By publication date

Exploited and new serious CVEs: June 2015

80 records · 3 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
44Plan	CVE-2010-5323Proof of concept	Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management (ZCM) 10 bnovell · zenworks configuration management · CWE-22 pre-auth RCE Path traversal	Critical10.0	—	14.3%	Jun 7, 2015
62This week	CVE-2010-5324Weaponized	Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management (ZCM) 10 bnovell · zenworks configuration management · CWE-22 pre-auth RCE Path traversal	Critical10.0	—	71.8%	Jun 7, 2015
62This week	CVE-2015-0779Weaponized	Directory traversal vulnerability in UploadServlet in Novell ZENworks Configuration Management (ZCM) 10 and 11 before 11.3.2 allows remote anovell · zenworks configuration management · CWE-22 pre-auth RCE Path traversal	Critical10.0	—	74.3%	Jun 7, 2015
37Monitor	CVE-2014-0230No exploit	Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs beforeapache · tomcat · CWE-399 Pre-auth Denial of service	High7.8	—	20.1%	Jun 7, 2015
24Monitor	CVE-2014-7810No exploit	The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly capache · tomcat · CWE-284 Pre-auth Broken access control (IDOR)	Medium5.0	—	13.8%	Jun 7, 2015
47Plan	CVE-2015-2993Weaponized	SysAid Help Desk before 15.2 does not properly restrict access to certain functionality, which allows remote attackers to (1) create adminissysaid · sysaid · CWE-264 Pre-auth	High7.5	—	55.1%	Jun 8, 2015
41Plan	CVE-2015-2994Weaponized	Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute arbitrary sysaid · sysaid RCE File upload	Medium6.5	—	49.7%	Jun 8, 2015
40Plan	CVE-2015-2995Weaponized	The RdsLogsEntry servlet in SysAid Help Desk before 15.2 does not properly check file extensions, which allows remote attackers to upload ansysaid · sysaid · CWE-22 pre-auth RCE Path traversal	Medium6.8	—	33.5%	Jun 8, 2015
60This week	CVE-2015-2996Weaponized	Multiple directory traversal vulnerabilities in SysAid Help Desk before 15.2 allow remote attackers to (1) read arbitrary files via a ..sysaid · sysaid · CWE-22 Pre-auth Path traversal	High8.5	—	86.5%	Jun 8, 2015
40Plan	CVE-2015-2997Weaponized	SysAid Help Desk before 15.2 allows remote attackers to obtain sensitive information via an invalid value in the accountid parameter to getAsysaid · sysaid · CWE-200 Pre-auth Path traversal Info leak	Medium5.0	—	56.9%	Jun 8, 2015
40Plan	CVE-2015-2998Weaponized	SysAid Help Desk before 15.2 uses a hardcoded encryption key, which makes it easier for remote attackers to obtain sensitive information, assysaid · sysaid · CWE-200 Pre-auth Info leak	Medium5.0	—	26.1%	Jun 8, 2015
26Monitor	CVE-2015-2783No exploit	ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information frphp · php · CWE-119 Pre-auth Memory safety	Medium5.8	—	10.3%	Jun 9, 2015
41Plan	CVE-2015-3329No exploit	Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.xphp · php · CWE-119 pre-auth RCE Memory safety	High7.5	—	38.2%	Jun 9, 2015
31Monitor	CVE-2015-3330No exploit	The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the Aphp · php · CWE-20 pre-auth RCE	Medium6.8	—	13.9%	Jun 9, 2015
26Monitor	CVE-2015-4021No exploit	The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that thephp · php · CWE-189 Pre-auth Denial of service	Medium5.0	—	21.2%	Jun 9, 2015
36Monitor	CVE-2015-4022No exploit	Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remotphp · php · CWE-189 pre-auth RCE	High7.5	—	20.8%	Jun 9, 2015
35Monitor	CVE-2015-4024No exploit	Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, aphp · php · CWE-399 Pre-auth Denial of service	Medium5.0	—	49.8%	Jun 9, 2015
36Monitor	CVE-2015-4025No exploit	PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character in certain situationsphp · php · CWE-19 Pre-auth	High7.5	—	19.3%	Jun 9, 2015
36Monitor	CVE-2015-4026No exploit	The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x0php · php · CWE-19 Pre-auth	High7.5	—	19.5%	Jun 9, 2015
