# CVEs published 2015-01-15

38 CVEs were published on January 15, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2014-9596](https://cve.now/CVE-2014-9596.md): Panasonic Arbitrator Back-End Server (BES) MK 2.0 VPU before 9.3.1 build 4.08.003.0, when USB Wi-Fi or Direct LAN is enabled, and MK 3.0 VPU (no CVSS)
- [CVE-2014-7881](https://cve.now/CVE-2014-7881.md): Cross-site scripting (XSS) vulnerability in the server in HP Insight Control allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2014-8022](https://cve.now/CVE-2014-8022.md): Multiple cross-site scripting (XSS) vulnerabilities in Cisco Identity Services Engine allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2014-8034](https://cve.now/CVE-2014-8034.md): Cisco WebEx Meetings Server 1.5 presents the same CAPTCHA challenge for each login attempt, which makes it easier for remote attackers to ob (no CVSS)
- [CVE-2014-8904](https://cve.now/CVE-2014-8904.md): lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCMD\_LQUERYLV environme (no CVSS)
- [CVE-2015-0588](https://cve.now/CVE-2015-0588.md): Cross-site request forgery (CSRF) vulnerability in Cisco Unified Communications Domain Manager (UCDM) 10 allows remote attackers to hijack t (no CVSS)
- [CVE-2015-0591](https://cve.now/CVE-2015-0591.md): Cisco Unified Communications Domain Manager (UCDM) 10 allows remote attackers to cause a denial of service (daemon hang and GUI outage) via (no CVSS)
- [CVE-2014-0171](https://cve.now/CVE-2014-0171.md): XML external entity (XXE) vulnerability in StaxXMLFactoryProvider2 in Odata4j, as used in Red Hat JBoss Data Virtualization before 6.0.0 pat (no CVSS)
- [CVE-2014-7811](https://cve.now/CVE-2014-7811.md): Multiple cross-site scripting (XSS) vulnerabilities in Spacewalk and Red Hat Network (RHN) Satellite before 5.7.0 allow remote authenticated (no CVSS)
- [CVE-2014-7812](https://cve.now/CVE-2014-7812.md): Cross-site scripting (XSS) vulnerability in Spacewalk and Red Hat Network (RHN) Satellite before 5.7.0 allows remote authenticated users to (no CVSS)
- [CVE-2014-7956](https://cve.now/CVE-2014-7956.md): Cross-site scripting (XSS) vulnerability in the Pods plugin before 2.5 for WordPress allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2014-7957](https://cve.now/CVE-2014-7957.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Pods plugin before 2.5 for WordPress allow remote attackers to hijack the (no CVSS)
- [CVE-2014-8150](https://cve.now/CVE-2014-8150.md): CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2014-8151](https://cve.now/CVE-2014-8151.md): The darwinssl\_connect\_step1 function in lib/vtls/curl\_darwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL (aka SecureTran (no CVSS)
- [CVE-2014-8153](https://cve.now/CVE-2014-8153.md): The L3 agent in OpenStack Neutron 2014.2.x before 2014.2.2, when using radvd 2.0+, allows remote authenticated users to cause a denial of se (no CVSS)
- [CVE-2014-8394](https://cve.now/CVE-2014-8394.md): Multiple untrusted search path vulnerabilities in Corel CAD 2014 allow local users to execute arbitrary code and conduct DLL hijacking attac (no CVSS)
- [CVE-2014-8395](https://cve.now/CVE-2014-8395.md): Untrusted search path vulnerability in Corel Painter 2015 allows local users to execute arbitrary code and conduct DLL hijacking attacks via (no CVSS)
- [CVE-2014-8396](https://cve.now/CVE-2014-8396.md): Untrusted search path vulnerability in Corel PDF Fusion allows local users to execute arbitrary code and conduct DLL hijacking attacks via a (no CVSS)
- [CVE-2014-8397](https://cve.now/CVE-2014-8397.md): Untrusted search path vulnerability in Corel VideoStudio PRO X7 or FastFlick allows local users to execute arbitrary code and conduct DLL hi (no CVSS)
