# CVEs published 2015-09-03 26 CVEs were published on September 3, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2015-1291](https://cve.now/CVE-2015-1291.md): The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not (no CVSS) - [CVE-2015-1292](https://cve.now/CVE-2015-1292.md): The NavigatorServiceWorker::serviceWorker function in modules/serviceworkers/NavigatorServiceWorker.cpp in Blink, as used in Google Chrome b (no CVSS) - [CVE-2015-1293](https://cve.now/CVE-2015-1293.md): The DOM implementation in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy via (no CVSS) - [CVE-2015-1294](https://cve.now/CVE-2015-1294.md): Use-after-free vulnerability in the SkMatrix::invertNonIdentity function in core/SkMatrix.cpp in Skia, as used in Google Chrome before 45.0. (no CVSS) - [CVE-2015-1295](https://cve.now/CVE-2015-1295.md): Multiple use-after-free vulnerabilities in the PrintWebViewHelper class in components/printing/renderer/print\_web\_view\_helper.cc in Google C (no CVSS) - [CVE-2015-1296](https://cve.now/CVE-2015-1296.md): The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not prevent display of Uni (no CVSS) - [CVE-2015-1297](https://cve.now/CVE-2015-1297.md): The WebRequest API implementation in extensions/browser/api/web\_request/web\_request\_api.cc in Google Chrome before 45.0.2454.85 does not pro (no CVSS) - [CVE-2015-1298](https://cve.now/CVE-2015-1298.md): The RuntimeEventRouter::OnExtensionUninstalled function in extensions/browser/api/runtime/runtime\_api.cc in Google Chrome before 45.0.2454.8 (no CVSS) - [CVE-2015-1299](https://cve.now/CVE-2015-1299.md): Use-after-free vulnerability in the shared-timer implementation in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attack (no CVSS) - [CVE-2015-1300](https://cve.now/CVE-2015-1300.md): The FrameFetchContext::updateTimingInfoForIFrameNavigation function in core/loader/FrameFetchContext.cpp in Blink, as used in Google Chrome (no CVSS) - [CVE-2015-1301](https://cve.now/CVE-2015-1301.md): Multiple unspecified vulnerabilities in Google Chrome before 45.0.2454.85 allow attackers to cause a denial of service or possibly have othe (no CVSS) - [CVE-2015-6580](https://cve.now/CVE-2015-6580.md): Multiple unspecified vulnerabilities in Google V8 before 4.5.103.29, as used in Google Chrome before 45.0.2454.85, allow attackers to cause (no CVSS) - [CVE-2015-6581](https://cve.now/CVE-2015-6581.md): Double free vulnerability in the opj\_j2k\_copy\_default\_tcp\_and\_create\_tcd function in j2k.c in OpenJPEG before r3002, as used in PDFium in Go (no CVSS) - [CVE-2015-6582](https://cve.now/CVE-2015-6582.md): The decompose function in platform/transforms/TransformationMatrix.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not veri (no CVSS) - [CVE-2015-6583](https://cve.now/CVE-2015-6583.md): Google Chrome before 45.0.2454.85 does not display a location bar for a hosted app's window after navigation away from the installation site (no CVSS) - [CVE-2015-1516](https://cve.now/CVE-2015-1516.md): Cross-site scripting (XSS) vulnerability in Polycom RealPresence CloudAXIS Suite before 1.7.0 allows remote authenticated users to inject ar (no CVSS) - [CVE-2015-4552](https://cve.now/CVE-2015-4552.md): Cross-site scripting (XSS) vulnerability in the quick edit function in xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.8.5 allows remote (no CVSS) - [CVE-2015-6545](https://cve.now/CVE-2015-6545.md): Cross-site request forgery (CSRF) vulnerability in ajax.php in Cerb before 7.0.4 allows remote attackers to hijack the authentication of adm (no CVSS) - [CVE-2015-4077](https://cve.now/CVE-2015-4077.md): The (1) mdare64\_48.sys, (2) mdare32\_48.sys, (3) mdare32\_52.sys, and (4) mdare64\_52.sys drivers in Fortinet FortiClient before 5.2.4 allow lo (no CVSS) - [CVE-2015-5189](https://cve.now/CVE-2015-5189.md): Race condition in pcsd in PCS 0.9.139 and earlier uses a global variable to validate usernames, which allows remote authenticated users to g (no CVSS) - [CVE-2015-5190](https://cve.now/CVE-2015-5190.md): The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL. (no CVSS) - [CVE-2015-5735](https://cve.now/CVE-2015-5735.md): The (1) mdare64\_48.sys, (2) mdare32\_48.sys, (3) mdare32\_52.sys, and (4) mdare64\_52.sys drivers in Fortinet FortiClient before 5.2.4 allow lo (no CVSS) - [CVE-2015-5736](https://cve.now/CVE-2015-5736.md): The Fortishield.sys driver in Fortinet FortiClient before 5.2.4 allows local users to execute arbitrary code with kernel privileges by setti (no CVSS) - [CVE-2015-5737](https://cve.now/CVE-2015-5737.md): The (1) mdare64\_48.sys, (2) mdare32\_48.sys, (3) mdare32\_52.sys, (4) mdare64\_52.sys, and (5) Fortishield.sys drivers in Fortinet FortiClient (no CVSS) - [CVE-2015-6506](https://cve.now/CVE-2015-6506.md): Cross-site scripting (XSS) vulnerability in the cryptography interface in Request Tracker (RT) before 4.2.12 allows remote attackers to inje (no CVSS) - [CVE-2015-6654](https://cve.now/CVE-2015-6654.md): The xenmem\_add\_to\_physmap\_one function in arch/arm/mm.c in Xen 4.5.x, 4.4.x, and earlier does not limit the number of printk console message (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-09-03 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.