# Vulnerabilities published in 2015


- [CVE-2015-1009](https://insights.sbomify.com/CVE-2015-1009/): Information disclosure in indusoft:web studio (low 1.7)
- [CVE-2015-10089](https://insights.sbomify.com/CVE-2015-10089/): flame.js cross site scripting (low 3.5)
- [CVE-2015-10088](https://insights.sbomify.com/CVE-2015-10088/): ayttm proxy.c http_connect format string (medium 5.0)
- [CVE-2015-10087](https://insights.sbomify.com/CVE-2015-10087/): UpThemes Theme DesignFolio Plus unrestricted upload (medium 6.3)
- [CVE-2015-10086](https://insights.sbomify.com/CVE-2015-10086/): OpenCycleCompass server-php login.php sql injection (high 7.3)
- [CVE-2015-10085](https://insights.sbomify.com/CVE-2015-10085/): GoPistolet MTA denial of service (low 3.5)
- [CVE-2015-10084](https://insights.sbomify.com/CVE-2015-10084/): irontec klear-library BaseController.php _prepareWhere sql injection (medium 5.5)
- [CVE-2015-10083](https://insights.sbomify.com/CVE-2015-10083/): harrystech Dynosaur-Rails application_controller.rb basic_auth improper authentication (medium 6.3)
- [CVE-2015-10082](https://insights.sbomify.com/CVE-2015-10082/): UIKit0 libplist XML xplist.c plist_from_xml xml external entity reference (medium 5.5)
- [CVE-2015-10081](https://insights.sbomify.com/CVE-2015-10081/): arnoldle submitByMailPlugin edit_list.php cross-site request forgery (medium 4.3)
- [CVE-2015-10080](https://insights.sbomify.com/CVE-2015-10080/): NREL api-umbrella-web Admin Data Table cross site scripting (low 3.5)
- [CVE-2015-1008](https://insights.sbomify.com/CVE-2015-1008/): SQL injection in emerson:ams device manager (medium 6.5)
- [CVE-2015-10079](https://insights.sbomify.com/CVE-2015-10079/): juju2143 WalrusIRC parser.js parseLinks cross site scripting (low 3.5)
- [CVE-2015-10078](https://insights.sbomify.com/CVE-2015-10078/): atwellpub Resend Welcome Email Plugin resend-welcome-email.php send_welcome_email_url cross site scripting (low 3.5)
- [CVE-2015-10077](https://insights.sbomify.com/CVE-2015-10077/): webbuilders-group silverstripe-kapost-bridge KapostService.php getPreview sql injection (medium 6.3)
- [CVE-2015-10076](https://insights.sbomify.com/CVE-2015-10076/): dimtion Shaarlier Tag TagsSource.java createTag sql injection (medium 5.5)
- [CVE-2015-10075](https://insights.sbomify.com/CVE-2015-10075/): Custom-Content-Width custom-content-width.php register_settings cross site scripting (low 2.6)
- [CVE-2015-10074](https://insights.sbomify.com/CVE-2015-10074/): OpenSeaMap online_chart index.php init cross site scripting (low 3.5)
- [CVE-2015-10073](https://insights.sbomify.com/CVE-2015-10073/): tinymighty WikiSEO Meta Property Tag WikiSEO.body.php modifyHTML cross site scripting (low 3.5)
- [CVE-2015-10072](https://insights.sbomify.com/CVE-2015-10072/): NREL api-umbrella-web Flash Message cross site scripting (low 3.5)
- [CVE-2015-10071](https://insights.sbomify.com/CVE-2015-10071/): gitter-badger ezpublish-modern-legacy forgotpassword.php password recovery (low 2.6)
- [CVE-2015-10070](https://insights.sbomify.com/CVE-2015-10070/): copperwall Twiddit index.php sql injection (medium 6.3)
- [CVE-2015-1007](https://insights.sbomify.com/CVE-2015-1007/): Memory corruption in OptoDataLink (high 7.8)
- [CVE-2015-10069](https://insights.sbomify.com/CVE-2015-10069/): viakondratiuk cash-machine machine.py update_failed_attempts sql injection (medium 5.5)
