# Vulnerabilities published in 2015


- [CVE-2015-4074](https://insights.sbomify.com/CVE-2015-4074/): Path traversal in helpdesk pro project:helpdesk pro (high 7.5)
- [CVE-2015-4073](https://insights.sbomify.com/CVE-2015-4073/): SQL injection in helpdesk pro project:helpdesk pro (critical 9.8)
- [CVE-2015-4072](https://insights.sbomify.com/CVE-2015-4072/): Cross-site scripting in helpdesk pro project:helpdesk pro (medium 5.4)
- [CVE-2015-4071](https://insights.sbomify.com/CVE-2015-4071/): Missing authorization in helpdesk pro project:helpdesk pro (medium 5.3)
- [CVE-2015-4070](https://insights.sbomify.com/CVE-2015-4070/): Open redirect in wow new media:wow moodboard lite (medium 6.1)
- [CVE-2015-4069](https://insights.sbomify.com/CVE-2015-4069/): Information disclosure in arcserve:arcserve unified data protection (high 7.8)
- [CVE-2015-4068](https://insights.sbomify.com/CVE-2015-4068/): Arcserve Unified Data Protection (UDP) Directory Traversal (critical 9.1, exploited in the wild)
- [CVE-2015-4067](https://insights.sbomify.com/CVE-2015-4067/): Integer overflow in dell:netvault backup (critical 10.0)
- [CVE-2015-4066](https://insights.sbomify.com/CVE-2015-4066/): SQL injection in tri:gigpress (medium 6.5)
- [CVE-2015-4065](https://insights.sbomify.com/CVE-2015-4065/): Cross-site scripting in landing pages project:landing pages (low 3.5)
- [CVE-2015-4064](https://insights.sbomify.com/CVE-2015-4064/): SQL injection in landing pages project:landing pages (medium 6.5)
- [CVE-2015-4063](https://insights.sbomify.com/CVE-2015-4063/): Cross-site scripting in newstatpress project:newstatpress (low 3.5)
- [CVE-2015-4062](https://insights.sbomify.com/CVE-2015-4062/): SQL injection in newstatpress project:newstatpress (medium 6.5)
- [CVE-2015-4060](https://insights.sbomify.com/CVE-2015-4060/): Memory corruption in wavelink:connectpro (critical 10.0)
- [CVE-2015-4059](https://insights.sbomify.com/CVE-2015-4059/): Memory corruption in wavelink:terminal emulation (critical 10.0)
- [CVE-2015-4057](https://insights.sbomify.com/CVE-2015-4057/): Information disclosure in dell:vce vision intelligent operations (high 7.5)
- [CVE-2015-4056](https://insights.sbomify.com/CVE-2015-4056/): Weak cryptography in dell:vce vision intelligent operations (medium 6.7)
- [CVE-2015-4054](https://insights.sbomify.com/CVE-2015-4054/): Null dereference in pgbouncer:pgbouncer (high 7.5)
- [CVE-2015-4053](https://insights.sbomify.com/CVE-2015-4053/): ceph-deploy uses world-readable permissions on client.admin key (low 2.1)
- [CVE-2015-4051](https://insights.sbomify.com/CVE-2015-4051/): Missing authorization in beckhoff:ipc diagnostics (critical 9.0)
- [CVE-2015-4050](https://insights.sbomify.com/CVE-2015-4050/): Symfony Incorrect Access Control (medium 4.3)
- [CVE-2015-4049](https://insights.sbomify.com/CVE-2015-4049/): Memory corruption in unisys:mcp-firmware (medium 6.8)
- [CVE-2015-4047](https://insights.sbomify.com/CVE-2015-4047/): Null dereference in canonical:ubuntu linux (high 7.8)
- [CVE-2015-4046](https://insights.sbomify.com/CVE-2015-4046/): Command injection in alienvault:open source security information management (high 7.2)
