# CVEs published 2015-11-02

14 CVEs were published on November 2, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-1775](https://cve.now/CVE-2015-1775.md): Server-side request forgery (SSRF) vulnerability in the proxy endpoint (api/v1/proxy) in Apache Ambari before 2.1.0 allows remote authentica (no CVSS, org.apache.ambari:ambari)
- [CVE-2015-3186](https://cve.now/CVE-2015-3186.md): Cross-site scripting (XSS) vulnerability in Apache Ambari before 2.1.0 allows remote authenticated cluster operator users to inject arbitrar (no CVSS)
- [CVE-2015-3270](https://cve.now/CVE-2015-3270.md): Apache Ambari before 2.0.2 or 2.1.x before 2.1.1 allows remote authenticated users to gain administrative privileges via unspecified vectors (no CVSS)
- [CVE-2015-5210](https://cve.now/CVE-2015-5210.md): Open redirect vulnerability in Apache Ambari before 2.1.2 allows remote attackers to redirect users to arbitrary web sites and conduct phish (no CVSS, org.apache.ambari:ambari)
- [CVE-2015-5291](https://cve.now/CVE-2015-5291.md): Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allow (no CVSS)
- [CVE-2015-5308](https://cve.now/CVE-2015-5308.md): Multiple SQL injection vulnerabilities in cs\_admin\_users.php in the wp-championship plugin 5.8 for WordPress allow remote attackers to execu (no CVSS)
- [CVE-2015-5470](https://cve.now/CVE-2015-5470.md): The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 (no CVSS)
- [CVE-2015-5534](https://cve.now/CVE-2015-5534.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Oxwall before 1.8 allow remote attackers to hijack the authentication of admin (no CVSS)
- [CVE-2015-6031](https://cve.now/CVE-2015-6031.md): Buffer overflow in the IGDstartelt function in igd\_desc\_parse.c in the MiniUPnP client (aka MiniUPnPc) before 1.9.20150917 allows remote UPN (no CVSS)
- [CVE-2015-8036](https://cve.now/CVE-2015-8036.md): Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a (no CVSS)
- [CVE-2015-8037](https://cve.now/CVE-2015-8037.md): Multiple cross-site scripting (XSS) vulnerabilities in the Graphical User Interface (GUI) in Fortinet FortiManager before 5.2.4 allow remote (no CVSS)
- [CVE-2015-8038](https://cve.now/CVE-2015-8038.md): Multiple cross-site scripting (XSS) vulnerabilities in the Graphical User Interface (GUI) in Fortinet FortiManager before 5.2.4 allow remote (no CVSS)
- [CVE-2015-8039](https://cve.now/CVE-2015-8039.md): Samsung SmartViewer allows remote attackers to execute arbitrary code via unspecified vectors to the (1) DVRSetupSave method in the STWAxCon (no CVSS)
- [CVE-2015-8040](https://cve.now/CVE-2015-8040.md): The rtsp\_getdlsendtime method in the CNC\_Ctrl control in Samsung SmartViewer allows remote attackers to execute arbitrary code via an index (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-11-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.