# CVEs published 2015-01-13

94 CVEs were published on January 13, 2015: 0 critical, 2 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2015-0301](https://cve.now/CVE-2015-0301.md): Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR (no CVSS)
- [CVE-2015-0302](https://cve.now/CVE-2015-0302.md): Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR (no CVSS)
- [CVE-2015-0303](https://cve.now/CVE-2015-0303.md): Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR (no CVSS)
- [CVE-2015-0304](https://cve.now/CVE-2015-0304.md): Heap-based buffer overflow in Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11 (no CVSS)
- [CVE-2015-0305](https://cve.now/CVE-2015-0305.md): Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR (no CVSS)
- [CVE-2015-0306](https://cve.now/CVE-2015-0306.md): Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR (no CVSS)
- [CVE-2015-0307](https://cve.now/CVE-2015-0307.md): Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR (no CVSS)
- [CVE-2015-0308](https://cve.now/CVE-2015-0308.md): Use-after-free vulnerability in Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before (no CVSS)
- [CVE-2015-0309](https://cve.now/CVE-2015-0309.md): Heap-based buffer overflow in Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11 (no CVSS)
- [CVE-2015-0001](https://cve.now/CVE-2015-0001.md): The Windows Error Reporting (WER) component in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8. (no CVSS)
- [CVE-2015-0002](https://cve.now/CVE-2015-0002.md): The AhcVerifyAdminContext function in ahcache.sys in the Application Compatibility component in Microsoft Windows 7 SP1, Windows Server 2008 (no CVSS)
- [CVE-2015-0004](https://cve.now/CVE-2015-0004.md): The User Profile Service (aka ProfSvc) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows (no CVSS)
- [CVE-2015-0006](https://cve.now/CVE-2015-0006.md): The Network Location Awareness (NLA) service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Wi (no CVSS)
- [CVE-2015-0011](https://cve.now/CVE-2015-0011.md): mrxdav.sys (aka the WebDAV driver) in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 S (no CVSS)
- [CVE-2015-0014](https://cve.now/CVE-2015-0014.md): Buffer overflow in the Telnet service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 (no CVSS)
- [CVE-2015-0015](https://cve.now/CVE-2015-0015.md): Microsoft Windows Server 2003 SP2, Server 2008 SP2 and R2 SP1, and Server 2012 Gold and R2 allow remote attackers to cause a denial of servi (no CVSS)
- [CVE-2015-0016](https://cve.now/CVE-2015-0016.md): Directory traversal vulnerability in the TS WebProxy (aka TSWbPrxy) component in Microsoft Windows Vista SP2, Windows 7 SP1, Windows Server (CVSS 7.8, KEV)
- [CVE-2014-100011](https://cve.now/CVE-2014-100011.md): SQL injection vulnerability in /send-to in Sendy 1.1.9.1 allows remote attackers to execute arbitrary SQL commands via the c parameter. (no CVSS)
- [CVE-2014-100012](https://cve.now/CVE-2014-100012.md): SQL injection vulnerability in /app in Sendy 1.1.8.4 allows remote attackers to execute arbitrary SQL commands via the i parameter. (no CVSS)
- [CVE-2014-100013](https://cve.now/CVE-2014-100013.md): Multiple cross-site scripting (XSS) vulnerabilities in clientResponse 4.1 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2014-100014](https://cve.now/CVE-2014-100014.md): Multiple stack-based buffer overflows in pdmwService.exe in SolidWorks Workgroup PDM 2014 SP2 allow remote attackers to execute arbitrary co (no CVSS)
- [CVE-2014-100015](https://cve.now/CVE-2014-100015.md): Directory traversal vulnerability in pdmwService.exe in SolidWorks Workgroup PDM 2014 allows remote attackers to write to arbitrary files vi (no CVSS)
- [CVE-2014-100016](https://cve.now/CVE-2014-100016.md): Cross-site scripting (XSS) vulnerability in photocrati-gallery/ecomm-sizes.php in the Photocrati theme for WordPress allows remote attackers (no CVSS)
- [CVE-2014-100017](https://cve.now/CVE-2014-100017.md): Cross-site scripting (XSS) vulnerability in canned\_opr.php in PhpOnlineChat 3.0 allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2014-100018](https://cve.now/CVE-2014-100018.md): Cross-site scripting (XSS) vulnerability in the Unconfirmed plugin before 1.2.5 for WordPress allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2014-100019](https://cve.now/CVE-2014-100019.md): SQL injection vulnerability in the LTree converter in Pomm before 1.1.5 allows remote attackers to execute arbitrary SQL commands via unspec (no CVSS)
