# Vulnerabilities published in 2015


- [CVE-2015-1067](https://insights.sbomify.com/CVE-2015-1067/): Weak cryptography in apple:iphone os (medium 4.3)
- [CVE-2015-1066](https://insights.sbomify.com/CVE-2015-1066/): Memory corruption in apple:mac os x (critical 10.0)
- [CVE-2015-1065](https://insights.sbomify.com/CVE-2015-1065/): Memory corruption in apple:iphone os (medium 5.4)
- [CVE-2015-1064](https://insights.sbomify.com/CVE-2015-1064/): Security feature bypass in apple:iphone os (low 1.9)
- [CVE-2015-1063](https://insights.sbomify.com/CVE-2015-1063/): Null dereference in apple:iphone os (high 7.8)
- [CVE-2015-1062](https://insights.sbomify.com/CVE-2015-1062/): Other in apple:iphone os (medium 5.0)
- [CVE-2015-1061](https://insights.sbomify.com/CVE-2015-1061/): Memory corruption in apple:iphone os (critical 9.3)
- [CVE-2015-1060](https://insights.sbomify.com/CVE-2015-1060/): Open redirect in insanevisions:adaptcms (medium 5.8)
- [CVE-2015-1059](https://insights.sbomify.com/CVE-2015-1059/): File upload in insanevisions:adaptcms (medium 6.5)
- [CVE-2015-1058](https://insights.sbomify.com/CVE-2015-1058/): Cross-site scripting in insanevisions:adaptcms (medium 4.3)
- [CVE-2015-1057](https://insights.sbomify.com/CVE-2015-1057/): Cross-site scripting in e107:e107 (medium 4.3)
- [CVE-2015-1056](https://insights.sbomify.com/CVE-2015-1056/): Cross-site scripting in brother:mfc-j4410dw (medium 4.3)
- [CVE-2015-1055](https://insights.sbomify.com/CVE-2015-1055/): SQL injection in 10web:photo gallery (high 7.5)
- [CVE-2015-1054](https://insights.sbomify.com/CVE-2015-1054/): Cross-site scripting in crea8social:crea8social (low 3.5)
- [CVE-2015-1053](https://insights.sbomify.com/CVE-2015-1053/): Cross-site scripting in croogo:croogo (medium 4.3)
- [CVE-2015-1052](https://insights.sbomify.com/CVE-2015-1052/): Cross-site scripting in phpkit:phpkit (medium 4.3)
- [CVE-2015-1051](https://insights.sbomify.com/CVE-2015-1051/): Open redirect in context project:context (medium 5.8)
- [CVE-2015-1050](https://insights.sbomify.com/CVE-2015-1050/): Cross-site scripting in f5:big-ip application security manager (medium 4.3)
- [CVE-2015-1049](https://insights.sbomify.com/CVE-2015-1049/): Auth bypass in siemens:scalance x-200 series firmware (medium 6.8)
- [CVE-2015-1048](https://insights.sbomify.com/CVE-2015-1048/): Open redirect in siemens:simatic s7 1200 cpu firmware (medium 4.3)
- [CVE-2015-1047](https://insights.sbomify.com/CVE-2015-1047/): Denial of service in vmware:vcenter server (medium 5.0)
- [CVE-2015-1044](https://insights.sbomify.com/CVE-2015-1044/): Denial of service in vmware:esxi (low 3.3)
- [CVE-2015-1043](https://insights.sbomify.com/CVE-2015-1043/): Denial of service in vmware:fusion (low 3.3)
- [CVE-2015-1042](https://insights.sbomify.com/CVE-2015-1042/): Open redirect in mantisbt:mantisbt (medium 5.8)
- [CVE-2015-1041](https://insights.sbomify.com/CVE-2015-1041/): Cross-site scripting in e107:e107 (medium 4.3)
- [CVE-2015-1040](https://insights.sbomify.com/CVE-2015-1040/): Cross-site scripting in bedita:bedita (low 3.5)
- [CVE-2015-1039](https://insights.sbomify.com/CVE-2015-1039/): ZF-Commons ZfcUser Vulnerable to XSS in Login Redirect (medium 4.3)
- [CVE-2015-1038](https://insights.sbomify.com/CVE-2015-1038/): Path traversal in 7-zip:p7zip (medium 5.8)
- [CVE-2015-1032](https://insights.sbomify.com/CVE-2015-1032/): Cross-site scripting in kiwix:kiwix (medium 4.3)
