# CVEs published 2015-03-24 22 CVEs were published on March 24, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2015-0250](https://cve.now/CVE-2015-0250.md): XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote at (no CVSS, org.apache.xmlgraphics:batik) - [CVE-2015-0252](https://cve.now/CVE-2015-0252.md): internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) v (no CVSS) - [CVE-2015-0261](https://cve.now/CVE-2015-0261.md): Integer signedness error in the mobility\_opt\_print function in the IPv6 mobility printer in tcpdump before 4.7.2 allows remote attackers to (no CVSS) - [CVE-2015-0282](https://cve.now/CVE-2015-0282.md): GnuTLS before 3.1.0 does not verify that the RSA PKCS #1 signature algorithm matches the signature algorithm in the certificate, which allow (no CVSS) - [CVE-2015-1388](https://cve.now/CVE-2015-1388.md): The "RAP console" feature in ArubaOS 5.x through 6.2.x, 6.3.x before 6.3.1.15, and 6.4.x before 6.4.2.4 on Aruba access points in Remote Acc (no CVSS) - [CVE-2015-2153](https://cve.now/CVE-2015-2153.md): The rpki\_rtr\_pdu\_print function in print-rpki-rtr.c in the TCP printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of (no CVSS) - [CVE-2015-2154](https://cve.now/CVE-2015-2154.md): The osi\_print\_cksum function in print-isoclns.c in the ethernet printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of (no CVSS) - [CVE-2015-2155](https://cve.now/CVE-2015-2155.md): The force printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code v (no CVSS) - [CVE-2015-2265](https://cve.now/CVE-2015-2265.md): The remove\_bad\_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands (no CVSS) - [CVE-2015-2284](https://cve.now/CVE-2015-2284.md): userlogin.jsp in SolarWinds Firewall Security Manager (FSM) before 6.6.5 HotFix1 allows remote attackers to gain privileges and execute arbi (no CVSS) - [CVE-2015-0158](https://cve.now/CVE-2015-0158.md): Cross-site scripting (XSS) vulnerability in the Coach NG framework in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through (no CVSS) - [CVE-2015-0197](https://cve.now/CVE-2015-0197.md): IBM General Parallel File System (GPFS) 3.4 before 3.4.0.32, 3.5 before 3.5.0.24, and 4.1 before 4.1.0.7 allows local users to obtain root p (no CVSS) - [CVE-2015-0198](https://cve.now/CVE-2015-0198.md): IBM General Parallel File System (GPFS) 3.4 before 3.4.0.32, 3.5 before 3.5.0.24, and 4.1 before 4.1.0.7 in certain cipherList configuration (no CVSS) - [CVE-2015-0199](https://cve.now/CVE-2015-0199.md): The mmfslinux kernel module in IBM General Parallel File System (GPFS) 3.4 before 3.4.0.32, 3.5 before 3.5.0.24, and 4.1 before 4.1.0.7 allo (no CVSS) - [CVE-2015-0103](https://cve.now/CVE-2015-0103.md): Multiple cross-site scripting (XSS) vulnerabilities in the Process Portal in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 t (no CVSS) - [CVE-2015-0105](https://cve.now/CVE-2015-0105.md): Cross-site scripting (XSS) vulnerability in the Process Portal in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5. (no CVSS) - [CVE-2015-0106](https://cve.now/CVE-2015-0106.md): Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0 through 8.0.1.3, 8.5.0 through 8.5 (no CVSS) - [CVE-2015-0136](https://cve.now/CVE-2015-0136.md): powervc-iso-import in IBM PowerVC 1.2.0.x before 1.2.0.4 and 1.2.1.x before 1.2.2 places an access token on the command line during IVM and (no CVSS) - [CVE-2015-0137](https://cve.now/CVE-2015-0137.md): IBM PowerVC Standard 1.2.0.x before 1.2.0.4 and 1.2.1.x before 1.2.2 validates Hardware Management Console (HMC) certificates only during th (no CVSS) - [CVE-2015-0527](https://cve.now/CVE-2015-0527.md): EMC Documentum xCelerated Management System (xMS) 1.1 before P14 stores cleartext Windows Service credentials in a batch file during Documen (no CVSS) - [CVE-2015-0817](https://cve.now/CVE-2015-0817.md): The asm.js implementation in Mozilla Firefox before 36.0.3, Firefox ESR 31.x before 31.5.2, and SeaMonkey before 2.33.1 does not properly de (no CVSS) - [CVE-2015-0818](https://cve.now/CVE-2015-0818.md): Mozilla Firefox before 36.0.4, Firefox ESR 31.x before 31.5.3, and SeaMonkey before 2.33.1 allow remote attackers to bypass the Same Origin (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-03-24 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.