# Vulnerabilities published in 2015


- [CVE-2015-2308](https://insights.sbomify.com/CVE-2015-2308/): Symfony Vulnerable to PHP Eval Injection (medium 6.8)
- [CVE-2015-2305](https://insights.sbomify.com/CVE-2015-2305/): Integer overflow in canonical:ubuntu linux (medium 6.8)
- [CVE-2015-2304](https://insights.sbomify.com/CVE-2015-2304/): Path traversal in canonical:ubuntu linux (medium 6.4)
- [CVE-2015-2301](https://insights.sbomify.com/CVE-2015-2301/): Use after free in apple:mac os x (high 7.5)
- [CVE-2015-2298](https://insights.sbomify.com/CVE-2015-2298/): Information disclosure in etherpad:etherpad (high 7.5)
- [CVE-2015-2297](https://insights.sbomify.com/CVE-2015-2297/): Null dereference in libcsoap project:libcsoap (high 7.5)
- [CVE-2015-2296](https://insights.sbomify.com/CVE-2015-2296/): Python Requests Session Fixation (medium 6.8)
- [CVE-2015-2295](https://insights.sbomify.com/CVE-2015-2295/): Cross-site request forgery in netgate:pfsense (medium 6.8)
- [CVE-2015-2294](https://insights.sbomify.com/CVE-2015-2294/): Cross-site scripting in netgate:pfsense (medium 4.3)
- [CVE-2015-2293](https://insights.sbomify.com/CVE-2015-2293/): Cross-site request forgery in yoast:wordpress seo (medium 6.8)
- [CVE-2015-2292](https://insights.sbomify.com/CVE-2015-2292/): SQL injection in yoast:wordpress seo (medium 6.5)
- [CVE-2015-2291](https://insights.sbomify.com/CVE-2015-2291/): Intel Ethernet Diagnostics Driver for Windows Denial-of-Service (high 7.8, exploited in the wild)
- [CVE-2015-2289](https://insights.sbomify.com/CVE-2015-2289/): Cross-site scripting in s9y:serendipity (low 3.5)
- [CVE-2015-2286](https://insights.sbomify.com/CVE-2015-2286/): Information disclosure in edx:open edx (medium 6.5)
- [CVE-2015-2285](https://insights.sbomify.com/CVE-2015-2285/): Privilege escalation in ubuntu:upstart (high 7.2)
- [CVE-2015-2284](https://insights.sbomify.com/CVE-2015-2284/): Privilege escalation in solarwinds:firewall security manager (critical 10.0)
- [CVE-2015-2282](https://insights.sbomify.com/CVE-2015-2282/): Memory corruption in sap:gui (high 7.5)
- [CVE-2015-2281](https://insights.sbomify.com/CVE-2015-2281/): Memory corruption in fortinet:single sign on (high 7.5)
- [CVE-2015-2280](https://insights.sbomify.com/CVE-2015-2280/): Command injection in airlink101:skyipcam1620w wireless n mpeg4 3gpp firmware (high 8.8)
- [CVE-2015-2279](https://insights.sbomify.com/CVE-2015-2279/): Command injection in airlive:bu-2015 firmware (critical 9.8)
- [CVE-2015-2278](https://insights.sbomify.com/CVE-2015-2278/): Memory corruption in sap:gui (medium 5.0)
- [CVE-2015-2275](https://insights.sbomify.com/CVE-2015-2275/): Cross-site scripting in wotlab:community gallery (medium 4.3)
- [CVE-2015-2273](https://insights.sbomify.com/CVE-2015-2273/): Moodle cross-site scripting (XSS) vulnerability (low 3.5)
- [CVE-2015-2272](https://insights.sbomify.com/CVE-2015-2272/): Moodle allows attackers to bypass a forced-password-change requirement (medium 4.0)
- [CVE-2015-2271](https://insights.sbomify.com/CVE-2015-2271/): Moodle does not consider the moodle/tag:flag capability (medium 4.0)
