allow remote attackers to execute arbitrary SQL (no CVSS) - [CVE-2015-6010](https://cve.now/CVE-2015-6010.md): Multiple cross-site scripting (XSS) vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-0 (no CVSS) - [CVE-2015-6011](https://cve.now/CVE-2015-6011.md): Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allows remote attackers to conduct XML injection atta (no CVSS) - [CVE-2015-6012](https://cve.now/CVE-2015-6012.md): Multiple open redirect vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allow remot (no CVSS) - [CVE-2015-6278](https://cve.now/CVE-2015-6278.md): The IPv6 snooping functionality in the first-hop security subsystem in Cisco IOS 12.2, 15.0, 15.1, 15.2, 15.3, 15.4, and 15.5 and IOS XE 3.2 (no CVSS) - [CVE-2015-6279](https://cve.now/CVE-2015-6279.md): The IPv6 snooping functionality in the first-hop security subsystem in Cisco IOS 12.2, 15.0, 15.1, 15.2, 15.3, 15.4, and 15.5 and IOS XE 3.2 (no CVSS) - [CVE-2015-6280](https://cve.now/CVE-2015-6280.md): The SSHv2 functionality in Cisco IOS 15.2, 15.3, 15.4, and 15.5 and IOS XE 3.6E before 3.6.3E, 3.7E before 3.7.1E, 3.10S before 3.10.6S, 3.1 (no CVSS) - [CVE-2015-6307](https://cve.now/CVE-2015-6307.md): Cisco FirePOWER (formerly Sourcefire) 7000 and 8000 devices with software 5.4.0.1 allow remote attackers to cause a denial of service (inspe (no CVSS) - [CVE-2015-6463](https://cve.now/CVE-2015-6463.md): CodeWrights HART Comm DTM components, as used with Endress+Hauser FieldCare, allow remote attackers to read arbitrary files, send HTTP reque (no CVSS) - [CVE-2015-7381](https://cve.now/CVE-2015-7381.md): Multiple PHP remote file inclusion vulnerabilities in install.php in Web Reference Database (aka refbase) through 0.9.6 allow remote attacke (no CVSS) - [CVE-2015-7382](https://cve.now/CVE-2015-7382.md): SQL injection vulnerability in install.php in Web Reference Database (aka refbase) through 0.9.6 allows remote attackers to execute arbitrar (no CVSS) - [CVE-2015-7383](https://cve.now/CVE-2015-7383.md): Multiple cross-site scripting (XSS) vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge through 2015-04- (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-09-28 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.