By publication date

Exploited and new serious CVEs: May 2015

90 records · 4 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
99Now	CVE-2014-8361Weaponized	The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploirealtek · realtek sdk pre-auth RCE	Critical9.8	KEV	99.9%	May 1, 2015
27Monitor	CVE-2015-3337Proof of concept	Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackeelasticsearch · elasticsearch · CWE-22 Pre-auth Path traversal	Medium4.3	—	33.1%	May 1, 2015
43Plan	CVE-2015-3435No exploit	Samsung Security Manager (SSM) before 1.31 allows remote attackers to execute arbitrary code by uploading a file with an HTTP (1) PUT or (2)samsung · samsung security manager · CWE-264 pre-auth RCE	Critical10.0	—	10.2%	May 1, 2015
40Plan	CVE-2015-1155Weaponized	The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers apple · iphone os · CWE-264 Pre-auth	Medium4.3	—	10.8%	May 7, 2015
21Monitor	CVE-2015-1880Proof of concept	Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject afortinet · fortios · CWE-79 Pre-auth XSS	Medium4.3	—	14.1%	May 12, 2015
40Plan	CVE-2015-2219Weaponized	Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to galenovo · system update · CWE-264 Local privilege escalation	High7.2	—	4.1%	May 12, 2015
44Plan	CVE-2015-2842Proof of concept	Unrestricted file upload vulnerability in go_audiostore.php in the audiostore (Voice Files) upload functionality in GoAutoDial GoAdmin CE 3.goautodial · goadmin ce pre-auth RCE File upload	Critical10.0	—	13.0%	May 12, 2015
41Plan	CVE-2015-2843Weaponized	Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before 3.3-1421902800 allow remote attackers to execute arbitrary SQL commangoautodial · goadmin ce · CWE-89 pre-auth RCE SQL injection	High7.5	—	37.9%	May 12, 2015
44Plan	CVE-2015-2844Proof of concept	The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1420434000 allows remote attackers to execute arbitrary commands via goautodial · goadmin ce · CWE-78 pre-auth RCE Command injection	Critical10.0	—	12.6%	May 12, 2015
61This week	CVE-2015-2845Weaponized	The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1421902800 allows remote attackers to execute arbitrary commands via goautodial · goadmin ce · CWE-78 pre-auth RCE Command injection	Critical10.0	—	71.5%	May 12, 2015
27Monitor	CVE-2015-3622No exploit	The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-gnu · libtasn1 · CWE-119 Pre-auth Memory safety Denial of service	Medium4.3	—	32.8%	May 12, 2015
43Plan	CVE-2014-9160No exploit	Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attacadobe · acrobat reader · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	10.7%	May 13, 2015
42Plan	CVE-2015-1658No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.6%	May 13, 2015
22Monitor	CVE-2015-1670No exploit	The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, allows remote attackers microsoft · .net framework · CWE-200 Pre-auth Info leak	Medium4.3	—	15.9%	May 13, 2015
76This week	CVE-2015-1671Weaponized	The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010microsoft · .net framework RCE	High7.8	KEV	48.8%	May 13, 2015
25Monitor	CVE-2015-1672No exploit	Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allows remote attackers to cause a denial of service (recursion and pmicrosoft · .net framework · CWE-310 Pre-auth Denial of service	Medium5.0	—	17.3%	May 13, 2015
42Plan	CVE-2015-1673No exploit	The Windows Forms (aka WinForms) libraries in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allow user-assmicrosoft · .net framework · CWE-264 pre-auth RCE	Critical9.3	—	16.9%	May 13, 2015
41Plan	CVE-2015-1675No exploit	Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, andmicrosoft · windows 7 · CWE-94 pre-auth RCE	Critical9.3	—	14.1%	May 13, 2015
43Plan	CVE-2015-1682No exploit	Microsoft Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Office 2013 SP1, Excel 2013 SP1, PowerPoint 2013 SP1, Word 20microsoft · excel · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	20.3%	May 13, 2015
22Monitor	CVE-2015-1684No exploit	VBScript.dll in the Microsoft VBScript 5.6 through 5.8 engine, as used in Internet Explorer 8 through 11 and other products, allows remote amicrosoft · vbscript · CWE-200 Pre-auth Info leak	Medium4.3	—	16.1%	May 13, 2015
22Monitor	CVE-2015-1685No exploit	Microsoft Internet Explorer 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Exploremicrosoft · internet explorer · CWE-264 Pre-auth	Medium4.3	—	16.5%	May 13, 2015