- [CVE-2015-1031](https://insights.sbomify.com/CVE-2015-1031/): Use after free in privoxy:privoxy (high 7.5)
- [CVE-2015-1030](https://insights.sbomify.com/CVE-2015-1030/): Denial of service in privoxy:privoxy (medium 5.0)
- [CVE-2015-1029](https://insights.sbomify.com/CVE-2015-1029/): Privilege escalation in puppet:stdlib (medium 6.5)
- [CVE-2015-1028](https://insights.sbomify.com/CVE-2015-1028/): Cross-site scripting in dlink:dsl-2730b firmware (low 3.5)
- [CVE-2015-1027](https://insights.sbomify.com/CVE-2015-1027/): Information disclosure in percona:toolkit (medium 5.9)
- [CVE-2015-1026](https://insights.sbomify.com/CVE-2015-1026/): Cross-site scripting in zohocorp:manageengine admanager plus (medium 4.3)
- [CVE-2015-1015](https://insights.sbomify.com/CVE-2015-1015/): Weak cryptography in omron:cj2h plc (low 2.1)
- [CVE-2015-10148](https://insights.sbomify.com/CVE-2015-10148/): Hirschmann HiLCOS Hard-coded Credentials SSH SSL Keys (high 8.8)
- [CVE-2015-10147](https://insights.sbomify.com/CVE-2015-10147/): Easy Testimonial Slider and Form <= 1.0.2 - Authenticated (Admin+) SQL injection (medium 4.9)
- [CVE-2015-10146](https://insights.sbomify.com/CVE-2015-10146/): Thumbnail Slider With Lightbox <= 1.0.4 - Authenticated (Admin+) SQL Injection (medium 4.9)
- [CVE-2015-10145](https://insights.sbomify.com/CVE-2015-10145/): Gargoyle 1.5.x Authenticated OS Command Execution via run_commands.sh (high 8.7)
- [CVE-2015-10144](https://insights.sbomify.com/CVE-2015-10144/): Responsive Thumbnail Slider < 1.0.1 - Authenticated (Subscriber+) Arbitrary File Upload (high 8.8)
- [CVE-2015-10143](https://insights.sbomify.com/CVE-2015-10143/): Platform < 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Options Update (critical 9.8)
- [CVE-2015-10142](https://insights.sbomify.com/CVE-2015-10142/): Sitecore XP < 8.0 and CMS < 7.2 and < 7.5 File Read via Known Path (medium 6.9)
- [CVE-2015-10141](https://insights.sbomify.com/CVE-2015-10141/): Xdebug Remote Debugger Unauthenticated OS Command Execution (critical 9.3)
- [CVE-2015-10140](https://insights.sbomify.com/CVE-2015-10140/): Ajax Load More < 2.8.1.2 - Subscriber+ File Upload & Deletion (high 8.8)
- [CVE-2015-1014](https://insights.sbomify.com/CVE-2015-1014/): Other in OFS v3.5 (high 7.3)
- [CVE-2015-10139](https://insights.sbomify.com/CVE-2015-10139/): WPLMS Learning Management System for WordPress, WordPress LMS <= 1.8.4.1 - Privilege Escalation (high 8.8)
- [CVE-2015-10138](https://insights.sbomify.com/CVE-2015-10138/): Work The Flow File Upload <= 2.5.2 - Arbitrary File Upload (critical 9.8)
- [CVE-2015-10137](https://insights.sbomify.com/CVE-2015-10137/): Website Contact Form With File Upload <= 1.3.4 - Arbitrary File Upload (critical 9.8)
- [CVE-2015-10136](https://insights.sbomify.com/CVE-2015-10136/): GI-Media Library < 3.0 - Directory Traversal (high 7.5)
- [CVE-2015-10135](https://insights.sbomify.com/CVE-2015-10135/): WPshop 2 – E-Commerce < 1.3.9.6 - Arbitrary File Upload (critical 9.8)
- [CVE-2015-10134](https://insights.sbomify.com/CVE-2015-10134/): Simple Backup <= 2.7.10 - Arbitrary File Download via Path Traversal (high 7.5)
- [CVE-2015-10133](https://insights.sbomify.com/CVE-2015-10133/): Subscribe to Comments <= 2.1.2 - Local File Includion (high 7.2)
- [CVE-2015-10132](https://insights.sbomify.com/CVE-2015-10132/): Thimo Grauerholz WP-Spreadplugin spreadplugin.php cross site scripting (low 3.5)
