CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In May 2015 (CVSS score >= 4)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
251 CVE-2015-1263 17 2015-05-20 2017-01-03
4.3
 None Remote Medium Not required None Partial None
The Spellcheck API implementation in Google Chrome before 43.0.2357.65 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file.
252 CVE-2015-1262 17 DoS 2015-05-20 2017-01-03
7.5
 None Remote Low Not required Partial Partial Partial
platform/fonts/shaping/HarfBuzzShaper.cpp in Blink, as used in Google Chrome before 43.0.2357.65, does not initialize a certain width field, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted Unicode text.
253 CVE-2015-1261 20 2015-05-20 2017-01-03
5.0
 None Remote Low Not required None Partial None
android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java in Google Chrome before 43.0.2357.65 on Android does not properly restrict use of a URL's fragment identifier during construction of a page-info popup, which allows remote attackers to spoof the URL bar or deliver misleading popup content via crafted text.
254 CVE-2015-1260 DoS Exec Code 2015-05-20 2017-01-03
7.5
 None Remote Low Not required Partial Partial Partial
Multiple use-after-free vulnerabilities in content/renderer/media/user_media_client_impl.cc in the WebRTC implementation in Google Chrome before 43.0.2357.65 allow remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that executes upon completion of a getUserMedia request.
255 CVE-2015-1259 17 DoS 2015-05-20 2017-01-03
7.5
 None Remote Low Not required Partial Partial Partial
PDFium, as used in Google Chrome before 43.0.2357.65, does not properly initialize memory, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
256 CVE-2015-1258 189 DoS 2015-05-20 2017-01-03
7.5
 None Remote Low Not required Partial Partial Partial
Google Chrome before 43.0.2357.65 relies on libvpx code that was not built with an appropriate --size-limit value, which allows remote attackers to trigger a negative value for a size field, and consequently cause a denial of service or possibly have unspecified other impact, via a crafted frame size in VP9 video data.
257 CVE-2015-1257 119 DoS Overflow 2015-05-20 2017-01-03
7.5
 None Remote Low Not required Partial Partial Partial
platform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, does not properly handle an insufficient number of values in an feColorMatrix filter, which allows remote attackers to cause a denial of service (container overflow) or possibly have unspecified other impact via a crafted document.
258 CVE-2015-1256 DoS 2015-05-20 2017-01-03
7.5
 None Remote Low Not required Partial Partial Partial
Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document that leverages improper handling of a shadow tree for a use element.
259 CVE-2015-1255 DoS Mem. Corr. 2015-05-20 2017-01-03
6.8
 None Remote Medium Not required Partial Partial Partial
Use-after-free vulnerability in content/renderer/media/webaudio_capturer_source.cc in the WebAudio implementation in Google Chrome before 43.0.2357.65 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by leveraging improper handling of a stop action for an audio track.
260 CVE-2015-1254 264 Bypass 2015-05-20 2017-01-03
5.0
 None Remote Low Not required None Partial None
core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the availability of editing.
261 CVE-2015-1253 284 Exec Code Bypass 2015-05-20 2017-01-03
7.5
 None Remote Low Not required Partial Partial Partial
core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that appends a child to a SCRIPT element, related to the insert and executeReparentTask functions.
262 CVE-2015-1252 119 DoS Overflow Bypass 2015-05-20 2017-01-03
7.5
 None Remote Low Not required Partial Partial Partial
common/partial_circular_buffer.cc in Google Chrome before 43.0.2357.65 does not properly handle wraps, which allows remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-of-bounds write) via vectors that trigger a write operation with a large amount of data, related to the PartialCircularBuffer::Write and PartialCircularBuffer::DoWrite functions.
263 CVE-2015-1251 Exec Code 2015-05-20 2018-10-09
6.8
 None Remote Medium Not required Partial Partial Partial
Use-after-free vulnerability in the SpeechRecognitionClient implementation in the Speech subsystem in Google Chrome before 43.0.2357.65 allows remote attackers to execute arbitrary code via a crafted document.
264 CVE-2015-1250 DoS 2015-05-01 2017-01-03
7.5
 None Remote Low Not required Partial Partial Partial
Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.135 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
265 CVE-2015-1243 DoS 2015-05-01 2017-01-03
7.5
 None Remote Low Not required Partial Partial Partial
Use-after-free vulnerability in the MutationObserver::disconnect function in core/dom/MutationObserver.cpp in the DOM implementation in Blink, as used in Google Chrome before 42.0.2311.135, allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering an attempt to unregister a MutationObserver object that is not currently registered.
266 CVE-2015-1188 2015-05-20 2021-01-05
7.5
 None Remote Low Not required Partial Partial Partial
The certificate verification functions in the HNDS service in Swisscom Centro Grande (ADB) DSL routers with firmware before 6.14.00 allows remote attackers to access the management functions via unknown vectors.