- [CVE-2014-100020](https://cve.now/CVE-2014-100020.md): SQL injection vulnerability in ChangeEmail.php in iTechClassifieds 3.03.057 allows remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2014-100021](https://cve.now/CVE-2014-100021.md): Cross-site scripting (XSS) vulnerability in symfony/web/index.php/pim/viewEmployeeList in OrangeHRM before 3.1.2 allows remote attackers to (no CVSS)
- [CVE-2014-100022](https://cve.now/CVE-2014-100022.md): SQL injection vulnerability in question.php in the mTouch Quiz before 3.0.7 for WordPress allows remote attackers to execute arbitrary SQL c (no CVSS)
- [CVE-2014-100023](https://cve.now/CVE-2014-100023.md): Multiple cross-site scripting (XSS) vulnerabilities in question.php in the mTouch Quiz before 3.0.7 for WordPress allow remote attackers to (no CVSS)
- [CVE-2014-100024](https://cve.now/CVE-2014-100024.md): Cross-site scripting (XSS) vulnerability in Seo Panel before 3.4.0 allows remote attackers to inject arbitrary web script or HTML via unspec (no CVSS)
- [CVE-2014-100025](https://cve.now/CVE-2014-100025.md): Cross-site request forgery (CSRF) vulnerability in index.php/user\_data/insert\_user in Savsoft Quiz allows remote attackers to hijack the aut (no CVSS)
- [CVE-2014-100026](https://cve.now/CVE-2014-100026.md): Cross-site scripting (XSS) vulnerability in readme.php in the April's Super Functions Pack plugin before 1.4.8 for WordPress allows remote a (no CVSS)
- [CVE-2014-100027](https://cve.now/CVE-2014-100027.md): Cross-site scripting (XSS) vulnerability in the WP SlimStat plugin before 3.5.6 for WordPress allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2014-100028](https://cve.now/CVE-2014-100028.md): Cross-site scripting (XSS) vulnerability in /signup in WEBCrafted allows remote attackers to inject arbitrary web script or HTML via the use (no CVSS)
- [CVE-2014-100029](https://cve.now/CVE-2014-100029.md): Multiple directory traversal vulnerabilities in class/session.php in Ganesha Digital Library (GDL) 4.2 allow remote attackers to read arbitr (no CVSS)
- [CVE-2014-100030](https://cve.now/CVE-2014-100030.md): Cross-site scripting (XSS) vulnerability in module/search/function.php in Ganesha Digital Library (GDL) 4.2 allows remote attackers to injec (no CVSS)
- [CVE-2014-100031](https://cve.now/CVE-2014-100031.md): Multiple SQL injection vulnerabilities in Ganesha Digital Library (GDL) 4.2 allow remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2014-100032](https://cve.now/CVE-2014-100032.md): Cross-site scripting (XSS) vulnerability in top.html in the Airties Air 6372 modem allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2014-100033](https://cve.now/CVE-2014-100033.md): Directory traversal vulnerability in LicensePal ArcticDesk before 1.2.5 allows remote attackers to read arbitrary files via unspecified vect (no CVSS)
- [CVE-2014-100034](https://cve.now/CVE-2014-100034.md): Cross-site scripting (XSS) vulnerability in the frontend interface in LicensePal ArcticDesk before 1.2.5 allows remote attackers to inject a (no CVSS)
- [CVE-2014-100035](https://cve.now/CVE-2014-100035.md): SQL injection vulnerability in the ticket grid in the admin interface in LicensePal ArcticDesk before 1.2.5 allows remote attackers to execu (no CVSS)
- [CVE-2014-100036](https://cve.now/CVE-2014-100036.md): Cross-site scripting (XSS) vulnerability in FlatPress 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the content p (no CVSS)
- [CVE-2014-100037](https://cve.now/CVE-2014-100037.md): Cross-site scripting (XSS) vulnerability in Storytlr 1.3.dev and earlier allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2014-100038](https://cve.now/CVE-2014-100038.md): Cross-site scripting (XSS) vulnerability in Storytlr 1.3.dev and earlier allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2014-100039](https://cve.now/CVE-2014-100039.md): mbae.sys in Malwarebytes Anti-Exploit before 1.05.1.2014 allows local users to cause a denial of service (crash) via a crafted size in an un (no CVSS)
- [CVE-2014-10031](https://cve.now/CVE-2014-10031.md): Buffer overflow in the IMAPd service in Qualcomm Eudora WorldMail 9.0.333.0 allows remote attackers to execute arbitrary code via a long str (no CVSS)
- [CVE-2014-10032](https://cve.now/CVE-2014-10032.md): SQL injection vulnerability in news\_popup.php in Taboada MacroNews 1.0 allows remote authenticated users to execute arbitrary SQL commands v (no CVSS)