- [CVE-2015-10131](https://insights.sbomify.com/CVE-2015-10131/): chrisy TFO Graphviz Plugin tfo-graphviz-admin.php admin_page cross site scripting (low 3.5)
- [CVE-2015-10130](https://insights.sbomify.com/CVE-2015-10130/): Cross-site request forgery in Team Circle Image Slider With Lightbox (medium 5.3)
- [CVE-2015-1013](https://insights.sbomify.com/CVE-2015-1013/): Misconfiguration in osisoft:pi server (medium 6.5)
- [CVE-2015-10129](https://insights.sbomify.com/CVE-2015-10129/): planet-freo auth.inc.php comparison (low 3.7)
- [CVE-2015-10128](https://insights.sbomify.com/CVE-2015-10128/): rt-prettyphoto Plugin rt-prettyphoto.php royal_prettyphoto_plugin_links cross site scripting (low 3.5)
- [CVE-2015-10127](https://insights.sbomify.com/CVE-2015-10127/): PlusCaptcha Plugin cross site scripting (low 3.5)
- [CVE-2015-10126](https://insights.sbomify.com/CVE-2015-10126/): Easy2Map Photos Plugin sql injection (medium 6.3)
- [CVE-2015-10125](https://insights.sbomify.com/CVE-2015-10125/): WP Ultimate CSV Importer Plugin cross-site request forgery (medium 4.3)
- [CVE-2015-10124](https://insights.sbomify.com/CVE-2015-10124/): Most Popular Posts Widget Plugin functions.php show_views sql injection (medium 6.3)
- [CVE-2015-10123](https://insights.sbomify.com/CVE-2015-10123/): Wago: Buffer Copy without Checking Size of Input in wbm of multiple products (high 8.8)
- [CVE-2015-10122](https://insights.sbomify.com/CVE-2015-10122/): wp-donate Plugin donate-display.php sql injection (medium 6.3)
- [CVE-2015-10121](https://insights.sbomify.com/CVE-2015-10121/): Beeliked Microsite Plugin beelikedmicrosite.php embed_handler cross site scripting (low 3.5)
- [CVE-2015-10120](https://insights.sbomify.com/CVE-2015-10120/): WDS Multisite Aggregate Plugin WDS_Multisite_Aggregate_Options.php update_options cross site scripting (low 3.5)
- [CVE-2015-1012](https://insights.sbomify.com/CVE-2015-1012/): Information disclosure in LifeCare PCA Infusion System (high 7.5)
- [CVE-2015-10119](https://insights.sbomify.com/CVE-2015-10119/): View All Posts Page Plugin view-all-posts-pages.php action_admin_notices_activation cross site scripting (low 3.5)
- [CVE-2015-10118](https://insights.sbomify.com/CVE-2015-10118/): cchetanonline WP-CopyProtect wp-copyprotect.php CopyProtect_options_page cross site scripting (low 3.5)
- [CVE-2015-10117](https://insights.sbomify.com/CVE-2015-10117/): Gravity Forms DPS PxPay Plugin cross site scripting (low 3.5)
- [CVE-2015-10116](https://insights.sbomify.com/CVE-2015-10116/): Cross-site request forgery in Favicon Plugin (medium 4.3)
- [CVE-2015-10115](https://insights.sbomify.com/CVE-2015-10115/): WooSidebars Sidebar Manager Converter Plugin class-woosidebars-sbm-converter.php process_request redirect (medium 4.3)
- [CVE-2015-10114](https://insights.sbomify.com/CVE-2015-10114/): WooSidebars Plugin class-woo-sidebars.php enable_custom_post_sidebars redirect (medium 4.3)
- [CVE-2015-10113](https://insights.sbomify.com/CVE-2015-10113/): WooFramework Tweaks Plugin wooframework-tweaks.php admin_screen_logic redirect (low 3.5)
- [CVE-2015-10112](https://insights.sbomify.com/CVE-2015-10112/): WooFramework Branding Plugin wooframework-branding.php admin_screen_logic redirect (medium 4.3)
- [CVE-2015-10111](https://insights.sbomify.com/CVE-2015-10111/): Watu Quiz Plugin Exam exam.php watu_exams sql injection (medium 6.3)