22Monitor	CVE-2015-1686No exploit	The Microsoft (1) VBScript 5.6 through 5.8 and (2) JScript 5.6 through 5.8 engines, as used in Internet Explorer 8 through 11 and other prodmicrosoft · internet explorer · CWE-200 Pre-auth Info leak	Medium4.3	—	16.1%	May 13, 2015
30Monitor	CVE-2015-1688No exploit	Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevationmicrosoft · internet explorer · CWE-264 Pre-auth	Medium6.8	—	10.9%	May 13, 2015
42Plan	CVE-2015-1689No exploit	Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.5%	May 13, 2015
42Plan	CVE-2015-1691No exploit	Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via amicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.5%	May 13, 2015
28Monitor	CVE-2015-1692No exploit	Microsoft Internet Explorer 7 through 11 allows user-assisted remote attackers to read the clipboard contents via crafted web script, aka "Imicrosoft · internet explorer · CWE-200 Pre-auth Info leak	Medium4.3	—	35.1%	May 13, 2015
42Plan	CVE-2015-1694No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.5%	May 13, 2015
41Plan	CVE-2015-1695No exploit	Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, andmicrosoft · windows 7 · CWE-94 pre-auth RCE	Critical9.3	—	14.1%	May 13, 2015
42Plan	CVE-2015-1696No exploit	Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, andmicrosoft · windows 7 · CWE-94 pre-auth RCE	Critical9.3	—	17.6%	May 13, 2015
42Plan	CVE-2015-1697No exploit	Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, andmicrosoft · windows 7 · CWE-94 pre-auth RCE	Critical9.3	—	17.6%	May 13, 2015
42Plan	CVE-2015-1698No exploit	Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, andmicrosoft · windows 7 · CWE-94 pre-auth RCE	Critical9.3	—	17.6%	May 13, 2015
41Plan	CVE-2015-1699No exploit	Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, andmicrosoft · windows 7 · CWE-94 pre-auth RCE	Critical9.3	—	14.1%	May 13, 2015
28Monitor	CVE-2015-1700No exploit	Microsoft SharePoint Server 2007 SP3, SharePoint Foundation 2010 SP2, SharePoint Server 2010 SP2, and SharePoint Foundation 2013 SP1 allow rmicrosoft · sharepoint foundation · CWE-20 RCE	Medium6.0	—	12.0%	May 13, 2015
30Monitor	CVE-2015-1703No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevationmicrosoft · internet explorer · CWE-264 Pre-auth	Medium6.8	—	10.9%	May 13, 2015
30Monitor	CVE-2015-1704No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevationmicrosoft · internet explorer · CWE-264 Pre-auth	Medium6.8	—	10.9%	May 13, 2015
42Plan	CVE-2015-1705No exploit	Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.5%	May 13, 2015
42Plan	CVE-2015-1706No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.5%	May 13, 2015
42Plan	CVE-2015-1708No exploit	Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via amicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.5%	May 13, 2015
42Plan	CVE-2015-1709No exploit	Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.5%	May 13, 2015
42Plan	CVE-2015-1710No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.5%	May 13, 2015
42Plan	CVE-2015-1711No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.5%	May 13, 2015
45Plan	CVE-2015-1712No exploit	Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via amicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	26.7%	May 13, 2015
30Monitor	CVE-2015-1713No exploit	Microsoft Internet Explorer 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilmicrosoft · internet explorer · CWE-264 Pre-auth	Medium6.8	—	10.9%	May 13, 2015
45Plan	CVE-2015-1714No exploit	Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) viamicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	26.7%	May 13, 2015
41Plan	CVE-2015-1715No exploit	Microsoft Silverlight 5 before 5.1.40416.00 allows remote attackers to bypass intended integrity-level restrictions via a crafted Silverlighmicrosoft · silverlight · CWE-264 Pre-auth	Critical9.3	—	13.2%	May 13, 2015
26Monitor	CVE-2015-1716No exploit	Schannel in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1,microsoft · windows 7 · CWE-200 Pre-auth Info leak	Medium5.0	—	20.7%	May 13, 2015
42Plan	CVE-2015-1717No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.5%	May 13, 2015
42Plan	CVE-2015-1718No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.5%	May 13, 2015
44Plan	CVE-2015-3046No exploit	Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause adobe · acrobat · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	12.2%	May 13, 2015
44Plan	CVE-2015-3048No exploit	Buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allows attackers to execute arbiadobe · acrobat · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	13.6%	May 13, 2015