34Monitor	CVE-2015-4147No exploit	The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __dephp · php · CWE-19 pre-auth RCE	High7.5	—	12.1%	Jun 9, 2015
26Monitor	CVE-2015-4148Proof of concept	The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri php · php · CWE-20 Pre-auth	Medium5.0	—	19.8%	Jun 9, 2015
41Plan	CVE-2015-1687No exploit	Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vmicrosoft · internet explorer · CWE-19 pre-auth RCE	Critical9.3	—	12.9%	Jun 9, 2015
42Plan	CVE-2015-1728No exploit	Microsoft Windows Media Player 10 through 12 allows remote attackers to execute arbitrary code via a crafted DataObject on a web site, aka "microsoft · windows media player · CWE-17 pre-auth RCE	Critical9.3	—	17.5%	Jun 9, 2015
46Plan	CVE-2015-1730Proof of concept	Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craftmicrosoft · internet explorer · CWE-399 pre-auth RCE	Critical9.3	—	29.0%	Jun 9, 2015
43Plan	CVE-2015-1731No exploit	Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) viamicrosoft · internet explorer · CWE-399 pre-auth RCE	Critical9.3	—	21.0%	Jun 9, 2015
41Plan	CVE-2015-1732No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-399 pre-auth RCE	Critical9.3	—	12.9%	Jun 9, 2015
42Plan	CVE-2015-1735No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-399 pre-auth RCE	Critical9.3	—	15.5%	Jun 9, 2015
43Plan	CVE-2015-1736No exploit	Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) viamicrosoft · internet explorer · CWE-399 pre-auth RCE	Critical9.3	—	19.3%	Jun 9, 2015
42Plan	CVE-2015-1737No exploit	Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) viamicrosoft · internet explorer · CWE-399 pre-auth RCE	Critical9.3	—	15.5%	Jun 9, 2015
32Monitor	CVE-2015-1739No exploit	Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation ofmicrosoft · internet explorer · CWE-264 Pre-auth	Medium6.8	—	15.0%	Jun 9, 2015
42Plan	CVE-2015-1740No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-399 pre-auth RCE	Critical9.3	—	15.5%	Jun 9, 2015
42Plan	CVE-2015-1741No exploit	Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-399 pre-auth RCE	Critical9.3	—	15.5%	Jun 9, 2015
42Plan	CVE-2015-1742No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-399 pre-auth RCE	Critical9.3	—	15.5%	Jun 9, 2015
24Monitor	CVE-2015-1743No exploit	Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevationmicrosoft · internet explorer · CWE-367 Pre-auth Race condition	Medium5.1	—	13.6%	Jun 9, 2015
42Plan	CVE-2015-1744No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-399 pre-auth RCE	Critical9.3	—	15.5%	Jun 9, 2015
44Plan	CVE-2015-1745No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-399 pre-auth RCE	Critical9.3	—	23.6%	Jun 9, 2015
44Plan	CVE-2015-1747No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-399 pre-auth RCE	Critical9.3	—	23.6%	Jun 9, 2015
32Monitor	CVE-2015-1748No exploit	Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevationmicrosoft · internet explorer · CWE-264 Pre-auth	Medium6.8	—	15.0%	Jun 9, 2015
44Plan	CVE-2015-1750No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-399 pre-auth RCE	Critical9.3	—	22.4%	Jun 9, 2015
42Plan	CVE-2015-1751No exploit	Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-399 pre-auth RCE	Critical9.3	—	16.5%	Jun 9, 2015
42Plan	CVE-2015-1752No exploit	Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-399 pre-auth RCE	Critical9.3	—	15.5%	Jun 9, 2015
42Plan	CVE-2015-1753No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-399 pre-auth RCE	Critical9.3	—	15.5%	Jun 9, 2015
42Plan	CVE-2015-1754No exploit	Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craftmicrosoft · internet explorer · CWE-399 pre-auth RCE	Critical9.3	—	15.5%	Jun 9, 2015
43Plan	CVE-2015-1755No exploit	Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) viamicrosoft · internet explorer · CWE-399 pre-auth RCE	Critical9.3	—	19.5%	Jun 9, 2015
42Plan	CVE-2015-1756No exploit	Use-after-free vulnerability in Microsoft Common Controls in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1,microsoft · windows 7 · CWE-416 pre-auth RCE Memory safety	Critical9.3	—	17.4%	Jun 9, 2015
