# CVEs published 2015-10-29

22 CVEs were published on October 29, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-3230](https://cve.now/CVE-2015-3230.md): 389 Directory Server (formerly Fedora Directory Server) before 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSo (no CVSS)
- [CVE-2015-5285](https://cve.now/CVE-2015-5285.md): CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response spli (no CVSS, kallithea)
- [CVE-2015-5955](https://cve.now/CVE-2015-5955.md): ownCloud iOS app before 3.4.4 does not properly switch state between multiple instances, which might allow remote instance administrators to (no CVSS)
- [CVE-2015-7297](https://cve.now/CVE-2015-7297.md): SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a (no CVSS)
- [CVE-2015-7713](https://cve.now/CVE-2015-7713.md): OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do not properly apply security group changes, which allo (no CVSS, nova)
- [CVE-2015-7857](https://cve.now/CVE-2015-7857.md): SQL injection vulnerability in the getListQuery function in administrator/components/com\_contenthistory/models/history.php in Joomla! 3.2 be (no CVSS)
- [CVE-2015-7858](https://cve.now/CVE-2015-7858.md): SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a (no CVSS)
- [CVE-2015-7859](https://cve.now/CVE-2015-7859.md): The com\_contenthistory component in Joomla! 3.2 before 3.4.5 does not properly check ACLs, which allows remote attackers to obtain sensitive (no CVSS)
- [CVE-2015-7899](https://cve.now/CVE-2015-7899.md): The com\_content component in Joomla! 3.x before 3.4.5 does not properly check ACLs, which allows remote attackers to obtain sensitive inform (no CVSS)
- [CVE-2015-5292](https://cve.now/CVE-2015-5292.md): Memory leak in the Privilege Attribute Certificate (PAC) responder plugin (sssd\_pac\_plugin.so) in System Security Services Daemon (SSSD) 1.1 (no CVSS)
- [CVE-2015-2898](https://cve.now/CVE-2015-2898.md): Multiple stack-based buffer overflows in Medicomp MEDCIN Engine before 2.22.20153.226 might allow remote attackers to execute arbitrary code (no CVSS)
- [CVE-2015-2899](https://cve.now/CVE-2015-2899.md): Heap-based buffer overflow in the QualifierList retrieve\_qualifier\_list function in Medicomp MEDCIN Engine before 2.22.20153.226 might allow (no CVSS)
- [CVE-2015-2900](https://cve.now/CVE-2015-2900.md): The AddUserFinding add\_userfinding2 function in Medicomp MEDCIN Engine before 2.22.20153.226 allows remote attackers to cause a denial of se (no CVSS)
- [CVE-2015-2901](https://cve.now/CVE-2015-2901.md): Multiple stack-based buffer overflows in Medicomp MEDCIN Engine 2.22.20142.166 might allow remote attackers to execute arbitrary code via a (no CVSS)
- [CVE-2015-4994](https://cve.now/CVE-2015-4994.md): Buffer overflow in IBM Domino 8.5.1 through 8.5.3 before 8.5.3 FP6 IF10 and 9.x before 9.0.1 FP4 IF3 allows remote attackers to execute arbi (no CVSS)
- [CVE-2015-4997](https://cve.now/CVE-2015-4997.md): IBM WebSphere Portal 8.5.0 before CF08 allows remote attackers to bypass intended access restrictions via a crafted request. (no CVSS)
- [CVE-2015-5040](https://cve.now/CVE-2015-5040.md): Buffer overflow in IBM Domino 8.5.1 through 8.5.3 before 8.5.3 FP6 IF10 and 9.x before 9.0.1 FP4 IF3 allows remote attackers to execute arbi (no CVSS)
- [CVE-2015-5668](https://cve.now/CVE-2015-5668.md): SQL injection vulnerability in Techno Project Japan Enisys Gw before 1.4.1 allows remote attackers to execute arbitrary SQL commands via uns (no CVSS)
- [CVE-2015-5669](https://cve.now/CVE-2015-5669.md): Techno Project Japan Enisys Gw before 1.4.1 allows remote authenticated users to write to arbitrary files and consequently execute arbitrary (no CVSS)
- [CVE-2015-5670](https://cve.now/CVE-2015-5670.md): Cross-site scripting (XSS) vulnerability in Techno Project Japan Enisys Gw before 1.4.1 allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2015-5671](https://cve.now/CVE-2015-5671.md): Techno Project Japan Enisys Gw before 1.4.1 allows remote attackers to bypass intended access restrictions and read arbitrary uploaded files (no CVSS)
- [CVE-2015-6006](https://cve.now/CVE-2015-6006.md): The AddUserFinding implementation in Medicomp MEDCIN Engine 2.22.20153.x before 2.22.20153.226 might allow remote attackers to execute arbit (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-10-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.