# CVEs published 2015-03-30 23 CVEs were published on March 30, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2015-0283](https://cve.now/CVE-2015-0283.md): The slapi-nis plug-in before 0.54.2 does not properly reallocate memory when processing user accounts, which allows remote attackers to caus (no CVSS) - [CVE-2015-1609](https://cve.now/CVE-2015-1609.md): MongoDB before 2.4.13 and 2.6.x before 2.6.8 allows remote attackers to cause a denial of service via a crafted UTF-8 string in a BSON reque (no CVSS) - [CVE-2015-1815](https://cve.now/CVE-2015-1815.md): The get\_rpm\_nvr\_by\_file\_path\_temporary function in util.py in setroubleshoot before 3.2.22 allows remote attackers to execute arbitrary comm (no CVSS) - [CVE-2015-1827](https://cve.now/CVE-2015-1827.md): The get\_user\_grouplist function in the extdom plug-in in FreeIPA before 4.1.4 does not properly reallocate memory when processing user accou (no CVSS) - [CVE-2015-2171](https://cve.now/CVE-2015-2171.md): Middleware/SessionCookie.php in Slim before 2.6.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP (no CVSS, slim/slim) - [CVE-2015-2172](https://cve.now/CVE-2015-2172.md): DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticate (no CVSS) - [CVE-2015-2789](https://cve.now/CVE-2015-2789.md): Unquoted Windows search path vulnerability in the Foxit Cloud Safe Update Service in the Cloud plugin in Foxit Reader 6.1 through 7.0.6.1126 (no CVSS) - [CVE-2015-2790](https://cve.now/CVE-2015-2790.md): Foxit Reader, Enterprise Reader, and PhantomPDF before 7.1 allow remote attackers to cause a denial of service (memory corruption and crash) (no CVSS) - [CVE-2015-2791](https://cve.now/CVE-2015-2791.md): The "menu sync" function in the WPML plugin before 3.1.9 for WordPress allows remote attackers to delete arbitrary posts, pages, and menus v (no CVSS) - [CVE-2015-2792](https://cve.now/CVE-2015-2792.md): The WPML plugin before 3.1.9 for WordPress does not properly handle multiple actions in a request, which allows remote attackers to bypass n (no CVSS) - [CVE-2013-6501](https://cve.now/CVE-2013-6501.md): The default soap.wsdl\_cache\_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp direct (no CVSS) - [CVE-2014-9652](https://cve.now/CVE-2014-9652.md): The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5 (no CVSS) - [CVE-2014-9653](https://cve.now/CVE-2014-9653.md): readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not (no CVSS) - [CVE-2014-9705](https://cve.now/CVE-2014-9705.md): Heap-based buffer overflow in the enchant\_broker\_request\_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, a (no CVSS) - [CVE-2014-9709](https://cve.now/CVE-2014-9709.md): The GetCode\_ function in gd\_gif\_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers t (no CVSS) - [CVE-2015-0273](https://cve.now/CVE-2015-0273.md): Multiple use-after-free vulnerabilities in ext/date/php\_date.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allow remot (no CVSS) - [CVE-2015-1351](https://cve.now/CVE-2015-1351.md): Use-after-free vulnerability in the \_zend\_shared\_memdup function in zend\_shared\_alloc.c in the OPcache extension in PHP through 5.6.7 allows (no CVSS) - [CVE-2015-1352](https://cve.now/CVE-2015-1352.md): The build\_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate token extraction for (no CVSS) - [CVE-2015-2301](https://cve.now/CVE-2015-2301.md): Use-after-free vulnerability in the phar\_rename\_archive function in phar\_object.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote (no CVSS) - [CVE-2015-2305](https://cve.now/CVE-2015-2305.md): Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as us (no CVSS) - [CVE-2015-2331](https://cve.now/CVE-2015-2331.md): Integer overflow in the \_zip\_cdir\_new function in zip\_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4. (no CVSS) - [CVE-2015-2348](https://cve.now/CVE-2015-2348.md): The move\_uploaded\_file implementation in ext/standard/basic\_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 tr (no CVSS) - [CVE-2015-2787](https://cve.now/CVE-2015-2787.md): Use-after-free vulnerability in the process\_nested\_data function in ext/standard/var\_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-03-30 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.