20Monitor	CVE-2015-1757No exploit	Cross-site scripting (XSS) vulnerability in adfs/ls in Active Directory Federation Services (AD FS) in Microsoft Windows Server 2008 SP2 andmicrosoft · active directory federation services · CWE-79 Pre-auth XSS	Medium4.3	—	10.9%	Jun 9, 2015
42Plan	CVE-2015-1759No exploit	Microsoft Office Compatibility Pack SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Offimicrosoft · office compatibility pack · CWE-19 pre-auth RCE	Critical9.3	—	16.2%	Jun 9, 2015
42Plan	CVE-2015-1760No exploit	Microsoft Office Compatibility Pack SP3, Office 2010 SP2, Office 2013 SP1, and Office 2013 RT SP1 allow remote attackers to execute arbitrarmicrosoft · office · CWE-19 pre-auth RCE	Critical9.3	—	16.2%	Jun 9, 2015
21Monitor	CVE-2015-1764No exploit	The web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allow remote attackers to bypass the Same Origin Policy amicrosoft · exchange server Pre-auth SSRF	Medium4.3	—	13.4%	Jun 9, 2015
21Monitor	CVE-2015-1765No exploit	Microsoft Internet Explorer 9 through 11 allows remote attackers to read the browser history via a crafted web site.microsoft · internet explorer · CWE-200 Pre-auth Info leak	Medium4.3	—	14.1%	Jun 9, 2015
42Plan	CVE-2015-1766No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-399 pre-auth RCE	Critical9.3	—	15.5%	Jun 9, 2015
75This week	CVE-2015-1770Weaponized	Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Ofmicrosoft · office · CWE-824 pre-auth RCE Memory safety	High8.8	KEV	34.9%	Jun 9, 2015
20Monitor	CVE-2015-2359No exploit	Cross-site scripting (XSS) vulnerability in the web applications in Microsoft Exchange Server 2013 Cumulative Update 8 allows remote attackemicrosoft · exchange server · CWE-79 Pre-auth XSS	Medium4.3	—	11.0%	Jun 9, 2015
69This week	CVE-2015-2360Weaponized	win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1microsoft · windows 7 · CWE-119 Memory safety	High8.8	KEV	14.8%	Jun 9, 2015
24Monitor	CVE-2015-3097No exploit	Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160, Adobe AIR before 18.0.0.144, Adobe AIR SDK before 18.0.0.144, adobe · air · CWE-200 Pre-auth Info leak	Medium5.0	—	11.9%	Jun 9, 2015
67This week	CVE-2015-3105Weaponized	Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIRadobe · flash player · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	90.1%	Jun 9, 2015
53Plan	CVE-2015-3106Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before adobe · air pre-auth RCE	Critical10.0	—	43.4%	Jun 9, 2015
50Plan	CVE-2015-3107Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before adobe · air · CWE-416 pre-auth RCE Memory safety	Critical10.0	—	32.4%	Jun 9, 2015
24Monitor	CVE-2015-4153Proof of concept	Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and ezanematthew · zm ajax login \& register · CWE-22 pre-auth RCE Path traversal	Medium5.0	—	13.3%	Jun 10, 2015
35Monitor	CVE-2014-8176No exploit	The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structureopenssl · openssl · CWE-119 Pre-auth Memory safety	High7.5	—	16.5%	Jun 12, 2015
24Monitor	CVE-2015-1788Proof of concept	The BN_GF2m_mod_inv function in crypto/bn/bn_gf2m.c in OpenSSL before 0.9.8s, 1.0.0 before 1.0.0e, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0openssl · openssl · CWE-399 Pre-auth Denial of service	Medium4.3	—	24.2%	Jun 12, 2015
53Plan	CVE-2015-1789No exploit	The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1openssl · openssl · CWE-119 Pre-auth Memory safety Denial of service	High7.5	—	75.6%	Jun 12, 2015
27Monitor	CVE-2015-1790Proof of concept	The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 beforopenssl · openssl Pre-auth Denial of service	Medium5.0	—	22.7%	Jun 12, 2015
32Monitor	CVE-2015-1791Proof of concept	Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0openssl · openssl · CWE-362 Pre-auth Race condition	Medium6.8	—	16.7%	Jun 12, 2015
27Monitor	CVE-2015-1792Proof of concept	The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.openssl · openssl · CWE-399 Pre-auth Denial of service	Medium5.0	—	22.3%	Jun 12, 2015
