# CVEs published 2015-12-31

33 CVEs were published on December 31, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-1947](https://cve.now/CVE-2015-1947.md): Untrusted search path vulnerability in IBM InfoSphere BigInsights 3.0, 3.0.0.1, 3.0.0.2, and 4.0, when a DB2 database is used, allows local (no CVSS)
- [CVE-2015-5987](https://cve.now/CVE-2015-5987.md): Belkin F9K1102 2 devices with firmware 2.10.17 use an improper algorithm for selecting the ID value in the header of a DNS query, which make (no CVSS)
- [CVE-2015-5988](https://cve.now/CVE-2015-5988.md): The web management interface on Belkin F9K1102 2 devices with firmware 2.10.17 has a blank password, which allows remote attackers to obtain (no CVSS)
- [CVE-2015-5989](https://cve.now/CVE-2015-5989.md): Belkin F9K1102 2 devices with firmware 2.10.17 rely on client-side JavaScript code for authorization, which allows remote attackers to obtai (no CVSS)
- [CVE-2015-5990](https://cve.now/CVE-2015-5990.md): Cross-site request forgery (CSRF) vulnerability on Belkin F9K1102 2 devices with firmware 2.10.17 allows remote attackers to hijack the auth (no CVSS)
- [CVE-2014-3260](https://cve.now/CVE-2014-3260.md): Pacom 1000 CCU and RTU GMS devices allow remote attackers to spoof the controller-to-base data stream by leveraging improper use of cryptogr (no CVSS)
- [CVE-2014-4876](https://cve.now/CVE-2014-4876.md): Toshiba 4690 Operating System 6 Release 3, when the ADXSITCF logical name is not properly restricted, allows remote attackers to read potent (no CVSS)
- [CVE-2015-2874](https://cve.now/CVE-2015-2874.md): Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before (no CVSS)
- [CVE-2015-2875](https://cve.now/CVE-2015-2875.md): Absolute path traversal vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, an (no CVSS)
- [CVE-2015-2876](https://cve.now/CVE-2015-2876.md): Unrestricted file upload vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, a (no CVSS)
- [CVE-2015-2894](https://cve.now/CVE-2015-2894.md): Format string vulnerability in the up.time client in Idera Uptime Infrastructure Monitor 6.0 and 7.2 allows remote attackers to cause a deni (no CVSS)
- [CVE-2015-2895](https://cve.now/CVE-2015-2895.md): Buffer overflow in the up.time client in Idera Uptime Infrastructure Monitor 7.4 might allow remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2015-2896](https://cve.now/CVE-2015-2896.md): The up.time client in Idera Uptime Infrastructure Monitor through 7.6 allows remote attackers to obtain potentially sensitive version, OS, p (no CVSS)
- [CVE-2015-2912](https://cve.now/CVE-2015-2912.md): The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restr (no CVSS, com.orientechnologies:orientdb-studio)
- [CVE-2015-2913](https://cve.now/CVE-2015-2913.md): server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x b (no CVSS, com.orientechnologies:orientdb-server)
- [CVE-2015-2918](https://cve.now/CVE-2015-2918.md): The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME eleme (no CVSS, com.orientechnologies:orientdb-studio)
- [CVE-2015-5994](https://cve.now/CVE-2015-5994.md): The web management interface on Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 has a default password of admin for the adm (no CVSS)
- [CVE-2015-5995](https://cve.now/CVE-2015-5995.md): Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 and Tenda N3 Wireless N150 devices allow remote attackers to obtain adminis (no CVSS)
- [CVE-2015-5996](https://cve.now/CVE-2015-5996.md): Cross-site request forgery (CSRF) vulnerability on Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 allows remote attackers (no CVSS)
- [CVE-2015-6016](https://cve.now/CVE-2015-6016.md): ZyXEL P-660HW-T1 2 devices with ZyNOS firmware 3.40(AXH.0), PMG5318-B20A devices with firmware 1.00AANC0b5, and NBG-418N devices have a defa (no CVSS)
- [CVE-2015-6017](https://cve.now/CVE-2015-6017.md): Multiple cross-site scripting (XSS) vulnerabilities in Forms/rpAuth\_1 on ZyXEL P-660HW-T1 2 devices with ZyNOS firmware 3.40(AXH.0) allow re (no CVSS)
- [CVE-2015-6018](https://cve.now/CVE-2015-6018.md): The diagnostic-ping implementation on ZyXEL PMG5318-B20A devices with firmware before 1.00(AANC.2)C0 allows remote attackers to execute arbi (no CVSS)
- [CVE-2015-6019](https://cve.now/CVE-2015-6019.md): The management portal on ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 does not terminate sessions upon a logout action, which allows (no CVSS)
- [CVE-2015-6020](https://cve.now/CVE-2015-6020.md): ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 allow remote authenticated users to obtain administrative privileges by leveraging acce (no CVSS)
- [CVE-2015-7277](https://cve.now/CVE-2015-7277.md): The web administration interface on Amped Wireless R10000 devices with firmware 2.5.2.11 has a default password of admin for the admin accou (no CVSS)
- [CVE-2015-7278](https://cve.now/CVE-2015-7278.md): Cross-site request forgery (CSRF) vulnerability on Amped Wireless R10000 devices with firmware 2.5.2.11 allows remote attackers to hijack th (no CVSS)
- [CVE-2015-7279](https://cve.now/CVE-2015-7279.md): Amped Wireless R10000 devices with firmware 2.5.2.11 use an improper algorithm for selecting the ID value in the header of a DNS query, whic (no CVSS)
- [CVE-2015-7280](https://cve.now/CVE-2015-7280.md): The web administration interface on ReadyNet WRT300N-DD devices with firmware 1.0.26 has a default password of admin for the admin account, (no CVSS)
- [CVE-2015-7281](https://cve.now/CVE-2015-7281.md): Cross-site request forgery (CSRF) vulnerability on ReadyNet WRT300N-DD devices with firmware 1.0.26 allows remote attackers to hijack the au (no CVSS)
- [CVE-2015-7282](https://cve.now/CVE-2015-7282.md): ReadyNet WRT300N-DD devices with firmware 1.0.26 use the same source port number for every DNS query, which makes it easier for remote attac (no CVSS)
- [CVE-2015-7283](https://cve.now/CVE-2015-7283.md): The web administration interface on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 has a default password of 1234 for the admin account (no CVSS)
- [CVE-2015-7284](https://cve.now/CVE-2015-7284.md): Cross-site request forgery (CSRF) vulnerability on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 allows remote attackers to hijack the (no CVSS)
- [CVE-2015-7447](https://cve.now/CVE-2015-7447.md): IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF20, and 8.5. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-12-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.