Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: October 2015

41 records · 2 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2015-7709
    64This week

    The arkeiad daemon in the Arkeia Backup Agent in Western Digital Arkeia 11.0.12 and earlier allows remote attackers to bypass authentication

    CriticalCVSS 10.0WeaponizedEPSS 78%

    arkeia · western digital arkeiaOct 5, 2015

  • CVE-2015-5889
    40Plan

    rsh in the remote_cmds component in Apple OS X before 10.11 allows local users to obtain root privileges via vectors involving environment v

    HighCVSS 7.2WeaponizedEPSS 5%

    apple · mac os xOct 9, 2015

  • CVE-2015-7765
    56Plan

    ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows

    CriticalCVSS 9.0WeaponizedEPSS 67%

    zohocorp · manageengine opmanagerOct 9, 2015

  • CVE-2015-7766
    60This week

    PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions vi

    CriticalCVSS 9.0WeaponizedEPSS 80%

    zohocorp · manageengine opmanagerOct 9, 2015

  • CVE-2015-7768
    49Plan

    Buffer overflow in Konica Minolta FTP Utility 1.0 allows remote attackers to execute arbitrary code via a long CWD command.

    HighCVSS 7.5WeaponizedEPSS 63%

    konicaminolta · ftp utilityOct 9, 2015

  • CVE-2015-2342
    67This week

    The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration

    CriticalCVSS 10.0WeaponizedEPSS 89%

    vmware · vcenter serverOct 12, 2015

  • CVE-2015-2482
    47Plan

    The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, al

    CriticalCVSS 9.3Proof of conceptEPSS 32%

    microsoft · jscriptOct 13, 2015

  • CVE-2015-2515
    46Plan

    Use-after-free vulnerability in Windows Shell in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8,

    CriticalCVSS 9.3No exploitEPSS 28%

    microsoft · windows 10Oct 13, 2015

  • CVE-2015-2548
    44Plan

    Use-after-free vulnerability in the Tablet Input Band in Windows Shell in Microsoft Windows Vista SP2 and Windows 7 SP1 allows remote attack

    CriticalCVSS 9.3No exploitEPSS 24%

    microsoft · windows 7Oct 13, 2015

  • CVE-2015-2555
    44Plan

    Use-after-free vulnerability in Microsoft Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for

    CriticalCVSS 9.3No exploitEPSS 23%

    microsoft · excelOct 13, 2015

  • CVE-2015-2556
    22Monitor

    The InfoPath Forms Services component in Microsoft SharePoint Server 2007 SP3 and 2010 SP2 misparses DTDs, which allows remote attackers to

    MediumCVSS 4.3No exploitEPSS 15%

    microsoft · sharepoint serverOct 13, 2015

  • CVE-2015-2557
    44Plan

    Buffer overflow in Microsoft Visio 2007 SP3 and 2010 SP2 allows remote attackers to execute arbitrary code via crafted UML data in an Office

    CriticalCVSS 9.3No exploitEPSS 22%

    microsoft · visioOct 13, 2015

  • CVE-2015-2558
    44Plan

    Use-after-free vulnerability in Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011,

    CriticalCVSS 9.3No exploitEPSS 23%

    microsoft · excelOct 13, 2015

  • CVE-2015-6042
    44Plan

    Use-after-free vulnerability in the CWindow object implementation in Microsoft Internet Explorer 11 allows remote attackers to execute arbit

    CriticalCVSS 9.3No exploitEPSS 22%

    microsoft · internet explorerOct 13, 2015

  • CVE-2015-6046
    21Monitor

    Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site,

    MediumCVSS 4.3No exploitEPSS 14%

    microsoft · internet explorerOct 13, 2015

  • CVE-2015-6047
    31Monitor

    The broker EditWith feature in Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the AppContainer protection mechan

    MediumCVSS 6.8No exploitEPSS 13%

    microsoft · internet explorerOct 13, 2015

  • CVE-2015-6048
    41Plan

    Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 13%

    microsoft · internet explorerOct 13, 2015

  • CVE-2015-6049
    41Plan

    Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 14%

    microsoft · internet explorerOct 13, 2015

  • CVE-2015-6050
    41Plan

    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 12%

    microsoft · internet explorerOct 13, 2015

  • CVE-2015-6051
    21Monitor

    Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, as demonstrated by a transition fro

