# CVEs published 2015-09-09 54 CVEs were published on September 9, 2015: 0 critical, 2 high. 2 are now in CISA KEV. Days are UTC. - [CVE-2015-2483](https://cve.now/CVE-2015-2483.md): Microsoft Internet Explorer 10 and 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, ak (no CVSS) - [CVE-2015-2484](https://cve.now/CVE-2015-2484.md): Microsoft Internet Explorer 10 and 11 uses an incorrect flag during certain filesystem accesses, which allows remote attackers to delete arb (no CVSS) - [CVE-2015-2485](https://cve.now/CVE-2015-2485.md): Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m (no CVSS) - [CVE-2015-2486](https://cve.now/CVE-2015-2486.md): Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m (no CVSS) - [CVE-2015-2487](https://cve.now/CVE-2015-2487.md): Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS) - [CVE-2015-2489](https://cve.now/CVE-2015-2489.md): Microsoft Internet Explorer 11 allows remote attackers to gain privileges via a crafted web site, as demonstrated by a transition from Low I (no CVSS) - [CVE-2015-2490](https://cve.now/CVE-2015-2490.md): Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS) - [CVE-2015-2491](https://cve.now/CVE-2015-2491.md): Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS) - [CVE-2015-2492](https://cve.now/CVE-2015-2492.md): Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS) - [CVE-2015-2493](https://cve.now/CVE-2015-2493.md): The (1) VBScript and (2) JScript engines in Microsoft Internet Explorer 8 allow remote attackers to execute arbitrary code or cause a denial (no CVSS) - [CVE-2015-2494](https://cve.now/CVE-2015-2494.md): Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m (no CVSS) - [CVE-2015-2498](https://cve.now/CVE-2015-2498.md): Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS) - [CVE-2015-2499](https://cve.now/CVE-2015-2499.md): Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS) - [CVE-2015-2500](https://cve.now/CVE-2015-2500.md): Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a (no CVSS) - [CVE-2015-2501](https://cve.now/CVE-2015-2501.md): Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft (no CVSS) - [CVE-2015-2504](https://cve.now/CVE-2015-2504.md): Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 improperly counts objects before performing an array copy, which (no CVSS) - [CVE-2015-2505](https://cve.now/CVE-2015-2505.md): Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to obtain sensitive sta (no CVSS) - [CVE-2015-2506](https://cve.now/CVE-2015-2506.md): atmfd.dll in the Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Wi (no CVSS) - [CVE-2015-2507](https://cve.now/CVE-2015-2507.md): The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Wi (no CVSS) - [CVE-2015-2508](https://cve.now/CVE-2015-2508.md): The Adobe Type Manager Library in Microsoft Windows 10 allows local users to gain privileges via a crafted application, aka "Font Driver Ele (no CVSS) - [CVE-2015-2509](https://cve.now/CVE-2015-2509.md): Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows user-assisted remote attackers to exec (no CVSS) - [CVE-2015-2510](https://cve.now/CVE-2015-2510.md): Buffer overflow in the Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 SP3, Office 2010 SP2, (no CVSS) - [CVE-2015-2511](https://cve.now/CVE-2015-2511.md): The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Se (no CVSS) - [CVE-2015-2512](https://cve.now/CVE-2015-2512.md): The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Wi (no CVSS) - [CVE-2015-2513](https://cve.now/CVE-2015-2513.md): Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 20 (no CVSS) - [CVE-2015-2514](https://cve.now/CVE-2015-2514.md): Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 20 (no CVSS) - [CVE-2015-2516](https://cve.now/CVE-2015-2516.md): Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 20 (no CVSS) - [CVE-2015-2517](https://cve.now/CVE-2015-2517.md): The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Se (no CVSS) - [CVE-2015-2518](https://cve.now/CVE-2015-2518.md): The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Se (no CVSS) - [CVE-2015-2519](https://cve.now/CVE-2015-2519.md): Integer overflow in Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8. (no CVSS) - [CVE-2015-2520](https://cve.now/CVE-2015-2520.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and Excel Viewer allow remote attacker (no CVSS) - [CVE-2015-2521](https://cve.now/CVE-2015-2521.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code v (no CVSS) - [CVE-2015-2522](https://cve.now/CVE-2015-2522.md): Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2013 SP1 allows remote authenticated users to inject arbitrary w (no CVSS) - [CVE-2015-2523](https://cve.now/CVE-2015-2523.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and (no CVSS) - [CVE-2015-2524](https://cve.now/CVE-2015-2524.md): Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 do not properly constrain imperso (no CVSS) - [CVE-2015-2525](https://cve.now/CVE-2015-2525.md): Task Scheduler in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 201 (no CVSS) - [CVE-2015-2526](https://cve.now/CVE-2015-2526.md): Microsoft .NET Framework 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to cause a denial of service to an ASP.NET web site via crafted (no CVSS) - [CVE-2015-2527](https://cve.now/CVE-2015-2527.md): The process-initialization implementation in win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 (no CVSS) - [CVE-2015-2528](https://cve.now/CVE-2015-2528.md): Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 do not properly constrain imperso (no CVSS) - [CVE-2015-2529](https://cve.now/CVE-2015-2529.md): The kernel in Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 allows local users to bypass the ASLR protection (no CVSS) - [CVE-2015-2530](https://cve.now/CVE-2015-2530.md): Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 20 (no CVSS) - [CVE-2015-2531](https://cve.now/CVE-2015-2531.md): Cross-site scripting (XSS) vulnerability in the jQuery engine in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote (no CVSS) - [CVE-2015-2532](https://cve.now/CVE-2015-2532.md): Cross-site scripting (XSS) vulnerability in Microsoft Lync Server 2013 allows remote attackers to inject arbitrary web script or HTML via a (no CVSS) - [CVE-2015-2534](https://cve.now/CVE-2015-2534.md): Hyper-V in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows 10 improperly processes ACL settings, which allows local users to bypa (no CVSS) - [CVE-2015-2535](https://cve.now/CVE-2015-2535.md): Active Directory in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allows remote authenticated users to cause a de (no CVSS) - [CVE-2015-2536](https://cve.now/CVE-2015-2536.md): Cross-site scripting (XSS) vulnerability in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject (no CVSS) - [CVE-2015-2541](https://cve.now/CVE-2015-2541.md): Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS) - [CVE-2015-2542](https://cve.now/CVE-2015-2542.md): Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2015-2543](https://cve.now/CVE-2015-2543.md): Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 allows remo (no CVSS) - [CVE-2015-2544](https://cve.now/CVE-2015-2544.md): Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 all (no CVSS) - [CVE-2015-2545](https://cve.now/CVE-2015-2545.md): Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted EPS image, ak (CVSS 7.8, KEV) - [CVE-2015-2546](https://cve.now/CVE-2015-2546.md): The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Se (CVSS 8.2, KEV) - [CVE-2015-6680](https://cve.now/CVE-2015-6680.md): Adobe Shockwave Player before 12.2.0.162 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via uns (no CVSS) - [CVE-2015-6681](https://cve.now/CVE-2015-6681.md): Adobe Shockwave Player before 12.2.0.162 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via uns (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-09-09 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.