# CVEs published 2015-01-08

16 CVEs were published on January 8, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2014-9581](https://cve.now/CVE-2014-9581.md): Directory traversal vulnerability in components/filemanager/download.php in Codiad 2.4.3 allows remote attackers to read arbitrary files via (no CVSS)
- [CVE-2014-9582](https://cve.now/CVE-2014-9582.md): Cross-site scripting (XSS) vulnerability in components/filemanager/dialog.php in Codiad 2.4.3 allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2014-9583](https://cve.now/CVE-2014-9583.md): common.c in infosvr in ASUS WRT firmware 3.0.0.4.376\_1071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC66U, RT-N66U, and… (no CVSS)
- [CVE-2014-9580](https://cve.now/CVE-2014-9580.md): Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2014-9575](https://cve.now/CVE-2014-9575.md): VDG Security SENSE (formerly DIVA) before 2.3.15 allows remote attackers to bypass authentication, and consequently read and modify arbitrar (no CVSS)
- [CVE-2014-9576](https://cve.now/CVE-2014-9576.md): VDG Security SENSE (formerly DIVA) 2.3.13 has a hardcoded password of (1) ArpaRomaWi for the root Postgres account and !DVService for the (2 (no CVSS)
- [CVE-2014-9577](https://cve.now/CVE-2014-9577.md): VDG Security SENSE (formerly DIVA) 2.3.13 sends the user database when a user logs in, which allows remote authenticated users to obtain use (no CVSS)
- [CVE-2014-9578](https://cve.now/CVE-2014-9578.md): VDG Security SENSE (formerly DIVA) 2.3.13 performs authentication with a password hash instead of a password, which allows remote attackers (no CVSS)
- [CVE-2014-9579](https://cve.now/CVE-2014-9579.md): VDG Security SENSE (formerly DIVA) 2.3.13 stores administrator credentials in cleartext, which allows attackers to obtain sensitive informat (no CVSS)
- [CVE-2015-0917](https://cve.now/CVE-2015-0917.md): Cross-site scripting (XSS) vulnerability in the backend in Kajona before 4.6.3 allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2015-0918](https://cve.now/CVE-2015-0918.md): Cross-site scripting (XSS) vulnerability in the administrative backend in Sefrengo before 1.6.1 allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2015-0919](https://cve.now/CVE-2015-0919.md): Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before 1.6.1 allow remote administrators to execute arbitra (no CVSS)
- [CVE-2015-0920](https://cve.now/CVE-2015-0920.md): Cross-site request forgery (CSRF) vulnerability in the Banner Effect Header plugin 1.2.6 for WordPress allows remote attackers to hijack the (no CVSS)
- [CVE-2012-5853](https://cve.now/CVE-2012-5853.md): SQL injection vulnerability in the "the\_search\_function" function in cardoza\_ajax\_search.php in the AJAX Post Search (cardoza-ajax-search) p (no CVSS)
- [CVE-2012-6684](https://cve.now/CVE-2012-6684.md): Cross-site scripting (XSS) vulnerability in the RedCloth library 4.2.9 for Ruby and earlier allows remote attackers to inject arbitrary web (no CVSS, RedCloth)
- [CVE-2014-9473](https://cve.now/CVE-2014-9473.md): Unrestricted file upload vulnerability in lib\_nonajax.php in the CformsII plugin 14.7 and earlier for WordPress allows remote attackers to e (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-01-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.