Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: September 2015

68 records · 2 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2015-5722
    41Plan

    buffer.c in named in ISC BIND 9.x before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (assertio

    HighCVSS 7.8No exploitEPSS 33%

    isc · bindSep 4, 2015

  • CVE-2015-5986
    36Monitor

    openpgpkey_61.c in named in ISC BIND 9.9.7 before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service

    HighCVSS 7.1No exploitEPSS 26%

    isc · bindSep 4, 2015

  • CVE-2015-5625
    24Monitor

    Cross-site scripting (XSS) vulnerability in OpenDocMan before 1.3.4 allows remote attackers to inject arbitrary web script or HTML via the r

    MediumCVSS 4.3No exploitEPSS 22%

    opendocman · opendocmanSep 7, 2015

  • CVE-2015-2483
    26Monitor

    Microsoft Internet Explorer 10 and 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, ak

    MediumCVSS 5.0No exploitEPSS 19%

    microsoft · internet explorerSep 8, 2015

  • CVE-2015-2484
    29Monitor

    Microsoft Internet Explorer 10 and 11 uses an incorrect flag during certain filesystem accesses, which allows remote attackers to delete arb

    MediumCVSS 6.4No exploitEPSS 13%

    microsoft · internet explorerSep 8, 2015

  • CVE-2015-2485
    42Plan

    Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · edgeSep 8, 2015

  • CVE-2015-2486
    43Plan

    Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · edgeSep 8, 2015

  • CVE-2015-2487
    42Plan

    Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 18%

    microsoft · internet explorerSep 8, 2015

  • CVE-2015-2489
    20Monitor

    Microsoft Internet Explorer 11 allows remote attackers to gain privileges via a crafted web site, as demonstrated by a transition from Low I

    MediumCVSS 4.3No exploitEPSS 10%

    microsoft · internet explorerSep 8, 2015

  • CVE-2015-2490
    42Plan

    Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerSep 8, 2015

  • CVE-2015-2491
    42Plan

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerSep 8, 2015

  • CVE-2015-2492
    42Plan

    Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 18%

    microsoft · internet explorerSep 8, 2015

  • CVE-2015-2493
    42Plan

    The (1) VBScript and (2) JScript engines in Microsoft Internet Explorer 8 allow remote attackers to execute arbitrary code or cause a denial

    CriticalCVSS 9.3No exploitEPSS 18%

    microsoft · internet explorerSep 8, 2015

  • CVE-2015-2494
    43Plan

    Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · edgeSep 8, 2015

  • CVE-2015-2498
    44Plan

    Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 23%

    microsoft · internet explorerSep 8, 2015

  • CVE-2015-2499
    44Plan

    Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 23%

    microsoft · internet explorerSep 8, 2015

  • CVE-2015-2500
    44Plan

    Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a

    CriticalCVSS 9.3No exploitEPSS 23%

    microsoft · internet explorerSep 8, 2015

  • CVE-2015-2501
    44Plan

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    CriticalCVSS 9.3No exploitEPSS 23%

    microsoft · internet explorerSep 8, 2015

  • CVE-2015-2504
    43Plan

    Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 improperly counts objects before performing an array copy, which

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · .net frameworkSep 8, 2015

  • CVE-2015-2505
    25Monitor

    Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to obtain sensitive sta

    MediumCVSS 5.0No exploitEPSS 18%

    microsoft · exchange serverSep 8, 2015

  • CVE-2015-2506
    42Plan

    atmfd.dll in the Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Wi

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · windows 10Sep 8, 2015

  • CVE-2015-2509
    58Plan

    Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows user-assisted remote attackers to exec

    CriticalCVSS 9.3WeaponizedEPSS 71%

    microsoft · windows 7Sep 8, 2015

  • CVE-2015-2510
    48Plan

    Buffer overflow in the Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 SP3, Office 2010 SP2,

    CriticalCVSS 9.3Proof of conceptEPSS 35%

    microsoft · live meeting consoleSep 8, 2015

  • CVE-2015-2513
    43Plan

    Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 20

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · windows 10Sep 8, 2015

  • CVE-2015-2514
    42Plan

    Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 20

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · windows 10Sep 8, 2015

  • CVE-2015-2516
    21Monitor

    Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 20

    MediumCVSS 4.3No exploitEPSS 11%

    microsoft · windows 10Sep 8, 2015

  • CVE-2015-2519
    41Plan

    Integer overflow in Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.