44Plan	CVE-2015-3049No exploit	Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause adobe · acrobat reader · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	12.2%	May 13, 2015
44Plan	CVE-2015-3050No exploit	Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause adobe · acrobat reader · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	12.2%	May 13, 2015
44Plan	CVE-2015-3051No exploit	Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause adobe · acrobat · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	12.2%	May 13, 2015
44Plan	CVE-2015-3052No exploit	Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause adobe · acrobat · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	12.3%	May 13, 2015
43Plan	CVE-2015-3053No exploit	Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allows attackers toadobe · acrobat · CWE-416 pre-auth RCE Memory safety	Critical10.0	—	11.1%	May 13, 2015
43Plan	CVE-2015-3054No exploit	Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allows attackers toadobe · acrobat pre-auth RCE	Critical10.0	—	10.3%	May 13, 2015
44Plan	CVE-2015-3056No exploit	Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause adobe · acrobat · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	12.1%	May 13, 2015
44Plan	CVE-2015-3057No exploit	Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause adobe · acrobat · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	12.1%	May 13, 2015
43Plan	CVE-2015-3059No exploit	Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allows attackers toadobe · acrobat · CWE-416 pre-auth RCE Memory safety	Critical10.0	—	10.3%	May 13, 2015
44Plan	CVE-2015-3070No exploit	Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause adobe · acrobat reader · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	12.2%	May 13, 2015
48Plan	CVE-2015-3073Proof of concept	Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on adobe · acrobat · CWE-284 Pre-auth Broken access control (IDOR)	Critical10.0	—	25.4%	May 13, 2015
44Plan	CVE-2015-3076No exploit	Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause adobe · acrobat reader · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	12.2%	May 13, 2015
44Plan	CVE-2015-3077No exploit	Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIRadobe · flash player pre-auth RCE	Critical10.0	—	14.6%	May 13, 2015
57Plan	CVE-2015-3080Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before adobe · flash player pre-auth RCE	Critical10.0	—	56.5%	May 13, 2015
20Monitor	CVE-2015-3081Proof of concept	Race condition in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 oadobe · flash player · CWE-362 Pre-auth Race condition	Medium4.3	—	11.3%	May 13, 2015
38Monitor	CVE-2015-3082Proof of concept	Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIRadobe · air · CWE-264 Pre-auth	Medium6.4	—	42.5%	May 13, 2015
37Monitor	CVE-2015-3083Proof of concept	Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIRadobe · flash player · CWE-264 Pre-auth	Medium6.4	—	41.0%	May 13, 2015
62This week	CVE-2015-3087Proof of concept	Integer overflow in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460adobe · air · CWE-189 pre-auth RCE	Critical10.0	—	74.2%	May 13, 2015
59Plan	CVE-2015-3088Proof of concept	Heap-based buffer overflow in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11adobe · flash player · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	61.9%	May 13, 2015
54Plan	CVE-2015-3089Proof of concept	Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIRadobe · air · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	47.6%	May 13, 2015
65This week	CVE-2015-3090Weaponized	Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIRadobe · flash player · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	83.1%	May 13, 2015
54Plan	CVE-2015-3093Proof of concept	Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIRadobe · air · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	47.6%	May 13, 2015
41Plan	CVE-2015-1683No exploit	Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption microsoft · office · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	13.5%	May 13, 2015
35Monitor	CVE-2015-3456Proof of concept	The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (oqemu · qemu · CWE-119 RCE Memory safety	High7.7	—	15.2%	May 13, 2015
56Plan	CVE-2015-1868No exploit	The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Serverpowerdns · authoritative · CWE-399 Pre-auth Denial of service	High7.8	—	81.7%	May 18, 2015
