# CVEs published 2015-11-06

22 CVEs were published on November 6, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2014-9749](https://cve.now/CVE-2014-9749.md): Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote authenticated users to retain access (no CVSS)
- [CVE-2015-5225](https://cve.now/CVE-2015-5225.md): Buffer overflow in the vnc\_refresh\_server\_surface function in the VNC display driver in QEMU before 2.4.0.1 allows guest users to cause a de (no CVSS)
- [CVE-2015-6855](https://cve.now/CVE-2015-6855.md): hw/ide/core.c in QEMU does not properly restrict the commands accepted by an ATAPI device, which allows guest users to cause a denial of ser (no CVSS)
- [CVE-2015-7762](https://cve.now/CVE-2015-7762.md): rx/rx.c in OpenAFS before 1.6.15 and 1.7.x before 1.7.33 does not properly initialize the padding of a data structure when constructing an R (no CVSS)
- [CVE-2015-7763](https://cve.now/CVE-2015-7763.md): rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an (no CVSS)
- [CVE-2015-7809](https://cve.now/CVE-2015-7809.md): The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute a (no CVSS, twig/twig)
- [CVE-2015-8081](https://cve.now/CVE-2015-8081.md): The Field as Block module 7.x-1.x before 7.x-1.4 for Drupal might allow remote attackers to obtain sensitive field information by reading a (no CVSS)
- [CVE-2015-8082](https://cve.now/CVE-2015-8082.md): The Login Disable module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.2 for Drupal does not properly load the user\_logout function, which (no CVSS)
- [CVE-2015-5305](https://cve.now/CVE-2015-5305.md): Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files v (no CVSS, k8s.io/kubernetes · github.com/kubernetes/kubernetes)
- [CVE-2015-6546](https://cve.now/CVE-2015-6546.md): The vCMP host in F5 BIG-IP Analytics, APM, ASM, GTM, Link Controller, and LTM 11.0.0 before 11.6.0, BIG-IP AAM 11.4.0 before 11.6.0, BIG-IP (no CVSS)
- [CVE-2015-7394](https://cve.now/CVE-2015-7394.md): The datastor kernel module in F5 BIG-IP Analytics, APM, ASM, Link Controller, and LTM 11.1.0 before 12.0.0, BIG-IP AAM 11.4.0 before 12.0.0, (no CVSS)
- [CVE-2015-7696](https://cve.now/CVE-2015-7696.md): Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly exec (no CVSS)
- [CVE-2015-7697](https://cve.now/CVE-2015-7697.md): Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (infinite loop) via empty bzip2 data in a ZIP archive. (no CVSS)
- [CVE-2015-4282](https://cve.now/CVE-2015-4282.md): Cisco Mobility Services Engine (MSE) through 8.0.120.7 uses weak permissions for unspecified binary files, which allows local users to obtai (no CVSS)
- [CVE-2015-5672](https://cve.now/CVE-2015-5672.md): TYPE-MOON Fate/stay night, Fate/hollow ataraxia, Witch on the Holy Night, and Fate/stay night + hollow ataraxia set allow remote attackers t (no CVSS)
- [CVE-2015-6292](https://cve.now/CVE-2015-6292.md): The proxy-cache implementation in Cisco AsyncOS 8.0.x before 8.0.7-151, 8.1.x and 8.5.x before 8.5.2-004, 8.6.x and 8.7.x before 8.7.0-171-L (no CVSS)
- [CVE-2015-6298](https://cve.now/CVE-2015-6298.md): The admin web interface in Cisco AsyncOS 8.x before 8.0.8-113, 8.1.x and 8.5.x before 8.5.3-051, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8. (no CVSS)
- [CVE-2015-6316](https://cve.now/CVE-2015-6316.md): The default configuration of sshd\_config in Cisco Mobility Services Engine (MSE) through 8.0.120.7 allows logins by the oracle account, whic (no CVSS)
- [CVE-2015-7770](https://cve.now/CVE-2015-7770.md): Dell SonicWall TotalSecure TZ 100 devices with firmware before 5.9.1.0-22o allow remote attackers to cause a denial of service via a crafted (no CVSS)
- [CVE-2015-6291](https://cve.now/CVE-2015-6291.md): Cisco AsyncOS before 8.5.7-043, 9.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-046 on Email Security Appliance (ESA) devices mishand (no CVSS)
- [CVE-2015-6293](https://cve.now/CVE-2015-6293.md): Cisco AsyncOS 8.x before 8.0.8-113, 8.1.x and 8.5.x before 8.5.3-051, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085 on Web (no CVSS)
- [CVE-2015-6321](https://cve.now/CVE-2015-6321.md): Cisco AsyncOS before 8.5.7-042, 9.x before 9.1.0-032, 9.1.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-042 on Email Security Applian (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-11-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.