CVEs published May 1, 2015
18 CVEs were published on May 1, 2015: 1 critical, 0 high. 1 is now in CISA KEV.
- Published
- 18
- Critical
- 1
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 17
- Now in CISA KEV
- 1
- Fix available
- 2
Most affected products
- org.elasticsearch:elasticsearch
- 1
- pillow
- 1
Critical 1
Medium, low and unrated 17
- CVE-2014-3598The Jpeg2KImagePlugin plugin in Pillow before 2.5.3 allows remote attackers to cause a denial of service via a crafted image.pillow
- CVE-2015-0237Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 ignores the permission to deny snapshot creation during live storage migration
- CVE-2015-0257Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 uses weak permissions on the directories shared by the ovirt-engine-dwhd servi
- CVE-2015-2248Cross-site request forgery (CSRF) vulnerability in the user portal in Dell SonicWALL Secure Remote Access (SRA) products with firmware befor
- CVE-2015-3153The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might
- CVE-2015-3337Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackeorg.elasticsearch:elasticsearch
- CVE-2015-3435Samsung Security Manager (SSM) before 1.31 allows remote attackers to execute arbitrary code by uploading a file with an HTTP (1) PUT or (2)
- CVE-2015-3446The Framework Daemon in AlienVault Unified Security Management before 4.15 allows remote attackers to execute arbitrary Python code via a cr
- CVE-2015-3632Foxit Reader, Enterprise Reader, and PhantomPDF before 7.1.5 allow remote attackers to cause a denial of service (memory corruption and cras
- CVE-2015-3633Foxit Reader, Enterprise Reader, and PhantomPDF before 7.1.5 allow remote attackers to cause a denial of service (memory corruption and cras
- CVE-2015-0532EMC RSA Identity Management and Governance (IMG) 6.9 before P04 and 6.9.1 before P01 does not properly restrict password resets, which allow
- CVE-2015-0712The session-manager service in Cisco StarOS 12.0, 12.2(300), 14.0, and 14.0(600) on ASR 5000 devices allows remote attackers to cause a deni
- CVE-2015-0912EasyCTF before 1.4 allows remote authenticated users to write executable content to files via unspecified vectors.
- CVE-2015-0913Cross-site scripting (XSS) vulnerability in EasyCTF before 1.4 allows remote authenticated users to inject arbitrary web script or HTML via
- CVE-2015-0914EasyCTF before 1.4 does not validate the session ID, which allows remote attackers to obtain access via a crafted HTTP request.
- CVE-2015-1243Use-after-free vulnerability in the MutationObserver::disconnect function in core/dom/MutationObserver.cpp in the DOM implementation in Blin
- CVE-2015-1250Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.135 allow attackers to cause a denial of service or possibly have oth