Archive
May 2015
Vulnerabilities first published in this month (UTC), newest first.
410 results · Feed
-
Unscored —
Stack-based buffer overflow in IBM Domino 8.5 before 8.5.3 FP6 IF7 and 9.0 before 9.0.1 FP3 IF3 allows remote attackers…
-
Unscored —
platform/fonts/shaping/HarfBuzzShaper.cpp in Blink, as used in Google Chrome before 43.0.2357.65, does not initialize a…
-
Unscored —
common/partial_circular_buffer.cc in Google Chrome before 43.0.2357.65 does not properly handle wraps, which allows rem…
-
Unscored —
Google Chrome before 43.0.2357.65 relies on libvpx code that was not built with an appropriate --size-limit value, whic…
-
Unscored —
Use-after-free vulnerability in content/renderer/media/webaudio_capturer_source.cc in the WebAudio implementation in Go…
-
Unscored —
core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink, as used in Google Chrome before 43.0.2357…
-
Unscored —
Stack-based buffer overflow in IBM Domino 8.5 before 8.5.3 FP6 IF7 and 9.0 before 9.0.1 FP3 IF3 allows remote attackers…
-
Unscored —
Multiple use-after-free vulnerabilities in content/renderer/media/user_media_client_impl.cc in the WebRTC implementatio…
-
Unscored —
platform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in Blink, as used in Google Chrome before 43.0.23…
-
Unscored —
core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode…
-
Unscored —
android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java in Google Chrome before 43.0.2357.65 on Android …
-
Unscored —
Use-after-free vulnerability in the SpeechRecognitionClient implementation in the Speech subsystem in Google Chrome bef…
-
Unscored —
The Spellcheck API implementation in Google Chrome before 43.0.2357.65 does not use an HTTPS session for downloading a …
-
Unscored —
Multiple unspecified vulnerabilities in Google V8 before 4.3.61.21, as used in Google Chrome before 43.0.2357.65, allow…
-
Unscored —
IBM License Metric Tool 9 before 9.1.0.2 does not have an off autocomplete attribute for authentication fields, which m…
-
Unscored —
The server in IBM License Metric Tool 7.2.2 before IF15 and 7.5 before IF24 and Tivoli Asset Discovery for Distributed …
-
Unscored —
The command-line scripts in IBM WebSphere Commerce 6.0 through 6.0.0.11, 7.0 through 7.0.0.9, and 7.0 Feature Pack 2 th…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Cisco Unified Intelligence Center 10.6(1) allows remote attackers to…
-
Unscored —
IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, and 8.5 before 8…
-
Unscored —
The Red Hat module-setup.sh script for kexec-tools, as distributed in the kexec-tools before 2.0.7-19 packages in Red H…
-
Unscored —
unzoo allows remote attackers to cause a denial of service (infinite loop and resource consumption) via unspecified vec…
-
Unscored —
Buffer overflow in the EntrReadArch function in unzoo might allow remote attackers to execute arbitrary code via unspec…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2015.1.0 allow remote authenticate…
-
Unscored —
Module::Signature before 0.74 allows remote attackers to execute arbitrary shell commands via a crafted SIGNATURE file …
-
Unscored —
Untrusted search path vulnerability in Module::Signature before 0.75 allows local users to gain privileges via a Trojan…
-
Unscored —
Module::Signature before 0.74 allows remote attackers to bypass signature verification for files via a signature file t…
-
Unscored —
Integer overflow in the ljpeg_start function in dcraw 7.00 and earlier allows remote attackers to cause a denial of ser…
-
Unscored —
The Lights-Out Management (LOM) implementation in Cisco FireSIGHT System Software 5.3.0 on Sourcefire 3D Sensor devices…
-
Unscored —
libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileg…
-
Unscored —CVE-2015-1868 EPSS 79%
The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Author…
-
Medium 5.1
Arbitrary File Override in Docker Engine
Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc.
-
High 8.4
Information Exposure in Docker Engine
Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a cr…
-
High 8.4
Arbitrary File Write in Libcontainer
Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container.
-
Critical 10.0
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and…
KEV Oct 8, 2026 -
Medium —
Symlink Attack in Libcontainer and Docker Engine
Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.
-
Unscored —CVE-2015-3455 EPSS 11%
Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with clien…
-
Unscored —
XML external entity (XXE) vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote authenticate…
-
Unscored —
Untrusted search path vulnerability in GNS3 1.2.3 allows local users to gain privileges via a Trojan horse uuid.dll in …
-
Unscored —
realmd allows remote attackers to inject arbitrary configurations in to sssd.conf and smb.conf via a newline character …
-
Unscored —
The InFocus IN3128HD projector with firmware 0.26 allows remote attackers to bypass authentication via a direct request…