# CVEs published 2015-11-08 19 CVEs were published on November 8, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2015-1989](https://cve.now/CVE-2015-1989.md): SQL injection vulnerability in IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 allows remote authenticated users to execut (no CVSS) - [CVE-2015-1993](https://cve.now/CVE-2015-1993.md): IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not set the secure flag for unspecified cookies in an https session, (no CVSS) - [CVE-2015-1994](https://cve.now/CVE-2015-1994.md): IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not include the HTTPOnly flag in a Set-Cookie header for the session (no CVSS) - [CVE-2015-1995](https://cve.now/CVE-2015-1995.md): Multiple cross-site scripting (XSS) vulnerabilities in IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 allow remote attack (no CVSS) - [CVE-2015-1996](https://cve.now/CVE-2015-1996.md): IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not prevent caching of HTTPS responses, which allows physically proxi (no CVSS) - [CVE-2015-1997](https://cve.now/CVE-2015-1997.md): Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar Vulnerability Manager 7.2.x before 7.2.5 Patch 5 allows remote attack (no CVSS) - [CVE-2015-1999](https://cve.now/CVE-2015-1999.md): IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 places session IDs in https URLs, which allows remote attackers to obtain (no CVSS) - [CVE-2015-2017](https://cve.now/CVE-2015-2017.md): CRLF injection vulnerability in IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.12, and 8 (no CVSS) - [CVE-2015-4928](https://cve.now/CVE-2015-4928.md): Apache Ambari before 2.1, as used in IBM Infosphere BigInsights 4.x before 4.1, includes cleartext passwords on a Configs screen, which allo (no CVSS) - [CVE-2015-4940](https://cve.now/CVE-2015-4940.md): Apache Ambari before 2.1, as used in IBM Infosphere BigInsights 4.x before 4.1, stores a cleartext BigSheets password in a configuration fil (no CVSS) - [CVE-2015-4963](https://cve.now/CVE-2015-4963.md): IBM Security Access Manager for Web 7.x before 7.0.0.16 and 8.x before 8.0.1.3 mishandles WebSEAL HTTPTransformation requests, which allows (no CVSS) - [CVE-2015-4966](https://cve.now/CVE-2015-4966.md): IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 FP009, and 7.6.0 before 7.6.0.2 IFIX001; Maximo Asset Management 7.5. (no CVSS) - [CVE-2015-5005](https://cve.now/CVE-2015-5005.md): CSPOC in IBM PowerHA SystemMirror on AIX 6.1 and 7.1 allows remote authenticated users to perform an "su root" action by leveraging presence (no CVSS) - [CVE-2015-5015](https://cve.now/CVE-2015-5015.md): IBM WebSphere Commerce Enterprise 7.0.0.9 and 8.x before Feature Pack 8 allows remote attackers to obtain sensitive information via a crafte (no CVSS) - [CVE-2015-5019](https://cve.now/CVE-2015-5019.md): IBM Sterling Integrator 5.1 before 5010004\_8 and Sterling B2B Integrator 5.2 before 5020500\_9 allow remote authenticated users to read or up (no CVSS) - [CVE-2015-5043](https://cve.now/CVE-2015-5043.md): diag in IBM Security Guardium 8.2 before p6015, 9.0 before p6015, 9.1, 9.5, and 10.0 before p6015 allows local users to obtain root access v (no CVSS) - [CVE-2015-5044](https://cve.now/CVE-2015-5044.md): The Flow Collector in IBM Security QRadar QFLOW 7.1.x before 7.1 MR2 Patch 11 IF3 and 7.2.x before 7.2.5 Patch 4 IF3 allows remote attackers (no CVSS) - [CVE-2015-7412](https://cve.now/CVE-2015-7412.md): The GatewayScript modules on IBM DataPower Gateways with software 7.2.0.x before 7.2.0.1, when the GatewayScript decryption API or a JWE dec (no CVSS) - [CVE-2015-7395](https://cve.now/CVE-2015-7395.md): IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX005, and 7.6.0 before 7.6.0.2 FP002; Maximo Asset Management 7.5. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-11-08 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.