13Monitor	CVE-2015-3455No exploit	Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do oracle · linux · CWE-20 Pre-auth	Low2.6	—	11.4%	May 18, 2015
100Now	CVE-2015-3306Weaponized	The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.proftpd · proftpd · CWE-284 Pre-auth Broken access control (IDOR)	Critical10.0	KEV	99.4%	May 18, 2015
60This week	CVE-2015-4000Weaponized	The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_Eopenssl · openssl · CWE-310 Pre-auth	Low3.7	—	99.8%	May 20, 2015
48Plan	CVE-2015-3036Proof of concept	Stack-based buffer overflow in the run_init_sbus function in the KCodes NetUSB module for the Linux kernel, as used in certain NETGEAR produkcodes · netusb · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	27.7%	May 20, 2015
49Plan	CVE-2015-1896No exploit	Stack-based buffer overflow in the FastBackMount process in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.11.1 allows remote attackers ibm · tivoli storage manager fastback · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	31.4%	May 24, 2015
43Plan	CVE-2015-2110No exploit	Buffer overflow in HP LoadRunner 11.52 allows remote attackers to execute arbitrary code via unspecified vectors.hp · loadrunner · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	10.9%	May 25, 2015
34Monitor	CVE-2015-0935Proof of concept	Bomgar Remote Support before 15.1.1 allows remote attackers to execute arbitrary PHP code via crafted serialized data to unspecified PHP scrbomgar · remote support · CWE-94 pre-auth RCE	High7.5	—	11.9%	May 25, 2015
37Monitor	CVE-2014-8146Proof of concept	The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Componeapple · itunes · CWE-119 pre-auth RCE Memory safety	High7.5	—	24.7%	May 25, 2015
37Monitor	CVE-2014-8147Proof of concept	The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Componeapple · mac os x · CWE-189 pre-auth RCE	High7.5	—	23.6%	May 25, 2015
40Plan	CVE-2015-3331No exploit	The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel before 3.19.3 does not properly determine thlinux · linux kernel · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	10.0%	May 27, 2015
49Plan	CVE-2015-4133Weaponized	Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows reflex gallery project · reflex gallery pre-auth RCE File upload	High7.5	—	61.9%	May 28, 2015
62This week	CVE-2014-9727Weaponized	AVM Fritz!Box allows remote attackers to execute arbitrary commands via shell metacharacters in the var:lang parameter to cgi-bin/webcm.avm · fritz\!box · CWE-78 pre-auth RCE Command injection	Critical10.0	—	72.1%	May 29, 2015
42Plan	CVE-2015-1833Proof of concept	XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.apache · jackrabbit · CWE-20 Pre-auth XXE	Medium6.4	—	55.9%	May 29, 2015
85Now	CVE-2015-4068Weaponized	Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denarcserve · udp · CWE-22 Pre-auth Path traversal	Critical9.1	KEV	63.6%	May 29, 2015
44Plan	CVE-2015-3292Proof of concept	The installer in NetApp OnCommand Workflow Automation before 2.2.1P1 and 3.x before 3.0P1 sets up the Java Debugging Wire Protocol (JDWP) senetapp · oncommand workflow automation · CWE-17 pre-auth RCE	Critical10.0	—	12.4%	May 31, 2015

CVE-2014-8361
99Now
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploi
CriticalCVSS 9.8KEVWeaponizedEPSS 99%
- pre-auth RCE
realtek · realtek sdkMay 1, 2015
CVE-2015-3337
27Monitor
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attacke
MediumCVSS 4.3Proof of conceptEPSS 33%
- Pre-auth
- Path traversal
elasticsearch · elasticsearchMay 1, 2015
CVE-2015-3435
43Plan
Samsung Security Manager (SSM) before 1.31 allows remote attackers to execute arbitrary code by uploading a file with an HTTP (1) PUT or (2)
CriticalCVSS 10.0No exploitEPSS 10%
- pre-auth RCE
samsung · samsung security managerMay 1, 2015
CVE-2015-1155
40Plan
The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers
MediumCVSS 4.3WeaponizedEPSS 10%
- Pre-auth
apple · iphone osMay 7, 2015
CVE-2015-1880
21Monitor
Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject a
MediumCVSS 4.3Proof of conceptEPSS 14%
- Pre-auth
- XSS
fortinet · fortiosMay 12, 2015
CVE-2015-2219
40Plan
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to ga
HighCVSS 7.2WeaponizedEPSS 4%
- Local privilege escalation
lenovo · system updateMay 12, 2015
CVE-2015-2842
44Plan
Unrestricted file upload vulnerability in go_audiostore.php in the audiostore (Voice Files) upload functionality in GoAutoDial GoAdmin CE 3.