- [CVE-2015-10110](https://insights.sbomify.com/CVE-2015-10110/): ruddernation TinyChat Room Spy Plugin room-spy.php wp_show_room_spy cross site scripting (low 3.5)
- [CVE-2015-1011](https://insights.sbomify.com/CVE-2015-1011/): Hardcoded credentials in hospira:lifecare pcainfusion firmware (medium 5.0)
- [CVE-2015-10109](https://insights.sbomify.com/CVE-2015-10109/): Video Playlist and Gallery Plugin wp-media-cincopa.php cross-site request forgery (medium 4.3)
- [CVE-2015-10108](https://insights.sbomify.com/CVE-2015-10108/): meitar Inline Google Spreadsheet Viewer Plugin inline-gdocs-viewer.php displayShortcode cross-site request forgery (medium 4.3)
- [CVE-2015-10107](https://insights.sbomify.com/CVE-2015-10107/): Simplr Registration Form Plus+ Plugin cross site scripting (low 3.5)
- [CVE-2015-10106](https://insights.sbomify.com/CVE-2015-10106/): mback2k mh_httpbl Extension index.php moduleContent sql injection (medium 6.3)
- [CVE-2015-10105](https://insights.sbomify.com/CVE-2015-10105/): IP Blacklist Cloud Plugin CSV File Import ip_blacklist_cloud.php valid_js_identifier path traversal (medium 6.3)
- [CVE-2015-10104](https://insights.sbomify.com/CVE-2015-10104/): Icons for Features Plugin class-icons-for-features-admin.php redirect (low 3.5)
- [CVE-2015-10103](https://insights.sbomify.com/CVE-2015-10103/): InternalError503 Forget It settings.js infinite loop (low 2.8)
- [CVE-2015-10102](https://insights.sbomify.com/CVE-2015-10102/): Freshdesk Plugin redirect (medium 6.3)
- [CVE-2015-10101](https://insights.sbomify.com/CVE-2015-10101/): Google Analytics Top Content Widget Plugin class-tgm-plugin-activation.php cross site scripting (low 3.5)
- [CVE-2015-10100](https://insights.sbomify.com/CVE-2015-10100/): Dynamic Widgets Plugin dynwid_class.php sql injection (medium 6.3)
- [CVE-2015-1010](https://insights.sbomify.com/CVE-2015-1010/): Weak cryptography in rockwellautomation:rsview32 (medium 4.9)
- [CVE-2015-10099](https://insights.sbomify.com/CVE-2015-10099/): CP Appointment Calendar Plugin dex_appointments.php dex_process_ready_to_go_appointment sql injection (medium 6.3)
- [CVE-2015-10098](https://insights.sbomify.com/CVE-2015-10098/): Broken Link Checker Plugin ui_get_action_links cross site scripting (low 3.5)
- [CVE-2015-10097](https://insights.sbomify.com/CVE-2015-10097/): grinnellplans-php read.php interface_disp_page sql injection (medium 6.3)
- [CVE-2015-10096](https://insights.sbomify.com/CVE-2015-10096/): Zarthus IRC Twitter Announcer Bot twitter_announcer.rb get_tweets command injection (medium 5.0)
- [CVE-2015-10095](https://insights.sbomify.com/CVE-2015-10095/): woo-popup Plugin class-woo-popup-admin.php cross site scripting (low 3.5)
- [CVE-2015-10094](https://insights.sbomify.com/CVE-2015-10094/): Fastly Plugin api.php post cross site scripting (low 2.4)
- [CVE-2015-10093](https://insights.sbomify.com/CVE-2015-10093/): Mark User as Spammer Plugin plugin.php user_row_actions cross site scripting (low 2.6)
- [CVE-2015-10092](https://insights.sbomify.com/CVE-2015-10092/): Qtranslate Slug Plugin class-qtranslate-slug.php add_slug_meta_box cross site scripting (low 3.5)
- [CVE-2015-10091](https://insights.sbomify.com/CVE-2015-10091/): ByWater Solutions bywater-koha-xslt systempreferences.pl StringSearch sql injection (medium 4.7)
- [CVE-2015-10090](https://insights.sbomify.com/CVE-2015-10090/): Landing Pages Plugin cross site scripting (low 3.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2015/page/71/