- [CVE-2015-4045](https://insights.sbomify.com/CVE-2015-4045/): Privilege escalation in alienvault:open source security information management (medium 6.7)
- [CVE-2015-4043](https://insights.sbomify.com/CVE-2015-4043/): SQL injection in connx:esp hr management (critical 9.8)
- [CVE-2015-4042](https://insights.sbomify.com/CVE-2015-4042/): Integer overflow in gnu:coreutils (critical 9.8)
- [CVE-2015-4041](https://insights.sbomify.com/CVE-2015-4041/): Memory corruption in gnu:coreutils (high 7.8)
- [CVE-2015-4040](https://insights.sbomify.com/CVE-2015-4040/): Path traversal in f5:big-ip access policy manager (medium 4.0)
- [CVE-2015-4039](https://insights.sbomify.com/CVE-2015-4039/): Cross-site scripting in e-plugins:wp membership (medium 5.4)
- [CVE-2015-4038](https://insights.sbomify.com/CVE-2015-4038/): Privilege escalation in wpmembership:wpmembership (medium 6.5)
- [CVE-2015-4037](https://insights.sbomify.com/CVE-2015-4037/): Race condition in qemu:qemu (low 1.9)
- [CVE-2015-4036](https://insights.sbomify.com/CVE-2015-4036/): Memory corruption in linux:linux kernel (high 7.2)
- [CVE-2015-4035](https://insights.sbomify.com/CVE-2015-4035/): Command injection in tukaani:xz (high 7.8)
- [CVE-2015-4034](https://insights.sbomify.com/CVE-2015-4034/): Deserialization in samsung:galaxy s5 (high 7.9)
- [CVE-2015-4033](https://insights.sbomify.com/CVE-2015-4033/): Information disclosure in samsung:s-beam (low 3.3)
- [CVE-2015-4032](https://insights.sbomify.com/CVE-2015-4032/): File upload in visual mining:netcharts server (critical 10.0)
- [CVE-2015-4031](https://insights.sbomify.com/CVE-2015-4031/): Path traversal in visualmining:netcharts server (critical 10.0)
- [CVE-2015-4029](https://insights.sbomify.com/CVE-2015-4029/): Cross-site scripting in netgate:pfsense (medium 4.3)
- [CVE-2015-4027](https://insights.sbomify.com/CVE-2015-4027/): Command injection in acunetix:web vulnerability scanner (high 7.2)
- [CVE-2015-4026](https://insights.sbomify.com/CVE-2015-4026/): Security feature bypass in apple:mac os x (high 7.5)
- [CVE-2015-4025](https://insights.sbomify.com/CVE-2015-4025/): Security feature bypass in apple:mac os x (high 7.5)
- [CVE-2015-4024](https://insights.sbomify.com/CVE-2015-4024/): Denial of service in apple:mac os x (medium 5.0)
- [CVE-2015-4022](https://insights.sbomify.com/CVE-2015-4022/): Integer overflow in apple:mac os x (high 7.5)
- [CVE-2015-4021](https://insights.sbomify.com/CVE-2015-4021/): Integer overflow in apple:mac os x (medium 5.0)
- [CVE-2015-4020](https://insights.sbomify.com/CVE-2015-4020/): RubyGems Improper Input Validation vulnerability (medium 4.3)
- [CVE-2015-4018](https://insights.sbomify.com/CVE-2015-4018/): SQL injection in feedwordpress project:feedwordpress (medium 6.5)
- [CVE-2015-4017](https://insights.sbomify.com/CVE-2015-4017/): Salt vulnerable to Improper Certificate Validation (high 7.5)
- [CVE-2015-4016](https://insights.sbomify.com/CVE-2015-4016/): Denial of service in valvesoftware:steam client (medium 5.0)
- [CVE-2015-4010](https://insights.sbomify.com/CVE-2015-4010/): Cross-site request forgery in everybit:encrypted contact form (medium 6.8)