CriticalCVSS 10.0Proof of conceptEPSS 13%
- pre-auth RCE
- File upload
goautodial · goadmin ceMay 12, 2015
CVE-2015-2843
41Plan
Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before 3.3-1421902800 allow remote attackers to execute arbitrary SQL comman
HighCVSS 7.5WeaponizedEPSS 37%
- pre-auth RCE
- SQL injection
goautodial · goadmin ceMay 12, 2015
CVE-2015-2844
44Plan
The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1420434000 allows remote attackers to execute arbitrary commands via
CriticalCVSS 10.0Proof of conceptEPSS 12%
- pre-auth RCE
- Command injection
goautodial · goadmin ceMay 12, 2015
CVE-2015-2845
61This week
The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1421902800 allows remote attackers to execute arbitrary commands via
CriticalCVSS 10.0WeaponizedEPSS 71%
- pre-auth RCE
- Command injection
goautodial · goadmin ceMay 12, 2015
CVE-2015-3622
27Monitor
The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-
MediumCVSS 4.3No exploitEPSS 32%
- Pre-auth
- Memory safety
- Denial of service
gnu · libtasn1May 12, 2015
CVE-2014-9160
43Plan
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attac
CriticalCVSS 10.0No exploitEPSS 10%
- pre-auth RCE
- Memory safety
adobe · acrobat readerMay 13, 2015
CVE-2015-1658
42Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerMay 13, 2015
CVE-2015-1670
22Monitor
The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, allows remote attackers
MediumCVSS 4.3No exploitEPSS 15%
- Pre-auth
- Info leak
microsoft · .net frameworkMay 13, 2015
CVE-2015-1671
76This week
The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010
HighCVSS 7.8KEVWeaponizedEPSS 48%
- RCE
microsoft · .net frameworkMay 13, 2015
CVE-2015-1672
25Monitor
Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allows remote attackers to cause a denial of service (recursion and p
MediumCVSS 5.0No exploitEPSS 17%
- Pre-auth
- Denial of service
microsoft · .net frameworkMay 13, 2015
CVE-2015-1673
42Plan
The Windows Forms (aka WinForms) libraries in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allow user-ass
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
microsoft · .net frameworkMay 13, 2015
CVE-2015-1675
41Plan
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and
CriticalCVSS 9.3No exploitEPSS 14%
- pre-auth RCE
microsoft · windows 7May 13, 2015
CVE-2015-1682
43Plan
Microsoft Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Office 2013 SP1, Excel 2013 SP1, PowerPoint 2013 SP1, Word 20
CriticalCVSS 9.3No exploitEPSS 20%
- pre-auth RCE
- Memory safety
microsoft · excelMay 13, 2015
CVE-2015-1684
22Monitor
VBScript.dll in the Microsoft VBScript 5.6 through 5.8 engine, as used in Internet Explorer 8 through 11 and other products, allows remote a
MediumCVSS 4.3No exploitEPSS 16%
- Pre-auth
- Info leak
microsoft · vbscriptMay 13, 2015
CVE-2015-1685
22Monitor
Microsoft Internet Explorer 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explore
MediumCVSS 4.3No exploitEPSS 16%
- Pre-auth
microsoft · internet explorerMay 13, 2015
CVE-2015-1686
22Monitor
The Microsoft (1) VBScript 5.6 through 5.8 and (2) JScript 5.6 through 5.8 engines, as used in Internet Explorer 8 through 11 and other prod
MediumCVSS 4.3No exploitEPSS 16%
- Pre-auth
- Info leak
microsoft · internet explorerMay 13, 2015
CVE-2015-1688
30Monitor
Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation
MediumCVSS 6.8No exploitEPSS 10%
- Pre-auth
microsoft · internet explorerMay 13, 2015
CVE-2015-1689
42Plan
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerMay 13, 2015
CVE-2015-1691
42Plan
Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerMay 13, 2015
CVE-2015-1692
28Monitor
Microsoft Internet Explorer 7 through 11 allows user-assisted remote attackers to read the clipboard contents via crafted web script, aka "I
