# CVEs published 2015-07-14

88 CVEs were published on July 14, 2015: 0 critical, 6 high. 6 are now in CISA KEV. Days are UTC.

- [CVE-2015-1761](https://cve.now/CVE-2015-1761.md): Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014 uses an incorrect class during casts of unspecified p (no CVSS)
- [CVE-2015-1762](https://cve.now/CVE-2015-1762.md): Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014, when transactional replication is configured, does n (no CVSS)
- [CVE-2015-1763](https://cve.now/CVE-2015-1763.md): Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014 does not prevent use of uninitialized memory in certa (no CVSS)
- [CVE-2015-5120](https://cve.now/CVE-2015-5120.md): Adobe Shockwave Player before 12.1.9.159 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via uns (no CVSS)
- [CVE-2015-5121](https://cve.now/CVE-2015-5121.md): Adobe Shockwave Player before 12.1.9.159 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via uns (no CVSS)
- [CVE-2015-2363](https://cve.now/CVE-2015-2363.md): win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1 (no CVSS)
- [CVE-2015-2364](https://cve.now/CVE-2015-2364.md): The graphics component in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1 (no CVSS)
- [CVE-2015-2365](https://cve.now/CVE-2015-2365.md): win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1 (no CVSS)
- [CVE-2015-2366](https://cve.now/CVE-2015-2366.md): win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Go (no CVSS)
- [CVE-2015-2367](https://cve.now/CVE-2015-2367.md): win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1 (no CVSS)
- [CVE-2015-2370](https://cve.now/CVE-2015-2370.md): The authentication implementation in the RPC subsystem in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 20 (no CVSS)
- [CVE-2015-2371](https://cve.now/CVE-2015-2371.md): The Windows Installer service in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Window (no CVSS)
- [CVE-2015-2381](https://cve.now/CVE-2015-2381.md): win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allo (no CVSS)
- [CVE-2015-2382](https://cve.now/CVE-2015-2382.md): win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allo (no CVSS)
- [CVE-2015-2387](https://cve.now/CVE-2015-2387.md): ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, (CVSS 7.8, KEV)
- [CVE-2015-2416](https://cve.now/CVE-2015-2416.md): OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Wind (no CVSS)
- [CVE-2015-2417](https://cve.now/CVE-2015-2417.md): OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Wind (no CVSS)
- [CVE-2015-1729](https://cve.now/CVE-2015-1729.md): Microsoft Internet Explorer 9 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web s (no CVSS)
- [CVE-2015-1733](https://cve.now/CVE-2015-1733.md): Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (no CVSS)
- [CVE-2015-1738](https://cve.now/CVE-2015-1738.md): Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a (no CVSS)
- [CVE-2015-1767](https://cve.now/CVE-2015-1767.md): Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2015-2361](https://cve.now/CVE-2015-2361.md): Hyper-V in Microsoft Windows 8.1 and Windows Server 2012 R2 does not properly initialize guest OS system data structures, which allows guest (no CVSS)
- [CVE-2015-2362](https://cve.now/CVE-2015-2362.md): Hyper-V in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly initi (no CVSS)
- [CVE-2015-2368](https://cve.now/CVE-2015-2368.md): Untrusted search path vulnerability in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, Windows Server 2012 R2, and Windows (no CVSS)
- [CVE-2015-2369](https://cve.now/CVE-2015-2369.md): Untrusted search path vulnerability in Windows Media Device Manager in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server (no CVSS)
- [CVE-2015-2372](https://cve.now/CVE-2015-2372.md): vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 6 through 11 and other products, allows remote attackers (no CVSS)
- [CVE-2015-2373](https://cve.now/CVE-2015-2373.md): The Remote Desktop Protocol (RDP) server service in Microsoft Windows 7 SP1, Windows 8, and Windows Server 2012 allows remote attackers to e (no CVSS)
- [CVE-2015-2374](https://cve.now/CVE-2015-2374.md): The Netlogon service in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R (no CVSS)
- [CVE-2015-2375](https://cve.now/CVE-2015-2375.md): Microsoft Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel Viewer 2007 SP3, Excel Services on SharePoint Server 2010 SP2, and Excel (no CVSS)
- [CVE-2015-2376](https://cve.now/CVE-2015-2376.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Office for Mac 2011, Excel Viewer 2007 SP3, Office Compatibilit (no CVSS)