267 CVE-2015-1157 17 DoS 2015-05-28 2016-11-28
7.8
 None Remote Low Not required None None Complete
CoreText in Apple iOS 8.x through 8.3 allows remote attackers to cause a denial of service (reboot and messaging disruption) via crafted Unicode text that is not properly handled during display truncation in the Notifications feature, as demonstrated by Arabic characters in (1) an SMS message or (2) a WhatsApp message.
268 CVE-2015-1156 264 Bypass 2015-05-08 2016-11-28
4.3
 None Remote Medium Not required None Partial None
The page-loading implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, does not properly handle the rel attribute in an A element, which allows remote attackers to bypass the Same Origin Policy for a link's target, and spoof the user interface, via a crafted web site.
269 CVE-2015-1155 264 Bypass 2015-05-08 2017-01-03
4.3
 None Remote Medium Not required Partial None None
The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to bypass the Same Origin Policy and read arbitrary files via a crafted web site.
270 CVE-2015-1154 DoS Exec Code Mem. Corr. 2015-05-08 2015-07-13
6.8
 None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-1152 and CVE-2015-1153.
271 CVE-2015-1153 DoS Exec Code Mem. Corr. 2015-05-08 2016-12-03
6.8
 None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-1152 and CVE-2015-1154.
272 CVE-2015-1152 DoS Exec Code Mem. Corr. 2015-05-08 2016-12-03
6.8
 None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-1153 and CVE-2015-1154.
273 CVE-2015-1013 89 Sql Bypass 2015-05-26 2015-05-27
6.5
 None Remote Low ??? Partial Partial Partial
OSIsoft PI AF 2.6 and 2.7 and PI SQL for AF 2.1.2.19 do not ensure that the PI SQL (AF) Trusted Users group lacks the Everyone account, which allows remote authenticated users to bypass intended command restrictions via SQL statements.
274 CVE-2015-1010 310 +Info 2015-05-31 2015-06-02
4.9
 None Local Low Not required Complete None None
Rockwell Automation RSView32 7.60.00 (aka CPR9 SR4) and earlier does not properly encrypt credentials, which allows local users to obtain sensitive information by reading a file and conducting a decryption attack.
275 CVE-2015-1008 89 +Priv Sql 2015-05-26 2016-04-06
6.5
 None Remote Low ??? Partial Partial Partial
SQL injection vulnerability in Emerson AMS Device Manager before 13 allows remote authenticated users to gain privileges via malformed input.
276 CVE-2015-0986 119 Overflow 2015-05-26 2016-12-08
7.5
 None Remote Low Not required Partial Partial Partial
Multiple stack-based buffer overflows in Moxa VPort ActiveX SDK Plus before 2.8 allow remote attackers to insert assembly-code lines via vectors involving a regkey (1) set or (2) get command.
277 CVE-2015-0971 399 DoS 2015-05-14 2015-05-15
5.0
 None Remote Low Not required None None Partial
The DER parser in Suricata before 2.0.8 allows remote attackers to cause a denial of service (crash) via vectors related to SSL/TLS certificates.
278 CVE-2015-0962 18 2015-05-25 2015-05-27
4.3
 None Remote Medium Not required Partial None None
Barracuda Web Filter 7.x and 8.x before 8.1.0.005, when SSL Inspection is enabled, uses the same root Certification Authority certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's trust relationship.
279 CVE-2015-0961 +Info 2015-05-25 2015-05-27
4.3
 None Remote Medium Not required None Partial None
Barracuda Web Filter before 8.1.0.005, when SSL Inspection is enabled, does not verify X.509 certificates from upstream SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
280 CVE-2015-0935 94 Exec Code 2015-05-25 2017-09-07
7.5
 None Remote Low Not required Partial Partial Partial
Bomgar Remote Support before 15.1.1 allows remote attackers to execute arbitrary PHP code via crafted serialized data to unspecified PHP scripts.
281 CVE-2015-0916 89 Exec Code Sql 2015-05-22 2015-05-22
6.5
 None Remote Low ??? Partial Partial Partial
SQL injection vulnerability in graph.php in Cacti before 0.8.6f allows remote authenticated users to execute arbitrary SQL commands via the local_graph_id parameter, a different vulnerability than CVE-2007-6035.
282 CVE-2015-0915 79 XSS 2015-05-22 2015-05-22
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in RAKUS MailDealer 11.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted attachment filename.
283 CVE-2015-0914 284 2015-05-01 2015-05-01
5.0
 None Remote Low Not required Partial None None
EasyCTF before 1.4 does not validate the session ID, which allows remote attackers to obtain access via a crafted HTTP request.
284 CVE-2015-0912 2015-05-01 2015-05-01
6.5
 None Remote Low ??? Partial Partial Partial
EasyCTF before 1.4 allows remote authenticated users to write executable content to files via unspecified vectors.
285 CVE-2015-0847 17 DoS 2015-05-29 2016-12-31
7.8
 None Remote Low Not required None None Complete
nbd-server.c in Network Block Device (nbd-server) before 3.11 does not properly handle signals, which allows remote attackers to cause a denial of service (deadlock) via unspecified vectors.