- [CVE-2015-10068](https://insights.sbomify.com/CVE-2015-10068/): danynab movify-j ReviewServiceImpl.java getByMovieId sql injection (medium 5.5)
- [CVE-2015-10067](https://insights.sbomify.com/CVE-2015-10067/): oznetmaster SSharpSmartThreadPool SmartThreadPool.cs race condition (medium 4.6)
- [CVE-2015-10066](https://insights.sbomify.com/CVE-2015-10066/): tynx wuersch Store.class.php getByCustomQuery sql injection (medium 5.5)
- [CVE-2015-10065](https://insights.sbomify.com/CVE-2015-10065/): AenBleidd FiND my_validator.cpp init_result buffer overflow (medium 5.5)
- [CVE-2015-10064](https://insights.sbomify.com/CVE-2015-10064/): VictorFerraresi pokemon-database-php sql injection (medium 5.5)
- [CVE-2015-10063](https://insights.sbomify.com/CVE-2015-10063/): saemorris TheRadSystem _login.php redirect sql injection (high 7.3)
- [CVE-2015-10062](https://insights.sbomify.com/CVE-2015-10062/): galaxy-data-resource Command Line Template injection (medium 5.5)
- [CVE-2015-10061](https://insights.sbomify.com/CVE-2015-10061/): evandro-machado Trabalho-Web2 ClienteDAO.java sql injection (medium 5.5)
- [CVE-2015-10060](https://insights.sbomify.com/CVE-2015-10060/): MNBikeways database views.py sql injection (medium 5.5)
- [CVE-2015-1006](https://insights.sbomify.com/CVE-2015-1006/): Memory corruption in OptoDataLink (critical 9.8)
- [CVE-2015-10059](https://insights.sbomify.com/CVE-2015-10059/): s134328 Webapplication-Veganguide apiService.js cross site scripting (low 3.5)
- [CVE-2015-10058](https://insights.sbomify.com/CVE-2015-10058/): Wikisource Category Browser index.php cross site scripting (low 3.5)
- [CVE-2015-10057](https://insights.sbomify.com/CVE-2015-10057/): Little Apps Little Software Stats Password Reset class.securelogin.php access control (medium 4.6)
- [CVE-2015-10056](https://insights.sbomify.com/CVE-2015-10056/): 2071174A vinylmap views.py contact sql injection (medium 5.5)
- [CVE-2015-10055](https://insights.sbomify.com/CVE-2015-10055/): PictureThisWebServer user.js router.post sql injection (medium 5.5)
- [CVE-2015-10054](https://insights.sbomify.com/CVE-2015-10054/): githuis P2Manage Database.cs Execute sql injection (medium 5.5)
- [CVE-2015-10053](https://insights.sbomify.com/CVE-2015-10053/): prodigasistemas curupira passwords_controller.rb sql injection (medium 5.5)
- [CVE-2015-10052](https://insights.sbomify.com/CVE-2015-10052/): calesanz gibb-modul-151 login redirect (medium 4.6)
- [CVE-2015-10051](https://insights.sbomify.com/CVE-2015-10051/): bony2023 Discussion-Board main.php display_all_replies sql injection (medium 5.5)
- [CVE-2015-10050](https://insights.sbomify.com/CVE-2015-10050/): brandonfire miRNA_Database_by_PHP_MySql model.php count_rna sql injection (medium 5.5)
- [CVE-2015-1005](https://insights.sbomify.com/CVE-2015-1005/): Information disclosure in ininet solutions:scada web server (low 2.1)
- [CVE-2015-10049](https://insights.sbomify.com/CVE-2015-10049/): Overdrive Eletrônica course-builder oeditor.html cross site scripting (low 3.5)
- [CVE-2015-10048](https://insights.sbomify.com/CVE-2015-10048/): bmattoso desafio_buzz_woody sql injection (medium 5.5)
- [CVE-2015-10047](https://insights.sbomify.com/CVE-2015-10047/): KYUUBl school-register DBManager.java sql injection (medium 5.5)
- [CVE-2015-10046](https://insights.sbomify.com/CVE-2015-10046/): lolfeedback sql injection (medium 5.5)