- [CVE-2015-4004](https://insights.sbomify.com/CVE-2015-4004/): Memory corruption in canonical:ubuntu linux (high 8.5)
- [CVE-2015-4003](https://insights.sbomify.com/CVE-2015-4003/): Denial of service in linux:linux kernel (high 7.8)
- [CVE-2015-4002](https://insights.sbomify.com/CVE-2015-4002/): Memory corruption in canonical:ubuntu linux (critical 9.0)
- [CVE-2015-4001](https://insights.sbomify.com/CVE-2015-4001/): Integer overflow in linux:linux kernel (critical 9.0)
- [CVE-2015-4000](https://insights.sbomify.com/CVE-2015-4000/): Weak cryptography in apple:iphone os (low 3.7)
- [CVE-2015-3999](https://insights.sbomify.com/CVE-2015-3999/): Information disclosure in piriform:ccleaner (low 2.1)
- [CVE-2015-3998](https://insights.sbomify.com/CVE-2015-3998/): Cross-site scripting in clickfraud-monitoring:adsense-click-fraud-monitoring (medium 6.1)
- [CVE-2015-3996](https://insights.sbomify.com/CVE-2015-3996/): Security feature bypass in afnetworking project:afnetworking (medium 4.3)
- [CVE-2015-3995](https://insights.sbomify.com/CVE-2015-3995/): Path traversal in sap:hana (medium 4.0)
- [CVE-2015-3994](https://insights.sbomify.com/CVE-2015-3994/): Other in sap:hana (medium 4.0)
- [CVE-2015-3993](https://insights.sbomify.com/CVE-2015-3993/): Missing authorization in actian:matrix (medium 6.5)
- [CVE-2015-3991](https://insights.sbomify.com/CVE-2015-3991/): Integer overflow in strongswan:strongswan (critical 9.8)
- [CVE-2015-3990](https://insights.sbomify.com/CVE-2015-3990/): Command injection in sonicwall:analyzer (critical 9.0)
- [CVE-2015-3989](https://insights.sbomify.com/CVE-2015-3989/): concrete5 vulnerable to Cross-site Scripting (medium 4.3)
- [CVE-2015-3988](https://insights.sbomify.com/CVE-2015-3988/): Cross-site scripting in openstack:horizon (low 3.5)
- [CVE-2015-3987](https://insights.sbomify.com/CVE-2015-3987/): Privilege escalation in mcafee:epo deep command (high 7.2)
- [CVE-2015-3986](https://insights.sbomify.com/CVE-2015-3986/): Cross-site request forgery in thecartpress:thecartpress ecommerce shopping cart (medium 4.3)
- [CVE-2015-3983](https://insights.sbomify.com/CVE-2015-3983/): Misconfiguration in fedora:pacemaker configuration system (medium 4.3)
- [CVE-2015-3982](https://insights.sbomify.com/CVE-2015-3982/): Django allows user sessions hijacking via an empty string in the session key (medium 5.0)
- [CVE-2015-3981](https://insights.sbomify.com/CVE-2015-3981/): Information disclosure in sap:netweaver rfc sdk (medium 5.0)
- [CVE-2015-3980](https://insights.sbomify.com/CVE-2015-3980/): SQL injection in sap:customer relationship management (high 7.5)
- [CVE-2015-3979](https://insights.sbomify.com/CVE-2015-3979/): Other in sap:customer relationship management (high 7.5)
- [CVE-2015-3978](https://insights.sbomify.com/CVE-2015-3978/): Information disclosure in sap:sybase unwired platform online data proxy (low 2.1)
- [CVE-2015-3977](https://insights.sbomify.com/CVE-2015-3977/): Memory corruption in schneider-electric:imt25 magnetic flow dtm (high 7.7)
- [CVE-2015-3976](https://insights.sbomify.com/CVE-2015-3976/): GE Multilink Cross-site Scripting (medium 6.8)
- [CVE-2015-3974](https://insights.sbomify.com/CVE-2015-3974/): Hardcoded credentials in easyio:easyio-30p-sf (critical 9.0)
