# CVEs published 2015-04-14

64 CVEs were published on April 14, 2015: 1 critical, 2 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2015-0346](https://cve.now/CVE-2015-0346.md): Double free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11. (no CVSS)
- [CVE-2015-0347](https://cve.now/CVE-2015-0347.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows att (no CVSS)
- [CVE-2015-0348](https://cve.now/CVE-2015-0348.md): Buffer overflow in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 (no CVSS)
- [CVE-2015-0349](https://cve.now/CVE-2015-0349.md): Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before (no CVSS)
- [CVE-2015-0350](https://cve.now/CVE-2015-0350.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows att (no CVSS)
- [CVE-2015-0351](https://cve.now/CVE-2015-0351.md): Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before (no CVSS)
- [CVE-2015-0352](https://cve.now/CVE-2015-0352.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows att (no CVSS)
- [CVE-2015-0353](https://cve.now/CVE-2015-0353.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows att (no CVSS)
- [CVE-2015-0354](https://cve.now/CVE-2015-0354.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows att (no CVSS)
- [CVE-2015-0355](https://cve.now/CVE-2015-0355.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows att (no CVSS)
- [CVE-2015-0356](https://cve.now/CVE-2015-0356.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows att (no CVSS)
- [CVE-2015-0357](https://cve.now/CVE-2015-0357.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux does not p (no CVSS)
- [CVE-2015-0358](https://cve.now/CVE-2015-0358.md): Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before (no CVSS)
- [CVE-2015-0359](https://cve.now/CVE-2015-0359.md): Double free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11. (no CVSS)
- [CVE-2015-0360](https://cve.now/CVE-2015-0360.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows att (no CVSS)
- [CVE-2015-2112](https://cve.now/CVE-2015-2112.md): Unspecified vulnerability in HP Easy Deploy, as distributed standalone and in HP Easy Tools before 3.0.1.1650, on HP Thin Client t5540, t574 (no CVSS)
- [CVE-2015-2113](https://cve.now/CVE-2015-2113.md): Unspecified vulnerability in HP Easy Deploy, as distributed standalone and in HP Easy Tools before 3.0.1.1650, on HP Thin Client t5540, t574 (no CVSS)
- [CVE-2015-2114](https://cve.now/CVE-2015-2114.md): HP Support Solution Framework before 11.51.0049 allows remote attackers to download an arbitrary program onto a client machine and execute t (no CVSS)
- [CVE-2015-3038](https://cve.now/CVE-2015-3038.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows att (no CVSS)
- [CVE-2015-3039](https://cve.now/CVE-2015-3039.md): Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before (no CVSS)
- [CVE-2015-3040](https://cve.now/CVE-2015-3040.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux does not p (no CVSS)
- [CVE-2015-3041](https://cve.now/CVE-2015-3041.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows att (no CVSS)
- [CVE-2015-3042](https://cve.now/CVE-2015-3042.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows att (no CVSS)
- [CVE-2015-3043](https://cve.now/CVE-2015-3043.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows att (CVSS 7.8, KEV)
- [CVE-2015-3044](https://cve.now/CVE-2015-3044.md): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows att (no CVSS)
- [CVE-2015-0098](https://cve.now/CVE-2015-0098.md): Task Scheduler in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges by triggering application exe (no CVSS)
- [CVE-2015-1635](https://cve.now/CVE-2015-1635.md): HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote a (CVSS 9.8, KEV)
- [CVE-2015-1638](https://cve.now/CVE-2015-1638.md): Microsoft Active Directory Federation Services (AD FS) 3.0 on Windows Server 2012 R2 does not properly handle logoff actions, which allows r (no CVSS)
- [CVE-2015-1639](https://cve.now/CVE-2015-1639.md): Cross-site scripting (XSS) vulnerability in Microsoft Office for Mac 2011 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2015-1640](https://cve.now/CVE-2015-1640.md): Cross-site scripting (XSS) vulnerability in Microsoft Project Server 2010 SP2 and 2013 SP1 allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2015-1641](https://cve.now/CVE-2015-1641.md): Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, (CVSS 7.8, KEV)
- [CVE-2015-1643](https://cve.now/CVE-2015-1643.md): Microsoft Windows Server 2003 R2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Serv (no CVSS)
- [CVE-2015-1644](https://cve.now/CVE-2015-1644.md): Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Ser (no CVSS)
- [CVE-2015-1645](https://cve.now/CVE-2015-1645.md): Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to execut (no CVSS)
