# CVEs published 2015-05-20

35 CVEs were published on May 20, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2012-4901](https://cve.now/CVE-2012-4901.md): Cross-site scripting (XSS) vulnerability in Template CMS 2.1.1 and earlier allows remote attackers to inject arbitrary web script or HTML… (no CVSS)
- [CVE-2012-4902](https://cve.now/CVE-2012-4902.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Template CMS 2.1.1 and earlier allow remote attackers to hijack the… (no CVSS)
- [CVE-2015-3141](https://cve.now/CVE-2015-3141.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier allow remote… (no CVSS)
- [CVE-2012-1664](https://cve.now/CVE-2012-1664.md): Multiple cross-site scripting (XSS) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to inject arbitrary… (no CVSS)
- [CVE-2012-1665](https://cve.now/CVE-2012-1665.md): Multiple SQL injection vulnerabilities in the admin panel in osCMax before 2.5.1 allow (1) remote attackers to execute arbitrary SQL… (no CVSS)
- [CVE-2012-3243](https://cve.now/CVE-2012-3243.md): Cross-site scripting (XSS) vulnerability in the SEOgento plugin for Magento allows remote attackers to inject arbitrary web script or HTML… (no CVSS)
- [CVE-2012-6691](https://cve.now/CVE-2012-6691.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to hijack the… (no CVSS)
- [CVE-2015-1188](https://cve.now/CVE-2015-1188.md): The certificate verification functions in the HNDS service in Swisscom Centro Grande (ADB) DSL routers with firmware before 6.14.00 allows… (no CVSS)
- [CVE-2015-3990](https://cve.now/CVE-2015-3990.md): The GMS ViewPoint (GMSVP) web application in Dell Sonicwall GMS, Analyzer, and UMA EM5000 before 7.2 SP4 allows remote authenticated users… (no CVSS)
- [CVE-2015-3999](https://cve.now/CVE-2015-3999.md): Piriform CCleaner 3.26.0.1988 through 5.02.5101 writes the filenames to disk when overwriting files, which allows local users to obtain… (no CVSS)
- [CVE-2015-4016](https://cve.now/CVE-2015-4016.md): The client detection protocol in Valve Steam allows remote attackers to cause a denial of service (process crash) via a crafted response… (no CVSS)
- [CVE-2014-4776](https://cve.now/CVE-2014-4776.md): IBM License Metric Tool 9 before 9.1.0.2 does not have an off autocomplete attribute for authentication fields, which makes it easier for… (no CVSS)
- [CVE-2014-8924](https://cve.now/CVE-2014-8924.md): The server in IBM License Metric Tool 7.2.2 before IF15 and 7.5 before IF24 and Tivoli Asset Discovery for Distributed 7.2.2 before IF15… (no CVSS)
- [CVE-2015-0189](https://cve.now/CVE-2015-0189.md): The cluster repository manager in IBM WebSphere MQ 7.5 before 7.5.0.5 and 8.0 before 8.0.0.2 allows remote authenticated administrators to… (no CVSS)
- [CVE-2015-1251](https://cve.now/CVE-2015-1251.md): Use-after-free vulnerability in the SpeechRecognitionClient implementation in the Speech subsystem in Google Chrome before 43.0.2357.65… (no CVSS)
- [CVE-2015-1252](https://cve.now/CVE-2015-1252.md): common/partial\_circular\_buffer.cc in Google Chrome before 43.0.2357.65 does not properly handle wraps, which allows remote attackers to… (no CVSS)
- [CVE-2015-1253](https://cve.now/CVE-2015-1253.md): core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote… (no CVSS)
- [CVE-2015-1254](https://cve.now/CVE-2015-1254.md): core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode attribute, which… (no CVSS)
- [CVE-2015-1255](https://cve.now/CVE-2015-1255.md): Use-after-free vulnerability in content/renderer/media/webaudio\_capturer\_source.cc in the WebAudio implementation in Google Chrome before… (no CVSS)
- [CVE-2015-1256](https://cve.now/CVE-2015-1256.md): Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to… (no CVSS)
- [CVE-2015-1257](https://cve.now/CVE-2015-1257.md): platform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, does not… (no CVSS)
- [CVE-2015-1258](https://cve.now/CVE-2015-1258.md): Google Chrome before 43.0.2357.65 relies on libvpx code that was not built with an appropriate --size-limit value, which allows remote… (no CVSS)
- [CVE-2015-1259](https://cve.now/CVE-2015-1259.md): PDFium, as used in Google Chrome before 43.0.2357.65, does not properly initialize memory, which allows remote attackers to cause a denial… (no CVSS)
- [CVE-2015-1260](https://cve.now/CVE-2015-1260.md): Multiple use-after-free vulnerabilities in content/renderer/media/user\_media\_client\_impl.cc in the WebRTC implementation in Google Chrome… (no CVSS)
- [CVE-2015-1261](https://cve.now/CVE-2015-1261.md): android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java in Google Chrome before 43.0.2357.65 on Android does not properly… (no CVSS)
- [CVE-2015-1262](https://cve.now/CVE-2015-1262.md): platform/fonts/shaping/HarfBuzzShaper.cpp in Blink, as used in Google Chrome before 43.0.2357.65, does not initialize a certain width… (no CVSS)
- [CVE-2015-1263](https://cve.now/CVE-2015-1263.md): The Spellcheck API implementation in Google Chrome before 43.0.2357.65 does not use an HTTPS session for downloading a Hunspell… (no CVSS)
- [CVE-2015-1264](https://cve.now/CVE-2015-1264.md): Cross-site scripting (XSS) vulnerability in Google Chrome before 43.0.2357.65 allows user-assisted remote attackers to inject arbitrary… (no CVSS)
- [CVE-2015-1265](https://cve.now/CVE-2015-1265.md): Multiple unspecified vulnerabilities in Google Chrome before 43.0.2357.65 allow attackers to cause a denial of service or possibly have… (no CVSS)
- [CVE-2015-1902](https://cve.now/CVE-2015-1902.md): Stack-based buffer overflow in IBM Domino 8.5 before 8.5.3 FP6 IF7 and 9.0 before 9.0.1 FP3 IF3 allows remote attackers to execute… (no CVSS)
- [CVE-2015-1903](https://cve.now/CVE-2015-1903.md): Stack-based buffer overflow in IBM Domino 8.5 before 8.5.3 FP6 IF7 and 9.0 before 9.0.1 FP3 IF3 allows remote attackers to execute… (no CVSS)
- [CVE-2015-3910](https://cve.now/CVE-2015-3910.md): Multiple unspecified vulnerabilities in Google V8 before 4.3.61.21, as used in Google Chrome before 43.0.2357.65, allow attackers to cause… (no CVSS)
- [CVE-2014-6211](https://cve.now/CVE-2014-6211.md): The command-line scripts in IBM WebSphere Commerce 6.0 through 6.0.0.11, 7.0 through 7.0.0.9, and 7.0 Feature Pack 2 through 8, when… (no CVSS)
- [CVE-2015-0740](https://cve.now/CVE-2015-0740.md): Cross-site request forgery (CSRF) vulnerability in Cisco Unified Intelligence Center 10.6(1) allows remote attackers to hijack the… (no CVSS)
- [CVE-2015-1920](https://cve.now/CVE-2015-1920.md): IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, and 8.5 before 8.5.5.6 allows… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2015-05-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.