MediumCVSS 4.3No exploitEPSS 35%
- Pre-auth
- Info leak
microsoft · internet explorerMay 13, 2015
CVE-2015-1694
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerMay 13, 2015
CVE-2015-1695
41Plan
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and
CriticalCVSS 9.3No exploitEPSS 14%
- pre-auth RCE
microsoft · windows 7May 13, 2015
CVE-2015-1696
42Plan
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and
CriticalCVSS 9.3No exploitEPSS 17%
- pre-auth RCE
microsoft · windows 7May 13, 2015
CVE-2015-1697
42Plan
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and
CriticalCVSS 9.3No exploitEPSS 17%
- pre-auth RCE
microsoft · windows 7May 13, 2015
CVE-2015-1698
42Plan
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and
CriticalCVSS 9.3No exploitEPSS 17%
- pre-auth RCE
microsoft · windows 7May 13, 2015
CVE-2015-1699
41Plan
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and
CriticalCVSS 9.3No exploitEPSS 14%
- pre-auth RCE
microsoft · windows 7May 13, 2015
CVE-2015-1700
28Monitor
Microsoft SharePoint Server 2007 SP3, SharePoint Foundation 2010 SP2, SharePoint Server 2010 SP2, and SharePoint Foundation 2013 SP1 allow r
MediumCVSS 6.0No exploitEPSS 12%
- RCE
microsoft · sharepoint foundationMay 13, 2015
CVE-2015-1703
30Monitor
Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation
MediumCVSS 6.8No exploitEPSS 10%
- Pre-auth
microsoft · internet explorerMay 13, 2015
CVE-2015-1704
30Monitor
Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation
MediumCVSS 6.8No exploitEPSS 10%
- Pre-auth
microsoft · internet explorerMay 13, 2015
CVE-2015-1705
42Plan
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerMay 13, 2015
CVE-2015-1706
42Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerMay 13, 2015
CVE-2015-1708
42Plan
Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerMay 13, 2015
CVE-2015-1709
42Plan
Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerMay 13, 2015
CVE-2015-1710
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerMay 13, 2015
CVE-2015-1711
42Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerMay 13, 2015
CVE-2015-1712
45Plan
Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a
CriticalCVSS 9.3No exploitEPSS 26%
- pre-auth RCE
- Memory safety
microsoft · internet explorerMay 13, 2015
CVE-2015-1713
30Monitor
Microsoft Internet Explorer 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privil
MediumCVSS 6.8No exploitEPSS 10%
- Pre-auth
microsoft · internet explorerMay 13, 2015
CVE-2015-1714
45Plan
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3No exploitEPSS 26%
- pre-auth RCE
- Memory safety
microsoft · internet explorerMay 13, 2015
CVE-2015-1715
41Plan
Microsoft Silverlight 5 before 5.1.40416.00 allows remote attackers to bypass intended integrity-level restrictions via a crafted Silverligh
CriticalCVSS 9.3No exploitEPSS 13%
- Pre-auth
microsoft · silverlightMay 13, 2015
CVE-2015-1716
26Monitor
Schannel in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1,
MediumCVSS 5.0No exploitEPSS 20%
- Pre-auth
- Info leak
microsoft · windows 7May 13, 2015
CVE-2015-1717
42Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerMay 13, 2015
CVE-2015-1718
42Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerMay 13, 2015
CVE-2015-3046
44Plan
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause
CriticalCVSS 10.0No exploitEPSS 12%
- pre-auth RCE
- Memory safety
adobe · acrobatMay 13, 2015
CVE-2015-3048
44Plan
Buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allows attackers to execute arbi
CriticalCVSS 10.0No exploitEPSS 13%
- pre-auth RCE
- Memory safety
adobe · acrobatMay 13, 2015
CVE-2015-3049
44Plan
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause
