# CVEs published 2015-05-12

28 CVEs were published on May 12, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-3978](https://cve.now/CVE-2015-3978.md): SAP Sybase Unwired Platform Online Data Proxy allows local users to obtain usernames and passwords via the DataVault, aka SAP Security Note (no CVSS)
- [CVE-2015-3979](https://cve.now/CVE-2015-3979.md): Unspecified vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary code via unknown vec (no CVSS)
- [CVE-2015-3980](https://cve.now/CVE-2015-3980.md): SQL injection vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary SQL commands via u (no CVSS)
- [CVE-2015-3981](https://cve.now/CVE-2015-3981.md): SAP NetWeaver RFC SDK allows attackers to obtain sensitive information via unspecified vectors, aka SAP Security Note 2084037. (no CVSS)
- [CVE-2014-8616](https://cve.now/CVE-2014-8616.md): Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiOS 5.2.x before 5.2.3 allow remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2014-8618](https://cve.now/CVE-2014-8618.md): Cross-site scripting (XSS) vulnerability in the theme login page in Fortinet FortiADC D models before 4.2 allows remote attackers to inject (no CVSS)
- [CVE-2014-8619](https://cve.now/CVE-2014-8619.md): Cross-site scripting (XSS) vulnerability in the autolearn configuration page in Fortinet FortiWeb 5.1.2 through 5.3.4 allows remote attacker (no CVSS)
- [CVE-2014-9326](https://cve.now/CVE-2014-9326.md): The automatic signature update functionality in the (1) Phone Home feature in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, GTM, and Link Control (no CVSS)
- [CVE-2015-1858](https://cve.now/CVE-2015-1858.md): Multiple buffer overflows in gui/image/qbmphandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers t (no CVSS)
- [CVE-2015-1859](https://cve.now/CVE-2015-1859.md): Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow rem (no CVSS)
- [CVE-2015-1860](https://cve.now/CVE-2015-1860.md): Multiple buffer overflows in gui/image/qgifhandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers t (no CVSS)
- [CVE-2015-1880](https://cve.now/CVE-2015-1880.md): Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject a (no CVSS)
- [CVE-2015-2170](https://cve.now/CVE-2015-2170.md): The upx decoder in ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted file. (no CVSS)
- [CVE-2015-2219](https://cve.now/CVE-2015-2219.md): Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to ga (no CVSS)
- [CVE-2015-2221](https://cve.now/CVE-2015-2221.md): ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted y0da cryptor file. (no CVSS)
- [CVE-2015-2222](https://cve.now/CVE-2015-2222.md): ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted petite packed file. (no CVSS)
- [CVE-2015-2233](https://cve.now/CVE-2015-2233.md): Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 does not properly validate CA chains during signature validation (no CVSS)
- [CVE-2015-2234](https://cve.now/CVE-2015-2234.md): Race condition in Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses world-writable permissions for the update (no CVSS)
- [CVE-2015-2668](https://cve.now/CVE-2015-2668.md): ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted xz archive file. (no CVSS)
- [CVE-2015-2829](https://cve.now/CVE-2015-2829.md): Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.5 Build 53.9 through 55.8 and 10.5.e Build 53-9010.e (no CVSS)
- [CVE-2015-2842](https://cve.now/CVE-2015-2842.md): Unrestricted file upload vulnerability in go\_audiostore.php in the audiostore (Voice Files) upload functionality in GoAutoDial GoAdmin CE 3. (no CVSS)
- [CVE-2015-2843](https://cve.now/CVE-2015-2843.md): Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before 3.3-1421902800 allow remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2015-2844](https://cve.now/CVE-2015-2844.md): The cpanel function in go\_site.php in GoAutoDial GoAdmin CE before 3.3-1420434000 allows remote attackers to execute arbitrary commands via (no CVSS)
- [CVE-2015-2845](https://cve.now/CVE-2015-2845.md): The cpanel function in go\_site.php in GoAutoDial GoAdmin CE before 3.3-1421902800 allows remote attackers to execute arbitrary commands via (no CVSS)
- [CVE-2015-3451](https://cve.now/CVE-2015-3451.md): The \_clone function in XML::LibXML before 2.0119 does not properly set the expand\_entities option, which allows remote attackers to conduct (no CVSS)
- [CVE-2015-3620](https://cve.now/CVE-2015-3620.md): Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 throu (no CVSS)
- [CVE-2015-3622](https://cve.now/CVE-2015-3622.md): The \_asn1\_extract\_der\_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out- (no CVSS)
- [CVE-2015-3646](https://cve.now/CVE-2015-3646.md): OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend\_argument configuration option content, which all (no CVSS, keystone)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-05-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.