- [CVE-2014-10033](https://cve.now/CVE-2014-10033.md): SQL injection vulnerability in the update\_zone function in catalog/admin/geo\_zones.php in osCommerce Online Merchant 2.3.3.4 and earlier all (no CVSS)
- [CVE-2014-10034](https://cve.now/CVE-2014-10034.md): Multiple SQL injection vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to execute arbitrary SQL comm (no CVSS)
- [CVE-2014-10035](https://cve.now/CVE-2014-10035.md): Multiple cross-site scripting (XSS) vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to inject arbitr (no CVSS)
- [CVE-2014-10036](https://cve.now/CVE-2014-10036.md): Cross-site scripting (XSS) vulnerability in JetBrains TeamCity before 8.1 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2014-10037](https://cve.now/CVE-2014-10037.md): Directory traversal vulnerability in DomPHP 0.83 and earlier allows remote attackers to have unspecified impact via a .. (no CVSS)
- [CVE-2014-10038](https://cve.now/CVE-2014-10038.md): SQL injection vulnerability in agenda/indexdate.php in DomPHP 0.83 and earlier allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2014-100001](https://cve.now/CVE-2014-100001.md): Cross-site request forgery (CSRF) vulnerability in the SEO Plugin LiveOptim plugin before 1.1.4-free for WordPress allows remote attackers t (no CVSS)
- [CVE-2014-100002](https://cve.now/CVE-2014-100002.md): Directory traversal vulnerability in ManageEngine SupportCenter Plus 7.9 before 7917 allows remote attackers to read arbitrary files via a . (no CVSS)
- [CVE-2014-100003](https://cve.now/CVE-2014-100003.md): SQL injection vulnerability in includes/ym-download\_functions.include.php in the Code Futures YourMembers plugin for WordPress allows remote (no CVSS)
- [CVE-2014-100004](https://cve.now/CVE-2014-100004.md): Cross-site scripting (XSS) vulnerability in Sitecore CMS before 7.0 Update-4 (rev. (no CVSS)
- [CVE-2014-100005](https://cve.now/CVE-2014-100005.md): Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. (CVSS 8.0, KEV)
- [CVE-2014-100006](https://cve.now/CVE-2014-100006.md): Multiple cross-site scripting (XSS) vulnerabilities in modules\_v3/googlemap/wt\_v3\_street\_view.php in webtrees before 1.5.2 allow remote atta (no CVSS)
- [CVE-2014-100007](https://cve.now/CVE-2014-100007.md): Cross-site scripting (XSS) vulnerability in the HK Exif Tags plugin before 1.12 for WordPress allows remote authenticated users to inject ar (no CVSS)
- [CVE-2014-100008](https://cve.now/CVE-2014-100008.md): Cross-site scripting (XSS) vulnerability in includes/delete\_img.php in the Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) (no CVSS)
- [CVE-2014-100009](https://cve.now/CVE-2014-100009.md): The Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 and earlier for WordPress allows remote attackers to obtai (no CVSS)
- [CVE-2014-10001](https://cve.now/CVE-2014-10001.md): Multiple cross-site request forgery (CSRF) vulnerabilities in PHPJabbers Appointment Scheduler 2.0 allow remote attackers to hijack the auth (no CVSS)
- [CVE-2014-100010](https://cve.now/CVE-2014-100010.md): Cross-site scripting (XSS) vulnerability in ClanSphere 2011.4 allows remote attackers to inject arbitrary web script or HTML via the where p (no CVSS)
- [CVE-2014-10002](https://cve.now/CVE-2014-10002.md): Unspecified vulnerability in JetBrains TeamCity before 8.1 allows remote attackers to obtain sensitive information via unknown vectors. (no CVSS)
- [CVE-2014-10003](https://cve.now/CVE-2014-10003.md): Multiple cross-site scripting (XSS) vulnerabilities in Maian Uploader 4.0 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2014-10004](https://cve.now/CVE-2014-10004.md): SQL injection vulnerability in admin/data\_files/move.php in Maian Uploader 4.0 allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2014-10005](https://cve.now/CVE-2014-10005.md): Maian Uploader 4.0 allows remote attackers to obtain sensitive information via a request without the height parameter to load\_flv.js.php, wh (no CVSS)
- [CVE-2014-10006](https://cve.now/CVE-2014-10006.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Maian Uploader 4.0 allow remote attackers to hijack the authentication of unsp (no CVSS)
- [CVE-2014-10007](https://cve.now/CVE-2014-10007.md): Multiple cross-site scripting (XSS) vulnerabilities in Maian Weblog 4.0 and earlier allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2014-10008](https://cve.now/CVE-2014-10008.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Stark CRM 1.0 allow remote attackers to hijack the authentication of administr (no CVSS)
