# CVEs published 2015-05-01

18 CVEs were published on May 1, 2015: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2014-3598](https://cve.now/CVE-2014-3598.md): The Jpeg2KImagePlugin plugin in Pillow before 2.5.3 allows remote attackers to cause a denial of service via a crafted image. (no CVSS, pillow)
- [CVE-2015-0237](https://cve.now/CVE-2015-0237.md): Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 ignores the permission to deny snapshot creation during live storage migration (no CVSS)
- [CVE-2015-0257](https://cve.now/CVE-2015-0257.md): Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 uses weak permissions on the directories shared by the ovirt-engine-dwhd servi (no CVSS)
- [CVE-2015-2248](https://cve.now/CVE-2015-2248.md): Cross-site request forgery (CSRF) vulnerability in the user portal in Dell SonicWALL Secure Remote Access (SRA) products with firmware befor (no CVSS)
- [CVE-2015-3153](https://cve.now/CVE-2015-3153.md): The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might (no CVSS)
- [CVE-2015-3337](https://cve.now/CVE-2015-3337.md): Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attacke (no CVSS, org.elasticsearch:elasticsearch)
- [CVE-2015-3435](https://cve.now/CVE-2015-3435.md): Samsung Security Manager (SSM) before 1.31 allows remote attackers to execute arbitrary code by uploading a file with an HTTP (1) PUT or (2) (no CVSS)
- [CVE-2015-3446](https://cve.now/CVE-2015-3446.md): The Framework Daemon in AlienVault Unified Security Management before 4.15 allows remote attackers to execute arbitrary Python code via a cr (no CVSS)
- [CVE-2015-3632](https://cve.now/CVE-2015-3632.md): Foxit Reader, Enterprise Reader, and PhantomPDF before 7.1.5 allow remote attackers to cause a denial of service (memory corruption and cras (no CVSS)
- [CVE-2015-3633](https://cve.now/CVE-2015-3633.md): Foxit Reader, Enterprise Reader, and PhantomPDF before 7.1.5 allow remote attackers to cause a denial of service (memory corruption and cras (no CVSS)
- [CVE-2015-0532](https://cve.now/CVE-2015-0532.md): EMC RSA Identity Management and Governance (IMG) 6.9 before P04 and 6.9.1 before P01 does not properly restrict password resets, which allow (no CVSS)
- [CVE-2015-0712](https://cve.now/CVE-2015-0712.md): The session-manager service in Cisco StarOS 12.0, 12.2(300), 14.0, and 14.0(600) on ASR 5000 devices allows remote attackers to cause a deni (no CVSS)
- [CVE-2015-0912](https://cve.now/CVE-2015-0912.md): EasyCTF before 1.4 allows remote authenticated users to write executable content to files via unspecified vectors. (no CVSS)
- [CVE-2015-0913](https://cve.now/CVE-2015-0913.md): Cross-site scripting (XSS) vulnerability in EasyCTF before 1.4 allows remote authenticated users to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2015-0914](https://cve.now/CVE-2015-0914.md): EasyCTF before 1.4 does not validate the session ID, which allows remote attackers to obtain access via a crafted HTTP request. (no CVSS)
- [CVE-2015-1243](https://cve.now/CVE-2015-1243.md): Use-after-free vulnerability in the MutationObserver::disconnect function in core/dom/MutationObserver.cpp in the DOM implementation in Blin (no CVSS)
- [CVE-2015-1250](https://cve.now/CVE-2015-1250.md): Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.135 allow attackers to cause a denial of service or possibly have oth (no CVSS)
- [CVE-2014-8361](https://cve.now/CVE-2014-8361.md): The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as… (CVSS 9.8, KEV)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-05-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.