# CVEs published 2015-01-05

17 CVEs were published on January 5, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2014-9526](https://cve.now/CVE-2014-9526.md): Multiple cross-site scripting (XSS) vulnerabilities in concrete5 5.7.2.1, 5.7.2, and earlier allow remote attackers to inject arbitrary web (no CVSS)
- [CVE-2014-1679](https://cve.now/CVE-2014-1679.md): Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite before 7.2.2-rev31, 7.4.0 before 7.4.0-rev27, and 7.4.1 before 7.4.1- (no CVSS)
- [CVE-2014-2598](https://cve.now/CVE-2014-2598.md): Cross-site request forgery (CSRF) vulnerability in the Quick Page/Post Redirect plugin before 5.0.5 for WordPress allows remote attackers to (no CVSS)
- [CVE-2014-8083](https://cve.now/CVE-2014-8083.md): SQL injection vulnerability in the Search::setJsonAlert method in OSClass before 3.4.3 allows remote attackers to execute arbitrary SQL comm (no CVSS)
- [CVE-2014-8084](https://cve.now/CVE-2014-8084.md): Directory traversal vulnerability in oc-includes/osclass/controller/ajax.php in OSClass before 3.4.3 allows remote attackers to include and (no CVSS)
- [CVE-2014-8085](https://cve.now/CVE-2014-8085.md): Unrestricted file upload vulnerability in the CWebContact::doModel method in oc-includes/osclass/controller/contact.php in OSClass before 3. (no CVSS)
- [CVE-2014-9389](https://cve.now/CVE-2014-9389.md): Directory traversal vulnerability in Sonatype Nexus OSS and Pro before 2.11.1-01 allows remote attackers to read or write to arbitrary files (no CVSS)
- [CVE-2014-9516](https://cve.now/CVE-2014-9516.md): Cross-site scripting (XSS) vulnerability in Social Microblogging PRO 1.5 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2014-9517](https://cve.now/CVE-2014-9517.md): Cross-site scripting (XSS) vulnerability in D-link IP camera DCS-2103 with firmware before 1.20 allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2014-9518](https://cve.now/CVE-2014-9518.md): Cross-site scripting (XSS) vulnerability in login.cgi in D-Link router DIR-655 (rev Bx) with firmware before 2.12b01 allows remote attackers (no CVSS)
- [CVE-2014-9519](https://cve.now/CVE-2014-9519.md): SQL injection vulnerability in login.php in InfiniteWP Admin Panel before 2.4.3 allows remote attackers to execute arbitrary SQL commands vi (no CVSS)
- [CVE-2014-9520](https://cve.now/CVE-2014-9520.md): SQL injection vulnerability in execute.php in InfiniteWP Admin Panel before 2.4.4 allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2014-9521](https://cve.now/CVE-2014-9521.md): Unrestricted file upload vulnerability in uploadScript.php in InfiniteWP Admin Panel before 2.4.4, when the allWPFiles query parameter is se (no CVSS)
- [CVE-2014-9522](https://cve.now/CVE-2014-9522.md): Multiple cross-site scripting (XSS) vulnerabilities in CMS Papoo Light 6.0.0 (Rev 4701) allow remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2014-9523](https://cve.now/CVE-2014-9523.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Our Team Showcase (our-team-enhanced) plugin before 1.3 for WordPress allo (no CVSS)
- [CVE-2014-9524](https://cve.now/CVE-2014-9524.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Facebook Like Box (cardoza-facebook-like-box) plugin before 2.8.3 for Word (no CVSS)
- [CVE-2014-9525](https://cve.now/CVE-2014-9525.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Timed Popup (wp-timed-popup) plugin 1.3 for WordPress allow remote attacke (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-01-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.