286 CVE-2015-0797 DoS Exec Code 2015-05-14 2020-09-28
6.8
 None Remote Medium Not required Partial Partial Partial
GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows remote attackers to cause a denial of service (buffer over-read and application crash) or possibly execute arbitrary code via crafted H.264 video data in an m4v file.
287 CVE-2015-0758 200 +Info 2015-05-30 2017-01-04
4.0
 None Remote Low ??? Partial None None
The web-based user interface in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka Bug ID CSCus97452.
288 CVE-2015-0757 200 +Info 2015-05-29 2017-03-24
5.0
 None Remote Low Not required Partial None None
The web framework in Cisco Identity Services Engine (ISE) 1.2(1.901) and 1.3(0.722) does not properly implement session handlers, which allows remote attackers to obtain sensitive information by reading web pages, as demonstrated by MnT reports, aka Bug ID CSCuq23140.
289 CVE-2015-0756 20 DoS 2015-05-29 2017-01-04
6.1
 None Local Network Low Not required None None Complete
Cisco Wireless LAN Controller (WLC) devices with software 7.4(1.1) allow remote attackers to cause a denial of service (wireless-networking outage) via crafted TCP traffic on the local network, aka Bug ID CSCug67104.
290 CVE-2015-0755 284 +Priv 2015-05-29 2017-01-04
6.8
 None Local Low ??? Complete Complete Complete
The Posture module for Cisco Identity Services Engine (ISE), as distributed in Cisco AnyConnect Secure Mobility Client 4.0(64), allows local users to gain privileges via unspecified commands, aka Bug ID CSCut05797.
291 CVE-2015-0754 20 DoS +Info 2015-05-29 2017-01-04
7.5
 None Remote Low ??? Partial None Complete
Cisco Finesse 10.5(1) allows remote authenticated users to obtain sensitive information or cause a denial of service (CPU and memory consumption) via a crafted XML document, aka Bug ID CSCut95810.
292 CVE-2015-0753 20 Exec Code Sql 2015-05-29 2017-01-04
6.8
 None Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in Cisco Unified Email Interaction Manager (EIM) and Unified Web Interaction Manager (WIM) 9.0(2) allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuu30028.
293 CVE-2015-0752 79 XSS 2015-05-29 2017-01-04
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Cisco TelePresence Video Communication Server (VCS) X8.5.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut27635.
294 CVE-2015-0751 20 DoS 2015-05-29 2017-01-04
7.8
 None Remote Low Not required None None Complete
Cisco IP Phone 7861, when firmware from Cisco Unified Communications Manager 10.3(1) is used, allows remote attackers to cause a denial of service via crafted packets, aka Bug ID CSCus81800.
295 CVE-2015-0750 264 Exec Code 2015-05-23 2015-05-26
6.5
 None Remote Low ??? Partial Partial Partial
The administrative web interface in Cisco Hosted Collaboration Solution (HCS) 10.6(1) and earlier allows remote authenticated users to execute arbitrary commands via crafted input to unspecified fields, aka Bug ID CSCut02786.
296 CVE-2015-0747 20 2015-05-30 2017-01-04
4.3
 None Remote Medium Not required None Partial None
Cisco Conductor for Videoscape 3.0 and Cisco Headend System Release allow remote attackers to inject arbitrary cookies via a crafted HTTP request, aka Bug ID CSCuh25408.
297 CVE-2015-0746 254 DoS 2015-05-22 2016-04-06
5.0
 None Remote Low Not required None None Partial
The REST API in Cisco Access Control Server (ACS) 5.5(0.46.2) allows remote attackers to cause a denial of service (API outage) by sending many requests, aka Bug ID CSCut62022.
298 CVE-2015-0745 200 +Info 2015-05-30 2017-01-04
5.0
 None Remote Low Not required Partial None None
Cisco Headend System Release allows remote attackers to read temporary script files or archive files, and consequently obtain sensitive information, via a crafted header in an HTTP request, aka Bug ID CSCus44909.
299 CVE-2015-0744 399 DoS 2015-05-30 2017-01-04
7.8
 None Remote Low Not required None None Complete
Cisco DTA Control System (DTACS) 4.0.0.9 and Cisco Headend System Release allow remote attackers to cause a denial of service (CPU and memory consumption, and TCP service outage) via (1) a SYN flood or (2) another type of TCP traffic flood, aka Bug IDs CSCus50642, CSCus50662, CSCus50625, CSCus50657, and CSCus68315.
300 CVE-2015-0743 399 DoS 2015-05-30 2017-01-04
5.0
 None Remote Low Not required None None Partial
Cisco Headend System Release allows remote attackers to cause a denial of service (DHCP and TFTP outage) via a flood of crafted UDP traffic, aka Bug ID CSCus04097.
Total number of vulnerabilities : 377   Page : 1 2 3 4 5 6 (This Page)7 8
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.