33Monitor	CVE-2015-3205Proof of concept	libmimedir allows remote attackers to execute arbitrary code via a VCF file with two NULL bytes at the end of the file, related to "free" fulibmimedir project · libmimedir · CWE-74 pre-auth RCE	High7.5	—	10.5%	Jun 16, 2015
26Monitor	CVE-2015-4414Proof of concept	Directory traversal vulnerability in download_audio.php in the SE HTML5 Album Audio Player (se-html5-album-audio-player) plugin 1.1.0 and ease html5 album audio player project · se html5 album audio player · CWE-22 Pre-auth Path traversal	Medium5.0	—	18.8%	Jun 17, 2015
25Monitor	CVE-2015-3897Proof of concept	Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a ..bonitasoft · bonita bpm portal · CWE-22 Pre-auth Path traversal	Medium5.0	—	17.5%	Jun 18, 2015
63This week	CVE-2015-2797Weaponized	Stack-based buffer overflow in AirTies Air 6372, 5760, 5750, 5650TT, 5453, 5444TT, 5443, 5442, 5343, 5342, 5341, and 5021 DSL modems with fiairties · air firmware · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	77.7%	Jun 19, 2015
99Now	CVE-2015-3113Weaponized	Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11adobe · flash player · CWE-787 pre-auth RCE Memory safety	Critical9.8	KEV	99.8%	Jun 23, 2015
45Plan	CVE-2015-3110Proof of concept	Integer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attackers to execute arbitrary codeadobe · photoshop cc · CWE-189 pre-auth RCE	Critical10.0	—	16.5%	Jun 24, 2015
46Plan	CVE-2015-3111Proof of concept	Heap-based buffer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attackers to execute arbiadobe · bridge · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	19.4%	Jun 24, 2015
44Plan	CVE-2015-3112Proof of concept	Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allow attackers to execute arbitrary code or cause a denial ofadobe · bridge · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	14.2%	Jun 24, 2015
25Monitor	CVE-2015-5065Proof of concept	Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugintelligent-it · paypal currency converter basic for woocommerce · CWE-22 Pre-auth Path traversal	Medium5.0	—	16.2%	Jun 24, 2015
49Plan	CVE-2015-1158Proof of concept	The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-cups · cups · CWE-254 pre-auth RCE	Critical10.0	—	29.7%	Jun 26, 2015
26Monitor	CVE-2014-9734Proof of concept	Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress allows remote attackers to read arbitthemepunch · slider revolution · CWE-22 Pre-auth Path traversal	Medium5.0	—	20.4%	Jun 30, 2015
53Plan	CVE-2014-9735Weaponized	The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does themepunch · showbiz pro · CWE-264 pre-auth RCE	High7.5	—	75.5%	Jun 30, 2015
25Monitor	CVE-2015-5149Proof of concept	Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to write to arbitrary fileszohocorp · manageengine supportcenter plus · CWE-22 Path traversal	Medium5.5	—	10.3%	Jun 30, 2015
37Monitor	CVE-2015-1923No exploit	Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service ibm · tivoli storage manager fastback · CWE-119 Pre-auth Memory safety Denial of service	High7.8	—	19.0%	Jun 30, 2015
40Plan	CVE-2015-1930Weaponized	Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denialibm · tivoli storage manager fastback · CWE-119 Pre-auth Memory safety Denial of service	High7.8	—	9.9%	Jun 30, 2015

CVE-2010-5323
44Plan
Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management (ZCM) 10 b
CriticalCVSS 10.0Proof of conceptEPSS 14%
- pre-auth RCE
- Path traversal
novell · zenworks configuration managementJun 7, 2015
CVE-2010-5324
62This week
Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management (ZCM) 10 b
CriticalCVSS 10.0WeaponizedEPSS 71%
- pre-auth RCE
- Path traversal
novell · zenworks configuration managementJun 7, 2015
CVE-2015-0779
62This week
Directory traversal vulnerability in UploadServlet in Novell ZENworks Configuration Management (ZCM) 10 and 11 before 11.3.2 allows remote a
CriticalCVSS 10.0WeaponizedEPSS 74%