- [CVE-2015-2270](https://insights.sbomify.com/CVE-2015-2270/): Moodle allows attackers to obtain sensitive course information (medium 4.3)
- [CVE-2015-2269](https://insights.sbomify.com/CVE-2015-2269/): Moodle XSS Vulnerability (low 3.5)
- [CVE-2015-2268](https://insights.sbomify.com/CVE-2015-2268/): Moodle allows attackers to cause a denial of service (medium 6.8)
- [CVE-2015-2267](https://insights.sbomify.com/CVE-2015-2267/): Moodle allows attackers to extract archives to arbitrary directories (medium 4.0)
- [CVE-2015-2266](https://insights.sbomify.com/CVE-2015-2266/): Moodle allows attackers to obtain sensitive personal-contact and unread-message-count information (medium 4.0)
- [CVE-2015-2265](https://insights.sbomify.com/CVE-2015-2265/): Command injection in canonical:ubuntu linux (high 7.5)
- [CVE-2015-2264](https://insights.sbomify.com/CVE-2015-2264/): Other in telerik:analytics monitor library (medium 6.9)
- [CVE-2015-2263](https://insights.sbomify.com/CVE-2015-2263/): Misconfiguration in cloudera:cloudera manager (low 3.3)
- [CVE-2015-2255](https://insights.sbomify.com/CVE-2015-2255/): Denial of service in huawei:ar1220 firmware (medium 5.9)
- [CVE-2015-2254](https://insights.sbomify.com/CVE-2015-2254/): Information disclosure in huawei:oceanstor uds firmware (critical 9.1)
- [CVE-2015-2253](https://insights.sbomify.com/CVE-2015-2253/): Information disclosure in huawei:oceanstor uds firmware (medium 5.0)
- [CVE-2015-2252](https://insights.sbomify.com/CVE-2015-2252/): Code injection in huawei:oceanstor uds firmware (high 8.8)
- [CVE-2015-2251](https://insights.sbomify.com/CVE-2015-2251/): Information disclosure in huawei:oceanstor uds firmware (high 7.5)
- [CVE-2015-2250](https://insights.sbomify.com/CVE-2015-2250/): Cross-site scripting in concrete5:concrete5 (medium 4.3)
- [CVE-2015-2249](https://insights.sbomify.com/CVE-2015-2249/): Cross-site scripting in synacor:zimbra collaboration server (medium 5.4)
- [CVE-2015-2248](https://insights.sbomify.com/CVE-2015-2248/): Cross-site request forgery in sonicwall:remote access firmware (medium 6.8)
- [CVE-2015-2247](https://insights.sbomify.com/CVE-2015-2247/): Other in boosted:boosted boards (high 8.3)
- [CVE-2015-2246](https://insights.sbomify.com/CVE-2015-2246/): Information disclosure in P7-L10 V100R001C00B136 and earlier versions (low 3.3)
- [CVE-2015-2245](https://insights.sbomify.com/CVE-2015-2245/): Denial of service in huawei:p7-l09 firmware (high 7.5)
- [CVE-2015-2244](https://insights.sbomify.com/CVE-2015-2244/): Cross-site scripting in webshophun:webshop hun (medium 4.3)
- [CVE-2015-2243](https://insights.sbomify.com/CVE-2015-2243/): Path traversal in webshophun:webshop hun (high 7.5)
- [CVE-2015-2242](https://insights.sbomify.com/CVE-2015-2242/): SQL injection in webshophun:webshop hun (high 7.5)
- [CVE-2015-2241](https://insights.sbomify.com/CVE-2015-2241/): Django Cross-site Scripting Vulnerability (medium 4.3)
- [CVE-2015-2239](https://insights.sbomify.com/CVE-2015-2239/): Security feature bypass in google:chrome (medium 4.3)
- [CVE-2015-2238](https://insights.sbomify.com/CVE-2015-2238/): Other in canonical:ubuntu linux (high 7.5)