- [CVE-2014-8398](https://cve.now/CVE-2014-8398.md): Multiple untrusted search path vulnerabilities in Corel FastFlick allow local users to execute arbitrary code and conduct DLL hijacking atta (no CVSS)
- [CVE-2014-8738](https://cve.now/CVE-2014-8738.md): The \_bfd\_slurp\_extended\_name\_table function in bfd/archive.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of s (no CVSS)
- [CVE-2014-8869](https://cve.now/CVE-2014-8869.md): Multiple cross-site scripting (XSS) vulnerabilities in mobiquo/smartbanner/welcome.php in the Tapatalk (com.tapatalk.wbb4) plugin 1.x before (no CVSS)
- [CVE-2014-8870](https://cve.now/CVE-2014-8870.md): Open redirect vulnerability in mobiquo/smartbanner/welcome.php in the Tapatalk (com.tapatalk.wbb4) plugin before 1.1.2 for Woltlab Burning B (no CVSS)
- [CVE-2014-9308](https://cve.now/CVE-2014-9308.md): Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka WordPress Shopping Cart (no CVSS)
- [CVE-2014-9560](https://cve.now/CVE-2014-9560.md): SQL injection vulnerability in redir\_last\_post\_list.php in SoftBB 0.1.3 allows remote attackers to execute arbitrary SQL commands via the po (no CVSS)
- [CVE-2014-9561](https://cve.now/CVE-2014-9561.md): Cross-site scripting (XSS) vulnerability in redir\_last\_post\_list.php in SoftBB 0.1.3 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2014-9570](https://cve.now/CVE-2014-9570.md): Multiple cross-site scripting (XSS) vulnerabilities in the MyWebsiteAdvisor Simple Security plugin 1.1.5 and earlier for WordPress allow rem (no CVSS)
- [CVE-2014-9587](https://cve.now/CVE-2014-9587.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentica (no CVSS)
- [CVE-2014-9593](https://cve.now/CVE-2014-9593.md): Apache CloudStack before 4.3.2 and 4.4.x before 4.4.2 allows remote attackers to obtain private keys via a listSslCerts API call. (no CVSS)
- [CVE-2014-9594](https://cve.now/CVE-2014-9594.md): Buffer overflow in the SAP NetWeaver Dispatcher in SAP Kernel 7.00 32-bit and 7.40 64-bit allows remote authenticated users to cause a denia (no CVSS)
- [CVE-2014-9595](https://cve.now/CVE-2014-9595.md): Buffer overflow in the SAP NetWeaver Dispatcher in SAP Kernel 7.00 32-bit and 7.40 64-bit allows remote authenticated users to cause a denia (no CVSS)
- [CVE-2015-0552](https://cve.now/CVE-2015-0552.md): Directory traversal vulnerability in the gcab\_folder\_extract function in libgcab/gcab-folder.c in gcab 0.4 allows remote attackers to write (no CVSS)
- [CVE-2015-1039](https://cve.now/CVE-2015-1039.md): Cross-site scripting (XSS) vulnerability in user/login.phtml in ZF-Commons ZfcUser before 1.2.2 allows remote attackers to inject arbitrary (no CVSS, zf-commons/zfc-user)
- [CVE-2015-1040](https://cve.now/CVE-2015-1040.md): Multiple cross-site scripting (XSS) vulnerabilities in the administrative backend in BEdita 3.4.0 allow remote authenticated users to inject (no CVSS)
- [CVE-2015-1041](https://cve.now/CVE-2015-1041.md): Cross-site scripting (XSS) vulnerability in e107\_admin/filemanager.php in e107 1.0.4 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2015-1050](https://cve.now/CVE-2015-1050.md): Cross-site scripting (XSS) vulnerability in F5 BIG-IP Application Security Manager (ASM) before 11.6 allows remote attackers to inject arbit (no CVSS)
- [CVE-2015-1051](https://cve.now/CVE-2015-1051.md): Open redirect vulnerability in the Context UI module in the Context module 7.x-3.x before 7.x-3.6 for Drupal allows remote attackers to redi (no CVSS)
- [CVE-2015-1052](https://cve.now/CVE-2015-1052.md): Cross-site scripting (XSS) vulnerability in the poll archive in PHPKIT 1.6.6 (Build 160014) allows remote attackers to inject arbitrary web (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-01-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.