# CVEs published 2015-11-24

18 CVEs were published on November 24, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-0856](https://cve.now/CVE-2015-0856.md): daemon/Greeter.cpp in sddm before 0.13.0 does not properly disable the KDE crash handler, which allows local users to gain privileges by cra (no CVSS)
- [CVE-2015-5053](https://cve.now/CVE-2015-5053.md): The host memory mapping path feature in the NVIDIA GPU graphics driver R346 before 346.87 and R352 before 352.41 for Linux and R352 before 3 (no CVSS)
- [CVE-2015-5281](https://cve.now/CVE-2015-5281.md): The grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, when used on UEFI systems, allows local users to bypass intended Se (no CVSS)
- [CVE-2015-7496](https://cve.now/CVE-2015-7496.md): GNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the lock screen by holding the Escape key. (no CVSS)
- [CVE-2015-7808](https://cve.now/CVE-2015-7808.md): The vB\_Api\_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection a (no CVSS)
- [CVE-2015-7865](https://cve.now/CVE-2015-7865.md): nvSCPAPISvr.exe in the Stereoscopic 3D Driver Service in the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 bef (no CVSS)
- [CVE-2015-7866](https://cve.now/CVE-2015-7866.md): Unquoted Windows search path vulnerability in the Smart Maximize Helper (nvSmartMaxApp.exe) in the Control Panel in the NVIDIA GPU graphics (no CVSS)
- [CVE-2015-7869](https://cve.now/CVE-2015-7869.md): Multiple integer overflows in the kernel mode driver for the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 bef (no CVSS)
- [CVE-2015-7981](https://cve.now/CVE-2015-7981.md): The png\_convert\_to\_rfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before 1.2.54, and 1.4.x before 1.4.17 allows remote attac (no CVSS)
- [CVE-2015-7985](https://cve.now/CVE-2015-7985.md): Valve Steam 2.10.91.91 uses weak permissions (Users: read and write) for the Install folder, which allows local users to gain privileges via (no CVSS)
- [CVE-2015-8227](https://cve.now/CVE-2015-8227.md): The built-in web server in Huawei VP9660 multi-point control unit with software before V200R001C30SPC700 allows remote administrators to obt (no CVSS)
- [CVE-2015-8228](https://cve.now/CVE-2015-8228.md): Directory traversal vulnerability in the SFTP server in Huawei AR 120, 150, 160, 200, 500, 1200, 2200, 3200, and 3600 routers with software (no CVSS)
- [CVE-2015-8229](https://cve.now/CVE-2015-8229.md): Huawei eSpace U2980 unified gateway with software before V100R001C10 and U2990 with software before V200R001C10 allow remote authenticated u (no CVSS)
- [CVE-2015-8328](https://cve.now/CVE-2015-8328.md): Unspecified vulnerability in the NVAPI support layer in the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 befo (no CVSS)
- [CVE-2015-8329](https://cve.now/CVE-2015-8329.md): SAP Manufacturing Integration and Intelligence (aka MII, formerly xMII) uses weak encryption (Base64 and DES), which allows attackers to con (no CVSS)
- [CVE-2015-8330](https://cve.now/CVE-2015-8330.md): The PCo agent in SAP Plant Connectivity (PCo) allows remote attackers to cause a denial of service (memory corruption and agent crash) via c (no CVSS)
- [CVE-2015-6377](https://cve.now/CVE-2015-6377.md): Cisco Virtual Topology System (VTS) 2.0(0) and 2.0(1) allows remote attackers to cause a denial of service (CPU and memory consumption, and (no CVSS)
- [CVE-2015-6380](https://cve.now/CVE-2015-6380.md): An unspecified script in the web interface in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows remote (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-11-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.