CriticalCVSS 10.0No exploitEPSS 12%
- pre-auth RCE
- Memory safety
adobe · acrobat readerMay 13, 2015
CVE-2015-3050
44Plan
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause
CriticalCVSS 10.0No exploitEPSS 12%
- pre-auth RCE
- Memory safety
adobe · acrobat readerMay 13, 2015
CVE-2015-3051
44Plan
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause
CriticalCVSS 10.0No exploitEPSS 12%
- pre-auth RCE
- Memory safety
adobe · acrobatMay 13, 2015
CVE-2015-3052
44Plan
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause
CriticalCVSS 10.0No exploitEPSS 12%
- pre-auth RCE
- Memory safety
adobe · acrobatMay 13, 2015
CVE-2015-3053
43Plan
Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allows attackers to
CriticalCVSS 10.0No exploitEPSS 11%
- pre-auth RCE
- Memory safety
adobe · acrobatMay 13, 2015
CVE-2015-3054
43Plan
Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allows attackers to
CriticalCVSS 10.0No exploitEPSS 10%
- pre-auth RCE
adobe · acrobatMay 13, 2015
CVE-2015-3056
44Plan
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause
CriticalCVSS 10.0No exploitEPSS 12%
- pre-auth RCE
- Memory safety
adobe · acrobatMay 13, 2015
CVE-2015-3057
44Plan
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause
CriticalCVSS 10.0No exploitEPSS 12%
- pre-auth RCE
- Memory safety
adobe · acrobatMay 13, 2015
CVE-2015-3059
43Plan
Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allows attackers to
CriticalCVSS 10.0No exploitEPSS 10%
- pre-auth RCE
- Memory safety
adobe · acrobatMay 13, 2015
CVE-2015-3070
44Plan
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause
CriticalCVSS 10.0No exploitEPSS 12%
- pre-auth RCE
- Memory safety
adobe · acrobat readerMay 13, 2015
CVE-2015-3073
48Plan
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on
CriticalCVSS 10.0Proof of conceptEPSS 25%
- Pre-auth
- Broken access control (IDOR)
adobe · acrobatMay 13, 2015
CVE-2015-3076
44Plan
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause
CriticalCVSS 10.0No exploitEPSS 12%
- pre-auth RCE
- Memory safety
adobe · acrobat readerMay 13, 2015
CVE-2015-3077
44Plan
Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR
CriticalCVSS 10.0No exploitEPSS 14%
- pre-auth RCE
adobe · flash playerMay 13, 2015
CVE-2015-3080
57Plan
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before
CriticalCVSS 10.0Proof of conceptEPSS 56%
- pre-auth RCE
adobe · flash playerMay 13, 2015
CVE-2015-3081
20Monitor
Race condition in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 o
MediumCVSS 4.3Proof of conceptEPSS 11%
- Pre-auth
- Race condition
adobe · flash playerMay 13, 2015
CVE-2015-3082
38Monitor
Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR
MediumCVSS 6.4Proof of conceptEPSS 42%
- Pre-auth
adobe · airMay 13, 2015
CVE-2015-3083
37Monitor
Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR
MediumCVSS 6.4Proof of conceptEPSS 41%
- Pre-auth
adobe · flash playerMay 13, 2015
CVE-2015-3087
62This week
Integer overflow in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460
CriticalCVSS 10.0Proof of conceptEPSS 74%
- pre-auth RCE
adobe · airMay 13, 2015
CVE-2015-3088
59Plan
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11
CriticalCVSS 10.0Proof of conceptEPSS 61%
- pre-auth RCE
- Memory safety
adobe · flash playerMay 13, 2015
CVE-2015-3089
54Plan
Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR
CriticalCVSS 10.0Proof of conceptEPSS 47%
- pre-auth RCE
- Memory safety
adobe · airMay 13, 2015
CVE-2015-3090
65This week
Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR
CriticalCVSS 10.0WeaponizedEPSS 83%
- pre-auth RCE
- Memory safety
adobe · flash playerMay 13, 2015
CVE-2015-3093
54Plan
Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR
