Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: February 2015

71 records · 4 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2015-0313
    98Now

    Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before

    CriticalCVSS 9.8KEVWeaponizedEPSS 95%

    adobe · flash playerFeb 2, 2015

  • CVE-2014-7864
    37Monitor

    Multiple SQL injection vulnerabilities in the FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine OpManager 8 through 11.5

    HighCVSS 7.5Proof of conceptEPSS 22%

    zohocorp · manageengine opmanagerFeb 4, 2015

  • CVE-2015-0318
    63This week

    Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows att

    CriticalCVSS 10.0WeaponizedEPSS 75%

    adobe · flash playerFeb 5, 2015

  • CVE-2014-9636
    24Monitor

    unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompress

    MediumCVSS 5.0No exploitEPSS 11%

    unzip project · unzipFeb 6, 2015

  • CVE-2015-0072
    40Plan

    Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Polic

    MediumCVSS 4.3WeaponizedEPSS 71%

    microsoft · internet explorerFeb 7, 2015

  • CVE-2014-6362
    22Monitor

    Use-after-free vulnerability in Microsoft Office 2007 SP3, 2010 SP2, and 2013 Gold and SP1 allows remote attackers to bypass the ASLR protec

    MediumCVSS 4.3No exploitEPSS 16%

    microsoft · officeFeb 10, 2015

  • CVE-2015-0008
    42Plan

    The UNC implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8

    HighCVSS 8.3Proof of conceptEPSS 28%

    microsoft · windows 7Feb 10, 2015

  • CVE-2015-0017
    42Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0018
    42Plan

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0019
    44Plan

    Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via

    CriticalCVSS 9.3No exploitEPSS 22%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0020
    42Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0021
    42Plan

    Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0022
    42Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0023
    42Plan

    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0025
    42Plan

    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0026
    42Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0027
    42Plan

    Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0028
    42Plan

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0029
    42Plan

    Microsoft Internet Explorer 6 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0030
    43Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0031
    42Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0035
    42Plan

    Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0036
    42Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0037
    45Plan

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 26%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0038
    42Plan

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0039
    42Plan

    Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0040
    46Plan

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3Proof of conceptEPSS 30%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0041
    42Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0042
    43Plan

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0043
    42Plan

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0044
    42Plan

    Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0045
    42Plan

    Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0046
    42Plan

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0048
    42Plan

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0049
    42Plan

    Microsoft Internet Explorer 8 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0050
    47Plan

    Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a

    CriticalCVSS 9.3Proof of conceptEPSS 33%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0051
    22Monitor

    Microsoft Internet Explorer 8 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer

    MediumCVSS 4.3No exploitEPSS 15%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0052
    42Plan

    Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0053
    42Plan

    Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0054
    20Monitor

    Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation

    MediumCVSS 4.3No exploitEPSS 10%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0055
    20Monitor

    Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of

    MediumCVSS 4.3No exploitEPSS 10%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0057
    32Monitor

    win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7

    HighCVSS 7.2Proof of conceptEPSS 12%

    microsoft · windows 7Feb 10, 2015

  • CVE-2015-0059
    30Monitor

    win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Go

    MediumCVSS 6.9Proof of conceptEPSS 11%

    microsoft · windows 7Feb 10, 2015

  • CVE-2015-0061
    23Monitor

    Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Ser

    MediumCVSS 4.3No exploitEPSS 18%

    microsoft · windows 7Feb 10, 2015

  • CVE-2015-0063
    42Plan

    Microsoft Excel 2007 SP3; the proofing tools in Office 2010 SP2; Excel 2010 SP2; Excel 2013 Gold, SP1, and RT; Excel Viewer; and Office Comp

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · office compatibility packFeb 10, 2015

  • CVE-2015-0064
    46Plan

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applications 2010 SP2, Word

    CriticalCVSS 9.3Proof of conceptEPSS 29%

    microsoft · web applicationsFeb 10, 2015

  • CVE-2015-0065
    46Plan

    Microsoft Word 2007 SP3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Off

    CriticalCVSS 9.3Proof of conceptEPSS 30%

    microsoft · wordFeb 10, 2015

  • CVE-2015-0066
    42Plan

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0067
    42Plan

    Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0068
    44Plan

    Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via

    CriticalCVSS 9.3No exploitEPSS 22%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0069
    22Monitor

    Microsoft Internet Explorer 10 and 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet

    MediumCVSS 4.3No exploitEPSS 15%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0070
    22Monitor

    Microsoft Internet Explorer 6 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web s

    MediumCVSS 4.3No exploitEPSS 16%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-0071
    66This week

    Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Intern

    MediumCVSS 6.5KEVWeaponizedEPSS 33%

    microsoft · internet explorerFeb 10, 2015

  • CVE-2015-1172
    47Plan

    Unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme (aka holding_pattern) 0.6 and earlier for WordP

    HighCVSS 7.5WeaponizedEPSS 58%

    holding pattern project · holding patternFeb 11, 2015

  • CVE-2015-1579
    26Monitor

    Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a ..