- [CVE-2015-2377](https://cve.now/CVE-2015-2377.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, and Office Compatibility Pack SP3 allow remote attackers to exe (no CVSS)
- [CVE-2015-2378](https://cve.now/CVE-2015-2378.md): Untrusted search path vulnerability in Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel Viewer 2007 SP3, and Office Compatibility Pack SP3 al (no CVSS)
- [CVE-2015-2379](https://cve.now/CVE-2015-2379.md): Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, and Word Viewer allow remote (no CVSS)
- [CVE-2015-2380](https://cve.now/CVE-2015-2380.md): Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, and Word 2013 RT SP1 allow remote attackers to execute arbitrary cod (no CVSS)
- [CVE-2015-2383](https://cve.now/CVE-2015-2383.md): Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS)
- [CVE-2015-2384](https://cve.now/CVE-2015-2384.md): Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS)
- [CVE-2015-2385](https://cve.now/CVE-2015-2385.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2015-2388](https://cve.now/CVE-2015-2388.md): Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a (no CVSS)
- [CVE-2015-2389](https://cve.now/CVE-2015-2389.md): Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (no CVSS)
- [CVE-2015-2390](https://cve.now/CVE-2015-2390.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2015-2391](https://cve.now/CVE-2015-2391.md): Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft (no CVSS)
- [CVE-2015-2397](https://cve.now/CVE-2015-2397.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2015-2398](https://cve.now/CVE-2015-2398.md): Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the XSS filter via a crafted attribute of an element in an HTML d (no CVSS)
- [CVE-2015-2401](https://cve.now/CVE-2015-2401.md): Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2015-2402](https://cve.now/CVE-2015-2402.md): Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation (no CVSS)
- [CVE-2015-2403](https://cve.now/CVE-2015-2403.md): Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft (no CVSS)
- [CVE-2015-2404](https://cve.now/CVE-2015-2404.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2015-2406](https://cve.now/CVE-2015-2406.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2015-2408](https://cve.now/CVE-2015-2408.md): Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2015-2410](https://cve.now/CVE-2015-2410.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to determine the existence of local files via a crafted stylesheet, aka "In (no CVSS)
- [CVE-2015-2411](https://cve.now/CVE-2015-2411.md): Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (no CVSS)
- [CVE-2015-2412](https://cve.now/CVE-2015-2412.md): Microsoft Internet Explorer 10 and 11 allows remote attackers to read arbitrary local files via a crafted pathname, aka "Internet Explorer I (no CVSS)
- [CVE-2015-2413](https://cve.now/CVE-2015-2413.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to determine the existence of local files via a crafted module-resource req (no CVSS)
- [CVE-2015-2414](https://cve.now/CVE-2015-2414.md): Microsoft Internet Explorer 8 through 11 allows remote attackers to obtain sensitive browsing-history information via vectors related to ima (no CVSS)
- [CVE-2015-2415](https://cve.now/CVE-2015-2415.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, and Office Compatibility Pack SP3 allow remote attackers to exe (no CVSS)
- [CVE-2015-2419](https://cve.now/CVE-2015-2419.md): JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory co (CVSS 8.8, KEV)
- [CVE-2015-2421](https://cve.now/CVE-2015-2421.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Intern (no CVSS)
- [CVE-2015-2422](https://cve.now/CVE-2015-2422.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2015-2424](https://cve.now/CVE-2015-2424.md): Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, and PowerPoint 2013 RT (CVSS 8.8, KEV)
- [CVE-2015-2425](https://cve.now/CVE-2015-2425.md): Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (CVSS 8.8, KEV)
- [CVE-2015-1927](https://cve.now/CVE-2015-1927.md): The default configuration of IBM WebSphere Application Server (WAS) 7.0.0 before 7.0.0.39, 8.0.0 before 8.0.0.11, and 8.5 before 8.5.5.6 has (no CVSS)
- [CVE-2015-1936](https://cve.now/CVE-2015-1936.md): The administrative console in IBM WebSphere Application Server (WAS) 8.0.0 before 8.0.0.11 and 8.5 before 8.5.5.6, when the Security feature (no CVSS)
- [CVE-2015-1946](https://cve.now/CVE-2015-1946.md): IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.6, and WebSphere Virtual Enterprise 7.0 before 7.0.0.6 for WebSphere Application Ser (no CVSS)