    MediumCVSS 4.3No exploitEPSS 14%

    microsoft · internet explorerOct 13, 2015

  • CVE-2015-6052
    21Monitor

    The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, al

    MediumCVSS 4.3No exploitEPSS 14%

    microsoft · jscriptOct 13, 2015

  • CVE-2015-6053
    26Monitor

    Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information from process memory via crafted parameters in an Arra

    MediumCVSS 5.0No exploitEPSS 18%

    microsoft · internet explorerOct 13, 2015

  • CVE-2015-6055
    45Plan

    The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, al

    CriticalCVSS 9.3No exploitEPSS 25%

    microsoft · jscriptOct 13, 2015

  • CVE-2015-6056
    41Plan

    The (1) JScript and (2) VBScript engines in Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cau

    CriticalCVSS 9.3No exploitEPSS 12%

    microsoft · jscriptOct 13, 2015

  • CVE-2015-6057
    25Monitor

    Microsoft Edge allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Edge Infor

    MediumCVSS 5.0No exploitEPSS 15%

    microsoft · edgeOct 13, 2015

  • CVE-2015-6058
    38Monitor

    Microsoft Edge mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting (XSS) protection

    MediumCVSS 4.3No exploitEPSS 69%

    microsoft · edgeOct 13, 2015

  • CVE-2015-6059
    22Monitor

    The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, al

    MediumCVSS 4.3No exploitEPSS 16%

    microsoft · jscriptOct 13, 2015

  • CVE-2015-7622
    47Plan

    Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrob

    CriticalCVSS 10.0Proof of conceptEPSS 23%

    adobe · acrobatOct 14, 2015

  • CVE-2015-7645
    81Now

    Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows rem

    HighCVSS 7.8KEVWeaponizedEPSS 65%

    adobe · flash playerOct 15, 2015

  • CVE-2015-7647
    49Plan

    Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to exe

    CriticalCVSS 10.0Proof of conceptEPSS 29%

    adobe · flash playerOct 18, 2015

  • CVE-2015-7648
    49Plan

    Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to exe

    CriticalCVSS 10.0Proof of conceptEPSS 29%

    adobe · flash playerOct 18, 2015

  • CVE-2015-6477
    28Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in the Wind Farm Portal application in Nordex Control 2 (NC2) SCADA 16 and earlier allow

    MediumCVSS 6.1Proof of conceptEPSS 12%

    nordex · nordex control 2 scadaOct 18, 2015

  • CVE-2015-4716
    47Plan

    Directory traversal vulnerability in the routing component in ownCloud Server before 7.0.6 and 8.0.x before 8.0.4, when running on Windows,

    CriticalCVSS 10.0No exploitEPSS 24%

    owncloud · owncloudOct 21, 2015

  • CVE-2015-4796
    41Plan

    Unspecified vulnerability in the Java VM component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2, when running on Windows, allo

    CriticalCVSS 9.0No exploitEPSS 17%

    oracle · database serverOct 21, 2015

  • CVE-2015-4870
    25Monitor

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect ava

    MediumCVSS 4.0Proof of conceptEPSS 30%

    oracle · linuxOct 21, 2015

  • CVE-2015-4902
    60This week

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to

    MediumCVSS 5.3KEVWeaponizedEPSS 13%

    oracle · jdkOct 21, 2015

  • CVE-2015-7007
    46Plan

    Script Editor in Apple OS X before 10.11.1 allows remote attackers to bypass an intended user-confirmation requirement for AppleScript execu

    HighCVSS 7.5WeaponizedEPSS 53%

    apple · mac os xOct 23, 2015

  • CVE-2015-5262
    23Monitor

    http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration

    MediumCVSS 4.3No exploitEPSS 18%

    apache · httpclientOct 27, 2015

  • CVE-2015-7297
    60This week

    SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a

    HighCVSS 7.5WeaponizedEPSS 99%

    joomla · joomla\!Oct 29, 2015

  • CVE-2015-7857
    58Plan

    SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.php in Joomla! 3.2 be

    HighCVSS 7.5WeaponizedEPSS 94%

    joomla · joomla\!Oct 29, 2015

  • CVE-2015-7858
    56Plan

    SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a

    HighCVSS 7.5WeaponizedEPSS 85%

    joomla · joomla\!Oct 29, 2015