# CVEs published 2015-11-09

24 CVEs were published on November 9, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-8001](https://cve.now/CVE-2015-8001.md): The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not restrict the uploade (no CVSS)
- [CVE-2015-8002](https://cve.now/CVE-2015-8002.md): The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated u (no CVSS)
- [CVE-2015-8003](https://cve.now/CVE-2015-8003.md): MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not throttle file uploads, which allows remote authenticated u (no CVSS)
- [CVE-2015-8004](https://cve.now/CVE-2015-8004.md): MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not properly restrict access to revisions, which allows remote (no CVSS)
- [CVE-2015-8005](https://cve.now/CVE-2015-8005.md): MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 uses the thumbnail ImageMagick command line argument, which allows (no CVSS)
- [CVE-2015-8006](https://cve.now/CVE-2015-8006.md): Cross-site scripting (XSS) vulnerability in the PageTriage toolbar in the PageTriage extension for MediWiki allows remote attackers to injec (no CVSS)
- [CVE-2015-8007](https://cve.now/CVE-2015-8007.md): The Echo extension for MediWiki does not properly implement the hideuser functionality, which allows remote authenticated users to see hidde (no CVSS)
- [CVE-2014-8873](https://cve.now/CVE-2014-8873.md): A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime- (no CVSS)
- [CVE-2015-3240](https://cve.now/CVE-2015-3240.md): The pluto IKE daemon in libreswan before 3.15 and Openswan before 2.6.45, when built with NSS, allows remote attackers to cause a denial of (no CVSS)
- [CVE-2015-5218](https://cve.now/CVE-2015-5218.md): Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a cra (no CVSS)
- [CVE-2015-7295](https://cve.now/CVE-2015-7295.md): hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allo (no CVSS)
- [CVE-2015-7940](https://cve.now/CVE-2015-7940.md): The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attacke (no CVSS, org.bouncycastle:bcprov-jdk15 · org.bouncycastle:bcprov-… +1)
- [CVE-2015-8041](https://cve.now/CVE-2015-8041.md): Multiple integer overflows in the NDEF record parser in hostapd before 2.5 and wpa\_supplicant before 2.5 allow remote attackers to cause a d (no CVSS)
- [CVE-2015-8095](https://cve.now/CVE-2015-8095.md): The recycle bin feature in the Monster Menus module 7.x-1.21 before 7.x-1.24 for Drupal does not properly remove nodes from view, which allo (no CVSS)
- [CVE-2015-8096](https://cve.now/CVE-2015-8096.md): Integer overflow in Google Picasa 3.9.140 Build 239 and Build 248 allows remote attackers to execute arbitrary code via unspecified vectors (no CVSS)
- [CVE-2015-2213](https://cve.now/CVE-2015-2213.md): SQL injection vulnerability in the wp\_untrash\_post\_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attacke (no CVSS)
- [CVE-2015-5730](https://cve.now/CVE-2015-5730.md): The sanitize\_widget\_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time c (no CVSS)
- [CVE-2015-5731](https://cve.now/CVE-2015-5731.md): Cross-site request forgery (CSRF) vulnerability in wp-admin/post.php in WordPress before 4.2.4 allows remote attackers to hijack the authent (no CVSS)
- [CVE-2015-5732](https://cve.now/CVE-2015-5732.md): Cross-site scripting (XSS) vulnerability in the form function in the WP\_Nav\_Menu\_Widget class in wp-includes/default-widgets.php in WordPres (no CVSS)
- [CVE-2015-5733](https://cve.now/CVE-2015-5733.md): Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4 (no CVSS)
- [CVE-2015-5734](https://cve.now/CVE-2015-5734.md): Cross-site scripting (XSS) vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allow (no CVSS)
- [CVE-2015-2695](https://cve.now/CVE-2015-2695.md): lib/gssapi/spnego/spnego\_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote atta (no CVSS)
- [CVE-2015-2696](https://cve.now/CVE-2015-2696.md): lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers t (no CVSS)
- [CVE-2015-2697](https://cve.now/CVE-2015-2697.md): The build\_principal\_va function in lib/krb5/krb/bld\_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to ca (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-11-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.