Total
29895 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2015-6456 | 1 Ge | 1 Mds Pulsenet | 2026-06-17 | 9.0 HIGH | N/A |
| GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 have hardcoded credentials for a support account, which allows remote attackers to obtain administrative access, and consequently execute arbitrary code, by leveraging knowledge of the password. | |||||
| CVE-2015-6454 | 1 Everest | 1 Peakhmi | 2026-06-17 | 5.0 MEDIUM | N/A |
| Everest PeakHMI before 8.7.0.2, when the video server is used, allows remote attackers to cause a denial of service (incorrect pointer dereference and daemon crash) via a crafted packet. | |||||
| CVE-2015-6388 | 1 Cisco | 1 Unified Computing System Central Software | 2026-06-17 | 5.0 MEDIUM | N/A |
| Cisco Unified Computing System (UCS) Central software 1.3(0.1) allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted request, aka Bug ID CSCux33575. | |||||
| CVE-2015-6251 | 2 Debian, Gnu | 2 Debian Linux, Gnutls | 2026-06-17 | 5.0 MEDIUM | N/A |
| Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service via a long DistinguishedName (DN) entry in a certificate. | |||||
| CVE-2015-6184 | 1 Microsoft | 2 Internet Explorer, Windows 10 | 2026-06-17 | 9.3 HIGH | 8.1 HIGH |
| The CAttrArray object implementation in Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and memory corruption) via a malformed Cascading Style Sheets (CSS) token sequence in conjunction with modifications to HTML elements, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6048 and CVE-2015-6049. | |||||
| CVE-2015-6125 | 1 Microsoft | 2 Windows Server 2008, Windows Server 2012 | 2026-06-17 | 9.3 HIGH | N/A |
| Use-after-free vulnerability in the DNS server in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted requests, aka "Windows DNS Use After Free Vulnerability." | |||||
| CVE-2015-6045 | 1 Microsoft | 1 Internet Explorer | 2026-06-17 | 9.3 HIGH | N/A |
| Use-after-free vulnerability in the CElement object implementation in Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JavaScript that improperly interacts with use of the Cascading Style Sheets (CSS) empty-cells property for a TABLE element, aka "Internet Explorer Memory Corruption Vulnerability." | |||||
| CVE-2015-6036 | 1 Qnap | 1 Sinage Station | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| QNAP Signage Station before 2.0.1 allows remote attackers to bypass authentication, and consequently upload files, via a spoofed HTTP request. | |||||
| CVE-2015-6022 | 1 Qnap | 1 Signage Station | 2026-06-17 | 9.0 HIGH | 8.8 HIGH |
| Unrestricted file upload vulnerability in QNAP Signage Station before 2.0.1 allows remote authenticated users to execute arbitrary code by uploading an executable file, and then accessing this file via an unspecified URL. | |||||
| CVE-2015-6019 | 1 Zyxel | 1 Pmg5318-b20a Firmware | 2026-06-17 | 5.0 MEDIUM | 8.5 HIGH |
| The management portal on ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 does not terminate sessions upon a logout action, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation. | |||||
| CVE-2015-6012 | 1 Refbase | 1 Refbase | 2026-06-17 | 5.8 MEDIUM | N/A |
| Multiple open redirect vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the referrer parameter. | |||||
| CVE-2015-6011 | 1 Refbase | 1 Refbase | 2026-06-17 | 5.0 MEDIUM | N/A |
| Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allows remote attackers to conduct XML injection attacks via (1) the id parameter to unapi.php or (2) the stylesheet parameter to sru.php. | |||||
| CVE-2015-5997 | 1 Impero | 1 Impero Education Pro | 2026-06-17 | 7.8 HIGH | N/A |
| Impero Education Pro before 5105 uses a hardcoded CBC key and initialization vector derived from a hash of the Imp3ro string, which makes it easier for remote attackers to obtain plaintext data by sniffing the network for ciphertext data. | |||||
| CVE-2015-5987 | 1 Zyxel | 1 Gs1900-10hp Firmware | 2026-06-17 | 5.0 MEDIUM | 8.6 HIGH |
| Belkin F9K1102 2 devices with firmware 2.10.17 use an improper algorithm for selecting the ID value in the header of a DNS query, which makes it easier for remote attackers to spoof responses by predicting this value. | |||||
| CVE-2015-5954 | 1 Owncloud | 2 Owncloud, Owncloud Server | 2026-06-17 | 4.0 MEDIUM | N/A |
| The virtual filesystem in ownCloud Server before 6.0.9, 7.0.x before 7.0.7, and 8.0.x before 8.0.5 does not consider that NULL is a valid getPath return value, which allows remote authenticated users to bypass intended access restrictions and gain access to users files via a sharing link to a file with a deleted parent folder. | |||||
| CVE-2015-5932 | 1 Apple | 1 Mac Os X | 2026-06-17 | 7.2 HIGH | N/A |
| The kernel in Apple OS X before 10.11.1 allows local users to gain privileges by leveraging an unspecified "type confusion" during Mach task processing. | |||||
| CVE-2015-5920 | 1 Apple | 1 Itunes | 2026-06-17 | 4.3 MEDIUM | N/A |
| The Software Update component in Apple iTunes before 12.3 does not properly handle redirection, which allows man-in-the-middle attackers to discover encrypted SMB credentials via unspecified vectors. | |||||
| CVE-2015-5681 | 1 Wpslideshow | 1 Powerplay Gallery | 2026-06-17 | 7.5 HIGH | N/A |
| Unrestricted file upload vulnerability in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in *_uploadfolder/big/. | |||||
| CVE-2015-5652 | 2 Microsoft, Python | 2 Windows, Python | 2026-06-17 | 7.2 HIGH | N/A |
| Untrusted search path vulnerability in python.exe in Python through 3.5.0 on Windows allows local users to gain privileges via a Trojan horse readline.pyd file in the current working directory. NOTE: the vendor says "It was determined that this is a longtime behavior of Python that cannot really be altered at this point." | |||||
| CVE-2015-5584 | 5 Adobe, Apple, Google and 2 more | 8 Air, Air Sdk, Air Sdk \& Compiler and 5 more | 2026-06-17 | 10.0 HIGH | N/A |
| Use-after-free vulnerability in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5570, CVE-2015-5574, CVE-2015-5581, and CVE-2015-6682. | |||||