# CVEs published 2015-10-05 20 CVEs were published on October 5, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2015-7322](https://cve.now/CVE-2015-7322.md): The Secure Meeting (Pulse Collaboration) in Pulse Connect Secure (formerly Juniper Junos Pulse) before 7.1R22.1, 7.4, 8.0 before 8.0R11, and (no CVSS) - [CVE-2015-7323](https://cve.now/CVE-2015-7323.md): The Secure Meeting (Pulse Collaboration) in Pulse Connect Secure (formerly Juniper Junos Pulse) before 7.1R22.1, 7.4, 8.0 before 8.0R11, and (no CVSS) - [CVE-2015-7707](https://cve.now/CVE-2015-7707.md): Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.j (no CVSS) - [CVE-2015-7708](https://cve.now/CVE-2015-7708.md): Cross-site scripting (XSS) vulnerability in 4images 1.7.11 and earlier allows remote attackers to inject arbitrary web script or HTML via th (no CVSS) - [CVE-2015-7709](https://cve.now/CVE-2015-7709.md): The arkeiad daemon in the Arkeia Backup Agent in Western Digital Arkeia 11.0.12 and earlier allows remote attackers to bypass authentication (no CVSS) - [CVE-2015-5687](https://cve.now/CVE-2015-5687.md): system/session/drivers/cookie.php in Anchor CMS 0.9.x allows remote attackers to conduct PHP object injection attacks and execute arbitrary (no CVSS) - [CVE-2015-7392](https://cve.now/CVE-2015-7392.md): Heap-based buffer overflow in the parse\_string function in libs/esl/src/esl\_json.c in FreeSWITCH before 1.4.23 and 1.6.x before 1.6.2 allows (no CVSS) - [CVE-2015-7684](https://cve.now/CVE-2015-7684.md): Unrestricted file upload in GLPI before 0.85.3 allows remote authenticated users to execute arbitrary code by adding a file with an executab (no CVSS) - [CVE-2015-7685](https://cve.now/CVE-2015-7685.md): GLPI before 0.85.3 allows remote authenticated users to create super-admin accounts by leveraging permissions to create a user and the \_prof (no CVSS) - [CVE-2015-4939](https://cve.now/CVE-2015-4939.md): Cross-site scripting (XSS) vulnerability in IBM Emptoris Supplier Lifecycle Management and Emptoris Program Management 10.x before 10.0.1.4\_ (no CVSS) - [CVE-2015-4944](https://cve.now/CVE-2015-4944.md): Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX003, and 7.6.0 before (no CVSS) - [CVE-2015-4964](https://cve.now/CVE-2015-4964.md): IBM UrbanCode Deploy 6.0 and 6.0.1.x before 6.0.1.10, 6.1.1.x before 6.1.1.8, and 6.1.2 writes admin AUTH\_TOKEN values to execution logs, wh (no CVSS) - [CVE-2015-4965](https://cve.now/CVE-2015-4965.md): maximouiweb/webmodule/webclient/utility/merlin.jsp in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX004, and 7. (no CVSS) - [CVE-2015-4967](https://cve.now/CVE-2015-4967.md): SQL injection vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX004, and 7.6.0 before 7.6.0.1 IFIX (no CVSS) - [CVE-2015-4971](https://cve.now/CVE-2015-4971.md): Cross-site scripting (XSS) vulnerability in IBM Emptoris Strategic Supply Management Platform and Emptoris Program Management 10.x before 10 (no CVSS) - [CVE-2015-4973](https://cve.now/CVE-2015-4973.md): Cross-site scripting (XSS) vulnerability in IBM Multi-Enterprise Integration Gateway 1.x through 1.0.0.1 and B2B Advanced Communications 1.0 (no CVSS) - [CVE-2015-4992](https://cve.now/CVE-2015-4992.md): IBM Sterling B2B Integrator 5.2 before 5020500\_8 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors. (no CVSS) - [CVE-2015-5022](https://cve.now/CVE-2015-5022.md): IBM Multi-Enterprise Integration Gateway 1.x through 1.0.0.1 and B2B Advanced Communications 1.0.0.2 and 1.0.0.3 before 1.0.0.3\_2, when acce (no CVSS) - [CVE-2015-5024](https://cve.now/CVE-2015-5024.md): IBM Emptoris Sourcing 10.0.2.0 before iFix6, 10.0.2.2 before iFix11, 10.0.2.3, 10.0.2.5 before iFix4, 10.0.2.6 before iFix8, 10.0.2.7 before (no CVSS) - [CVE-2015-5652](https://cve.now/CVE-2015-5652.md): Untrusted search path vulnerability in python.exe in Python through 3.5.0 on Windows allows local users to gain privileges via a Trojan hors (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-10-05 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.