- pre-auth RCE
- Path traversal
novell · zenworks configuration managementJun 7, 2015
CVE-2014-0230
37Monitor
Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before
HighCVSS 7.8No exploitEPSS 20%
- Pre-auth
- Denial of service
apache · tomcatJun 7, 2015
CVE-2014-7810
24Monitor
The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly c
MediumCVSS 5.0No exploitEPSS 13%
- Pre-auth
- Broken access control (IDOR)
apache · tomcatJun 7, 2015
CVE-2015-2993
47Plan
SysAid Help Desk before 15.2 does not properly restrict access to certain functionality, which allows remote attackers to (1) create adminis
HighCVSS 7.5WeaponizedEPSS 55%
- Pre-auth
sysaid · sysaidJun 8, 2015
CVE-2015-2994
41Plan
Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute arbitrary
MediumCVSS 6.5WeaponizedEPSS 49%
- RCE
- File upload
sysaid · sysaidJun 8, 2015
CVE-2015-2995
40Plan
The RdsLogsEntry servlet in SysAid Help Desk before 15.2 does not properly check file extensions, which allows remote attackers to upload an
MediumCVSS 6.8WeaponizedEPSS 33%
- pre-auth RCE
- Path traversal
sysaid · sysaidJun 8, 2015
CVE-2015-2996
60This week
Multiple directory traversal vulnerabilities in SysAid Help Desk before 15.2 allow remote attackers to (1) read arbitrary files via a ..
HighCVSS 8.5WeaponizedEPSS 86%
- Pre-auth
- Path traversal
sysaid · sysaidJun 8, 2015
CVE-2015-2997
40Plan
SysAid Help Desk before 15.2 allows remote attackers to obtain sensitive information via an invalid value in the accountid parameter to getA
MediumCVSS 5.0WeaponizedEPSS 56%
- Pre-auth
- Path traversal
- Info leak
sysaid · sysaidJun 8, 2015
CVE-2015-2998
40Plan
SysAid Help Desk before 15.2 uses a hardcoded encryption key, which makes it easier for remote attackers to obtain sensitive information, as
MediumCVSS 5.0WeaponizedEPSS 26%
- Pre-auth
- Info leak
sysaid · sysaidJun 8, 2015
CVE-2015-2783
26Monitor
ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information fr
MediumCVSS 5.8No exploitEPSS 10%
- Pre-auth
- Memory safety
php · phpJun 9, 2015
CVE-2015-3329
41Plan
Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x
HighCVSS 7.5No exploitEPSS 38%
- pre-auth RCE
- Memory safety
php · phpJun 9, 2015
CVE-2015-3330
31Monitor
The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the A
MediumCVSS 6.8No exploitEPSS 13%
- pre-auth RCE
php · phpJun 9, 2015
CVE-2015-4021
26Monitor
The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the
MediumCVSS 5.0No exploitEPSS 21%
- Pre-auth
- Denial of service
php · phpJun 9, 2015
CVE-2015-4022
36Monitor
Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remot
HighCVSS 7.5No exploitEPSS 20%
- pre-auth RCE
php · phpJun 9, 2015
CVE-2015-4024
35Monitor
Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, a
MediumCVSS 5.0No exploitEPSS 49%
- Pre-auth
- Denial of service
php · phpJun 9, 2015
CVE-2015-4025
36Monitor
PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character in certain situations
HighCVSS 7.5No exploitEPSS 19%
- Pre-auth
php · phpJun 9, 2015
CVE-2015-4026
36Monitor
The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x0
HighCVSS 7.5No exploitEPSS 19%
- Pre-auth
php · phpJun 9, 2015
CVE-2015-4147
34Monitor
The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __de
HighCVSS 7.5No exploitEPSS 12%
- pre-auth RCE
php · phpJun 9, 2015
CVE-2015-4148
26Monitor
The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri
MediumCVSS 5.0Proof of conceptEPSS 19%
- Pre-auth
php · phpJun 9, 2015
CVE-2015-1687
41Plan
Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v
CriticalCVSS 9.3No exploitEPSS 12%
- pre-auth RCE
microsoft · internet explorerJun 9, 2015
CVE-2015-1728
42Plan
Microsoft Windows Media Player 10 through 12 allows remote attackers to execute arbitrary code via a crafted DataObject on a web site, aka "
CriticalCVSS 9.3No exploitEPSS 17%
- pre-auth RCE
microsoft · windows media playerJun 9, 2015
CVE-2015-1730
46Plan
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft
CriticalCVSS 9.3Proof of conceptEPSS 29%
- pre-auth RCE
