Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: April 2015

48 records · 7 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2015-0802
    40Plan

    Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, whic

    MediumCVSS 5.0WeaponizedEPSS 65%

    mozilla · firefoxApr 1, 2015

  • CVE-2015-0816
    40Plan

    Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes

    MediumCVSS 5.0WeaponizedEPSS 65%

    mozilla · firefoxApr 1, 2015

  • CVE-2015-2294
    24Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in the WebGUI in pfSense before 2.2.1 allow remote attackers to inject arbitrary web scr

    MediumCVSS 4.3No exploitEPSS 24%

    netgate · pfsenseApr 1, 2015

  • CVE-2015-0666
    72This week

    Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) before 7.1(1) allows remote atta

    HighCVSS 7.5KEVWeaponizedEPSS 40%

    cisco · prime data center network managerApr 3, 2015

  • CVE-2015-2166
    28Monitor

    Directory traversal vulnerability in the Instance Monitor in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5, and 6 allows remot

    MediumCVSS 5.0Proof of conceptEPSS 26%

    ericsson · drutt mobile service delivery platformApr 6, 2015

  • CVE-2015-0248
    24Monitor

    The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a d

    MediumCVSS 5.0No exploitEPSS 12%

    apache · subversionApr 8, 2015

  • CVE-2015-1126
    40Plan

    WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly handle the

    MediumCVSS 4.3WeaponizedEPSS 9%

    apple · iphone osApr 10, 2015

  • CVE-2015-1130
    64This week

    The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileg

    HighCVSS 7.8KEVWeaponizedEPSS 9%

    apple · mac os xApr 10, 2015

  • CVE-2015-2295
    47Plan

    Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote

    MediumCVSS 6.8Proof of conceptEPSS 65%

    netgate · pfsenseApr 10, 2015

  • CVE-2015-3008
    31Monitor

    Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified Asterisk 1.8.28 befo

    MediumCVSS 4.3No exploitEPSS 46%

    digium · asteriskApr 10, 2015

  • CVE-2015-1635
    99Now

    HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote a

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    microsoft · windows 7Apr 14, 2015

  • CVE-2015-1638
    27Monitor

    Microsoft Active Directory Federation Services (AD FS) 3.0 on Windows Server 2012 R2 does not properly handle logoff actions, which allows r

    MediumCVSS 5.8No exploitEPSS 12%

    microsoft · windows server 2012Apr 14, 2015

  • CVE-2015-1641
    90Now

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3,

    HighCVSS 7.8KEVWeaponizedEPSS 97%

    microsoft · officeApr 14, 2015

  • CVE-2015-1645
    45Plan

    Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to execut

    CriticalCVSS 9.3No exploitEPSS 25%

    microsoft · windows 7Apr 14, 2015

  • CVE-2015-1646
    22Monitor

    Microsoft XML Core Services (aka MSXML) 3.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a

    MediumCVSS 4.3No exploitEPSS 16%

    microsoft · xml core servicesApr 14, 2015

  • CVE-2015-1648
    20Monitor

    ASP.NET in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, when the customErrors configuration is disabled,

    LowCVSS 2.6No exploitEPSS 34%

    microsoft · .net frameworkApr 14, 2015

  • CVE-2015-1649
    45Plan

    Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Viewer, Office Compatibility Pack SP3, Word Au

    CriticalCVSS 9.3No exploitEPSS 25%

    microsoft · officeApr 14, 2015

  • CVE-2015-1650
    46Plan

    Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word Viewer, Offic

    CriticalCVSS 9.3No exploitEPSS 28%

    microsoft · officeApr 14, 2015

  • CVE-2015-1651
    42Plan

    Use-after-free vulnerability in Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allows remote attackers to execute a

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · office compatibility packApr 14, 2015

  • CVE-2015-1652
    42Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerApr 14, 2015

  • CVE-2015-1657
    41Plan

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 12%

    microsoft · internet explorerApr 14, 2015

  • CVE-2015-1659
    42Plan

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerApr 14, 2015

  • CVE-2015-1660
    41Plan

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    CriticalCVSS 9.3No exploitEPSS 12%

    microsoft · internet explorerApr 14, 2015

  • CVE-2015-1661
    21Monitor

    Microsoft Internet Explorer 6 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Intern

    MediumCVSS 4.3No exploitEPSS 14%

    microsoft · internet explorerApr 14, 2015

  • CVE-2015-1662
    41Plan

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 12%

    microsoft · internet explorerApr 14, 2015

  • CVE-2015-1665
    42Plan

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerApr 14, 2015

  • CVE-2015-1666
    41Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 12%

    microsoft · internet explorerApr 14, 2015

  • CVE-2015-1667
    41Plan

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 12%

    microsoft · internet explorerApr 14, 2015

  • CVE-2015-1668
    42Plan

    Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerApr 14, 2015

  • CVE-2015-0346
    43Plan

    Double free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.

