# CVEs published 2015-10-28

26 CVEs were published on October 28, 2015: 1 critical, 1 high. Days are UTC.

- [CVE-2014-8912](https://cve.now/CVE-2014-8912.md): IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 through 8.0.0.1 CF18, and 8.5 (no CVSS)
- [CVE-2015-6034](https://cve.now/CVE-2015-6034.md): EPSON Network Utility 4.10 uses weak permissions (Everyone: Full Control) for eEBSVC.exe, which allows local users to gain privileges via a (no CVSS)
- [CVE-2015-7649](https://cve.now/CVE-2015-7649.md): Adobe Shockwave Player before 12.2.1.171 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via uns (no CVSS)
- [CVE-2015-3967](https://cve.now/CVE-2015-3967.md): Cross-site request forgery (CSRF) vulnerability on Janitza UMG 508, 509, 511, 604, and 605 devices allows remote attackers to hijack the aut (no CVSS)
- [CVE-2015-3968](https://cve.now/CVE-2015-3968.md): The FTP service on Janitza UMG 508, 509, 511, 604, and 605 devices has a default password, which makes it easier for remote attackers to rea (no CVSS)
- [CVE-2015-3969](https://cve.now/CVE-2015-3969.md): Janitza UMG 508, 509, 511, 604, and 605 devices allow remote attackers to obtain sensitive network-connection information via a request to U (no CVSS)
- [CVE-2015-3970](https://cve.now/CVE-2015-3970.md): Multiple cross-site scripting (XSS) vulnerabilities in the web interface on Janitza UMG 508, 509, 511, 604, and 605 devices allow remote att (no CVSS)
- [CVE-2015-3971](https://cve.now/CVE-2015-3971.md): The debug interface on Janitza UMG 508, 509, 511, 604, and 605 devices does not require authentication, which allows remote attackers to rea (no CVSS)
- [CVE-2015-3972](https://cve.now/CVE-2015-3972.md): The web interface on Janitza UMG 508, 509, 511, 604, and 605 devices supports only short PIN values for authentication, which makes it easie (no CVSS)
- [CVE-2015-3973](https://cve.now/CVE-2015-3973.md): Janitza UMG 508, 509, 511, 604, and 605 devices improperly generate session tokens, which makes it easier for remote attackers to determine (no CVSS)
- [CVE-2015-5712](https://cve.now/CVE-2015-5712.md): Spotfire Parsing Library and Spotfire Security Filter in TIBCO Spotfire Server 5.5.x before 5.5.4, 6.0.x before 6.0.5, 6.5.x before 6.5.4, a (no CVSS)
- [CVE-2015-5713](https://cve.now/CVE-2015-5713.md): Spotfire Parsing Library and Spotfire Security Filter in TIBCO Spotfire Server 5.5.x before 5.5.4, 6.0.x before 6.0.5, 6.5.x before 6.5.4, a (no CVSS)
- [CVE-2015-6486](https://cve.now/CVE-2015-6486.md): SQL injection vulnerability on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allows remote (no CVSS)
- [CVE-2015-6488](https://cve.now/CVE-2015-6488.md): Cross-site scripting (XSS) vulnerability in the web server on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices bef (no CVSS)
- [CVE-2015-6490](https://cve.now/CVE-2015-6490.md): Stack-based buffer overflow on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices through B FRN 15.003 allows remote (CVSS 9.8)
- [CVE-2015-6491](https://cve.now/CVE-2015-6491.md): Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allow remote authenticated users to insert th (no CVSS)
- [CVE-2015-6492](https://cve.now/CVE-2015-6492.md): Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allow remote attackers to cause a denial of s (CVSS 7.5)
- [CVE-2015-6493](https://cve.now/CVE-2015-6493.md): Cross-site request forgery (CSRF) vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430 allows remot (no CVSS)
- [CVE-2015-6494](https://cve.now/CVE-2015-6494.md): Cross-site scripting (XSS) vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authen (no CVSS)
- [CVE-2015-7836](https://cve.now/CVE-2015-7836.md): Siemens RUGGEDCOM ROS before 4.2.1 allows remote attackers to obtain sensitive information by sniffing the network for VLAN data within the (no CVSS)
- [CVE-2015-7873](https://cve.now/CVE-2015-7873.md): The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via t (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2015-7900](https://cve.now/CVE-2015-7900.md): Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote attackers to obtain sensitive debugging informatio (no CVSS)
- [CVE-2015-7901](https://cve.now/CVE-2015-7901.md): Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430 allows remote authenticated users to execute arbitrary OS comma (no CVSS)
- [CVE-2015-7902](https://cve.now/CVE-2015-7902.md): Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 provides different error messages for failed login attempts in u (no CVSS)
- [CVE-2015-7903](https://cve.now/CVE-2015-7903.md): SQL injection vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users (no CVSS)
- [CVE-2015-7904](https://cve.now/CVE-2015-7904.md): Unrestricted file upload vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenti (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-10-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.