    CriticalCVSS 9.3No exploitEPSS 14%

    microsoft · windows 10Sep 8, 2015

  • CVE-2015-2520
    45Plan

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and Excel Viewer allow remote attacker

    CriticalCVSS 9.3Proof of conceptEPSS 27%

    microsoft · excelSep 8, 2015

  • CVE-2015-2521
    45Plan

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code v

    CriticalCVSS 9.3Proof of conceptEPSS 27%

    microsoft · excelSep 8, 2015

  • CVE-2015-2522
    17Monitor

    Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2013 SP1 allows remote authenticated users to inject arbitrary w

    LowCVSS 3.5No exploitEPSS 10%

    microsoft · sharepoint foundationSep 8, 2015

  • CVE-2015-2523
    46Plan

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and

    CriticalCVSS 9.3Proof of conceptEPSS 30%

    microsoft · excelSep 8, 2015

  • CVE-2015-2525
    37Monitor

    Task Scheduler in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 201

    HighCVSS 7.2Proof of conceptEPSS 31%

    microsoft · windows 10Sep 8, 2015

  • CVE-2015-2526
    27Monitor

    Microsoft .NET Framework 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to cause a denial of service to an ASP.NET web site via crafted

    MediumCVSS 5.0No exploitEPSS 23%

    microsoft · .net frameworkSep 8, 2015

  • CVE-2015-2530
    42Plan

    Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 20

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · windows 10Sep 8, 2015

  • CVE-2015-2531
    20Monitor

    Cross-site scripting (XSS) vulnerability in the jQuery engine in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote

    MediumCVSS 4.3No exploitEPSS 10%

    microsoft · lync serverSep 8, 2015

  • CVE-2015-2532
    20Monitor

    Cross-site scripting (XSS) vulnerability in Microsoft Lync Server 2013 allows remote attackers to inject arbitrary web script or HTML via a

    MediumCVSS 4.3No exploitEPSS 10%

    microsoft · lync serverSep 8, 2015

  • CVE-2015-2535
    19Monitor

    Active Directory in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allows remote authenticated users to cause a de

    MediumCVSS 4.0No exploitEPSS 11%

    microsoft · windows server 2008Sep 8, 2015

  • CVE-2015-2541
    43Plan

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · internet explorerSep 8, 2015

  • CVE-2015-2542
    43Plan

    Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memo

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · edgeSep 8, 2015

  • CVE-2015-2545
    87Now

    Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted EPS image, ak

    HighCVSS 7.8KEVWeaponizedEPSS 85%

    microsoft · officeSep 8, 2015

  • CVE-2015-2546
    65This week

    The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Se

    HighCVSS 8.2KEVWeaponizedEPSS 10%

    microsoft · windows 10 1507Sep 8, 2015

  • CVE-2015-6908
    26Monitor

    The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (rea

    MediumCVSS 5.0Proof of conceptEPSS 19%

    openldap · openldapSep 11, 2015

  • CVE-2015-6912
    44Plan

    Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharacters in the subtitle_

    CriticalCVSS 10.0Proof of conceptEPSS 11%

    synology · video stationSep 11, 2015

  • CVE-2015-6830
    23Monitor

    libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers

    MediumCVSS 5.0Proof of conceptEPSS 10%

    phpmyadmin · phpmyadminSep 13, 2015

  • CVE-2015-6946
    43Plan

    Multiple stack-based buffer overflows in the Reprise License Manager service in Borland AccuRev allow remote attackers to execute arbitrary

    CriticalCVSS 9.3No exploitEPSS 21%

    microfocus · accurevSep 15, 2015

  • CVE-2015-6967
    41Plan

    Unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators to execute arbitrary c

    MediumCVSS 6.5WeaponizedEPSS 49%

    nibbleblog · nibbleblogSep 16, 2015

  • CVE-2015-3623
    30Monitor

    XML external entity (XXE) vulnerability in QlikTech Qlikview before 11.20 SR12 allows remote attackers to conduct server-side request forger

    MediumCVSS 6.4Proof of conceptEPSS 15%

    qlik · qlikviewSep 16, 2015

  • CVE-2015-6973
    46Plan

    Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentic

    MediumCVSS 6.8Proof of conceptEPSS 64%

    igniterealtime · openfireSep 16, 2015

  • CVE-2015-7243
    47Plan

    Buffer overflow in Boxoft WAV to MP3 Converter allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary c

