# CVEs published 2015-01-02

33 CVEs were published on January 2, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2013-7418](https://cve.now/CVE-2013-7418.md): cgi-bin/iptablesgui.cgi in IPCop (aka IPCop Firewall) before 2.1.5 allows remote authenticated users to execute arbitrary code via shell met (no CVSS)
- [CVE-2014-9461](https://cve.now/CVE-2014-9461.md): Directory traversal vulnerability in models/Cart66.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated user (no CVSS)
- [CVE-2014-9428](https://cve.now/CVE-2014-9428.md): The batadv\_frag\_merge\_packets function in net/batman-adv/fragmentation.c in the B.A.T.M.A.N. (no CVSS)
- [CVE-2014-7293](https://cve.now/CVE-2014-7293.md): Cross-site scripting (XSS) vulnerability in the logon page in NYU OpenSSO Integration 2.1 and earlier for Ex Libris Patron Directory Service (no CVSS)
- [CVE-2014-7294](https://cve.now/CVE-2014-7294.md): Open redirect vulnerability in the logon page in NYU OpenSSO Integration 2.1 and earlier for Ex Libris Patron Directory Services (PDS) allow (no CVSS)
- [CVE-2014-9444](https://cve.now/CVE-2014-9444.md): Cross-site scripting (XSS) vulnerability in the Frontend Uploader plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2014-9445](https://cve.now/CVE-2014-9445.md): SQL injection vulnerability in incl/create.inc.php in Installatron GQ File Manager 0.2.5 allows remote attackers to execute arbitrary SQL co (no CVSS)
- [CVE-2014-9446](https://cve.now/CVE-2014-9446.md): Multiple cross-site scripting (XSS) vulnerabilities in the Staff client in Koha before 3.16.6 and 3.18.x before 3.18.2 allow remote attacker (no CVSS)
- [CVE-2014-9447](https://cve.now/CVE-2014-9447.md): Directory traversal vulnerability in the read\_long\_names function in libelf/elf\_begin.c in elfutils 0.152 and 0.161 allows remote attackers (no CVSS)
- [CVE-2014-9448](https://cve.now/CVE-2014-9448.md): Buffer overflow in Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS)
- [CVE-2014-9449](https://cve.now/CVE-2014-9449.md): Buffer overflow in the RiffVideo::infoTagsHandler function in riffvideo.cpp in Exiv2 0.24 allows remote attackers to cause a denial of servi (no CVSS)
- [CVE-2014-9450](https://cve.now/CVE-2014-9450.md): Multiple SQL injection vulnerabilities in chart\_bar.php in the frontend in Zabbix before 1.8.22, 2.0.x before 2.0.14, and 2.2.x before 2.2.8 (no CVSS)
- [CVE-2014-9451](https://cve.now/CVE-2014-9451.md): Multiple stack-based buffer overflows in the DIVA web service API (/webservice) in VDG Security SENSE (formerly DIVA) 2.3.13 allow remote at (no CVSS)
- [CVE-2014-9452](https://cve.now/CVE-2014-9452.md): Directory traversal vulnerability in VDG Security SENSE (formerly DIVA) 2.3.13 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2014-9453](https://cve.now/CVE-2014-9453.md): Multiple cross-site scripting (XSS) vulnerabilities in simple-visitor-stat.php in the Simple visitor stat plugin for WordPress allow remote (no CVSS)
- [CVE-2014-9454](https://cve.now/CVE-2014-9454.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Simple Sticky Footer plugin before 1.3.3 for WordPress allow remote attack (no CVSS)
- [CVE-2014-9455](https://cve.now/CVE-2014-9455.md): SQL injection vulnerability in showads.php in CTS Projects & Software ClassAd 3.0 allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2014-9456](https://cve.now/CVE-2014-9456.md): Buffer overflow in NotePad++ 6.6.9 allows remote attackers to have unspecified impact via a long Time attribute in an Event element in an XM (no CVSS)
- [CVE-2014-9457](https://cve.now/CVE-2014-9457.md): SQL injection vulnerability in classes/mono\_display.class.php in PMB 4.1.3 and earlier allows remote authenticated users to execute arbitrar (no CVSS)
- [CVE-2014-9458](https://cve.now/CVE-2014-9458.md): Heap-based buffer overflow in the GDB debugger module in Hex-Rays IDA Pro before 6.6 cumulative fix 2014-12-24 allows remote GDB servers to (no CVSS)
- [CVE-2014-9459](https://cve.now/CVE-2014-9459.md): Cross-site request forgery (CSRF) vulnerability in the AdminObserver function in e107\_admin/users.php in e107 2.0 alpha2 allows remote attac (no CVSS)
- [CVE-2014-9460](https://cve.now/CVE-2014-9460.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the WP-ViperGB plugin before 1.3.11 for WordPress allow remote attackers to hi (no CVSS)
- [CVE-2013-7417](https://cve.now/CVE-2013-7417.md): Cross-site scripting (XSS) vulnerability in cgi-bin/ipinfo.cgi in IPCop (aka IPCop Firewall) before 2.1.3 allows remote attackers to inject (no CVSS)
- [CVE-2014-9434](https://cve.now/CVE-2014-9434.md): Cross-site scripting (XSS) vulnerability in admin/managerrelated.php in the administrative backend in Absolut Engine 1.73 allows remote auth (no CVSS)
- [CVE-2014-9435](https://cve.now/CVE-2014-9435.md): Multiple SQL injection vulnerabilities in Absolut Engine 1.73 allow remote authenticated users to execute arbitrary SQL commands via the (1) (no CVSS)
- [CVE-2014-9436](https://cve.now/CVE-2014-9436.md): Absolute path traversal vulnerability in SysAid On-Premise before 14.4.2 allows remote attackers to read arbitrary files via a \\\\\\\\ (four ba (no CVSS)
- [CVE-2014-9437](https://cve.now/CVE-2014-9437.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Sliding Social Icons plugin 1.61 for WordPress allow remote attackers to h (no CVSS)
- [CVE-2014-9438](https://cve.now/CVE-2014-9438.md): Cross-site request forgery (CSRF) vulnerability in the Moderator Control Panel in vBulletin 4.2.2 allows remote attackers to hijack the auth (no CVSS)
- [CVE-2014-9439](https://cve.now/CVE-2014-9439.md): Cross-site scripting (XSS) vulnerability in Easy File Sharing Web Server 6.8 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2014-9440](https://cve.now/CVE-2014-9440.md): SQL injection vulnerability in browse.php in phpMyRecipes 1.2.2 allows remote attackers to execute arbitrary SQL commands via the category p (no CVSS)
- [CVE-2014-9441](https://cve.now/CVE-2014-9441.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Lightbox Photo Gallery plugin 1.0 for WordPress allow remote attackers to (no CVSS)
- [CVE-2014-9442](https://cve.now/CVE-2014-9442.md): SQL injection vulnerability in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users (no CVSS)
- [CVE-2014-9443](https://cve.now/CVE-2014-9443.md): Cross-site scripting (XSS) vulnerability in the Relevanssi plugin before 3.3.8 for WordPress allows remote attackers to inject arbitrary web (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-01-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.