CriticalCVSS 10.0Proof of conceptEPSS 47%
- pre-auth RCE
- Memory safety
adobe · airMay 13, 2015
CVE-2015-1683
41Plan
Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption
CriticalCVSS 9.3No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · officeMay 13, 2015
CVE-2015-3456
35Monitor
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (o
HighCVSS 7.7Proof of conceptEPSS 15%
- RCE
- Memory safety
qemu · qemuMay 13, 2015
CVE-2015-1868
56Plan
The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server
HighCVSS 7.8No exploitEPSS 81%
- Pre-auth
- Denial of service
powerdns · authoritativeMay 18, 2015
CVE-2015-3455
13Monitor
Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do
LowCVSS 2.6No exploitEPSS 11%
- Pre-auth
oracle · linuxMay 18, 2015
CVE-2015-3306
100Now
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
CriticalCVSS 10.0KEVWeaponizedEPSS 99%
- Pre-auth
- Broken access control (IDOR)
proftpd · proftpdMay 18, 2015
CVE-2015-4000
60This week
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_E
LowCVSS 3.7WeaponizedEPSS 99%
- Pre-auth
openssl · opensslMay 20, 2015
CVE-2015-3036
48Plan
Stack-based buffer overflow in the run_init_sbus function in the KCodes NetUSB module for the Linux kernel, as used in certain NETGEAR produ
CriticalCVSS 10.0Proof of conceptEPSS 27%
- pre-auth RCE
- Memory safety
kcodes · netusbMay 20, 2015
CVE-2015-1896
49Plan
Stack-based buffer overflow in the FastBackMount process in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.11.1 allows remote attackers
CriticalCVSS 10.0No exploitEPSS 31%
- pre-auth RCE
- Memory safety
ibm · tivoli storage manager fastbackMay 24, 2015
CVE-2015-2110
43Plan
Buffer overflow in HP LoadRunner 11.52 allows remote attackers to execute arbitrary code via unspecified vectors.
CriticalCVSS 10.0No exploitEPSS 10%
- pre-auth RCE
- Memory safety
hp · loadrunnerMay 25, 2015
CVE-2015-0935
34Monitor
Bomgar Remote Support before 15.1.1 allows remote attackers to execute arbitrary PHP code via crafted serialized data to unspecified PHP scr
HighCVSS 7.5Proof of conceptEPSS 11%
- pre-auth RCE
bomgar · remote supportMay 25, 2015
CVE-2014-8146
37Monitor
The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Compone
HighCVSS 7.5Proof of conceptEPSS 24%
- pre-auth RCE
- Memory safety
apple · itunesMay 25, 2015
CVE-2014-8147
37Monitor
The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Compone
HighCVSS 7.5Proof of conceptEPSS 23%
- pre-auth RCE
apple · mac os xMay 25, 2015
CVE-2015-3331
40Plan
The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel before 3.19.3 does not properly determine th
CriticalCVSS 9.3No exploitEPSS 10%
- pre-auth RCE
- Memory safety
linux · linux kernelMay 27, 2015
CVE-2015-4133
49Plan
Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows
HighCVSS 7.5WeaponizedEPSS 61%
- pre-auth RCE
- File upload
reflex gallery project · reflex galleryMay 28, 2015
CVE-2014-9727
62This week
AVM Fritz!Box allows remote attackers to execute arbitrary commands via shell metacharacters in the var:lang parameter to cgi-bin/webcm.
CriticalCVSS 10.0WeaponizedEPSS 72%
- pre-auth RCE
- Command injection
avm · fritz\!boxMay 29, 2015
CVE-2015-1833
42Plan
XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.
MediumCVSS 6.4Proof of conceptEPSS 55%
- Pre-auth
- XXE
apache · jackrabbitMay 29, 2015
CVE-2015-4068
85Now
Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a den
CriticalCVSS 9.1KEVWeaponizedEPSS 63%
- Pre-auth
- Path traversal
arcserve · udpMay 29, 2015
CVE-2015-3292
44Plan
The installer in NetApp OnCommand Workflow Automation before 2.2.1P1 and 3.x before 3.0P1 sets up the Java Debugging Wire Protocol (JDWP) se
CriticalCVSS 10.0Proof of conceptEPSS 12%
- pre-auth RCE
netapp · oncommand workflow automationMay 31, 2015