# CVEs published 2015-09-29 16 CVEs were published on September 29, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2015-0299](https://cve.now/CVE-2015-0299.md): Multiple cross-site scripting (XSS) vulnerabilities in Open Source Point of Sale 2.3.1 allow remote authenticated users to inject arbitrary (no CVSS) - [CVE-2015-5074](https://cve.now/CVE-2015-5074.md): Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM be (no CVSS) - [CVE-2015-5075](https://cve.now/CVE-2015-5075.md): Cross-site request forgery (CSRF) vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of adminis (no CVSS) - [CVE-2015-5076](https://cve.now/CVE-2015-5076.md): Multiple cross-site scripting (XSS) vulnerabilities in X2Engine X2CRM before 5.0.9 allow remote attackers to inject arbitrary web script or (no CVSS) - [CVE-2015-7319](https://cve.now/CVE-2015-7319.md): SQL injection vulnerability in cpabc\_appointments\_admin\_int\_calendar\_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 fo (no CVSS) - [CVE-2015-7320](https://cve.now/CVE-2015-7320.md): Multiple cross-site scripting (XSS) vulnerabilities in cpabc\_appointments\_admin\_int\_bookings\_list.inc.php in the Appointment Booking Calenda (no CVSS) - [CVE-2015-7337](https://cve.now/CVE-2015-7337.md): The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript (no CVSS, notebook ยท ipython) - [CVE-2015-7601](https://cve.now/CVE-2015-7601.md): Directory traversal vulnerability in PCMan's FTP Server 2.0.7 allows remote attackers to read arbitrary files via a ..// (dot dot double sla (no CVSS) - [CVE-2015-7602](https://cve.now/CVE-2015-7602.md): Directory traversal vulnerability in BisonWare BisonFTP 3.5 allows remote attackers to read arbitrary files via a ../ (dot dot slash) in a R (no CVSS) - [CVE-2015-7603](https://cve.now/CVE-2015-7603.md): Directory traversal vulnerability in Konica Minolta FTP Utility 1.0 allows remote attackers to read arbitrary files via a ..\\ (dot dot backs (no CVSS) - [CVE-2015-7604](https://cve.now/CVE-2015-7604.md): Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.2.x before 6.2.6 and Splunk Light 6.2.x before 6.2.6 allows re (no CVSS) - [CVE-2015-0852](https://cve.now/CVE-2015-0852.md): Multiple integer underflows in PluginPCX.cpp in FreeImage 3.17.0 and earlier allow remote attackers to cause a denial of service (heap memor (no CVSS) - [CVE-2015-5442](https://cve.now/CVE-2015-5442.md): Unspecified vulnerability in HP Software Update before 5.005.002.002 allows local users to gain privileges via unknown vectors. (no CVSS) - [CVE-2015-5711](https://cve.now/CVE-2015-5711.md): TIBCO Managed File Transfer Internet Server before 7.2.5, Managed File Transfer Command Center before 7.2.5, Slingshot before 1.9.4, and Vau (no CVSS) - [CVE-2015-5435](https://cve.now/CVE-2015-5435.md): Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 3 before 1.85 and 4 before 2.22 allows remote authenticated users to ca (no CVSS) - [CVE-2015-5950](https://cve.now/CVE-2015-5950.md): The NVIDIA display driver R352 before 353.82 and R340 before 341.81 on Windows; R304 before 304.128, R340 before 340.93, and R352 before 352 (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-09-29 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.