# CVEs published 2015-05-20

35 CVEs were published on May 20, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2012-4901](https://cve.now/CVE-2012-4901.md): Cross-site scripting (XSS) vulnerability in Template CMS 2.1.1 and earlier allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2012-4902](https://cve.now/CVE-2012-4902.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Template CMS 2.1.1 and earlier allow remote attackers to hijack the authentica (no CVSS)
- [CVE-2015-3141](https://cve.now/CVE-2015-3141.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier allow remote attacke (no CVSS)
- [CVE-2012-1664](https://cve.now/CVE-2012-1664.md): Multiple cross-site scripting (XSS) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to inject arbitrary web (no CVSS)
- [CVE-2012-1665](https://cve.now/CVE-2012-1665.md): Multiple SQL injection vulnerabilities in the admin panel in osCMax before 2.5.1 allow (1) remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2012-3243](https://cve.now/CVE-2012-3243.md): Cross-site scripting (XSS) vulnerability in the SEOgento plugin for Magento allows remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2012-6691](https://cve.now/CVE-2012-6691.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to hijack the au (no CVSS)
- [CVE-2015-1188](https://cve.now/CVE-2015-1188.md): The certificate verification functions in the HNDS service in Swisscom Centro Grande (ADB) DSL routers with firmware before 6.14.00 allows r (no CVSS)
- [CVE-2015-3990](https://cve.now/CVE-2015-3990.md): The GMS ViewPoint (GMSVP) web application in Dell Sonicwall GMS, Analyzer, and UMA EM5000 before 7.2 SP4 allows remote authenticated users t (no CVSS)
- [CVE-2015-3999](https://cve.now/CVE-2015-3999.md): Piriform CCleaner 3.26.0.1988 through 5.02.5101 writes the filenames to disk when overwriting files, which allows local users to obtain sens (no CVSS)
- [CVE-2015-4016](https://cve.now/CVE-2015-4016.md): The client detection protocol in Valve Steam allows remote attackers to cause a denial of service (process crash) via a crafted response to (no CVSS)
- [CVE-2014-4776](https://cve.now/CVE-2014-4776.md): IBM License Metric Tool 9 before 9.1.0.2 does not have an off autocomplete attribute for authentication fields, which makes it easier for re (no CVSS)
- [CVE-2014-8924](https://cve.now/CVE-2014-8924.md): The server in IBM License Metric Tool 7.2.2 before IF15 and 7.5 before IF24 and Tivoli Asset Discovery for Distributed 7.2.2 before IF15 and (no CVSS)
- [CVE-2015-0189](https://cve.now/CVE-2015-0189.md): The cluster repository manager in IBM WebSphere MQ 7.5 before 7.5.0.5 and 8.0 before 8.0.0.2 allows remote authenticated administrators to c (no CVSS)
- [CVE-2015-1251](https://cve.now/CVE-2015-1251.md): Use-after-free vulnerability in the SpeechRecognitionClient implementation in the Speech subsystem in Google Chrome before 43.0.2357.65 allo (no CVSS)
- [CVE-2015-1252](https://cve.now/CVE-2015-1252.md): common/partial\_circular\_buffer.cc in Google Chrome before 43.0.2357.65 does not properly handle wraps, which allows remote attackers to bypa (no CVSS)
- [CVE-2015-1253](https://cve.now/CVE-2015-1253.md): core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote at (no CVSS)
- [CVE-2015-1254](https://cve.now/CVE-2015-1254.md): core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode attribute, which all (no CVSS)
- [CVE-2015-1255](https://cve.now/CVE-2015-1255.md): Use-after-free vulnerability in content/renderer/media/webaudio\_capturer\_source.cc in the WebAudio implementation in Google Chrome before 43 (no CVSS)
- [CVE-2015-1256](https://cve.now/CVE-2015-1256.md): Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to ca (no CVSS)
- [CVE-2015-1257](https://cve.now/CVE-2015-1257.md): platform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, does not prope (no CVSS)
- [CVE-2015-1258](https://cve.now/CVE-2015-1258.md): Google Chrome before 43.0.2357.65 relies on libvpx code that was not built with an appropriate --size-limit value, which allows remote attac (no CVSS)
- [CVE-2015-1259](https://cve.now/CVE-2015-1259.md): PDFium, as used in Google Chrome before 43.0.2357.65, does not properly initialize memory, which allows remote attackers to cause a denial o (no CVSS)
- [CVE-2015-1260](https://cve.now/CVE-2015-1260.md): Multiple use-after-free vulnerabilities in content/renderer/media/user\_media\_client\_impl.cc in the WebRTC implementation in Google Chrome be (no CVSS)
- [CVE-2015-1261](https://cve.now/CVE-2015-1261.md): android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java in Google Chrome before 43.0.2357.65 on Android does not properly res (no CVSS)
- [CVE-2015-1262](https://cve.now/CVE-2015-1262.md): platform/fonts/shaping/HarfBuzzShaper.cpp in Blink, as used in Google Chrome before 43.0.2357.65, does not initialize a certain width field, (no CVSS)
- [CVE-2015-1263](https://cve.now/CVE-2015-1263.md): The Spellcheck API implementation in Google Chrome before 43.0.2357.65 does not use an HTTPS session for downloading a Hunspell dictionary, (no CVSS)
- [CVE-2015-1264](https://cve.now/CVE-2015-1264.md): Cross-site scripting (XSS) vulnerability in Google Chrome before 43.0.2357.65 allows user-assisted remote attackers to inject arbitrary web (no CVSS)
- [CVE-2015-1265](https://cve.now/CVE-2015-1265.md): Multiple unspecified vulnerabilities in Google Chrome before 43.0.2357.65 allow attackers to cause a denial of service or possibly have othe (no CVSS)
- [CVE-2015-1902](https://cve.now/CVE-2015-1902.md): Stack-based buffer overflow in IBM Domino 8.5 before 8.5.3 FP6 IF7 and 9.0 before 9.0.1 FP3 IF3 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2015-1903](https://cve.now/CVE-2015-1903.md): Stack-based buffer overflow in IBM Domino 8.5 before 8.5.3 FP6 IF7 and 9.0 before 9.0.1 FP3 IF3 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2015-3910](https://cve.now/CVE-2015-3910.md): Multiple unspecified vulnerabilities in Google V8 before 4.3.61.21, as used in Google Chrome before 43.0.2357.65, allow attackers to cause a (no CVSS)
- [CVE-2014-6211](https://cve.now/CVE-2014-6211.md): The command-line scripts in IBM WebSphere Commerce 6.0 through 6.0.0.11, 7.0 through 7.0.0.9, and 7.0 Feature Pack 2 through 8, when debuggi (no CVSS)
- [CVE-2015-0740](https://cve.now/CVE-2015-0740.md): Cross-site request forgery (CSRF) vulnerability in Cisco Unified Intelligence Center 10.6(1) allows remote attackers to hijack the authentic (no CVSS)
- [CVE-2015-1920](https://cve.now/CVE-2015-1920.md): IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, and 8.5 before 8.5.5.6 allows remote (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-05-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.