# CVEs published 2015-02-10

12 CVEs were published on February 10, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-1042](https://cve.now/CVE-2015-1042.md): The string\_sanitize\_url function in core/string\_api.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which… (no CVSS)
- [CVE-2015-1169](https://cve.now/CVE-2015-1169.md): Apereo Central Authentication Service (CAS) Server before 3.5.3 allows remote attackers to conduct LDAP injection attacks via a crafted… (no CVSS)
- [CVE-2015-1377](https://cve.now/CVE-2015-1377.md): The Read Mail module in Webmin 1.720 allows local users to read arbitrary files via a symlink attack on an unspecified file. (no CVSS)
- [CVE-2015-1569](https://cve.now/CVE-2015-1569.md): Fortinet FortiClient 5.2.028 for iOS does not validate certificates, which makes it easier for man-in-the-middle attackers to spoof SSL… (no CVSS)
- [CVE-2015-1570](https://cve.now/CVE-2015-1570.md): The Endpoint Control protocol implementation in Fortinet FortiClient 5.2.3.091 for Android and 5.2.028 for iOS does not validate… (no CVSS)
- [CVE-2015-1571](https://cve.now/CVE-2015-1571.md): The CAPWAP DTLS protocol implementation in Fortinet FortiOS 5.0 Patch 7 build 4457 uses the same certificate and private key across… (no CVSS)
- [CVE-2014-8733](https://cve.now/CVE-2014-8733.md): Cloudera Manager 5.2.0, 5.2.1, and 5.3.0 stores the LDAP bind password in plaintext in unspecified world-readable files under /etc/hadoop… (no CVSS)
- [CVE-2015-1031](https://cve.now/CVE-2015-1031.md): Multiple use-after-free vulnerabilities in Privoxy before 3.0.22 allow remote attackers to have unspecified impact via vectors related to… (no CVSS)
- [CVE-2015-1548](https://cve.now/CVE-2015-1548.md): mini\_httpd 1.21 and earlier allows remote attackers to obtain sensitive information from process memory via an HTTP request with a long… (no CVSS)
- [CVE-2015-1431](https://cve.now/CVE-2015-1431.md): Cross-site scripting (XSS) vulnerability in includes/startup.php in phpBB before 3.0.13 allows remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2015-1432](https://cve.now/CVE-2015-1432.md): The message\_options function in includes/ucp/ucp\_pm\_options.php in phpBB before 3.0.13 does not properly validate the form key, which… (no CVSS)
- [CVE-2015-1559](https://cve.now/CVE-2015-1559.md): Multiple cross-site request forgery (CSRF) vulnerabilities in administrator.php in Epignosis eFront Open Source Edition before 3.6.15.3… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2015-02-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.