# CVEs published 2015-01-04

7 CVEs were published on January 4, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2013-2131](https://cve.now/CVE-2013-2131.md): Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial (no CVSS)
- [CVE-2014-9276](https://cve.now/CVE-2014-9276.md): Cross-site request forgery (CSRF) vulnerability in the Special:ExpandedTemplates page in MediaWiki before 1.19.22, 1.20.x through 1.22.x bef (no CVSS)
- [CVE-2014-9277](https://cve.now/CVE-2014-9277.md): The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1 (no CVSS)
- [CVE-2014-9506](https://cve.now/CVE-2014-9506.md): MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates when a monitored issue is related to another (no CVSS)
- [CVE-2014-9507](https://cve.now/CVE-2014-9507.md): MediaWiki 1.21.x, 1.22.x before 1.22.14, and 1.23.x before 1.23.7, when $wgContentHandlerUseDB is enabled, allows remote attackers to conduc (no CVSS)
- [CVE-2014-9508](https://cve.now/CVE-2014-9508.md): The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLoc (no CVSS, typo3/cms)
- [CVE-2014-9509](https://cve.now/CVE-2014-9509.md): The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLoc (no CVSS, typo3/cms)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-01-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.