# CVEs published 2015-11-04

13 CVEs were published on November 4, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-2902](https://cve.now/CVE-2015-2902.md): HP ArcSight SmartConnectors before 7.1.6 do not verify X.509 certificates from Logger devices, which allows man-in-the-middle attackers to s (no CVSS)
- [CVE-2015-2903](https://cve.now/CVE-2015-2903.md): The CWSAPI SOAP service in HP ArcSight SmartConnectors before 7.1.6 has a hardcoded password, which makes it easier for remote attackers to (no CVSS)
- [CVE-2015-4927](https://cve.now/CVE-2015-4927.md): The Reporting and Monitoring component in Tivoli Monitoring in IBM Tivoli Storage Manager 6.3 before 6.3.6 and 7.1 before 7.1.3 on Linux and (no CVSS)
- [CVE-2015-5021](https://cve.now/CVE-2015-5021.md): IBM InfoSphere Information Server 11.3 and 11.5 allows remote authenticated DataStage users to bypass intended job-execution restrictions or (no CVSS)
- [CVE-2015-5673](https://cve.now/CVE-2015-5673.md): eventapp/lib/gcloud.rb in the ISUCON5 qualifier portal (aka eventapp) web application before 2015-10-30 makes improper popen calls, which al (no CVSS)
- [CVE-2015-6029](https://cve.now/CVE-2015-6029.md): HP ArcSight Logger before 6.0 P2 does not limit attempts to authenticate to the SOAP interface, which makes it easier for remote attackers t (no CVSS)
- [CVE-2015-6030](https://cve.now/CVE-2015-6030.md): HP ArcSight Logger 6.0.0.7307.1, ArcSight Command Center 6.8.0.1896.0, and ArcSight Connector Appliance 6.4.0.6881.3 use the root account to (no CVSS)
- [CVE-2015-6355](https://cve.now/CVE-2015-6355.md): The web interface in Cisco Unified Computing System (UCS) 2.2(5b)A on blade servers allows remote attackers to obtain potentially sensitive (no CVSS)
- [CVE-2015-6356](https://cve.now/CVE-2015-6356.md): Cross-site scripting (XSS) vulnerability in the WeChat page in Cisco Social Miner 10.0(1) allows remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2015-6867](https://cve.now/CVE-2015-6867.md): The vertica-udx-zygote process in HP Vertica 7.1.1 UDx does not require authentication, which allows remote attackers to execute arbitrary c (no CVSS)
- [CVE-2015-7244](https://cve.now/CVE-2015-7244.md): The default configuration of the server in MobaXterm before 8.3 has a disabled Access Control setting and consequently does not require auth (no CVSS)
- [CVE-2015-7253](https://cve.now/CVE-2015-7253.md): The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted serialized data in a coo (no CVSS)
- [CVE-2015-7650](https://cve.now/CVE-2015-7650.md): Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrob (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-11-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.