- [CVE-2015-10045](https://insights.sbomify.com/CVE-2015-10045/): tutrantta project_todolist Database.php update sql injection (medium 5.5)
- [CVE-2015-10044](https://insights.sbomify.com/CVE-2015-10044/): gophergala sqldump sql injection (medium 5.5)
- [CVE-2015-10043](https://insights.sbomify.com/CVE-2015-10043/): abreen Apollo path traversal (medium 5.5)
- [CVE-2015-10042](https://insights.sbomify.com/CVE-2015-10042/): Dovgalyuk AIBattle procedures.php registerUser sql injection (medium 5.5)
- [CVE-2015-10041](https://insights.sbomify.com/CVE-2015-10041/): Dovgalyuk AIBattle procedures.php sendComments sql injection (medium 5.5)
- [CVE-2015-10040](https://insights.sbomify.com/CVE-2015-10040/): gitlearn Escape Sequence config.sh getOutOf injection (medium 5.4)
- [CVE-2015-10039](https://insights.sbomify.com/CVE-2015-10039/): dobos domino EntityFactory.cs sql injection (medium 5.5)
- [CVE-2015-10038](https://insights.sbomify.com/CVE-2015-10038/): nym3r0s pplv2 sql injection (medium 5.5)
- [CVE-2015-10037](https://insights.sbomify.com/CVE-2015-10037/): ACI_Escola sql injection (medium 5.5)
- [CVE-2015-10036](https://insights.sbomify.com/CVE-2015-10036/): kylebebak dronfelipe sql injection (medium 5.5)
- [CVE-2015-10035](https://insights.sbomify.com/CVE-2015-10035/): gperson angular-test-reporter data-server.js addTest sql injection (medium 5.5)
- [CVE-2015-10034](https://insights.sbomify.com/CVE-2015-10034/): j-nowak workout-organizer sql injection (medium 5.5)
- [CVE-2015-10033](https://insights.sbomify.com/CVE-2015-10033/): jvvlee MerlinsBoard Grade improper authorization (low 3.5)
- [CVE-2015-10032](https://insights.sbomify.com/CVE-2015-10032/): HealthMateWeb createaccount.php cross site scripting (low 3.5)
- [CVE-2015-10031](https://insights.sbomify.com/CVE-2015-10031/): purpleparrots 491-Project Highscore update.php sql injection (medium 5.5)
- [CVE-2015-10030](https://insights.sbomify.com/CVE-2015-10030/): SUKOHI Surpass Surpass.php pathname traversal (medium 5.5)
- [CVE-2015-1003](https://insights.sbomify.com/CVE-2015-1003/): Path traversal in ininet solutions:scada web server (medium 5.0)
- [CVE-2015-10029](https://insights.sbomify.com/CVE-2015-10029/): kelvinmo simplexrd simplexrd.class.php xml external entity reference (medium 5.5)
- [CVE-2015-10028](https://insights.sbomify.com/CVE-2015-10028/): ss15-this-is-sparta Main Page roomElement.js cross site scripting (low 3.5)
- [CVE-2015-10027](https://insights.sbomify.com/CVE-2015-10027/): hydrian TTRSS-Auth-LDAP Username ldap injection (medium 5.5)
- [CVE-2015-10026](https://insights.sbomify.com/CVE-2015-10026/): tiredtyrant flairbot flair.py sql injection (medium 5.5)
- [CVE-2015-10025](https://insights.sbomify.com/CVE-2015-10025/): luelista miniConf URL Scanning MessageView.cs denial of service (low 3.5)
- [CVE-2015-10024](https://insights.sbomify.com/CVE-2015-10024/): hoffie larasync file_storage.go path traversal (medium 5.5)
- [CVE-2015-10023](https://insights.sbomify.com/CVE-2015-10023/): Fumon trello-octometric srv.go main sql injection (medium 5.5)
- [CVE-2015-10022](https://insights.sbomify.com/CVE-2015-10022/): IISH nlgis2 custom_import.pl sql injection (medium 5.5)
- [CVE-2015-10021](https://insights.sbomify.com/CVE-2015-10021/): ritterim definely database.js cross site scripting (low 3.5)
