CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In May 2015 (CVSS score >= 5)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2014-9727 78 1 Exec Code 2015-05-29 2018-08-13
10.0
 None Remote Low Not required Complete Complete Complete
AVM Fritz!Box allows remote attackers to execute arbitrary commands via shell metacharacters in the var:lang parameter to cgi-bin/webcm.
2 CVE-2012-5849 89 1 Exec Code Sql 2015-05-14 2015-05-15
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in ClipBucket 2.6 Revision 738 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) uid parameter in an add_friend action to ajax.php; id parameter in a (2) share_object, (3) add_to_fav, (4) rating, or (5) flag_object action to ajax.php; cid parameter in an (6) add_new_item, (7) remove_collection_item, (8) get_item, or (9) load_more_items action to ajax.php; (10) ci_id parameter in a get_item action to ajax.php; user parameter to (11) user_contacts.php or (12) view_channel.php; (13) pid parameter to view_page.php; (14) tid parameter to view_topic.php; or (15) v parameter to watch_video.php.
3 CVE-2015-4137 89 Exec Code Sql 2015-05-29 2016-12-06
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in related.php in Milw0rm Clone Script 1.0 allows remote attackers to execute arbitrary SQL commands via the program parameter.
4 CVE-2015-4134 2015-05-28 2016-12-31
5.8
 None Remote Medium Not required Partial Partial None
Open redirect vulnerability in goto.php in phpwind 8.7 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
5 CVE-2015-4133 Exec Code 2015-05-28 2016-11-28
7.5
 None Remote Low Not required Partial Partial Partial
Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in uploads/ directory.
6 CVE-2015-4092 119 DoS Exec Code Overflow 2015-05-26 2018-12-10
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the XComms process in SAP Afaria 7.00.6620.2 SP5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request, aka SAP Security Note 2153690.
7 CVE-2015-4091 2015-05-26 2018-12-10
7.5
 None Remote Low Not required Partial Partial Partial
XML external entity (XXE) vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to send TCP requests to intranet servers or possibly have unspecified other impact via an XML request to tc~sld~wd~main/Main, related to "CIM UPLOAD," aka SAP Security Note 2090851.
8 CVE-2015-4069 200 +Info 2015-05-29 2016-12-06
7.8
 None Remote Low Not required Complete None None
The EdgeServiceImpl web service in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive credentials via a crafted SOAP request to the (1) getBackupPolicy or (2) getBackupPolicies method.
9 CVE-2015-4068 22 DoS Dir. Trav. +Info 2015-05-29 2016-12-06
9.4
 None Remote Low Not required Complete None Complete
Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denial of service via a crafted file path to the (1) reportFileServlet or (2) exportServlet servlet.
10 CVE-2015-4067 189 Exec Code Overflow 2015-05-29 2016-12-06
10.0
 None Remote Low Not required Complete Complete Complete
Integer overflow in the libnv6 module in Dell NetVault Backup before 10.0.5 allows remote attackers to execute arbitrary code via crafted template string specifiers in a serialized object, which triggers a heap-based buffer overflow.
11 CVE-2015-4066 89 Exec Code Sql 2015-05-27 2021-08-19
6.5
 None Remote Low ??? Partial Partial Partial
Multiple SQL injection vulnerabilities in admin/handlers.php in the GigPress plugin before 2.3.9 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) show_artist_id or (2) show_venue_id parameter in an add action in the gigpress.php page to wp-admin/admin.php.
12 CVE-2015-4064 89 Exec Code Sql 2015-05-27 2015-05-28
6.5
 None Remote Low ??? Partial Partial Partial
SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the post parameter in an edit delete-variation action to wp-admin/post.php.
13 CVE-2015-4062 89 Exec Code Sql 2015-05-27 2015-05-28
6.5
 None Remote Low ??? Partial Partial Partial
SQL injection vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the where1 parameter in the nsp_search page to wp-admin/admin.php.
14 CVE-2015-4060 119 Exec Code Overflow 2015-05-29 2016-12-06
10.0
 None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in the TermProxy (WLTermProxyService.exe) service in Wavelink ConnectPro allows remote attackers to execute arbitrary code via a large HTTP header.
15 CVE-2015-4059 119 Exec Code Overflow 2015-05-29 2016-12-06
10.0
 None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in the License Server (LicenseServer.exe) in Wavelink Terminal Emulation (TE) allows remote attackers to execute arbitrary code via a large HTTP header.
16 CVE-2015-4047 476 DoS 2015-05-29 2019-03-27
7.8
 None Remote Low Not required None None Complete
racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests.
17 CVE-2015-4032 264 2015-05-29 2016-12-06
10.0
 None Remote Low Not required Complete Complete Complete
projectContents.jsp in the Developer tools in Visual Mining NetCharts Server allows remote attackers to rename arbitrary files, and consequently execute them, via unspecified vectors.
