Total
5502 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2015-4221 | 1 Cisco | 1 Unified Communications Manager Im And Presence Service | 2026-06-17 | 4.0 MEDIUM | N/A |
| Cisco Unified Communications Manager IM and Presence Service 9.1(1) does not properly restrict access to encrypted passwords, which allows remote attackers to determine cleartext passwords, and consequently execute arbitrary commands, by visiting an unspecified web page and then conducting a decryption attack, aka Bug ID CSCuq46194. | |||||
| CVE-2015-4219 | 1 Cisco | 2 Identity Services Engine Software, Secure Access Control System | 2026-06-17 | 4.0 MEDIUM | N/A |
| Cisco Secure Access Control System before 5.4(0.46.2) and 5.5 before 5.5(0.46) and Cisco Identity Services Engine 1.0(4.573) do not properly implement access control for support bundles, which allows remote authenticated users to obtain sensitive information via brute-force attempts to send valid credentials, aka Bug IDs CSCue00833 and CSCub40331. | |||||
| CVE-2015-4211 | 2 Cisco, Microsoft | 2 Anyconnect Secure Mobility Client, Windows | 2026-06-17 | 7.2 HIGH | N/A |
| Cisco AnyConnect Secure Mobility Client 3.1(60) on Windows does not properly validate pathnames, which allows local users to gain privileges via a crafted INF file, aka Bug ID CSCus65862. | |||||
| CVE-2015-4185 | 1 Cisco | 1 Ios | 2026-06-17 | 6.9 MEDIUM | N/A |
| The TCL interpreter in Cisco IOS 15.2 does not properly maintain the vty state, which allows local users to gain privileges by starting a session very soon after a TCL script execution, aka Bug ID CSCuq24202. | |||||
| CVE-2015-4182 | 1 Cisco | 1 Identity Services Engine Software | 2026-06-17 | 5.5 MEDIUM | N/A |
| The administrative web interface in Cisco Identity Services Engine (ISE) before 1.3 allows remote authenticated users to bypass intended access restrictions, and obtain sensitive information or change settings, via unspecified vectors, aka Bug ID CSCui72087. | |||||
| CVE-2015-4165 | 1 Elasticsearch | 1 Elasticsearch | 2026-06-17 | 6.0 MEDIUM | 7.5 HIGH |
| The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code from them, is accessible by the attacker, and the Java VM on which Elasticsearch is running can write to a location that the other application can read and execute from, allows remote authenticated users to write to and create arbitrary snapshot metadata files, and potentially execute arbitrary code. | |||||
| CVE-2015-4161 | 1 Sap | 1 Afaria | 2026-06-17 | 7.5 HIGH | N/A |
| SAP Afaria does not properly restrict access to unspecified functionality, which allows remote attackers to obtain sensitive information, gain privileges, or have other unspecified impact via unknown vectors, SAP Security Note 2155690. | |||||
| CVE-2015-4104 | 1 Xen | 1 Xen | 2026-06-17 | 7.8 HIGH | N/A |
| Xen 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask bits, which allows local x86 HVM guest users to cause a denial of service (unexpected interrupt and host crash) via unspecified vectors. | |||||
| CVE-2015-4103 | 1 Xen | 1 Xen | 2026-06-17 | 4.9 MEDIUM | N/A |
| Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field, which allows local x86 HVM guest administrators to cause a denial of service (host interrupt handling confusion) via vectors related to qemu and accessing spanning multiple fields. | |||||
| CVE-2015-4082 | 1 Attic Project | 1 Attic | 2026-06-17 | 4.0 MEDIUM | 6.5 MEDIUM |
| attic before 0.15 does not confirm unencrypted backups with the user, which allows remote attackers with read and write privileges for the encrypted repository to obtain potentially sensitive information by changing the manifest type byte of the repository to "unencrypted / without key file". | |||||
| CVE-2015-4045 | 1 Alienvault | 1 Open Source Security Information Management | 2026-06-17 | 7.2 HIGH | 6.7 MEDIUM |
| The sudoers file in the asset discovery scanner in AlienVault OSSIM before 5.0.1 allows local users to gain privileges via a crafted nmap script. | |||||
| CVE-2015-4038 | 1 Wpmembership | 1 Wpmembership | 2026-06-17 | 6.5 MEDIUM | N/A |
| The WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain administrator privileges via an iv_membership_update_user_settings action to wp-admin/admin-ajax.php. | |||||
| CVE-2015-4032 | 1 Visual Mining | 1 Netcharts Server | 2026-06-17 | 10.0 HIGH | N/A |
| projectContents.jsp in the Developer tools in Visual Mining NetCharts Server allows remote attackers to rename arbitrary files, and consequently execute them, via unspecified vectors. | |||||
| CVE-2015-4027 | 1 Acunetix | 1 Web Vulnerability Scanner | 2026-06-17 | 7.2 HIGH | N/A |
| The AcuWVSSchedulerv10 service in Acunetix Web Vulnerability Scanner (WVS) before 10 build 20151125 allows local users to gain privileges via a command parameter in the reporttemplate property in a params JSON object to api/addScan. | |||||
| CVE-2015-3965 | 1 Pfizer | 2 Symbiq Infusion System, Symbiq Infusion System Firmware | 2026-06-17 | 9.0 HIGH | 8.8 HIGH |
| Hospira Symbiq Infusion System 3.13 and earlier allows remote authenticated users to trigger "unanticipated operations" by leveraging "elevated privileges" for an unspecified call to an incorrectly exposed function. | |||||
| CVE-2015-3879 | 1 Google | 1 Android | 2026-06-17 | 9.3 HIGH | N/A |
| Media Player Framework in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, aka internal bug 23223325. | |||||
| CVE-2015-3878 | 1 Google | 1 Android | 2026-06-17 | 4.3 MEDIUM | N/A |
| Media Projection in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to bypass an intended screen-recording warning feature and obtain sensitive screen-snapshot information via a crafted application that references a long application name, aka internal bug 23345192. | |||||
| CVE-2015-3865 | 1 Google | 1 Android | 2026-06-17 | 9.3 HIGH | N/A |
| The Runtime subsystem in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23050463. | |||||
| CVE-2015-3858 | 1 Google | 1 Android | 2026-06-17 | 9.3 HIGH | N/A |
| The checkDestination function in internal/telephony/SMSDispatcher.java in Android before 5.1.1 LMY48M relies on an obsolete permission name for an authorization check, which allows attackers to bypass an intended user-confirmation requirement for SMS short-code messaging via a crafted application, aka internal bug 22314646. | |||||
| CVE-2015-3849 | 1 Google | 1 Android | 2026-06-17 | 9.3 HIGH | N/A |
| The Region_createFromParcel function in core/jni/android/graphics/Region.cpp in Region in Android before 5.1.1 LMY48M does not check the return values of certain read operations, which allows attackers to execute arbitrary code via an application that sends a crafted message to a service, aka internal bug 21585255. | |||||