# CVEs published 2015-03-19

18 CVEs were published on March 19, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-2281](https://cve.now/CVE-2015-2281.md): Stack-based buffer overflow in collectoragent.exe in Fortinet Single Sign On (FSSO) before build 164 allows remote attackers to execute arbi (no CVSS)
- [CVE-2015-2349](https://cve.now/CVE-2015-2349.md): Cross-site scripting (XSS) vulnerability in defaultnewsletter.php in SuperWebMailer 5.60.0.01190 and earlier allows remote attackers to inje (no CVSS)
- [CVE-2015-2350](https://cve.now/CVE-2015-2350.md): Cross-site request forgery (CSRF) vulnerability in MikroTik RouterOS 5.0 and earlier allows remote attackers to hijack the authentication of (no CVSS)
- [CVE-2015-2351](https://cve.now/CVE-2015-2351.md): Multiple cross-site scripting (XSS) vulnerabilities in Alkacon OpenCms 9.5.1 and earlier allow remote attackers to inject arbitrary web scri (no CVSS, org.opencms:opencms-core)
- [CVE-2015-2352](https://cve.now/CVE-2015-2352.md): The cache handler in MyBB (aka MyBulletinBoard) before 1.8.4 does not properly check the encoding of input to the var\_export function, which (no CVSS)
- [CVE-2015-0207](https://cve.now/CVE-2015-0207.md): The dtls1\_listen function in d1\_lib.c in OpenSSL 1.0.2 before 1.0.2a does not properly isolate the state information of independent data str (no CVSS)
- [CVE-2015-0208](https://cve.now/CVE-2015-0208.md): The ASN.1 signature-verification implementation in the rsa\_item\_verify function in crypto/rsa/rsa\_ameth.c in OpenSSL 1.0.2 before 1.0.2a all (no CVSS)
- [CVE-2015-0209](https://cve.now/CVE-2015-0209.md): Use-after-free vulnerability in the d2i\_ECPrivateKey function in crypto/ec/ec\_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 b (no CVSS)
- [CVE-2015-0285](https://cve.now/CVE-2015-0285.md): The ssl3\_client\_hello function in s3\_clnt.c in OpenSSL 1.0.2 before 1.0.2a does not ensure that the PRNG is seeded before proceeding with a (no CVSS)
- [CVE-2015-0286](https://cve.now/CVE-2015-0286.md): The ASN1\_TYPE\_cmp function in crypto/asn1/a\_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0 (no CVSS)
- [CVE-2015-0287](https://cve.now/CVE-2015-0287.md): The ASN1\_item\_ex\_d2i function in crypto/asn1/tasn\_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 befor (no CVSS)
- [CVE-2015-0288](https://cve.now/CVE-2015-0288.md): The X509\_to\_X509\_REQ function in crypto/x509/x509\_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 befor (no CVSS)
- [CVE-2015-0289](https://cve.now/CVE-2015-0289.md): The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly han (no CVSS)
- [CVE-2015-0290](https://cve.now/CVE-2015-0290.md): The multi-block feature in the ssl3\_write\_bytes function in s3\_pkt.c in OpenSSL 1.0.2 before 1.0.2a on 64-bit x86 platforms with AES NI supp (no CVSS)
- [CVE-2015-0291](https://cve.now/CVE-2015-0291.md): The sigalgs implementation in t1\_lib.c in OpenSSL 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (NULL pointer der (no CVSS)
- [CVE-2015-0292](https://cve.now/CVE-2015-0292.md): Integer underflow in the EVP\_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1 (no CVSS)
- [CVE-2015-0293](https://cve.now/CVE-2015-0293.md): The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attacker (no CVSS)
- [CVE-2015-1787](https://cve.now/CVE-2015-1787.md): The ssl3\_get\_client\_key\_exchange function in s3\_srvr.c in OpenSSL 1.0.2 before 1.0.2a, when client authentication and an ephemeral Diffie-He (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-03-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.