microsoft · internet explorerJun 9, 2015
CVE-2015-1731
43Plan
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3No exploitEPSS 21%
- pre-auth RCE
microsoft · internet explorerJun 9, 2015
CVE-2015-1732
41Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 12%
- pre-auth RCE
microsoft · internet explorerJun 9, 2015
CVE-2015-1735
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
microsoft · internet explorerJun 9, 2015
CVE-2015-1736
43Plan
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3No exploitEPSS 19%
- pre-auth RCE
microsoft · internet explorerJun 9, 2015
CVE-2015-1737
42Plan
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
microsoft · internet explorerJun 9, 2015
CVE-2015-1739
32Monitor
Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of
MediumCVSS 6.8No exploitEPSS 15%
- Pre-auth
microsoft · internet explorerJun 9, 2015
CVE-2015-1740
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
microsoft · internet explorerJun 9, 2015
CVE-2015-1741
42Plan
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
microsoft · internet explorerJun 9, 2015
CVE-2015-1742
42Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
microsoft · internet explorerJun 9, 2015
CVE-2015-1743
24Monitor
Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation
MediumCVSS 5.1No exploitEPSS 13%
- Pre-auth
- Race condition
microsoft · internet explorerJun 9, 2015
CVE-2015-1744
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
microsoft · internet explorerJun 9, 2015
CVE-2015-1745
44Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 23%
- pre-auth RCE
microsoft · internet explorerJun 9, 2015
CVE-2015-1747
44Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 23%
- pre-auth RCE
microsoft · internet explorerJun 9, 2015
CVE-2015-1748
32Monitor
Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation
MediumCVSS 6.8No exploitEPSS 15%
- Pre-auth
microsoft · internet explorerJun 9, 2015
CVE-2015-1750
44Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 22%
- pre-auth RCE
microsoft · internet explorerJun 9, 2015
CVE-2015-1751
42Plan
Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
microsoft · internet explorerJun 9, 2015
CVE-2015-1752
42Plan
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
microsoft · internet explorerJun 9, 2015
CVE-2015-1753
42Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
microsoft · internet explorerJun 9, 2015
CVE-2015-1754
42Plan
Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
microsoft · internet explorerJun 9, 2015
CVE-2015-1755
43Plan
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3No exploitEPSS 19%
- pre-auth RCE
microsoft · internet explorerJun 9, 2015
CVE-2015-1756
42Plan
Use-after-free vulnerability in Microsoft Common Controls in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1,
CriticalCVSS 9.3No exploitEPSS 17%
- pre-auth RCE
- Memory safety
microsoft · windows 7Jun 9, 2015
CVE-2015-1757
20Monitor
Cross-site scripting (XSS) vulnerability in adfs/ls in Active Directory Federation Services (AD FS) in Microsoft Windows Server 2008 SP2 and
MediumCVSS 4.3No exploitEPSS 10%
- Pre-auth
- XSS
microsoft · active directory federation servicesJun 9, 2015
CVE-2015-1759
42Plan
Microsoft Office Compatibility Pack SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Offi
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
microsoft · office compatibility packJun 9, 2015
CVE-2015-1760
42Plan
Microsoft Office Compatibility Pack SP3, Office 2010 SP2, Office 2013 SP1, and Office 2013 RT SP1 allow remote attackers to execute arbitrar
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
microsoft · officeJun 9, 2015
CVE-2015-1764
21Monitor
The web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allow remote attackers to bypass the Same Origin Policy a
MediumCVSS 4.3No exploitEPSS 13%
- Pre-auth
- SSRF
microsoft · exchange serverJun 9, 2015
CVE-2015-1765
21Monitor
Microsoft Internet Explorer 9 through 11 allows remote attackers to read the browser history via a crafted web site.
