# CVEs published 2015-04-24

20 CVEs were published on April 24, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-1886](https://cve.now/CVE-2015-1886.md): The Remote Document Conversion Service (DCS) in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7 (no CVSS)
- [CVE-2015-1908](https://cve.now/CVE-2015-1908.md): Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0 (no CVSS)
- [CVE-2015-2706](https://cve.now/CVE-2015-2706.md): Race condition in the AsyncPaintWaitEvent::AsyncPaintWaitEvent function in Mozilla Firefox before 37.0.2 allows remote attackers to execute (no CVSS)
- [CVE-2015-3414](https://cve.now/CVE-2015-3414.md): SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause (no CVSS)
- [CVE-2015-3415](https://cve.now/CVE-2015-3415.md): The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-depende (no CVSS)
- [CVE-2015-3416](https://cve.now/CVE-2015-3416.md): The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point co (no CVSS)
- [CVE-2015-3417](https://cve.now/CVE-2015-3417.md): Use-after-free vulnerability in the ff\_h264\_free\_tables function in libavcodec/h264.c in FFmpeg before 2.3.6 allows remote attackers to caus (no CVSS)
- [CVE-2011-4403](https://cve.now/CVE-2011-4403.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of adminis (no CVSS)
- [CVE-2012-2930](https://cve.now/CVE-2012-2930.md): Multiple cross-site request forgery (CSRF) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to hijack the authent (no CVSS)
- [CVE-2012-2932](https://cve.now/CVE-2012-2932.md): Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2012-5451](https://cve.now/CVE-2012-5451.md): Multiple stack-based buffer overflows in HttpUtils.dll in TVMOBiLi before 2.1.0.3974 allow remote attackers to cause a denial of service (tv (no CVSS)
- [CVE-2015-0297](https://cve.now/CVE-2015-0297.md): Red Hat JBoss Operations Network 3.3.1 does not properly restrict access to certain APIs, which allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2015-0846](https://cve.now/CVE-2015-0846.md): django-markupfield before 1.3.2 uses the default docutils RESTRUCTUREDTEXT\_FILTER\_SETTINGS settings, which allows remote attackers to includ (no CVSS, django-markupfield)
- [CVE-2015-3143](https://cve.now/CVE-2015-3143.md): cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users vi (no CVSS)
- [CVE-2015-3144](https://cve.now/CVE-2015-3144.md): The fix\_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to c (no CVSS)
- [CVE-2015-3145](https://cve.now/CVE-2015-3145.md): The sanitize\_cookie\_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attack (no CVSS)
- [CVE-2015-3148](https://cve.now/CVE-2015-3148.md): cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect (no CVSS)
- [CVE-2015-3310](https://cve.now/CVE-2015-3310.md): Buffer overflow in the rc\_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is gr (no CVSS)
- [CVE-2015-0910](https://cve.now/CVE-2015-0910.md): Cross-site scripting (XSS) vulnerability in TAGAWA Takao TransmitMail 1.0.11 through 1.5.8 allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2015-0911](https://cve.now/CVE-2015-0911.md): Directory traversal vulnerability in TAGAWA Takao TransmitMail 1.0.11 through 1.5.8 allows remote attackers to read arbitrary files via vect (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-04-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.