# CVEs published 2015-11-18

17 CVEs were published on November 18, 2015: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2015-5255](https://cve.now/CVE-2015-5255.md): Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x (no CVSS)
- [CVE-2015-8051](https://cve.now/CVE-2015-8051.md): The Adobe Premiere Clip app before 1.2.1 for iOS mishandles unspecified input, which has unknown impact and attack vectors. (no CVSS)
- [CVE-2015-8052](https://cve.now/CVE-2015-8052.md): Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject ar (no CVSS)
- [CVE-2015-8053](https://cve.now/CVE-2015-8053.md): Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject ar (no CVSS)
- [CVE-2015-8090](https://cve.now/CVE-2015-8090.md): The Web Server component in TIBCO LogLogic Unity before 1.1.1 allows remote authenticated users to gain privileges, and consequently obtain (no CVSS)
- [CVE-2015-5253](https://cve.now/CVE-2015-5253.md): The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote authenticated users to bypass (no CVSS, org.apache.cxf:cxf-rt-rs-security-sso-saml)
- [CVE-2015-5999](https://cve.now/CVE-2015-5999.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DIR-816L Wireless Router with firmware before 2.06.B09\_BETA allow r (no CVSS)
- [CVE-2015-7941](https://cve.now/CVE-2015-7941.md): libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bo (no CVSS)
- [CVE-2015-7942](https://cve.now/CVE-2015-7942.md): The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid i (no CVSS)
- [CVE-2015-8023](https://cve.now/CVE-2015-8023.md): The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not pro (no CVSS)
- [CVE-2015-8035](https://cve.now/CVE-2015-8035.md): The xz\_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to (no CVSS)
- [CVE-2015-4852](https://cve.now/CVE-2015-4852.md): The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary (CVSS 9.8, KEV)
- [CVE-2015-6372](https://cve.now/CVE-2015-6372.md): Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Firepower Extensible Operating System 1.1(1.160) on (no CVSS)
- [CVE-2015-6373](https://cve.now/CVE-2015-6373.md): Cross-site request forgery (CSRF) vulnerability in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows r (no CVSS)
- [CVE-2015-6330](https://cve.now/CVE-2015-6330.md): Cross-site request forgery (CSRF) vulnerability in Cisco Prime Collaboration Assurance 10.5(1) and 10.6 allows remote attackers to hijack th (no CVSS)
- [CVE-2015-6357](https://cve.now/CVE-2015-6357.md): The rule-update feature in Cisco FireSIGHT Management Center (MC) 5.2 through 5.4.0.1 does not verify the X.509 certificate of the support.s (no CVSS)
- [CVE-2015-6847](https://cve.now/CVE-2015-6847.md): The default configuration of EMC VPLEX GeoSynchrony 5.4 SP1 before P3 stores cleartext NAVISPHERE GUI passwords in a log file, which allows (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-11-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.