# CVEs published 2015-11-25 19 CVEs were published on November 25, 2015: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2014-3665](https://cve.now/CVE-2014-3665.md): Jenkins before 1.587 and LTS before 1.580.1 do not properly ensure trust separation between a master and slaves, which might allow remote at (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2015-5242](https://cve.now/CVE-2015-5242.md): OpenStack Swift-on-File (aka Swiftonfile) does not properly restrict use of the pickle Python module when loading metadata, which allows rem (no CVSS) - [CVE-2015-5306](https://cve.now/CVE-2015-5306.md): OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access th (no CVSS, python-ironic-inspector-client ยท ironic-inspector) - [CVE-2015-5317](https://cve.now/CVE-2015-5317.md): The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name in (CVSS 7.5, KEV, org.jenkins-ci.main:jenkins-core) - [CVE-2015-5318](https://cve.now/CVE-2015-5318.md): Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for re (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2015-5319](https://cve.now/CVE-2015-5319.md): XML external entity (XXE) vulnerability in the create-job CLI command in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2015-5320](https://cve.now/CVE-2015-5320.md): Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote att (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2015-5321](https://cve.now/CVE-2015-5321.md): The sidepanel widgets in the CLI command overview and help pages in Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to ob (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2015-5322](https://cve.now/CVE-2015-5322.md): Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2015-5323](https://cve.now/CVE-2015-5323.md): Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain pr (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2015-5324](https://cve.now/CVE-2015-5324.md): Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api. (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2015-5325](https://cve.now/CVE-2015-5325.md): Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slav (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2015-5326](https://cve.now/CVE-2015-5326.md): Cross-site scripting (XSS) vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote authenticat (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2015-8103](https://cve.now/CVE-2015-8103.md): The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted ser (no CVSS, org.jenkins-ci.main:cli) - [CVE-2015-6379](https://cve.now/CVE-2015-6379.md): The XML parser in the management interface in Cisco Adaptive Security Appliance (ASA) Software 8.4 allows remote authenticated users to caus (no CVSS) - [CVE-2015-7285](https://cve.now/CVE-2015-7285.md): CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 do not require authentication from Alarm Receiving Center (ARC) servers, w (no CVSS) - [CVE-2015-7286](https://cve.now/CVE-2015-7286.md): CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 rely on a polyalphabetic substitution cipher with hardcoded keys, which ma (no CVSS) - [CVE-2015-7287](https://cve.now/CVE-2015-7287.md): CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 use the same 001984 default PIN across different customers' installations, (no CVSS) - [CVE-2015-7288](https://cve.now/CVE-2015-7288.md): CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 allow remote attackers to modify the configuration via a command in an SMS (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-11-25 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.