# CVEs published 2015-12-15

23 CVEs were published on December 15, 2015: 1 critical, 0 high. Days are UTC.

- [CVE-2015-5312](https://cve.now/CVE-2015-5312.md): The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context (no CVSS, nokogiri)
- [CVE-2015-7497](https://cve.now/CVE-2015-7497.md): Heap-based buffer overflow in the xmlDictComputeFastQKey function in dict.c in libxml2 before 2.9.3 allows context-dependent attackers to ca (no CVSS)
- [CVE-2015-7498](https://cve.now/CVE-2015-7498.md): Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a (no CVSS)
- [CVE-2015-7499](https://cve.now/CVE-2015-7499.md): Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitiv (no CVSS, nokogiri)
- [CVE-2015-7500](https://cve.now/CVE-2015-7500.md): The xmlParseMisc function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (out-of-bounds (no CVSS)
- [CVE-2015-8241](https://cve.now/CVE-2015-8241.md): The xmlNextChar function in libxml2 2.9.2 does not properly check the state, which allows context-dependent attackers to cause a denial of s (no CVSS)
- [CVE-2015-8242](https://cve.now/CVE-2015-8242.md): The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-dependent attackers t (no CVSS)
- [CVE-2015-8247](https://cve.now/CVE-2015-8247.md): Cross-site scripting (XSS) vulnerability in synnefoclient in Synnefo Internet Management Software (IMS) 2015 allows remote attackers to inje (no CVSS)
- [CVE-2015-8317](https://cve.now/CVE-2015-8317.md): The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive information via an ( (no CVSS)
- [CVE-2015-8377](https://cve.now/CVE-2015-8377.md): SQL injection vulnerability in the host\_new\_graphs\_save function in graphs\_new.php in Cacti 0.8.8f and earlier allows remote authenticated u (no CVSS)
- [CVE-2015-8570](https://cve.now/CVE-2015-8570.md): The password reset functionality in Lepide Active Directory Self Service allows remote authenticated users to change arbitrary domain user p (no CVSS)
- [CVE-2015-8571](https://cve.now/CVE-2015-8571.md): Integer overflow in Autodesk Design Review (ADR) before 2013 Hotfix 2 allows remote attackers to execute arbitrary code via a crafted biClrU (no CVSS)
- [CVE-2015-8572](https://cve.now/CVE-2015-8572.md): Multiple buffer overflows in Autodesk Design Review (ADR) before 2013 Hotfix 2 allow remote attackers to execute arbitrary code via crafted (no CVSS)
- [CVE-2015-4206](https://cve.now/CVE-2015-4206.md): Cisco Unified Communications Manager (UCM) 8.0 through 8.6 allows remote attackers to bypass an XSS protection mechanism via a crafted param (no CVSS)
- [CVE-2015-5004](https://cve.now/CVE-2015-5004.md): The Edge Component Caching Proxy in IBM WebSphere Application Server (WAS) 8.0 before 8.0.0.12 and 8.5 before 8.5.5.8 does not properly encr (no CVSS)
- [CVE-2015-6359](https://cve.now/CVE-2015-6359.md): The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in Cisco IOS 15.3(3)S0.1 on ASR devices mishandles internal tables, wh (no CVSS)
- [CVE-2015-6399](https://cve.now/CVE-2015-6399.md): The Supervisor 1.0.0.0 and 1.0.0.1 in Cisco Integrated Management Controller (IMC) before 2.0(9) allows remote authenticated users to cause (no CVSS)
- [CVE-2015-6403](https://cve.now/CVE-2015-6403.md): The TFTP implementation on Cisco Small Business SPA30x, SPA50x, SPA51x phones 7.5.7 improperly validates firmware-image file integrity, whic (no CVSS)
- [CVE-2015-6404](https://cve.now/CVE-2015-6404.md): Cisco Hosted Collaboration Mediation Fulfillment 10.6(3) does not use RBAC, which allows remote authenticated users to obtain sensitive cred (no CVSS)
- [CVE-2015-6411](https://cve.now/CVE-2015-6411.md): Cisco FirePOWER Management Center 5.4.1.3, 6.0.0, and 6.0.1 provides verbose responses to requests for help files, which allows remote attac (no CVSS)
- [CVE-2015-6420](https://cve.now/CVE-2015-6420.md): Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Ser (CVSS 9.8, org.apache.commons:commons-collections4 · commons-collec… +3)
- [CVE-2015-7918](https://cve.now/CVE-2015-7918.md): Multiple buffer overflows in the F1BookView ActiveX control in F1 Bookview in Schneider Electric ProClima before 6.2 allow remote attackers (no CVSS)
- [CVE-2015-8561](https://cve.now/CVE-2015-8561.md): The F1BookView ActiveX control in F1 Bookview in Schneider Electric ProClima before 6.2 allows remote attackers to execute arbitrary code or (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-12-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.