- [CVE-2014-10009](https://cve.now/CVE-2014-10009.md): Multiple cross-site scripting (XSS) vulnerabilities in Stark CRM 1.0 allow remote attackers to inject arbitrary web script or HTML via the ( (no CVSS)
- [CVE-2014-10010](https://cve.now/CVE-2014-10010.md): Directory traversal vulnerability in PHPJabbers Appointment Scheduler 2.0 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2014-10011](https://cve.now/CVE-2014-10011.md): Stack-based buffer overflow in UltraCamLib in the UltraCam ActiveX Control (UltraCamX.ocx) for the TRENDnet SecurView camera TV-IP422WN allo (no CVSS)
- [CVE-2014-10012](https://cve.now/CVE-2014-10012.md): Cross-site scripting (XSS) vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to inject (no CVSS)
- [CVE-2014-10013](https://cve.now/CVE-2014-10013.md): SQL injection vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to execute arbitrary SQ (no CVSS)
- [CVE-2014-10014](https://cve.now/CVE-2014-10014.md): Multiple cross-site request forgery (CSRF) vulnerabilities in PHPJabbers Event Booking Calendar 2.0 allow remote attackers to hijack the aut (no CVSS)
- [CVE-2014-10015](https://cve.now/CVE-2014-10015.md): SQL injection vulnerability in load-calendar.php in PHPJabbers Event Booking Calendar 2.0 allows remote attackers to execute arbitrary SQL c (no CVSS)
- [CVE-2014-10016](https://cve.now/CVE-2014-10016.md): Multiple cross-site scripting (XSS) vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to inject a (no CVSS)
- [CVE-2014-10017](https://cve.now/CVE-2014-10017.md): Multiple SQL injection vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2014-10018](https://cve.now/CVE-2014-10018.md): Cross-site scripting (XSS) vulnerability in webconfig/wlan/country.html/country in the Teracom T2-B-Gawv1.4U10Y-BI modem allows remote attac (no CVSS)
- [CVE-2014-10019](https://cve.now/CVE-2014-10019.md): Multiple cross-site request forgery (CSRF) vulnerabilities in webconfig/wlan/country.html/country in the Teracom T2-B-Gawv1.4U10Y-BI modem a (no CVSS)
- [CVE-2014-10020](https://cve.now/CVE-2014-10020.md): SQL injection vulnerability in login.php in Simple e-document 1.31 allows remote attackers to execute arbitrary SQL commands via the usernam (no CVSS)
- [CVE-2014-10021](https://cve.now/CVE-2014-10021.md): Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote attackers to execut (no CVSS)
- [CVE-2014-10022](https://cve.now/CVE-2014-10022.md): Apache Traffic Server before 5.1.2 allows remote attackers to cause a denial of service via unspecified vectors, related to internal buffer (no CVSS)
- [CVE-2014-10023](https://cve.now/CVE-2014-10023.md): Multiple SQL injection vulnerabilities in TopicsViewer 3.0 Beta 1 allow remote attackers to execute arbitrary SQL commands via the id parame (no CVSS)
- [CVE-2014-10024](https://cve.now/CVE-2014-10024.md): Multiple integer signedness errors in DirectShowDemuxFilter, as used in Divx Web Player, Divx Player, and other Divx plugins, allow remote a (no CVSS)
- [CVE-2014-10025](https://cve.now/CVE-2014-10025.md): Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DAP-1360 with firmware 2.5.4 and earlier allow remote attackers to hija (no CVSS)
- [CVE-2014-10026](https://cve.now/CVE-2014-10026.md): index.cgi in D-Link DAP-1360 with firmware 2.5.4 and earlier allows remote attackers to bypass authentication and obtain sensitive informati (no CVSS)
- [CVE-2014-10027](https://cve.now/CVE-2014-10027.md): Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DAP-1360 router with firmware 2.5.4 and earlier allow remote attackers (no CVSS)
- [CVE-2014-10028](https://cve.now/CVE-2014-10028.md): Cross-site scripting (XSS) vulnerability in D-Link DAP-1360 router with firmware 2.5.4 and later allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2014-10029](https://cve.now/CVE-2014-10029.md): SQL injection vulnerability in profile.php in FluxBB before 1.4.13 and 1.5.x before 1.5.7 allows remote attackers to execute arbitrary SQL c (no CVSS)
- [CVE-2014-10030](https://cve.now/CVE-2014-10030.md): Open redirect vulnerability in forums/login.php in FluxBB before 1.4.13 and 1.5.x before 1.5.7 allows remote attackers to redirect users to (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-01-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.