# CVEs published 2015-04-01

40 CVEs were published on April 1, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-1233](https://cve.now/CVE-2015-1233.md): Google Chrome before 41.0.2272.118 does not properly handle the interaction of IPC, the Gamepad API, and Google V8, which allows remote atta (no CVSS)
- [CVE-2015-1234](https://cve.now/CVE-2015-1234.md): Race condition in gpu/command\_buffer/service/gles2\_cmd\_decoder.cc in Google Chrome before 41.0.2272.118 allows remote attackers to cause a d (no CVSS)
- [CVE-2014-9713](https://cve.now/CVE-2014-9713.md): The default slapd configuration in the Debian openldap package 2.4.23-3 through 2.4.39-1.1 allows remote authenticated users to modify the u (no CVSS)
- [CVE-2015-0259](https://cve.now/CVE-2015-0259.md): OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket request (no CVSS, nova)
- [CVE-2015-2294](https://cve.now/CVE-2015-2294.md): Multiple cross-site scripting (XSS) vulnerabilities in the WebGUI in pfSense before 2.2.1 allow remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2015-2751](https://cve.now/CVE-2015-2751.md): Xen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows remote domains with partial management control to cause a denial of (no CVSS)
- [CVE-2015-2752](https://cve.now/CVE-2015-2752.md): The XEN\_DOMCTL\_memory\_mapping hypercall in Xen 3.2.x through 4.5.x, when using a PCI passthrough device, is not preemptible, which allows lo (no CVSS)
- [CVE-2015-2755](https://cve.now/CVE-2015-2755.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the AB Google Map Travel (AB-MAP) plugin before 4.0 for WordPress allow remote (no CVSS)
- [CVE-2015-2756](https://cve.now/CVE-2015-2756.md): QEMU, as used in Xen 3.3.x through 4.5.x, does not properly restrict access to PCI command registers, which might allow local HVM guest user (no CVSS)
- [CVE-2015-2811](https://cve.now/CVE-2015-2811.md): XML external entity (XXE) vulnerability in ReportXmlViewer in SAP NetWeaver Portal 7.31.201109172004 allows remote attackers to send request (no CVSS)
- [CVE-2015-2812](https://cve.now/CVE-2015-2812.md): XML external entity (XXE) vulnerability in XMLValidationComponent in SAP NetWeaver Portal 7.31.201109172004 allows remote attackers to send (no CVSS)
- [CVE-2015-2813](https://cve.now/CVE-2015-2813.md): XML external entity (XXE) vulnerability in SAP Mobile Platform allows remote attackers to send requests to intranet servers via crafted XML, (no CVSS)
- [CVE-2015-2814](https://cve.now/CVE-2015-2814.md): SAP EMR Unwired (com.sap.mobile.healthcare.emr.v2) and Clinical Task Tracker (com.sap.mobile.healthcare.ctt) does not properly restrict acce (no CVSS)
- [CVE-2015-2815](https://cve.now/CVE-2015-2815.md): Buffer overflow in the C\_SAPGPARAM function in the NetWeaver Dispatcher in SAP KERNEL 7.00 (7000.52.12.34966) and 7.40 (7400.12.21.30308) al (no CVSS)
- [CVE-2015-2816](https://cve.now/CVE-2015-2816.md): The XcListener in SAP Afaria 7.0.6001.5 does not properly restrict access, which allows remote attackers to have unspecified impact via a cr (no CVSS)
- [CVE-2015-2817](https://cve.now/CVE-2015-2817.md): The SAP Management Console in SAP NetWeaver 7.40 allows remote attackers to obtain sensitive information via the ReadProfile parameters, aka (no CVSS)
- [CVE-2015-2818](https://cve.now/CVE-2015-2818.md): XML external entity (XXE) vulnerability in SAP Mobile Platform 3 allows remote attackers to send requests to intranet servers via crafted XM (no CVSS)
- [CVE-2015-2819](https://cve.now/CVE-2015-2819.md): SAP Sybase SQL Anywhere 11 and 16 allows remote attackers to cause a denial of service (crash) via a crafted request, aka SAP Security Note (no CVSS)
- [CVE-2015-2820](https://cve.now/CVE-2015-2820.md): Buffer overflow in XcListener in SAP Afaria 7.0.6001.5 allows remote attackers to cause a denial of service (process termination) via a craf (no CVSS)
