Skip to content
OpenAdvisories

Archive

June 2015

Vulnerabilities first published in this month (UTC), newest first.

← May 2015 2015 / June July 2015 →
  1. 125
  2. 219
  3. 38
  4. 47
  5. 57
  6. 6 
  7. 716
  8. 814
  9. 926
  10. 1070
  11. 117
  12. 1216
  13. 1322
  14. 14 
  15. 1567
  16. 1615
  17. 1719
  18. 1816
  19. 1911
  20. 204
  21. 21 
  22. 2210
  23. 2316
  24. 2427
  25. 253
  26. 2611
  27. 272
  28. 2825
  29. 293
  30. 3029
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High —
    CVE-2015-3900

    RubyGems vulnerable to DNS hijack attack

    RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS…

    jruby rubygems-update Debian RubyGems
  • High 7.8
    CVE-2015-3113 Exploited Public exploit EPSS 100%

    Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows a…

    flashplugin-nonfree Ubuntu
    KEV Apr 13, 2022
  • High 8.8
    CVE-2015-1770 Exploited EPSS 35%

    Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office docume…

    KEV Mar 28, 2022
  • High 8.8
    CVE-2015-2360 Exploited EPSS 15%

    win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Serve…

    KEV May 25, 2022
  • High —
    CVE-2014-0230 EPSS 20%

    Uncontrolled Resource Consumption in Apache Tomcat

    Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread co…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • High 7.5
    CVE-2015-3982

    Django allows user sessions hijacking via an empty string in the session key

    The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key.

    django PyPI