# CVEs published 2015-05-14 29 CVEs were published on May 14, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2012-5849](https://cve.now/CVE-2012-5849.md): Multiple SQL injection vulnerabilities in ClipBucket 2.6 Revision 738 and earlier allow remote attackers to execute arbitrary SQL commands v (no CVSS) - [CVE-2014-8162](https://cve.now/CVE-2014-8162.md): XML external entity (XXE) in the RPC interface in Spacewalk and Red Hat Network (RHN) Satellite 5.7 and earlier allows remote attackers to r (no CVSS) - [CVE-2015-0971](https://cve.now/CVE-2015-0971.md): The DER parser in Suricata before 2.0.8 allows remote attackers to cause a denial of service (crash) via vectors related to SSL/TLS certific (no CVSS) - [CVE-2015-1848](https://cve.now/CVE-2015-1848.md): The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for re (no CVSS) - [CVE-2015-3300](https://cve.now/CVE-2015-3300.md): Multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Pl (no CVSS) - [CVE-2015-3301](https://cve.now/CVE-2015-3301.md): Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for W (no CVSS) - [CVE-2015-3427](https://cve.now/CVE-2015-3427.md): Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote at (no CVSS) - [CVE-2015-3983](https://cve.now/CVE-2015-3983.md): The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote (no CVSS) - [CVE-2015-3986](https://cve.now/CVE-2015-3986.md): Cross-site request forgery (CSRF) vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin (no CVSS) - [CVE-2015-3987](https://cve.now/CVE-2015-3987.md): Multiple unquoted Windows search path vulnerabilities in the (1) Client Management and (2) Gateway in McAfee ePO Deep Command 2.1 and 2.2 be (no CVSS) - [CVE-2015-0797](https://cve.now/CVE-2015-0797.md): GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows r (no CVSS) - [CVE-2015-2708](https://cve.now/CVE-2015-2708.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird bef (no CVSS) - [CVE-2015-2709](https://cve.now/CVE-2015-2709.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0 allow remote attackers to cause a denial of servic (no CVSS) - [CVE-2015-2710](https://cve.now/CVE-2015-2710.md): Heap-based buffer overflow in the SVGTextFrame class in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31 (no CVSS) - [CVE-2015-2711](https://cve.now/CVE-2015-2711.md): Mozilla Firefox before 38.0 does not recognize a referrer policy delivered by a referrer META element in cases of context-menu navigation an (no CVSS) - [CVE-2015-2712](https://cve.now/CVE-2015-2712.md): The asm.js implementation in Mozilla Firefox before 38.0 does not properly determine heap lengths during identification of cases in which bo (no CVSS) - [CVE-2015-2713](https://cve.now/CVE-2015-2713.md): Use-after-free vulnerability in the SetBreaks function in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before (no CVSS) - [CVE-2015-2714](https://cve.now/CVE-2015-2714.md): Mozilla Firefox before 38.0 on Android does not properly restrict writing URL data to the Android logging system, which allows attackers to (no CVSS) - [CVE-2015-2715](https://cve.now/CVE-2015-2715.md): Race condition in the nsThreadManager::RegisterCurrentThread function in Mozilla Firefox before 38.0 allows remote attackers to execute arbi (no CVSS) - [CVE-2015-2716](https://cve.now/CVE-2015-2716.md): Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote at (no CVSS) - [CVE-2015-2717](https://cve.now/CVE-2015-2717.md): Integer overflow in libstagefright in Mozilla Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a denial of ser (no CVSS) - [CVE-2015-2718](https://cve.now/CVE-2015-2718.md): The WebChannel.jsm module in Mozilla Firefox before 38.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive webch (no CVSS) - [CVE-2015-2720](https://cve.now/CVE-2015-2720.md): The update implementation in Mozilla Firefox before 38.0 on Windows does not ensure that the pathname for updater.exe corresponds to the app (no CVSS) - [CVE-2014-1900](https://cve.now/CVE-2014-1900.md): Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bulle (no CVSS) - [CVE-2014-1901](https://cve.now/CVE-2014-1901.md): Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bulle (no CVSS) - [CVE-2014-1902](https://cve.now/CVE-2014-1902.md): Multiple cross-site scripting (XSS) vulnerabilities in Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW0 (no CVSS) - [CVE-2015-3326](https://cve.now/CVE-2015-3326.md): Trend Micro ScanMail for Microsoft Exchange (SMEX) 10.2 before Hot Fix Build 3318 and 11.0 before Hot Fix Build 4180 creates session IDs for (no CVSS) - [CVE-2015-3397](https://cve.now/CVE-2015-3397.md): Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via ve (no CVSS, yiisoft/yii2) - [CVE-2015-3644](https://cve.now/CVE-2015-3644.md): Stunnel 5.00 through 5.13, when using the redirect option, does not redirect client connections to the expected server after the initial con (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-05-14 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.