- [CVE-2015-3007](https://cve.now/CVE-2015-3007.md): The Juniper SRX Series services gateways with Junos OS 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, and 12.3X48 before 12.3X48-D1 (no CVSS)
- [CVE-2015-4268](https://cve.now/CVE-2015-4268.md): Multiple cross-site scripting (XSS) vulnerabilities in the Infra Admin UI in Cisco Identity Services Engine (ISE) 1.2(1.198) and 1.3(0.876) (no CVSS)
- [CVE-2015-4270](https://cve.now/CVE-2015-4270.md): Multiple cross-site scripting (XSS) vulnerabilities in Cisco FireSIGHT System Software 5.3.1.5 and 6.0.0 allow remote attackers to inject ar (no CVSS)
- [CVE-2015-5143](https://cve.now/CVE-2015-5143.md): The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cau (no CVSS, django)
- [CVE-2015-5144](https://cve.now/CVE-2015-5144.md): Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows rem (no CVSS, django)
- [CVE-2015-5145](https://cve.now/CVE-2015-5145.md): validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified (no CVSS, django)
- [CVE-2015-5358](https://cve.now/CVE-2015-5358.md): Juniper Junos OS 12.1X44 before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R9, 12.3X48 before 12.3 (no CVSS)
- [CVE-2015-5359](https://cve.now/CVE-2015-5359.md): Juniper Junos OS 12.1X44 before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R9, 12.3X48 before 12.3 (no CVSS)
- [CVE-2015-5362](https://cve.now/CVE-2015-5362.md): The BFD daemon in Juniper Junos OS 12.1X44 before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, (no CVSS)
- [CVE-2015-1560](https://cve.now/CVE-2015-1560.md): SQL injection vulnerability in the isUserAdmin function in include/common/common-Func.php in Centreon (formerly Merethis Centreon) 2.5.4 and (no CVSS)
- [CVE-2015-1561](https://cve.now/CVE-2015-1561.md): The escape\_command function in include/Administration/corePerformance/getStats.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlie (no CVSS, centreon/centreon)
- [CVE-2015-3258](https://cve.now/CVE-2015-3258.md): Heap-based buffer overflow in the WriteProlog function in filter/texttopdf.c in texttopdf in cups-filters before 1.0.70 allows remote attack (no CVSS)
- [CVE-2015-3279](https://cve.now/CVE-2015-3279.md): Integer overflow in filter/texttopdf.c in texttopdf in cups-filters before 1.0.71 allows remote attackers to cause a denial of service (cras (no CVSS)
- [CVE-2015-5147](https://cve.now/CVE-2015-5147.md): Stack-based buffer overflow in the header\_anchor function in the HTML renderer in Redcarpet before 3.3.2 allows attackers to cause a denial (no CVSS, redcarpet)
- [CVE-2015-5397](https://cve.now/CVE-2015-5397.md): Cross-site request forgery (CSRF) vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.2 allows remote attackers to hijack the (no CVSS)
- [CVE-2015-5519](https://cve.now/CVE-2015-5519.md): Cross-site scripting (XSS) vulnerability in the applyConvolution demo in WideImage 11.02.19 allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2015-5520](https://cve.now/CVE-2015-5520.md): Cross-site scripting (XSS) vulnerability in the Users module in Orchard 1.7.3 through 1.8.2 and 1.9.x before 1.9.1 allows remote attackers t (no CVSS)
- [CVE-2015-5521](https://cve.now/CVE-2015-5521.md): Cross-site scripting (XSS) vulnerability in BlackCat CMS 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the name i (no CVSS)
- [CVE-2015-1887](https://cve.now/CVE-2015-1887.md): IBM WebSphere Portal 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF17, and 8.5.0 before CF06 allows remote attackers to obtain sensitiv (no CVSS)
- [CVE-2015-1917](https://cve.now/CVE-2015-1917.md): Cross-site scripting (XSS) vulnerability in the Active Content Filtering component in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 (no CVSS)
- [CVE-2015-1944](https://cve.now/CVE-2015-1944.md): Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.0 before 8.0.0.1 CF17 and 8.5.0 before CF06 allows remote authenticated (no CVSS)
- [CVE-2015-4269](https://cve.now/CVE-2015-4269.md): The Tomcat throttling feature in Cisco Unified Communications Manager 10.5(1.99995.9) allows remote authenticated users to cause a denial of (no CVSS)
- [CVE-2015-4272](https://cve.now/CVE-2015-4272.md): Multiple cross-site scripting (XSS) vulnerabilities in the ccmivr page in Cisco Unified Communications Manager (formerly CallManager) 10.5(2 (no CVSS)
- [CVE-2015-5122](https://cve.now/CVE-2015-5122.md): Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0 (CVSS 7.8, KEV)
- [CVE-2015-5123](https://cve.now/CVE-2015-5123.md): Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.30 (CVSS 7.8, KEV)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-07-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.