MediumCVSS 4.3No exploitEPSS 14%
- Pre-auth
- Info leak
microsoft · internet explorerJun 9, 2015
CVE-2015-1766
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
microsoft · internet explorerJun 9, 2015
CVE-2015-1770
75This week
Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Of
HighCVSS 8.8KEVWeaponizedEPSS 34%
- pre-auth RCE
- Memory safety
microsoft · officeJun 9, 2015
CVE-2015-2359
20Monitor
Cross-site scripting (XSS) vulnerability in the web applications in Microsoft Exchange Server 2013 Cumulative Update 8 allows remote attacke
MediumCVSS 4.3No exploitEPSS 11%
- Pre-auth
- XSS
microsoft · exchange serverJun 9, 2015
CVE-2015-2360
69This week
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1
HighCVSS 8.8KEVWeaponizedEPSS 14%
- Memory safety
microsoft · windows 7Jun 9, 2015
CVE-2015-3097
24Monitor
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160, Adobe AIR before 18.0.0.144, Adobe AIR SDK before 18.0.0.144,
MediumCVSS 5.0No exploitEPSS 11%
- Pre-auth
- Info leak
adobe · airJun 9, 2015
CVE-2015-3105
67This week
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR
CriticalCVSS 10.0WeaponizedEPSS 90%
- pre-auth RCE
- Memory safety
adobe · flash playerJun 9, 2015
CVE-2015-3106
53Plan
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before
CriticalCVSS 10.0Proof of conceptEPSS 43%
- pre-auth RCE
adobe · airJun 9, 2015
CVE-2015-3107
50Plan
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before
CriticalCVSS 10.0Proof of conceptEPSS 32%
- pre-auth RCE
- Memory safety
adobe · airJun 9, 2015
CVE-2015-4153
24Monitor
Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and e
MediumCVSS 5.0Proof of conceptEPSS 13%
- pre-auth RCE
- Path traversal
zanematthew · zm ajax login \& registerJun 10, 2015
CVE-2014-8176
35Monitor
The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structure
HighCVSS 7.5No exploitEPSS 16%
- Pre-auth
- Memory safety
openssl · opensslJun 12, 2015
CVE-2015-1788
24Monitor
The BN_GF2m_mod_inv function in crypto/bn/bn_gf2m.c in OpenSSL before 0.9.8s, 1.0.0 before 1.0.0e, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0
MediumCVSS 4.3Proof of conceptEPSS 24%
- Pre-auth
- Denial of service
openssl · opensslJun 12, 2015
CVE-2015-1789
53Plan
The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1
HighCVSS 7.5No exploitEPSS 75%
- Pre-auth
- Memory safety
- Denial of service
openssl · opensslJun 12, 2015
CVE-2015-1790
27Monitor
The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 befor
MediumCVSS 5.0Proof of conceptEPSS 22%
- Pre-auth
- Denial of service
openssl · opensslJun 12, 2015
CVE-2015-1791
32Monitor
Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0
MediumCVSS 6.8Proof of conceptEPSS 16%
- Pre-auth
- Race condition
openssl · opensslJun 12, 2015
CVE-2015-1792
27Monitor
The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.
