# CVEs published 2015-04-14 64 CVEs were published on April 14, 2015: 1 critical, 2 high. 3 are now in CISA KEV. Days are UTC. - [CVE-2015-0346](https://cve.now/CVE-2015-0346.md): Double free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before… (no CVSS) - [CVE-2015-0347](https://cve.now/CVE-2015-0347.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows… (no CVSS) - [CVE-2015-0348](https://cve.now/CVE-2015-0348.md): Buffer overflow in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before… (no CVSS) - [CVE-2015-0349](https://cve.now/CVE-2015-0349.md): Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and… (no CVSS) - [CVE-2015-0350](https://cve.now/CVE-2015-0350.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows… (no CVSS) - [CVE-2015-0351](https://cve.now/CVE-2015-0351.md): Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and… (no CVSS) - [CVE-2015-0352](https://cve.now/CVE-2015-0352.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows… (no CVSS) - [CVE-2015-0353](https://cve.now/CVE-2015-0353.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows… (no CVSS) - [CVE-2015-0354](https://cve.now/CVE-2015-0354.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows… (no CVSS) - [CVE-2015-0355](https://cve.now/CVE-2015-0355.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows… (no CVSS) - [CVE-2015-0356](https://cve.now/CVE-2015-0356.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows… (no CVSS) - [CVE-2015-0357](https://cve.now/CVE-2015-0357.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux does not… (no CVSS) - [CVE-2015-0358](https://cve.now/CVE-2015-0358.md): Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and… (no CVSS) - [CVE-2015-0359](https://cve.now/CVE-2015-0359.md): Double free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before… (no CVSS) - [CVE-2015-0360](https://cve.now/CVE-2015-0360.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows… (no CVSS) - [CVE-2015-2112](https://cve.now/CVE-2015-2112.md): Unspecified vulnerability in HP Easy Deploy, as distributed standalone and in HP Easy Tools before 3.0.1.1650, on HP Thin Client t5540… (no CVSS) - [CVE-2015-2113](https://cve.now/CVE-2015-2113.md): Unspecified vulnerability in HP Easy Deploy, as distributed standalone and in HP Easy Tools before 3.0.1.1650, on HP Thin Client t5540… (no CVSS) - [CVE-2015-2114](https://cve.now/CVE-2015-2114.md): HP Support Solution Framework before 11.51.0049 allows remote attackers to download an arbitrary program onto a client machine and execute… (no CVSS) - [CVE-2015-3038](https://cve.now/CVE-2015-3038.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows… (no CVSS) - [CVE-2015-3039](https://cve.now/CVE-2015-3039.md): Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and… (no CVSS) - [CVE-2015-3040](https://cve.now/CVE-2015-3040.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux does not… (no CVSS) - [CVE-2015-3041](https://cve.now/CVE-2015-3041.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows… (no CVSS) - [CVE-2015-3042](https://cve.now/CVE-2015-3042.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows… (no CVSS) - [CVE-2015-3043](https://cve.now/CVE-2015-3043.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows att (CVSS 7.8, KEV) - [CVE-2015-3044](https://cve.now/CVE-2015-3044.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows… (no CVSS) - [CVE-2015-0098](https://cve.now/CVE-2015-0098.md): Task Scheduler in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges by triggering application… (no CVSS) - [CVE-2015-1635](https://cve.now/CVE-2015-1635.md): HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote a (CVSS 9.8, KEV) - [CVE-2015-1638](https://cve.now/CVE-2015-1638.md): Microsoft Active Directory Federation Services (AD FS) 3.0 on Windows Server 2012 R2 does not properly handle logoff actions, which allows… (no CVSS) - [CVE-2015-1639](https://cve.now/CVE-2015-1639.md): Cross-site scripting (XSS) vulnerability in Microsoft Office for Mac 2011 allows remote attackers to inject arbitrary web script or HTML… (no CVSS) - [CVE-2015-1640](https://cve.now/CVE-2015-1640.md): Cross-site scripting (XSS) vulnerability in Microsoft Project Server 2010 SP2 and 2013 SP1 allows remote attackers to inject arbitrary web… (no CVSS) - [CVE-2015-1641](https://cve.now/CVE-2015-1641.md): Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, (CVSS 7.8, KEV) - [CVE-2015-1643](https://cve.now/CVE-2015-1643.md): Microsoft Windows Server 2003 R2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows… (no CVSS) - [CVE-2015-1644](https://cve.now/CVE-2015-1644.md): Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows… (no CVSS) - [CVE-2015-1645](https://cve.now/CVE-2015-1645.md): Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to… (no CVSS) - [CVE-2015-1646](https://cve.now/CVE-2015-1646.md): Microsoft XML Core Services (aka MSXML) 3.