# CVEs published 2015-05-18

13 CVEs were published on May 18, 2015: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2014-8383](https://cve.now/CVE-2014-8383.md): The InFocus IN3128HD projector with firmware 0.26 allows remote attackers to bypass authentication via a direct request to main.html. (no CVSS)
- [CVE-2014-8384](https://cve.now/CVE-2014-8384.md): The InFocus IN3128HD projector with firmware 0.26 does not restrict access to cgi-bin/webctrl.cgi.elf, which allows remote attackers to modi (no CVSS)
- [CVE-2015-0278](https://cve.now/CVE-2015-0278.md): libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified ve (no CVSS)
- [CVE-2015-1868](https://cve.now/CVE-2015-1868.md): The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server (no CVSS)
- [CVE-2015-2346](https://cve.now/CVE-2015-2346.md): XML external entity (XXE) vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote authenticated users to read arbit (no CVSS)
- [CVE-2015-2667](https://cve.now/CVE-2015-2667.md): Untrusted search path vulnerability in GNS3 1.2.3 allows local users to gain privileges via a Trojan horse uuid.dll in an unspecified direct (no CVSS)
- [CVE-2015-2704](https://cve.now/CVE-2015-2704.md): realmd allows remote attackers to inject arbitrary configurations in to sssd.conf and smb.conf via a newline character in an LDAP response. (no CVSS)
- [CVE-2015-3306](https://cve.now/CVE-2015-3306.md): The mod\_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. (CVSS 10.0, KEV)
- [CVE-2015-3455](https://cve.now/CVE-2015-3455.md): Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do (no CVSS)
- [CVE-2015-3627](https://cve.now/CVE-2015-3627.md): Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows (no CVSS, github.com/docker/docker)
- [CVE-2015-3629](https://cve.now/CVE-2015-3629.md): Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitr (no CVSS, github.com/docker/docker)
- [CVE-2015-3630](https://cve.now/CVE-2015-3630.md): Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer\_stats, (3) /proc/latency\_stats, and (4) /proc/fs, whi (no CVSS, github.com/docker/docker)
- [CVE-2015-3631](https://cve.now/CVE-2015-3631.md): Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker\_t policies via an image that allows v (no CVSS, github.com/docker/docker)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-05-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.