# CVEs published 2015-12-17

15 CVEs were published on December 17, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-4027](https://cve.now/CVE-2015-4027.md): The AcuWVSSchedulerv10 service in Acunetix Web Vulnerability Scanner (WVS) before 10 build 20151125 allows local users to gain privileges vi (no CVSS)
- [CVE-2015-5204](https://cve.now/CVE-2015-5204.md): CRLF injection vulnerability in the Apache Cordova File Transfer Plugin (cordova-plugin-file-transfer) for Android before 1.3.0 allows remot (no CVSS)
- [CVE-2015-5277](https://cve.now/CVE-2015-5277.md): The get\_contents function in nss\_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) before 2.20 might (no CVSS)
- [CVE-2015-7518](https://cve.now/CVE-2015-7518.md): Multiple cross-site scripting (XSS) vulnerabilities in information popups in Foreman before 1.10.0 allow remote attackers to inject arbitrar (no CVSS)
- [CVE-2015-7527](https://cve.now/CVE-2015-7527.md): lib/core.php in the Cool Video Gallery plugin 1.9 for WordPress allows remote attackers to execute arbitrary code via shell metacharacters i (no CVSS)
- [CVE-2015-8327](https://cve.now/CVE-2015-8327.md): Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.2.0 and in foomatic-filters in Foomatic 4.0.x a (no CVSS)
- [CVE-2015-8338](https://cve.now/CVE-2015-8338.md): Xen 4.6.x and earlier does not properly enforce limits on page order inputs for the (1) XENMEM\_increase\_reservation, (2) XENMEM\_populate\_phy (no CVSS)
- [CVE-2015-8339](https://cve.now/CVE-2015-8339.md): The memory\_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly hand back pages to a domain, which might allow (no CVSS)
- [CVE-2015-8340](https://cve.now/CVE-2015-8340.md): The memory\_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly release locks, which might allow guest OS admin (no CVSS)
- [CVE-2015-8341](https://cve.now/CVE-2015-8341.md): The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when (no CVSS)
- [CVE-2015-8368](https://cve.now/CVE-2015-8368.md): ntopng (aka ntop) before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and usern (no CVSS)
- [CVE-2015-8369](https://cve.now/CVE-2015-8369.md): SQL injection vulnerability in include/top\_graph\_header.php in Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary SQL com (no CVSS)
- [CVE-2015-8600](https://cve.now/CVE-2015-8600.md): The SysAdminWebTool servlets in SAP Mobile Platform allow remote attackers to bypass authentication and obtain sensitive information, gain p (no CVSS)
- [CVE-2015-8601](https://cve.now/CVE-2015-8601.md): The Chat Room module 7.x-2.x before 7.x-2.2 for Drupal does not properly check permissions when setting up a websocket for chat messages, wh (no CVSS)
- [CVE-2015-8602](https://cve.now/CVE-2015-8602.md): The Token Insert Entity module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permissions, which allows remote authenticated user (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-12-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.