# CVEs published 2015-12-30

16 CVEs were published on December 30, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-5663](https://cve.now/CVE-2015-5663.md): The file-execution functionality in WinRAR before 5.30 beta 5 allows local users to gain privileges via a Trojan horse file with a name simi (no CVSS)
- [CVE-2015-7248](https://cve.now/CVE-2015-7248.md): ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k\_PE allow remote attackers to discover usernames and password hashes by reading the (no CVSS)
- [CVE-2015-7249](https://cve.now/CVE-2015-7249.md): ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k\_PE allow remote authenticated users to bypass intended access restrictions via a mo (no CVSS)
- [CVE-2015-7250](https://cve.now/CVE-2015-7250.md): Absolute path traversal vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k\_PE allows remote attack (no CVSS)
- [CVE-2015-7251](https://cve.now/CVE-2015-7251.md): ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k\_PE have a hardcoded password of root for the root account, which allows remote atta (no CVSS)
- [CVE-2015-7252](https://cve.now/CVE-2015-7252.md): Cross-site scripting (XSS) vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k\_PE allows remote att (no CVSS)
- [CVE-2015-7782](https://cve.now/CVE-2015-7782.md): Cross-site scripting (XSS) vulnerability in Let's PHP! Frame high-speed chat before 2015-09-22 allows remote attackers to inject arbitrary w (no CVSS)
- [CVE-2015-7784](https://cve.now/CVE-2015-7784.md): SQL injection vulnerability in the BOKUBLOCK (1) BbAdminViewsControl213 plugin before 1.1 and (2) BbAdminViewsControl plugin before 2.1 for (no CVSS)
- [CVE-2015-7787](https://cve.now/CVE-2015-7787.md): ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to discover the WPA2-PSK passphrase via unspecified vector (no CVSS)
- [CVE-2015-7788](https://cve.now/CVE-2015-7788.md): ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to execute arbitrary commands via unspecified vectors. (no CVSS)
- [CVE-2015-7789](https://cve.now/CVE-2015-7789.md): ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to cause a denial of service via unspecified vectors. (no CVSS)
- [CVE-2015-7790](https://cve.now/CVE-2015-7790.md): Cross-site scripting (XSS) vulnerability on ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allows remote attackers to inject arb (no CVSS)
- [CVE-2015-7792](https://cve.now/CVE-2015-7792.md): Corega CG-WLBARGS devices allow remote attackers to perform administrative operations via unspecified vectors. (no CVSS)
- [CVE-2015-7793](https://cve.now/CVE-2015-7793.md): Corega CG-WLBARAGM devices provide an open proxy service, which allows remote attackers to trigger outbound network traffic via unspecified (no CVSS)
- [CVE-2015-7794](https://cve.now/CVE-2015-7794.md): Corega CG-WLNCM4G devices provide an open DNS resolver, which allows remote attackers to cause a denial of service (traffic amplification) v (no CVSS)
- [CVE-2015-8703](https://cve.now/CVE-2015-8703.md): ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k\_PE and ZXV10 W300 devices W300V1.0.0f\_ER1\_PE allow remote authenticated users to by (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-12-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.