- [CVE-2015-2237](https://insights.sbomify.com/CVE-2015-2237/): SQL injection in betster project:betster (high 7.5)
- [CVE-2015-2234](https://insights.sbomify.com/CVE-2015-2234/): Race condition in lenovo:system update (medium 6.9)
- [CVE-2015-2233](https://insights.sbomify.com/CVE-2015-2233/): Security feature bypass in lenovo:system update (high 8.3)
- [CVE-2015-2230](https://insights.sbomify.com/CVE-2015-2230/): Cross-site scripting in synacor:zimbra collaboration server (medium 6.1)
- [CVE-2015-2223](https://insights.sbomify.com/CVE-2015-2223/): Cross-site scripting in palo alto networks:traps (medium 4.3)
- [CVE-2015-2222](https://insights.sbomify.com/CVE-2015-2222/): Denial of service in canonical:ubuntu linux (medium 5.0)
- [CVE-2015-2221](https://insights.sbomify.com/CVE-2015-2221/): Denial of service in canonical:ubuntu linux (medium 5.0)
- [CVE-2015-2220](https://insights.sbomify.com/CVE-2015-2220/): Cross-site scripting in ninjaforms:ninja forms (medium 4.3)
- [CVE-2015-2219](https://insights.sbomify.com/CVE-2015-2219/): Privilege escalation in lenovo:system update (high 7.2)
- [CVE-2015-2218](https://insights.sbomify.com/CVE-2015-2218/): Cross-site scripting in magic hills:wonderplugin audio player (medium 4.3)
- [CVE-2015-2217](https://insights.sbomify.com/CVE-2015-2217/): Cross-site scripting in myupb:ultimate php board (medium 4.3)
- [CVE-2015-2216](https://insights.sbomify.com/CVE-2015-2216/): SQL injection in photocati media:photocrati (high 7.5)
- [CVE-2015-2215](https://insights.sbomify.com/CVE-2015-2215/): Open redirect in services single sign-on server helper project:services single sign-on server helper (medium 5.8)
- [CVE-2015-2214](https://insights.sbomify.com/CVE-2015-2214/): Information disclosure in netcat:netcat (medium 5.0)
- [CVE-2015-2213](https://insights.sbomify.com/CVE-2015-2213/): SQL injection in wordpress:wordpress (high 7.5)
- [CVE-2015-2210](https://insights.sbomify.com/CVE-2015-2210/): Command injection in epicor:crs retail store (high 7.8)
- [CVE-2015-2209](https://insights.sbomify.com/CVE-2015-2209/): Information disclosure in dlguard:dlguard (medium 5.0)
- [CVE-2015-2208](https://insights.sbomify.com/CVE-2015-2208/): Command injection in avinu:phpmoadmin (high 7.5)
- [CVE-2015-2207](https://insights.sbomify.com/CVE-2015-2207/): Cross-site scripting in netcracker:resource management system (medium 5.4)
- [CVE-2015-2206](https://insights.sbomify.com/CVE-2015-2206/): Information disclosure in fedoraproject:fedora (medium 5.0)
- [CVE-2015-2204](https://insights.sbomify.com/CVE-2015-2204/): Missing authorization in evergreen-ils:evergreen (high 7.5)
- [CVE-2015-2203](https://insights.sbomify.com/CVE-2015-2203/): Information disclosure in evergreen-ils:evergreen (medium 6.5)
- [CVE-2015-2202](https://insights.sbomify.com/CVE-2015-2202/): Privilege escalation in arubanetworks:airwave (high 7.2)
- [CVE-2015-2201](https://insights.sbomify.com/CVE-2015-2201/): Command injection in arubanetworks:airwave (high 7.2)
- [CVE-2015-2199](https://insights.sbomify.com/CVE-2015-2199/): SQL injection in wonderplugin:audio player (medium 6.5)