MediumCVSS 5.0Proof of conceptEPSS 22%
- Pre-auth
- Denial of service
openssl · opensslJun 12, 2015
CVE-2015-3205
33Monitor
libmimedir allows remote attackers to execute arbitrary code via a VCF file with two NULL bytes at the end of the file, related to "free" fu
HighCVSS 7.5Proof of conceptEPSS 10%
- pre-auth RCE
libmimedir project · libmimedirJun 16, 2015
CVE-2015-4414
26Monitor
Directory traversal vulnerability in download_audio.php in the SE HTML5 Album Audio Player (se-html5-album-audio-player) plugin 1.1.0 and ea
MediumCVSS 5.0Proof of conceptEPSS 18%
- Pre-auth
- Path traversal
se html5 album audio player project · se html5 album audio playerJun 17, 2015
CVE-2015-3897
25Monitor
Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a ..
MediumCVSS 5.0Proof of conceptEPSS 17%
- Pre-auth
- Path traversal
bonitasoft · bonita bpm portalJun 18, 2015
CVE-2015-2797
63This week
Stack-based buffer overflow in AirTies Air 6372, 5760, 5750, 5650TT, 5453, 5444TT, 5443, 5442, 5343, 5342, 5341, and 5021 DSL modems with fi
CriticalCVSS 10.0WeaponizedEPSS 77%
- pre-auth RCE
- Memory safety
airties · air firmwareJun 19, 2015
CVE-2015-3113
99Now
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11
CriticalCVSS 9.8KEVWeaponizedEPSS 99%
- pre-auth RCE
- Memory safety
adobe · flash playerJun 23, 2015
CVE-2015-3110
45Plan
Integer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attackers to execute arbitrary code
CriticalCVSS 10.0Proof of conceptEPSS 16%
- pre-auth RCE
adobe · photoshop ccJun 24, 2015
CVE-2015-3111
46Plan
Heap-based buffer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attackers to execute arbi
CriticalCVSS 10.0Proof of conceptEPSS 19%
- pre-auth RCE
- Memory safety
adobe · bridgeJun 24, 2015
CVE-2015-3112
44Plan
Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allow attackers to execute arbitrary code or cause a denial of
CriticalCVSS 10.0Proof of conceptEPSS 14%
- pre-auth RCE
- Memory safety
adobe · bridgeJun 24, 2015
CVE-2015-5065
25Monitor
Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plug
MediumCVSS 5.0Proof of conceptEPSS 16%
- Pre-auth
- Path traversal
intelligent-it · paypal currency converter basic for woocommerceJun 24, 2015
CVE-2015-1158
49Plan
The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-
CriticalCVSS 10.0Proof of conceptEPSS 29%
- pre-auth RCE
cups · cupsJun 26, 2015
CVE-2014-9734
26Monitor
Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress allows remote attackers to read arbit
MediumCVSS 5.0Proof of conceptEPSS 20%
- Pre-auth
- Path traversal
themepunch · slider revolutionJun 30, 2015
CVE-2014-9735
53Plan
The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does
HighCVSS 7.5WeaponizedEPSS 75%
- pre-auth RCE
themepunch · showbiz proJun 30, 2015
CVE-2015-5149
25Monitor
Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to write to arbitrary files
MediumCVSS 5.5Proof of conceptEPSS 10%
- Path traversal
zohocorp · manageengine supportcenter plusJun 30, 2015
CVE-2015-1923
37Monitor
Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service
HighCVSS 7.8No exploitEPSS 19%
- Pre-auth
- Memory safety
- Denial of service
ibm · tivoli storage manager fastbackJun 30, 2015
CVE-2015-1930
40Plan
Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial
HighCVSS 7.8WeaponizedEPSS 9%
- Pre-auth
- Memory safety
- Denial of service
ibm · tivoli storage manager fastbackJun 30, 2015