    CriticalCVSS 10.0No exploitEPSS 10%

    adobe · flash playerApr 14, 2015

  • CVE-2015-0358
    43Plan

    Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before

    CriticalCVSS 10.0No exploitEPSS 10%

    adobe · flash playerApr 14, 2015

  • CVE-2015-0359
    68This week

    Double free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.

    CriticalCVSS 10.0WeaponizedEPSS 92%

    adobe · flash playerApr 14, 2015

  • CVE-2015-3042
    51Plan

    Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows att

    CriticalCVSS 10.0Proof of conceptEPSS 36%

    adobe · flash playerApr 14, 2015

  • CVE-2015-3043
    91Now

    Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows att

    CriticalCVSS 9.8KEVWeaponizedEPSS 73%

    adobe · flash playerApr 14, 2015

  • CVE-2015-0501
    25Monitor

    Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect ava

    MediumCVSS 5.7No exploitEPSS 10%

    oracle · mysqlApr 16, 2015

  • CVE-2015-1318
    40Plan

    The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a crafted usr/share/apport

    HighCVSS 7.2WeaponizedEPSS 4%

    apport project · apportApr 17, 2015

  • CVE-2015-0969
    24Monitor

    SearchBlox before 8.2 allows remote attackers to obtain sensitive information via a pretty=true action to the _cluster/health URI.

    MediumCVSS 5.0No exploitEPSS 13%

    searchblox · searchbloxApr 17, 2015

  • CVE-2015-1701
    78This week

    Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privil

    HighCVSS 7.8KEVWeaponizedEPSS 55%

    microsoft · windows 2003 serverApr 21, 2015

  • CVE-2015-2825
    34Monitor

    Unrestricted file upload vulnerability in sam-ajax-admin.php in the Simple Ads Manager plugin before 2.5.96 for WordPress allows remote atta

    HighCVSS 7.5Proof of conceptEPSS 14%

    simple ads manager project · simple ads managerApr 21, 2015

  • CVE-2015-0135
    52Plan

    IBM Domino 8.5 before 8.5.3 FP6 IF4 and 9.0 before 9.0.1 FP3 IF2 allows remote attackers to execute arbitrary code or cause a denial of serv

    CriticalCVSS 10.0No exploitEPSS 39%

    ibm · dominoApr 21, 2015

  • CVE-2015-3035
    85Now

    Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0)

    HighCVSS 7.5KEVWeaponizedEPSS 83%

    tp-link · tl-wr741nd firmwareApr 21, 2015

  • CVE-2015-3143
    23Monitor

    cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users vi

    MediumCVSS 5.0No exploitEPSS 11%

    haxx · curlApr 24, 2015

  • CVE-2015-3144
    39Monitor

    The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to c

    CriticalCVSS 9.0No exploitEPSS 10%

    oracle · mysql enterprise monitorApr 24, 2015

  • CVE-2015-3145
    39Monitor

    The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attack

    HighCVSS 7.5No exploitEPSS 30%

    fedoraproject · fedoraApr 24, 2015

  • CVE-2015-3148
    24Monitor

    cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect

    MediumCVSS 5.0No exploitEPSS 14%

    fedoraproject · fedoraApr 24, 2015

  • CVE-2015-1397
    43Plan

    SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1

    MediumCVSS 6.5Proof of conceptEPSS 55%

    magento · magentoApr 29, 2015

  • CVE-2015-1398
    30Monitor

    Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote aut

    MediumCVSS 6.5No exploitEPSS 13%

    magento · magentoApr 29, 2015

  • CVE-2015-3457
    28Monitor

    Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentication via the forwarde

    MediumCVSS 5.0No exploitEPSS 25%

    magento · magentoApr 29, 2015