    HighCVSS 7.5WeaponizedEPSS 58%

    boxoft · boxoft wav to mp3 converterSep 18, 2015

  • CVE-2015-5603
    44Plan

    The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java code via unspecifie

    MediumCVSS 6.5WeaponizedEPSS 59%

    atlassian · hipchatSep 21, 2015

  • CVE-2015-7303
    51Plan

    Use-after-free vulnerability in the Update Manager service in Avira Management Console allows remote attackers to execute arbitrary code via

    CriticalCVSS 10.0No exploitEPSS 35%

    avira · management consoleSep 21, 2015

  • CVE-2015-5568
    46Plan

    Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.

    CriticalCVSS 10.0Proof of conceptEPSS 19%

    adobe · flash playerSep 22, 2015

  • CVE-2015-5574
    54Plan

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521

    CriticalCVSS 10.0Proof of conceptEPSS 45%

    adobe · flash playerSep 22, 2015

  • CVE-2015-7309
    40Plan

    The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to exec

    MediumCVSS 6.5WeaponizedEPSS 38%

    boltcms · boltSep 22, 2015

  • CVE-2015-5082
    61This week

    Endian Firewall before 3.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) NEW_PASSWORD_1 or (2) N

    CriticalCVSS 10.0WeaponizedEPSS 69%

    endian firewall · endian firewallSep 28, 2015

  • CVE-2015-7387
    54Plan

    ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitra

    HighCVSS 7.5WeaponizedEPSS 80%

    zohocorp · manageengine eventlog analyzerSep 28, 2015

  • CVE-2015-5400
    33Monitor

    Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cache_peer, which allows remote attackers to

    MediumCVSS 6.8No exploitEPSS 20%

    fedoraproject · fedoraSep 28, 2015

  • CVE-2015-7601
    49Plan

    Directory traversal vulnerability in PCMan's FTP Server 2.0.7 allows remote attackers to read arbitrary files via a ..// (dot dot double sla

    HighCVSS 7.8WeaponizedEPSS 58%

    pcman · ftp serverSep 29, 2015

  • CVE-2015-7602
    49Plan

    Directory traversal vulnerability in BisonWare BisonFTP 3.5 allows remote attackers to read arbitrary files via a ../ (dot dot slash) in a R

    HighCVSS 7.8WeaponizedEPSS 61%

    bisonware · bisonftpSep 29, 2015

  • CVE-2015-7603
    49Plan

    Directory traversal vulnerability in Konica Minolta FTP Utility 1.0 allows remote attackers to read arbitrary files via a ..\ (dot dot backs

    HighCVSS 7.8WeaponizedEPSS 60%

    konicaminolta · ftp utilitySep 29, 2015

  • CVE-2015-1538
    70This week

    Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I all

    CriticalCVSS 10.0Proof of conceptEPSS 99%

    google · androidSep 30, 2015

  • CVE-2015-1539
    66This week

    Multiple integer underflows in the ESDS::parseESDescriptor function in ESDS.cpp in libstagefright in Android before 5.1.1 LMY48I allow remot

    CriticalCVSS 10.0No exploitEPSS 85%

    google · androidSep 30, 2015

  • CVE-2015-3824
    67This week

    The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly restrict si

    CriticalCVSS 10.0No exploitEPSS 90%

    google · androidSep 30, 2015

  • CVE-2015-3826
    42Plan

    The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a min

    MediumCVSS 5.0No exploitEPSS 73%

    google · androidSep 30, 2015

  • CVE-2015-3827
    61This week

    The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not validate the relatio

    CriticalCVSS 9.3No exploitEPSS 81%

    google · androidSep 30, 2015

  • CVE-2015-3828
    66This week

    The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a min

    CriticalCVSS 10.0No exploitEPSS 85%

    google · androidSep 30, 2015

  • CVE-2015-3829
    67This week

    Off-by-one error in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I allows re

    CriticalCVSS 10.0No exploitEPSS 89%

    google · androidSep 30, 2015

  • CVE-2015-3864
    66This week

    Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1

    CriticalCVSS 10.0WeaponizedEPSS 87%

    google · androidSep 30, 2015