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via… (no CVSS) - [CVE-2015-1647](https://cve.now/CVE-2015-1647.md): Virtual Machine Manager (VMM) in Hyper-V in Microsoft Windows 8.1 and Windows Server 2012 R2 allows guest OS users to cause a denial of… (no CVSS) - [CVE-2015-1648](https://cve.now/CVE-2015-1648.md): ASP.NET in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, when the customErrors configuration is… (no CVSS) - [CVE-2015-1649](https://cve.now/CVE-2015-1649.md): Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Viewer, Office Compatibility Pack SP3, Word… (no CVSS) - [CVE-2015-1650](https://cve.now/CVE-2015-1650.md): Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word Viewer… (no CVSS) - [CVE-2015-1651](https://cve.now/CVE-2015-1651.md): Use-after-free vulnerability in Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allows remote attackers to execute… (no CVSS) - [CVE-2015-1652](https://cve.now/CVE-2015-1652.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory… (no CVSS) - [CVE-2015-1653](https://cve.now/CVE-2015-1653.md): Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2013 SP1 and SharePoint Server 2013 SP1 allows remote… (no CVSS) - [CVE-2015-1657](https://cve.now/CVE-2015-1657.md): Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory… (no CVSS) - [CVE-2015-1659](https://cve.now/CVE-2015-1659.md): Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a… (no CVSS) - [CVE-2015-1660](https://cve.now/CVE-2015-1660.md): Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a… (no CVSS) - [CVE-2015-1661](https://cve.now/CVE-2015-1661.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka… (no CVSS) - [CVE-2015-1662](https://cve.now/CVE-2015-1662.md): Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a… (no CVSS) - [CVE-2015-1665](https://cve.now/CVE-2015-1665.md): Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a… (no CVSS) - [CVE-2015-1666](https://cve.now/CVE-2015-1666.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory… (no CVSS) - [CVE-2015-1667](https://cve.now/CVE-2015-1667.md): Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory… (no CVSS) - [CVE-2015-1668](https://cve.now/CVE-2015-1668.md): Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)… (no CVSS) - [CVE-2014-5032](https://cve.now/CVE-2014-5032.md): GLPI before 0.84.7 does not properly restrict access to cost information, which allows remote attackers to obtain sensitive information… (no CVSS) - [CVE-2014-8360](https://cve.now/CVE-2014-8360.md): Directory traversal vulnerability in inc/autoload.function.php in GLPI before 0.84.8 allows remote attackers to include and execute… (no CVSS) - [CVE-2014-9488](https://cve.now/CVE-2014-9488.md): The is\_utf8\_well\_formed function in GNU less before 475 allows remote attackers to have unspecified impact via malformed UTF-8 characters… (no CVSS) - [CVE-2015-0844](https://cve.now/CVE-2015-0844.md): The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x and 1.12.x before 1.12.2 allows remote attackers to read arbitrary files via a… (no CVSS) - [CVE-2015-2788](https://cve.now/CVE-2015-2788.md): Multiple stack-based buffer overflows in the ib\_fill\_isqlda function in dbdimp.c in DBD-Firebird before 1.19 allow remote attackers to… (no CVSS) - [CVE-2015-2831](https://cve.now/CVE-2015-2831.md): Buffer overflow in das\_watchdog 0.9.0 allows local users to execute arbitrary code with root privileges via a large string in the… (no CVSS) - [CVE-2015-3293](https://cve.now/CVE-2015-3293.md): FortiMail 5.0.3 through 5.2.3 allows remote administrators to obtain credentials via the "diag debug application httpd" command. (no CVSS) - [CVE-2014-9145](https://cve.now/CVE-2014-9145.md): Multiple SQL injection vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to execute arbitrary SQL commands via the (1) id… (no CVSS) - [CVE-2014-9146](https://cve.now/CVE-2014-9146.md): Multiple cross-site scripting (XSS) vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to inject arbitrary web script or HTML via… (no CVSS) - [CVE-2014-9311](https://cve.now/CVE-2014-9311.md): Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated… (no CVSS) - [CVE-2015-2223](https://cve.now/CVE-2015-2223.md): Multiple cross-site scripting (XSS) vulnerabilities in the web-based console management interface in Palo Alto Networks Traps (formerly… (no CVSS) - [CVE-2015-2781](https://cve.now/CVE-2015-2781.md): Cross-site scripting (XSS) vulnerability in cgi-bin/hotspotlogin.cgi in Hotspot Express hotEx Billing Manager 73 allows remote attackers… (no CVSS) - [CVE-2015-2926](https://cve.now/CVE-2015-2926.md): Cross-site scripting (XSS) vulnerability in Php/stats/statsRecent.inc.php in phpTrafficA 2.3 and earlier allows remote attackers to inject… (no CVSS) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/archive/2015-04-14 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.