- [CVE-2015-2821](https://cve.now/CVE-2015-2821.md): TYPO3 Neos 1.1.x before 1.1.3 and 1.2.x before 1.2.3 allows remote editors to access, create, and modify content nodes in the workspace of o (no CVSS)
- [CVE-2012-2808](https://cve.now/CVE-2012-2808.md): The PRNG implementation in the DNS resolver in Bionic in Android before 4.1.1 incorrectly uses time and PID information during the generatio (no CVSS)
- [CVE-2015-0800](https://cve.now/CVE-2015-0800.md): The PRNG implementation in the DNS resolver in Mozilla Firefox (aka Fennec) before 37.0 on Android does not properly generate random numbers (no CVSS)
- [CVE-2015-0801](https://cve.now/CVE-2015-0801.md): Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Poli (no CVSS)
- [CVE-2015-0802](https://cve.now/CVE-2015-0802.md): Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, whic (no CVSS)
- [CVE-2015-0803](https://cve.now/CVE-2015-0803.md): The HTMLSourceElement::AfterSetAttr function in Mozilla Firefox before 37.0 does not properly constrain the original data type of a casted v (no CVSS)
- [CVE-2015-0804](https://cve.now/CVE-2015-0804.md): The HTMLSourceElement::BindToTree function in Mozilla Firefox before 37.0 does not properly constrain a data type after omitting namespace v (no CVSS)
- [CVE-2015-0805](https://cve.now/CVE-2015-0805.md): The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 makes an incorrect memset call during interaction with (no CVSS)
- [CVE-2015-0806](https://cve.now/CVE-2015-0806.md): The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 attempts to use memset for a memory region of negative (no CVSS)
- [CVE-2015-0807](https://cve.now/CVE-2015-0807.md): The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 processes (no CVSS)
- [CVE-2015-0808](https://cve.now/CVE-2015-0808.md): The webrtc::VPMContentAnalysis::Release function in the WebRTC implementation in Mozilla Firefox before 37.0 uses incompatible approaches to (no CVSS)
- [CVE-2015-0810](https://cve.now/CVE-2015-0810.md): Mozilla Firefox before 37.0 on OS X does not ensure that the cursor is visible, which allows remote attackers to conduct clickjacking attack (no CVSS)
- [CVE-2015-0811](https://cve.now/CVE-2015-0811.md): The QCMS implementation in Mozilla Firefox before 37.0 allows remote attackers to obtain sensitive information from process heap memory or c (no CVSS)
- [CVE-2015-0812](https://cve.now/CVE-2015-0812.md): Mozilla Firefox before 37.0 does not require an HTTPS session for lightweight theme add-on installations, which allows man-in-the-middle att (no CVSS)
- [CVE-2015-0813](https://cve.now/CVE-2015-0813.md): Use-after-free vulnerability in the AppendElements function in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird be (no CVSS)
- [CVE-2015-0814](https://cve.now/CVE-2015-0814.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0 allow remote attackers to cause a denial of servic (no CVSS)
- [CVE-2015-0815](https://cve.now/CVE-2015-0815.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird bef (no CVSS)
- [CVE-2015-0816](https://cve.now/CVE-2015-0816.md): Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes (no CVSS)
- [CVE-2015-1892](https://cve.now/CVE-2015-1892.md): The Multicast DNS (mDNS) responder in IBM Security Access Manager for Web 7.x before 7.0.0 FP12 and 8.x before 8.0.1 FP1 inadvertently respo (no CVSS)
- [CVE-2015-2809](https://cve.now/CVE-2015-2809.md): The Multicast DNS (mDNS) responder in Synology DiskStation Manager (DSM) before 3.1 inadvertently responds to unicast queries with source ad (no CVSS)
- [CVE-2015-2808](https://cve.now/CVE-2015-2808.md): The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initializatio (CVSS 3.7)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-04-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.