# CVEs published 2015-04-08

22 CVEs were published on April 8, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-0202](https://cve.now/CVE-2015-0202.md): The mod\_dav\_svn server in Subversion 1.8.0 through 1.8.11 allows remote attackers to cause a denial of service (memory consumption) via a la (no CVSS)
- [CVE-2015-0248](https://cve.now/CVE-2015-0248.md): The (1) mod\_dav\_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a d (no CVSS)
- [CVE-2015-0251](https://cve.now/CVE-2015-0251.md): The mod\_dav\_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author (no CVSS)
- [CVE-2015-0556](https://cve.now/CVE-2015-0556.md): Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks via a symlink attack in an ARJ archive. (no CVSS)
- [CVE-2015-0557](https://cve.now/CVE-2015-0557.md): Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which allows remote attackers to conduct absolute path (no CVSS)
- [CVE-2015-1317](https://cve.now/CVE-2015-1317.md): Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1.6.1 allows remote attackers to cause a denial of service (crash) or po (no CVSS)
- [CVE-2015-2782](https://cve.now/CVE-2015-2782.md): Buffer overflow in Open-source ARJ archiver 3.10.22 allows remote attackers to cause a denial of service (crash) or possibly execute arbitra (no CVSS)
- [CVE-2015-3028](https://cve.now/CVE-2015-3028.md): McAfee Advanced Threat Defense (MATD) before 3.4.4.63 allows remote authenticated users to bypass intended restrictions and change or update (no CVSS)
- [CVE-2015-3029](https://cve.now/CVE-2015-3029.md): The web interface in McAfee Advanced Threat Defense (MATD) before 3.4.4.63 does not properly restrict access, which allows remote authentica (no CVSS)
- [CVE-2015-3030](https://cve.now/CVE-2015-3030.md): The web interface in McAfee Advanced Threat Defense (MATD) before 3.4.4.63 allows remote authenticated users to obtain sensitive configurati (no CVSS)
- [CVE-2015-2822](https://cve.now/CVE-2015-2822.md): Siemens SIMATIC HMI Comfort Panels before WinCC (TIA Portal) 13 SP1 Upd2 and SIMATIC WinCC Runtime Advanced before WinCC (TIA Portal) 13 SP1 (no CVSS)
- [CVE-2015-2823](https://cve.now/CVE-2015-2823.md): Siemens SIMATIC HMI Basic Panels 2nd Generation before WinCC (TIA Portal) 13 SP1 Upd2, SIMATIC HMI Comfort Panels before WinCC (TIA Portal) (no CVSS)
- [CVE-2015-0798](https://cve.now/CVE-2015-0798.md): The Reader mode feature in Mozilla Firefox before 37.0.1 on Android, and Desktop Firefox pre-release, does not properly handle privileged UR (no CVSS)
- [CVE-2015-0799](https://cve.now/CVE-2015-0799.md): The HTTP Alternative Services feature in Mozilla Firefox before 37.0.1 allows man-in-the-middle attackers to bypass an intended X.509 certif (no CVSS)
- [CVE-2015-1472](https://cve.now/CVE-2015-1472.md): The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size dur (no CVSS)
- [CVE-2015-1473](https://cve.now/CVE-2015-1473.md): The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size dur (no CVSS)
- [CVE-2015-1798](https://cve.now/CVE-2015-1798.md): The symmetric-key feature in the receive function in ntp\_proto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC fi (no CVSS)
- [CVE-2015-1799](https://cve.now/CVE-2015-1799.md): The symmetric-key feature in the receive function in ntp\_proto.c in ntpd in NTP 3.x and 4.x before 4.2.8p2 performs state-variable updates u (no CVSS)
- [CVE-2015-0905](https://cve.now/CVE-2015-0905.md): Cross-site request forgery (CSRF) vulnerability in bBlog allows remote attackers to hijack the authentication of arbitrary users. (no CVSS)
- [CVE-2015-1773](https://cve.now/CVE-2015-1773.md): Cross-site scripting (XSS) vulnerability in asdoc/templates/index.html in Apache Flex before 4.14.1 allows remote attackers to inject arbitr (no CVSS)
- [CVE-2015-2827](https://cve.now/CVE-2015-2827.md): Cross-site scripting (XSS) vulnerability in CA Spectrum 9.2.x and 9.3.x before 9.3 H02 allows remote authenticated users to inject arbitrary (no CVSS)
- [CVE-2015-2828](https://cve.now/CVE-2015-2828.md): CA Spectrum 9.2.x and 9.3.x before 9.3 H02 does not properly validate serialized Java objects, which allows remote authenticated users to ob (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-04-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.