# CVEs published 2015-01-09 29 CVEs were published on January 9, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2014-9529](https://cve.now/CVE-2014-9529.md): Race condition in the key\_gc\_unused\_keys function in security/keys/gc.c in the Linux kernel through 3.18.2 allows local users to cause a den (no CVSS) - [CVE-2014-9584](https://cve.now/CVE-2014-9584.md): The parse\_rock\_ridge\_inode\_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 does not validate a length value in the Ex (no CVSS) - [CVE-2014-9585](https://cve.now/CVE-2014-9585.md): The vdso\_addr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area (no CVSS) - [CVE-2013-7419](https://cve.now/CVE-2013-7419.md): Cross-site scripting (XSS) vulnerability in includes/refreshDate.php in the Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) (no CVSS) - [CVE-2014-9269](https://cve.now/CVE-2014-9269.md): Cross-site scripting (XSS) vulnerability in helper\_api.php in MantisBT 1.1.0a1 through 1.2.x before 1.2.18, when Extended project browser is (no CVSS) - [CVE-2014-9271](https://cve.now/CVE-2014-9271.md): Cross-site scripting (XSS) vulnerability in file\_download.php in MantisBT before 1.2.18 allows remote authenticated users to inject arbitrar (no CVSS) - [CVE-2014-9272](https://cve.now/CVE-2014-9272.md): The string\_insert\_href function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows re (no CVSS) - [CVE-2014-9498](https://cve.now/CVE-2014-9498.md): Cross-site scripting (XSS) vulnerability in the Webform Invitation module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.4 for Drupal allow (no CVSS) - [CVE-2014-9499](https://cve.now/CVE-2014-9499.md): Cross-site scripting (XSS) vulnerability in the Godwin's Law module before 7.x-1.1 for Drupal, when using the dblog module, allows remote au (no CVSS) - [CVE-2014-9500](https://cve.now/CVE-2014-9500.md): Cross-site scripting (XSS) vulnerability in the Moip module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to inject arbitrary we (no CVSS) - [CVE-2014-9501](https://cve.now/CVE-2014-9501.md): Cross-site scripting (XSS) vulnerability in the Poll Chart Block module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users (no CVSS) - [CVE-2014-9505](https://cve.now/CVE-2014-9505.md): Cross-site scripting (XSS) vulnerability in the School Administration module 7.x-1.x before 7.x-1.8 for Drupal allows remote authenticated u (no CVSS) - [CVE-2014-9510](https://cve.now/CVE-2014-9510.md): Cross-site request forgery (CSRF) vulnerability in the administration console in TP-Link TL-WR840N (V1) router with firmware before 3.13.27 (no CVSS) - [CVE-2015-0921](https://cve.now/CVE-2015-0921.md): XML external entity (XXE) vulnerability in the Server Task Log in McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 allows (no CVSS) - [CVE-2015-0922](https://cve.now/CVE-2015-0922.md): McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, whic (no CVSS) - [CVE-2014-3570](https://cve.now/CVE-2014-3570.md): The BN\_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of (no CVSS) - [CVE-2014-3571](https://cve.now/CVE-2014-3571.md): OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (NULL pointer dere (no CVSS) - [CVE-2014-3572](https://cve.now/CVE-2014-3572.md): The ssl3\_get\_key\_exchange function in s3\_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL se (no CVSS) - [CVE-2014-8027](https://cve.now/CVE-2014-8027.md): The RBAC component in Cisco Secure Access Control System (ACS) allows remote authenticated users to obtain Network Device Administrator priv (no CVSS) - [CVE-2014-8028](https://cve.now/CVE-2014-8028.md): Multiple cross-site scripting (XSS) vulnerabilities in the web framework in Cisco Secure Access Control System (ACS) allow remote attackers (no CVSS) - [CVE-2014-8029](https://cve.now/CVE-2014-8029.md): Open redirect vulnerability in the web interface in Cisco Secure Access Control System (ACS) allows remote attackers to redirect users to ar (no CVSS) - [CVE-2014-8030](https://cve.now/CVE-2014-8030.md): Cross-site scripting (XSS) vulnerability in sendPwMail.do in Cisco WebEx Meetings Server allows remote attackers to inject arbitrary web scr (no CVSS) - [CVE-2014-8031](https://cve.now/CVE-2014-8031.md): Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server allows remote attackers to hijack the authentication of arbit (no CVSS) - [CVE-2014-8032](https://cve.now/CVE-2014-8032.md): The OutlookAction LI in Cisco WebEx Meetings Server allows remote authenticated users to obtain sensitive encrypted-password information via (no CVSS) - [CVE-2014-8033](https://cve.now/CVE-2014-8033.md): The play/modules component in Cisco WebEx Meetings Server allows remote attackers to obtain administrator access via crafted API requests, a (no CVSS) - [CVE-2014-8275](https://cve.now/CVE-2014-8275.md): OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows (no CVSS) - [CVE-2015-0204](https://cve.now/CVE-2015-0204.md): The ssl3\_get\_key\_exchange function in s3\_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL se (no CVSS) - [CVE-2015-0205](https://cve.now/CVE-2015-0205.md): The ssl3\_get\_cert\_verify function in s3\_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a D (no CVSS) - [CVE-2015-0206](https://cve.now/CVE-2015-0206.md): Memory leak in the dtls1\_buffer\_record function in d1\_pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allows remote attackers t (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-01-09 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.