- [CVE-2015-3973](https://insights.sbomify.com/CVE-2015-3973/): Weak cryptography in janitza:umg 508 (medium 5.0)
- [CVE-2015-3972](https://insights.sbomify.com/CVE-2015-3972/): Weak cryptography in janitza:umg 508 (critical 10.0)
- [CVE-2015-3971](https://insights.sbomify.com/CVE-2015-3971/): Missing authorization in janitza:umg 508 (high 7.5)
- [CVE-2015-3970](https://insights.sbomify.com/CVE-2015-3970/): Cross-site scripting in janitza:umg 508 (medium 4.3)
- [CVE-2015-3969](https://insights.sbomify.com/CVE-2015-3969/): Information disclosure in janitza:umg 508 (medium 5.0)
- [CVE-2015-3968](https://insights.sbomify.com/CVE-2015-3968/): Hardcoded credentials in janitza:umg 508 (high 7.5)
- [CVE-2015-3967](https://insights.sbomify.com/CVE-2015-3967/): Cross-site request forgery in janitza:umg 508 (medium 6.8)
- [CVE-2015-3966](https://insights.sbomify.com/CVE-2015-3966/): Denial of service in innominate:mguard firmware (medium 4.0)
- [CVE-2015-3965](https://insights.sbomify.com/CVE-2015-3965/): Privilege escalation in Symbiq Infusion System (high 8.8)
- [CVE-2015-3964](https://insights.sbomify.com/CVE-2015-3964/): Hardcoded credentials in sma solar technology ag:webbox firmware (critical 10.0)
- [CVE-2015-3963](https://insights.sbomify.com/CVE-2015-3963/): Weak cryptography in windriver:vxworks (medium 5.8)
- [CVE-2015-3962](https://insights.sbomify.com/CVE-2015-3962/): Weak cryptography in schneider-electric:struxureware building expert multi-purpose management (medium 5.0)
- [CVE-2015-3961](https://insights.sbomify.com/CVE-2015-3961/): Memory corruption in garrettcom:magnum 10k firmware (low 3.5)
- [CVE-2015-3960](https://insights.sbomify.com/CVE-2015-3960/): Hardcoded credentials in garrettcom:magnum 10k firmware (medium 4.3)
- [CVE-2015-3959](https://insights.sbomify.com/CVE-2015-3959/): Hardcoded credentials in garrettcom:magnum 10k firmware (high 7.2)
- [CVE-2015-3958](https://insights.sbomify.com/CVE-2015-3958/): Denial of service in hospira:lifecare pcainfusion firmware (high 7.8)
- [CVE-2015-3957](https://insights.sbomify.com/CVE-2015-3957/): Hardcoded credentials in hospira:lifecare pca3 (medium 4.6)
- [CVE-2015-3956](https://insights.sbomify.com/CVE-2015-3956/): Missing authorization in Plum A+ Infusion System (critical 9.8)
- [CVE-2015-3955](https://insights.sbomify.com/CVE-2015-3955/): Memory corruption in hospira:lifecare pcainfusion firmware (critical 10.0)
- [CVE-2015-3954](https://insights.sbomify.com/CVE-2015-3954/): Missing authorization in Plum A+ Infusion System (critical 9.8)
- [CVE-2015-3953](https://insights.sbomify.com/CVE-2015-3953/): Hardcoded credentials in Plum A+ Infusion System (critical 9.8)
- [CVE-2015-3952](https://insights.sbomify.com/CVE-2015-3952/): Information disclosure in Plum A+ Infusion System (high 7.5)
- [CVE-2015-3951](https://insights.sbomify.com/CVE-2015-3951/): Information disclosure in rle:nova-wind turbine hmi firmware (medium 5.0)
- [CVE-2015-3950](https://insights.sbomify.com/CVE-2015-3950/): Cross-site request forgery in xzeres:442sr os (medium 6.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2015/page/46/