    MediumCVSS 5.0Proof of conceptEPSS 20%

    elegantthemes · diviFeb 11, 2015

  • CVE-2015-1545
    23Monitor

    The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial o

    MediumCVSS 5.0No exploitEPSS 11%

    openldap · openldapFeb 12, 2015

  • CVE-2015-0923
    40Plan

    The ContentBlockEx method in Workarea/ServerControlWS.asmx in Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 befor

    MediumCVSS 5.0WeaponizedEPSS 22%

    ektron · ektron content management systemFeb 13, 2015

  • CVE-2014-7883
    31Monitor

    HP Universal CMDB (UCMDB) Probe 9.05, 10.01, and 10.11 enables the HTTP TRACE method, which allows remote attackers to obtain sensitive info

    MediumCVSS 5.0Proof of conceptEPSS 37%

    hp · universal configuration management databaseFeb 15, 2015

  • CVE-2014-0227
    31Monitor

    java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 do

    MediumCVSS 6.4No exploitEPSS 21%

    apache · tomcatFeb 16, 2015

  • CVE-2015-1497
    62This week

    radexecd.exe in Persistent Systems Radia Client Automation (RCA) 7.9, 8.1, 9.0, and 9.1 allows remote attackers to execute arbitrary command

    CriticalCVSS 10.0WeaponizedEPSS 74%

    persistent systems · radia client automationFeb 16, 2015

  • CVE-2015-1427
    99Now

    The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection me

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    elastic · elasticsearchFeb 17, 2015

  • CVE-2015-1349
    28Monitor

    named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC validation and the managed-keys feature are e

    MediumCVSS 5.4No exploitEPSS 22%

    isc · bindFeb 18, 2015

  • CVE-2015-1587
    43Plan

    Unrestricted file upload vulnerability in file_to_index.php in Maarch LetterBox 2.8 and earlier and GEC/GED 1.4 and earlier allows remote at

    HighCVSS 7.5WeaponizedEPSS 43%

    maarch · gec\/gedFeb 19, 2015

  • CVE-2015-1592
    52Plan

    Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::t

    HighCVSS 7.5WeaponizedEPSS 74%

    debian · debian linuxFeb 19, 2015

  • CVE-2015-2049
    56Plan

    Unrestricted file upload vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote authenticated users to execute arbitr

    CriticalCVSS 9.0WeaponizedEPSS 66%

    dlink · dcs-931l firmwareFeb 23, 2015

  • CVE-2015-2051
    94Now

    The D-Link DIR-645 Wired/Wireless Router Rev.

    HighCVSS 8.8KEVWeaponizedEPSS 97%

    dlink · dir-645 firmwareFeb 23, 2015

  • CVE-2015-0240
    66This week

    The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x befor

    CriticalCVSS 10.0WeaponizedEPSS 87%

    samba · sambaFeb 23, 2015

  • CVE-2015-1605
    35Monitor

    Multiple SQL injection vulnerabilities in Dell ScriptLogic Asset Manager (aka Quest Workspace Asset Manager) before 9.5 allow remote attacke

    HighCVSS 7.5No exploitEPSS 17%

    dell · asset managerFeb 24, 2015

  • CVE-2015-2065
    42Plan

    SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery (contus-video-gallery) plugin before 2.8 for WordPr

    HighCVSS 7.5WeaponizedEPSS 40%

    apptha · wordpress video galleryFeb 24, 2015

  • CVE-2015-2067
    32Monitor

    Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allows remot

    MediumCVSS 5.0Proof of conceptEPSS 38%

    magmi project · magmiFeb 24, 2015

  • CVE-2015-2068
    21Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allow remote attacker

    MediumCVSS 4.3Proof of conceptEPSS 14%

    magmi project · magmiFeb 24, 2015