# CVEs published 2015-02-13 20 CVEs were published on February 13, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2013-2027](https://cve.now/CVE-2013-2027.md): Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access… (no CVSS, org.python:jython-standalone) - [CVE-2014-0151](https://cve.now/CVE-2014-0151.md): Cross-site request forgery (CSRF) vulnerability in oVirt Engine before 3.5.0 beta2 allows remote attackers to hijack the authentication of… (no CVSS) - [CVE-2014-0154](https://cve.now/CVE-2014-0154.md): oVirt Engine before 3.5.0 does not include the HTTPOnly flag in a Set-Cookie header for the session IDs, which makes it easier for remote… (no CVSS) - [CVE-2014-7827](https://cve.now/CVE-2014-7827.md): The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application… (no CVSS) - [CVE-2014-7849](https://cve.now/CVE-2014-7849.md): The Role Based Access Control (RBAC) implementation in JBoss Enterprise Application Platform (EAP) 6.2.0 through 6.3.2 does not properly… (no CVSS) - [CVE-2014-7853](https://cve.now/CVE-2014-7853.md): The JBoss Application Server (WildFly) JacORB subsystem in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 does not… (no CVSS) - [CVE-2014-8122](https://cve.now/CVE-2014-8122.md): Race condition in JBoss Weld before 2.2.8 and 3.x before 3.0.0 Alpha3 allows remote attackers to obtain information from a previous… (no CVSS, org.jboss.weld:weld-core-bom) - [CVE-2015-0245](https://cve.now/CVE-2015-0245.md): D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure… (no CVSS) - [CVE-2015-0255](https://cve.now/CVE-2015-0255.md): X.Org Server (aka xserver and xorg-server) before 1.16.3 and 1.17.x before 1.17.1 allows remote attackers to obtain sensitive information… (no CVSS) - [CVE-2014-4771](https://cve.now/CVE-2014-4771.md): IBM WebSphere MQ 7.0.1 before 7.0.1.13, 7.1 before 7.1.0.6, 7.5 before 7.5.0.5, and 8 before 8.0.0.1 allows remote authenticated users to… (no CVSS) - [CVE-2014-4781](https://cve.now/CVE-2014-4781.md): The alert module in IBM InfoSphere BigInsights 2.1.2 and 3.x before 3.0.0.2 allows remote attackers to obtain sensitive Alert… (no CVSS) - [CVE-2014-4803](https://cve.now/CVE-2014-4803.md): CRLF injection vulnerability in the Universal Access implementation in IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4… (no CVSS) - [CVE-2014-4813](https://cve.now/CVE-2014-4813.md): Race condition in the client in IBM Tivoli Storage Manager (TSM) 5.4.0.0 through 5.4.3.6, 5.5.0.0 through 5.5.4.3, 6.1.0.0 through… (no CVSS) - [CVE-2014-6139](https://cve.now/CVE-2014-6139.md): The Search REST API in IBM Business Process Manager 8.0.1.3, 8.5.0.1, and 8.5.5.0 allows remote authenticated users to bypass intended… (no CVSS) - [CVE-2014-6154](https://cve.now/CVE-2014-6154.md): Directory traversal vulnerability in IBM Optim Performance Manager for DB2 4.1.0.1 through 4.1.1 on Linux, UNIX, and Windows and IBM… (no CVSS) - [CVE-2014-6185](https://cve.now/CVE-2014-6185.md): dsmtca in the client in IBM Tivoli Storage Manager (TSM) 6.3 before 6.3.2.3, 6.4 before 6.4.2.2, and 7.1 before 7.1.1.3 does not properly… (no CVSS) - [CVE-2014-8385](https://cve.now/CVE-2014-8385.md): Buffer overflow on Advantech EKI-1200 gateways with firmware before 1.63 allows remote attackers to execute arbitrary code via unspecified… (no CVSS) - [CVE-2014-8909](https://cve.now/CVE-2014-8909.md): Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x… (no CVSS) - [CVE-2015-0593](https://cve.now/CVE-2015-0593.md): The Zone-Based Firewall implementation in Cisco IOS 12.4(122)T and earlier does not properly manage session-object structures, which… (no CVSS) - [CVE-2015-0873](https://cve.now/CVE-2015-0873.md): Cross-site scripting (XSS) vulnerability in Homepage Decorator PerlTreeBBS 2.30 and earlier allows remote attackers to inject arbitrary… (no CVSS) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/archive/2015-02-13 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.