18 CVE-2015-4031 22 Dir. Trav. 2015-05-29 2019-06-24
10.0
 None Remote Low Not required Complete Complete Complete
Directory traversal vulnerability in saveFile.jsp in the development installation in Visual Mining NetChart allows remote attackers to write to arbitrary files via unspecified vectors.
19 CVE-2015-4018 89 Exec Code Sql 2015-05-21 2015-06-25
6.5
 None Remote Low ??? Partial Partial Partial
SQL injection vulnerability in feedwordpresssyndicationpage.class.php in the FeedWordPress plugin before 2015.0514 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the link_ids[] parameter in an Update action in the syndication.php page to wp-admin/admin.php.
20 CVE-2015-4016 20 DoS 2015-05-20 2022-02-07
5.0
 None Remote Low Not required None None Partial
The client detection protocol in Valve Steam allows remote attackers to cause a denial of service (process crash) via a crafted response to a broadcast packet.
21 CVE-2015-3990 19 Exec Code 2015-05-20 2018-03-13
9.0
 None Remote Low ??? Complete Complete Complete
The GMS ViewPoint (GMSVP) web application in Dell Sonicwall GMS, Analyzer, and UMA EM5000 before 7.2 SP4 allows remote authenticated users to execute arbitrary commands via vectors related to configuration.
22 CVE-2015-3987 426 +Priv 2015-05-14 2019-02-11
7.2
 None Local Low Not required Complete Complete Complete
Multiple unquoted Windows search path vulnerabilities in the (1) Client Management and (2) Gateway in McAfee ePO Deep Command 2.1 and 2.2 before HF 1058831 allow local users to gain privileges via unspecified vectors.
23 CVE-2015-3981 200 +Info 2015-05-12 2018-12-10
5.0
 None Remote Low Not required Partial None None
SAP NetWeaver RFC SDK allows attackers to obtain sensitive information via unspecified vectors, aka SAP Security Note 2084037.
24 CVE-2015-3980 89 Exec Code Sql 2015-05-12 2017-01-03
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2097534.
25 CVE-2015-3979 Exec Code 2015-05-12 2017-01-03
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary code via unknown vectors, aka SAP Security Note 2097534.
26 CVE-2015-3939 22 Dir. Trav. 2015-05-31 2016-12-06
6.8
 None Remote Low ??? Complete None None
Directory traversal vulnerability in the NC854 and NC856 modules for IDS RTU 850C devices allows remote authenticated users to read arbitrary files via unspecified vectors involving an internal web server, as demonstrated by reading a TELNET credentials file.
27 CVE-2015-3922 2015-05-27 2016-12-31
5.8
 None Remote Medium Not required Partial Partial None
Open redirect vulnerability in mode.php in Coppermine Photo Gallery before 1.5.36 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referer parameter.
28 CVE-2015-3912 200 +Info 2015-05-21 2015-05-22
5.0
 None Remote Low Not required Partial None None
Huawei E355s Mobile WiFi with firmware before 22.158.45.02.625 and WEBUI before 13.100.04.01.625 allows remote attackers to obtain sensitive configuration information by sniffing the network or sending unspecified commands.
29 CVE-2015-3911 284 DoS Bypass 2015-05-21 2015-05-22
9.0
 None Remote Low Not required Partial Partial Complete
Huawei E587 Mobile WiFi with firmware before 11.203.30.00.00 allows remote attackers to bypass authentication, change configurations, send messages, and cause a denial of service (device restart) via unspecified vectors.
30 CVE-2015-3910 DoS 2015-05-20 2016-12-31
7.5
 None Remote Low Not required Partial Partial Partial
Multiple unspecified vulnerabilities in Google V8 before 4.3.61.21, as used in Google Chrome before 43.0.2357.65, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
31 CVE-2015-3906 119 DoS Overflow 2015-05-26 2017-07-01
5.0
 None Remote Low Not required None None Partial
The logcat_dump_text function in wiretap/logcat.c in the Android Logcat file parser in Wireshark 1.12.x before 1.12.5 does not properly handle a lack of \0 termination, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted message in a packet, a different vulnerability than CVE-2015-3815.
32 CVE-2015-3902 352 CSRF 2015-05-26 2016-12-28
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in the setup process in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 allow remote attackers to hijack the authentication of administrators for requests that modify the configuration file.
33 CVE-2015-3815 119 DoS Overflow 2015-05-26 2017-07-01
5.0
 None Remote Low Not required None None Partial
The detect_version function in wiretap/logcat.c in the Android Logcat file parser in Wireshark 1.12.x before 1.12.5 does not check the length of the payload, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a packet with a crafted payload, as demonstrated by a length of zero, a different vulnerability than CVE-2015-3906.