- [CVE-2015-10020](https://insights.sbomify.com/CVE-2015-10020/): ssn2013 cis450Project AddAppUser.java addUser sql injection (medium 5.5)
- [CVE-2015-1002](https://insights.sbomify.com/CVE-2015-1002/): Path traversal in ininet solutions:scada web server (medium 6.4)
- [CVE-2015-10019](https://insights.sbomify.com/CVE-2015-10019/): foxoverflow MySimplifiedSQL MySimplifiedSQL_Examples.php cross site scripting (low 3.5)
- [CVE-2015-10018](https://insights.sbomify.com/CVE-2015-10018/): DBRisinajumi d2files D2filesController.php actionDownloadFile sql injection (medium 5.5)
- [CVE-2015-10017](https://insights.sbomify.com/CVE-2015-10017/): HPI-Information-Systems ProLOD sql injection (medium 5.5)
- [CVE-2015-10016](https://insights.sbomify.com/CVE-2015-10016/): jeff-kelley opensim-utils regionscrits.php DatabaseForRegion sql injection (medium 5.5)
- [CVE-2015-10015](https://insights.sbomify.com/CVE-2015-10015/): glidernet ogn-live sql injection (medium 5.5)
- [CVE-2015-10014](https://insights.sbomify.com/CVE-2015-10014/): arekk uke finder.rb sql injection (medium 5.5)
- [CVE-2015-10013](https://insights.sbomify.com/CVE-2015-10013/): WebDevStudios taxonomy-switcher Plugin taxonomy-switcher.php taxonomy_switcher_init cross site scripting (low 3.5)
- [CVE-2015-10012](https://insights.sbomify.com/CVE-2015-10012/): sumocoders FrameworkUserBundle login.html.twig information exposure (low 3.5)
- [CVE-2015-10011](https://insights.sbomify.com/CVE-2015-10011/): OpenDNS OpenResolve endpoints.py neutralization for logs (medium 4.6)
- [CVE-2015-10010](https://insights.sbomify.com/CVE-2015-10010/): OpenDNS OpenResolve API endpoints.py get cross site scripting (low 3.1)
- [CVE-2015-1001](https://insights.sbomify.com/CVE-2015-1001/): Memory corruption in ininet solutions:scada web server (critical 10.0)
- [CVE-2015-10009](https://insights.sbomify.com/CVE-2015-10009/): nterchange code_caller_controller.php getContent code injection (medium 5.5)
- [CVE-2015-10008](https://insights.sbomify.com/CVE-2015-10008/): 82Flex WEIPDCRM sql injection (medium 6.3)
- [CVE-2015-10007](https://insights.sbomify.com/CVE-2015-10007/): 82Flex WEIPDCRM cross site scripting (low 3.5)
- [CVE-2015-10006](https://insights.sbomify.com/CVE-2015-10006/): admont28 Ingnovarq insertarSliderAjax.php cross site scripting (low 3.5)
- [CVE-2015-10005](https://insights.sbomify.com/CVE-2015-10005/): markdown-it html_re.js redos (low 3.5)
- [CVE-2015-10004](https://insights.sbomify.com/CVE-2015-10004/): Timing side-channel in github.com/robbert229/jwt (high 7.5)
- [CVE-2015-10003](https://insights.sbomify.com/CVE-2015-10003/): FileZilla Server PORT confused deputy (medium 4.3)
- [CVE-2015-10002](https://insights.sbomify.com/CVE-2015-10002/): Kiddoware Kids Place Home Button Protection denial of service (medium 5.3)
- [CVE-2015-10001](https://insights.sbomify.com/CVE-2015-10001/): WP-Stats < 2.5.2 - CSRF to Stored Cross-Site Scripting (XSS) (medium 4.3)
- [CVE-2015-1000013](https://insights.sbomify.com/CVE-2015-1000013/): File upload in csv2wpec-coupon project:csv2wpec-coupon (high 7.8)
- [CVE-2015-1000012](https://insights.sbomify.com/CVE-2015-1000012/): Path traversal in mypixs project:mypixs (high 7.5)
- [CVE-2015-1000011](https://insights.sbomify.com/CVE-2015-1000011/): SQL injection in dukapress project:dukapress (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2015/page/72/