# CVEs published 2015-01-09 29 CVEs were published on January 9, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2014-9529](https://cve.now/CVE-2014-9529.md): Race condition in the key\_gc\_unused\_keys function in security/keys/gc.c in the Linux kernel through 3.18.2 allows local users to cause a… (no CVSS) - [CVE-2014-9584](https://cve.now/CVE-2014-9584.md): The parse\_rock\_ridge\_inode\_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 does not validate a length value in the… (no CVSS) - [CVE-2014-9585](https://cve.now/CVE-2014-9585.md): The vdso\_addr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO… (no CVSS) - [CVE-2013-7419](https://cve.now/CVE-2013-7419.md): Cross-site scripting (XSS) vulnerability in includes/refreshDate.php in the Joomlaskin JS Multi Hotel (aka JS MultiHotel and… (no CVSS) - [CVE-2014-9269](https://cve.now/CVE-2014-9269.md): Cross-site scripting (XSS) vulnerability in helper\_api.php in MantisBT 1.1.0a1 through 1.2.x before 1.2.18, when Extended project browser… (no CVSS) - [CVE-2014-9271](https://cve.now/CVE-2014-9271.md): Cross-site scripting (XSS) vulnerability in file\_download.php in MantisBT before 1.2.18 allows remote authenticated users to inject… (no CVSS) - [CVE-2014-9272](https://cve.now/CVE-2014-9272.md): The string\_insert\_href function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows… (no CVSS) - [CVE-2014-9498](https://cve.now/CVE-2014-9498.md): Cross-site scripting (XSS) vulnerability in the Webform Invitation module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.4 for Drupal… (no CVSS) - [CVE-2014-9499](https://cve.now/CVE-2014-9499.md): Cross-site scripting (XSS) vulnerability in the Godwin's Law module before 7.x-1.1 for Drupal, when using the dblog module, allows remote… (no CVSS) - [CVE-2014-9500](https://cve.now/CVE-2014-9500.md): Cross-site scripting (XSS) vulnerability in the Moip module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to inject arbitrary… (no CVSS) - [CVE-2014-9501](https://cve.now/CVE-2014-9501.md): Cross-site scripting (XSS) vulnerability in the Poll Chart Block module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated… (no CVSS) - [CVE-2014-9505](https://cve.now/CVE-2014-9505.md): Cross-site scripting (XSS) vulnerability in the School Administration module 7.x-1.x before 7.x-1.8 for Drupal allows remote authenticated… (no CVSS) - [CVE-2014-9510](https://cve.now/CVE-2014-9510.md): Cross-site request forgery (CSRF) vulnerability in the administration console in TP-Link TL-WR840N (V1) router with firmware before… (no CVSS) - [CVE-2015-0921](https://cve.now/CVE-2015-0921.md): XML external entity (XXE) vulnerability in the Server Task Log in McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2… (no CVSS) - [CVE-2015-0922](https://cve.now/CVE-2015-0922.md): McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations… (no CVSS) - [CVE-2014-3570](https://cve.now/CVE-2014-3570.md): The BN\_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square… (no CVSS) - [CVE-2014-3571](https://cve.now/CVE-2014-3571.md): OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (NULL pointer… (no CVSS) - [CVE-2014-3572](https://cve.now/CVE-2014-3572.md): The ssl3\_get\_key\_exchange function in s3\_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL… (no CVSS) - [CVE-2014-8027](https://cve.now/CVE-2014-8027.md): The RBAC component in Cisco Secure Access Control System (ACS) allows remote authenticated users to obtain Network Device Administrator… (no CVSS) - [CVE-2014-8028](https://cve.now/CVE-2014-8028.md): Multiple cross-site scripting (XSS) vulnerabilities in the web framework in Cisco Secure Access Control System (ACS) allow remote… (no CVSS) - [CVE-2014-8029](https://cve.now/CVE-2014-8029.md): Open redirect vulnerability in the web interface in Cisco Secure Access Control System (ACS) allows remote attackers to redirect users to… (no CVSS) - [CVE-2014-8030](https://cve.now/CVE-2014-8030.md): Cross-site scripting (XSS) vulnerability in sendPwMail.do in Cisco WebEx Meetings Server allows remote attackers to inject arbitrary web… (no CVSS) - [CVE-2014-8031](https://cve.now/CVE-2014-8031.md): Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server allows remote attackers to hijack the authentication of… (no CVSS) - [CVE-2014-8032](https://cve.now/CVE-2014-8032.md): The OutlookAction LI in Cisco WebEx Meetings Server allows remote authenticated users to obtain sensitive encrypted-password information… (no CVSS) - [CVE-2014-8033](https://cve.now/CVE-2014-8033.md): The play/modules component in Cisco WebEx Meetings Server allows remote attackers to obtain administrator access via crafted API requests… (no CVSS) - [CVE-2014-8275](https://cve.now/CVE-2014-8275.md): OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which… (no CVSS) - [CVE-2015-0204](https://cve.now/CVE-2015-0204.md): The ssl3\_get\_key\_exchange function in s3\_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL se (no CVSS) - [CVE-2015-0205](https://cve.now/CVE-2015-0205.md): The ssl3\_get\_cert\_verify function in s3\_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a… (no CVSS) - [CVE-2015-0206](https://cve.now/CVE-2015-0206.md): Memory leak in the dtls1\_buffer\_record function in d1\_pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allows remote attackers… (no CVSS) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/archive/2015-01-09 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.