- [CVE-2015-1646](https://cve.now/CVE-2015-1646.md): Microsoft XML Core Services (aka MSXML) 3.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a (no CVSS)
- [CVE-2015-1647](https://cve.now/CVE-2015-1647.md): Virtual Machine Manager (VMM) in Hyper-V in Microsoft Windows 8.1 and Windows Server 2012 R2 allows guest OS users to cause a denial of serv (no CVSS)
- [CVE-2015-1648](https://cve.now/CVE-2015-1648.md): ASP.NET in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, when the customErrors configuration is disabled, (no CVSS)
- [CVE-2015-1649](https://cve.now/CVE-2015-1649.md): Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Viewer, Office Compatibility Pack SP3, Word Au (no CVSS)
- [CVE-2015-1650](https://cve.now/CVE-2015-1650.md): Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word Viewer, Offic (no CVSS)
- [CVE-2015-1651](https://cve.now/CVE-2015-1651.md): Use-after-free vulnerability in Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allows remote attackers to execute a (no CVSS)
- [CVE-2015-1652](https://cve.now/CVE-2015-1652.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2015-1653](https://cve.now/CVE-2015-1653.md): Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2013 SP1 and SharePoint Server 2013 SP1 allows remote attackers (no CVSS)
- [CVE-2015-1657](https://cve.now/CVE-2015-1657.md): Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2015-1659](https://cve.now/CVE-2015-1659.md): Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS)
- [CVE-2015-1660](https://cve.now/CVE-2015-1660.md): Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft (no CVSS)
- [CVE-2015-1661](https://cve.now/CVE-2015-1661.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Intern (no CVSS)
- [CVE-2015-1662](https://cve.now/CVE-2015-1662.md): Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS)
- [CVE-2015-1665](https://cve.now/CVE-2015-1665.md): Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS)
- [CVE-2015-1666](https://cve.now/CVE-2015-1666.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2015-1667](https://cve.now/CVE-2015-1667.md): Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2015-1668](https://cve.now/CVE-2015-1668.md): Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (no CVSS)
- [CVE-2014-5032](https://cve.now/CVE-2014-5032.md): GLPI before 0.84.7 does not properly restrict access to cost information, which allows remote attackers to obtain sensitive information via (no CVSS)
- [CVE-2014-8360](https://cve.now/CVE-2014-8360.md): Directory traversal vulnerability in inc/autoload.function.php in GLPI before 0.84.8 allows remote attackers to include and execute arbitrar (no CVSS)
- [CVE-2014-9488](https://cve.now/CVE-2014-9488.md): The is\_utf8\_well\_formed function in GNU less before 475 allows remote attackers to have unspecified impact via malformed UTF-8 characters, w (no CVSS)
- [CVE-2015-0844](https://cve.now/CVE-2015-0844.md): The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x and 1.12.x before 1.12.2 allows remote attackers to read arbitrary files via a cr (no CVSS)
- [CVE-2015-2788](https://cve.now/CVE-2015-2788.md): Multiple stack-based buffer overflows in the ib\_fill\_isqlda function in dbdimp.c in DBD-Firebird before 1.19 allow remote attackers to have (no CVSS)
- [CVE-2015-2831](https://cve.now/CVE-2015-2831.md): Buffer overflow in das\_watchdog 0.9.0 allows local users to execute arbitrary code with root privileges via a large string in the XAUTHORITY (no CVSS)
- [CVE-2015-3293](https://cve.now/CVE-2015-3293.md): FortiMail 5.0.3 through 5.2.3 allows remote administrators to obtain credentials via the "diag debug application httpd" command. (no CVSS)
- [CVE-2014-9145](https://cve.now/CVE-2014-9145.md): Multiple SQL injection vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter (no CVSS)
- [CVE-2014-9146](https://cve.now/CVE-2014-9146.md): Multiple cross-site scripting (XSS) vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2014-9311](https://cve.now/CVE-2014-9311.md): Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated use (no CVSS)
- [CVE-2015-2223](https://cve.now/CVE-2015-2223.md): Multiple cross-site scripting (XSS) vulnerabilities in the web-based console management interface in Palo Alto Networks Traps (formerly Cyve (no CVSS)
- [CVE-2015-2781](https://cve.now/CVE-2015-2781.md): Cross-site scripting (XSS) vulnerability in cgi-bin/hotspotlogin.cgi in Hotspot Express hotEx Billing Manager 73 allows remote attackers to (no CVSS)
- [CVE-2015-2926](https://cve.now/CVE-2015-2926.md): Cross-site scripting (XSS) vulnerability in Php/stats/statsRecent.inc.php in phpTrafficA 2.3 and earlier allows remote attackers to inject a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-04-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.