- [CVE-2015-2198](https://insights.sbomify.com/CVE-2015-2198/): Cross-site scripting in beehive forum:beehive forum (medium 4.3)
- [CVE-2015-2197](https://insights.sbomify.com/CVE-2015-2197/): Cross-site scripting in entity api project:entity api (low 3.5)
- [CVE-2015-2196](https://insights.sbomify.com/CVE-2015-2196/): SQL injection in web-dorado:spider calendar (high 7.5)
- [CVE-2015-2195](https://insights.sbomify.com/CVE-2015-2195/): Cross-site scripting in wp media cleaner project:wp media cleaner (medium 4.3)
- [CVE-2015-2194](https://insights.sbomify.com/CVE-2015-2194/): File upload in digitalnature:fusion (medium 6.5)
- [CVE-2015-2192](https://insights.sbomify.com/CVE-2015-2192/): Integer overflow in opensuse:opensuse (medium 5.0)
- [CVE-2015-2191](https://insights.sbomify.com/CVE-2015-2191/): Integer overflow in debian:debian linux (medium 5.0)
- [CVE-2015-2190](https://insights.sbomify.com/CVE-2015-2190/): Denial of service in opensuse:opensuse (medium 5.0)
- [CVE-2015-2189](https://insights.sbomify.com/CVE-2015-2189/): Memory corruption in debian:debian linux (medium 5.0)
- [CVE-2015-2188](https://insights.sbomify.com/CVE-2015-2188/): Memory corruption in debian:debian linux (medium 5.0)
- [CVE-2015-2187](https://insights.sbomify.com/CVE-2015-2187/): Memory corruption in opensuse:opensuse (medium 5.0)
- [CVE-2015-2186](https://insights.sbomify.com/CVE-2015-2186/): Misconfiguration in edx:configuration (high 7.5)
- [CVE-2015-2184](https://insights.sbomify.com/CVE-2015-2184/): Information disclosure in ajsquare:zeuscart (medium 5.0)
- [CVE-2015-2183](https://insights.sbomify.com/CVE-2015-2183/): SQL injection in zeuscart:zeuscart (high 7.5)
- [CVE-2015-2182](https://insights.sbomify.com/CVE-2015-2182/): Cross-site scripting in ajsquare:zeuscart (medium 4.3)
- [CVE-2015-2181](https://insights.sbomify.com/CVE-2015-2181/): Memory corruption in roundcube:webmail (high 8.8)
- [CVE-2015-2180](https://insights.sbomify.com/CVE-2015-2180/): Command injection in roundcube:webmail (high 8.8)
- [CVE-2015-2179](https://insights.sbomify.com/CVE-2015-2179/): xaviershay-dm-rails Gem for Ruby exposes sensitive information via the process table (medium 5.5)
- [CVE-2015-2177](https://insights.sbomify.com/CVE-2015-2177/): Denial of service in siemens:simatic s7-300 cpu (high 7.5)
- [CVE-2015-2172](https://insights.sbomify.com/CVE-2015-2172/): Missing authorization in dokuwiki:dokuwiki (medium 6.5)
- [CVE-2015-2171](https://insights.sbomify.com/CVE-2015-2171/): Slim vulnerable to PHP object injection (high 7.5)
- [CVE-2015-2170](https://insights.sbomify.com/CVE-2015-2170/): Denial of service in canonical:ubuntu linux (medium 5.0)
- [CVE-2015-2169](https://insights.sbomify.com/CVE-2015-2169/): Cross-site scripting in zohocorp:manageengine assetexplorer (medium 4.3)
- [CVE-2015-2167](https://insights.sbomify.com/CVE-2015-2167/): Open redirect in ericsson:drutt mobile service delivery platform (medium 5.8)
- [CVE-2015-2166](https://insights.sbomify.com/CVE-2015-2166/): Path traversal in ericsson:drutt mobile service delivery platform (medium 5.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2015/page/60/