34 CVE-2015-3814 189 DoS 2015-05-26 2017-07-01
5.0
 None Remote Low Not required None None Partial
The (1) dissect_tfs_request and (2) dissect_tfs_response functions in epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 interpret a zero value as a length rather than an error condition, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
35 CVE-2015-3813 399 DoS 2015-05-26 2018-01-05
5.0
 None Remote Low Not required None None Partial
The fragment_add_work function in epan/reassemble.c in the packet-reassembly feature in Wireshark 1.12.x before 1.12.5 does not properly determine the defragmentation state in a case of an insufficient snapshot length, which allows remote attackers to cause a denial of service (memory consumption) via a crafted packet.
36 CVE-2015-3812 399 DoS 2015-05-26 2019-12-27
7.8
 None Remote Low Not required None None Complete
Multiple memory leaks in the x11_init_protocol function in epan/dissectors/packet-x11.c in the X11 dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 allow remote attackers to cause a denial of service (memory consumption) via a crafted packet.
37 CVE-2015-3811 17 DoS 2015-05-26 2019-12-27
5.0
 None Remote Low Not required None None Partial
epan/dissectors/packet-wcp.c in the WCP dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 improperly refers to previously processed bytes, which allows remote attackers to cause a denial of service (application crash) via a crafted packet, a different vulnerability than CVE-2015-2188.
38 CVE-2015-3810 399 DoS 2015-05-26 2017-07-01
7.8
 None Remote Low Not required None None Complete
epan/dissectors/packet-websocket.c in the WebSocket dissector in Wireshark 1.12.x before 1.12.5 uses a recursive algorithm, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted packet.
39 CVE-2015-3809 189 DoS 2015-05-26 2017-07-01
7.8
 None Remote Low Not required None None Complete
The dissect_lbmr_pser function in epan/dissectors/packet-lbmr.c in the LBMR dissector in Wireshark 1.12.x before 1.12.5 does not properly track the current offset, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
40 CVE-2015-3808 189 DoS 2015-05-26 2017-07-01
7.8
 None Remote Low Not required None None Complete
The dissect_lbmr_pser function in epan/dissectors/packet-lbmr.c in the LBMR dissector in Wireshark 1.12.x before 1.12.5 does not reject a zero length, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
41 CVE-2015-3644 284 Bypass 2015-05-14 2016-12-28
5.8
 None Remote Medium Not required Partial Partial None
Stunnel 5.00 through 5.13, when using the redirect option, does not redirect client connections to the expected server after the initial connection, which allows remote attackers to bypass authentication.
42 CVE-2015-3633 119 DoS Overflow Mem. Corr. 2015-05-01 2017-01-03
5.0
 None Remote Low Not required None None Partial
Foxit Reader, Enterprise Reader, and PhantomPDF before 7.1.5 allow remote attackers to cause a denial of service (memory corruption and crash) via vectors related to digital signatures.
43 CVE-2015-3630 264 +Info 2015-05-18 2018-08-13
7.2
 None Local Low Not required Complete Complete Complete
Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.
44 CVE-2015-3629 59 2015-05-18 2018-08-13
7.2
 None Local Low Not required Complete Complete Complete
Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container.
45 CVE-2015-3627 59 +Priv 2015-05-18 2018-08-13
7.2
 None Local Low Not required Complete Complete Complete
Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.
46 CVE-2015-3610 310 +Info 2015-05-07 2015-05-07
5.4
 None Local Network Medium Not required Partial Partial Partial
The Siemens HomeControl for Room Automation application before 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information or modify data via a crafted certificate.
47 CVE-2015-3456 119 DoS Exec Code Overflow 2015-05-13 2021-11-17
7.7
 None Local Network Low ??? Complete Complete Complete
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.
48 CVE-2015-3451 611 2015-05-12 2020-04-29
5.0
 None Remote Low Not required Partial None None
The _clone function in XML::LibXML before 2.0119 does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function.
49 CVE-2015-3446 94 Exec Code 2015-05-01 2016-12-06
9.3
 None Remote Medium Not required Complete Complete Complete
The Framework Daemon in AlienVault Unified Security Management before 4.15 allows remote attackers to execute arbitrary Python code via a crafted plugin configuration file (.cfg).
50 CVE-2015-3435 264 Exec Code 2015-05-01 2016-12-06
10.0
 None Remote Low Not required Complete Complete Complete
Samsung Security Manager (SSM) before 1.31 allows remote attackers to execute arbitrary code by uploading a file with an HTTP (1) PUT or (2) MOVE request.
Total number of vulnerabilities : 293   Page : 1 (This Page)2 3 4 5 6
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.