# CVEs published 2015-10-03

24 CVEs were published on October 3, 2015: 1 critical, 0 high. Days are UTC.

- [CVE-2014-8916](https://cve.now/CVE-2014-8916.md): Cross-site scripting (XSS) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 bef (no CVSS)
- [CVE-2015-0141](https://cve.now/CVE-2015-0141.md): IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to (no CVSS)
- [CVE-2015-0142](https://cve.now/CVE-2015-0142.md): IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to (no CVSS)
- [CVE-2015-0143](https://cve.now/CVE-2015-0143.md): IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to (no CVSS)
- [CVE-2015-0144](https://cve.now/CVE-2015-0144.md): Cross-site scripting (XSS) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 bef (no CVSS)
- [CVE-2015-0145](https://cve.now/CVE-2015-0145.md): Cross-site request forgery (CSRF) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and (no CVSS)
- [CVE-2015-0195](https://cve.now/CVE-2015-0195.md): Cross-site scripting (XSS) vulnerability in IBM Content Template Catalog 4.x before 4.1.4 for WebSphere Portal 8.0.x and 4.x before 4.3.1 fo (no CVSS)
- [CVE-2015-1888](https://cve.now/CVE-2015-1888.md): Cross-site scripting (XSS) vulnerability in IBM Content Navigator 2.0.2 before 2.0.2-ICN-FP007 and 2.0.3 before 2.0.3-ICN-FP003, as used in (no CVSS)
- [CVE-2015-4955](https://cve.now/CVE-2015-4955.md): Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8 (no CVSS)
- [CVE-2015-5651](https://cve.now/CVE-2015-5651.md): Cross-site scripting (XSS) vulnerability in Dotclear before 2.8.1 allows remote attackers to inject arbitrary web script or HTML via unspeci (no CVSS)
- [CVE-2015-0987](https://cve.now/CVE-2015-0987.md): Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 rely on cleartext password transmission, (CVSS 10.0)
- [CVE-2015-0988](https://cve.now/CVE-2015-0988.md): Omron CX-One CX-Programmer before 9.6 uses a reversible format for password storage in project source-code files, which makes it easier for (no CVSS)
- [CVE-2015-1015](https://cve.now/CVE-2015-1015.md): Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 use a reversible format for password sto (no CVSS)
- [CVE-2015-3938](https://cve.now/CVE-2015-3938.md): The HTTP application on Mitsubishi Electric MELSEC FX3G PLC devices before April 2015 allows remote attackers to cause a denial of service ( (no CVSS)
- [CVE-2015-5640](https://cve.now/CVE-2015-5640.md): baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request. (no CVSS, baserproject/basercms)
- [CVE-2015-5641](https://cve.now/CVE-2015-5641.md): SQL injection vulnerability in baserCMS before 3.0.8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vec (no CVSS)
- [CVE-2015-5642](https://cve.now/CVE-2015-5642.md): Multiple SQL injection vulnerabilities in ICZ MATCHA INVOICE before 2.5.7 allow remote authenticated users to execute arbitrary SQL commands (no CVSS)
- [CVE-2015-5643](https://cve.now/CVE-2015-5643.md): The installer in ICZ MATCHA INVOICE before 2.5.7 does not properly configure the database, which allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2015-5644](https://cve.now/CVE-2015-5644.md): The installer in ICZ MATCHA SNS before 1.3.7 does not properly configure the database, which allows remote attackers to execute arbitrary PH (no CVSS)
- [CVE-2015-5645](https://cve.now/CVE-2015-5645.md): ICZ MATCHA SNS before 1.3.7 allows remote authenticated users to obtain administrative privileges via unspecified vectors. (no CVSS)
- [CVE-2015-5650](https://cve.now/CVE-2015-5650.md): Directory traversal vulnerability in AjaXplorer 2.0 allows remote attackers to read arbitrary files via unspecified vectors. (no CVSS)
- [CVE-2015-6549](https://cve.now/CVE-2015-6549.md): Cross-site scripting (XSS) vulnerability in an application console in the server in Symantec NetBackup OpsCenter before 7.7.1 allows remote (no CVSS)
- [CVE-2015-7314](https://cve.now/CVE-2015-7314.md): The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-fil (no CVSS, gollum)
- [CVE-2015-7686](https://cve.now/CVE-2015-7686.md): Algorithmic complexity vulnerability in Address.pm in the Email-Address module 1.908 and earlier for Perl allows remote attackers to cause a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-10-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.