# CVEs published 2015-01-16

35 CVEs were published on January 16, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2014-9602](https://cve.now/CVE-2014-9602.md): libavcodec/xface.h in FFmpeg before 2.5.2 establishes certain digits and words array dimensions that do not satisfy a required mathematical (no CVSS)
- [CVE-2014-9603](https://cve.now/CVE-2014-9603.md): The vmd\_decode function in libavcodec/vmdvideo.c in FFmpeg before 2.5.2 does not validate the relationship between a certain length value an (no CVSS)
- [CVE-2014-9604](https://cve.now/CVE-2014-9604.md): libavcodec/utvideodec.c in FFmpeg before 2.5.2 does not check for a zero value of a slice height, which allows remote attackers to cause a d (no CVSS)
- [CVE-2014-1949](https://cve.now/CVE-2014-1949.md): GTK+ 3.10.9 and earlier, as used in cinnamon-screensaver, gnome-screensaver, and other applications, allows physically proximate attackers t (no CVSS)
- [CVE-2014-3692](https://cve.now/CVE-2014-3692.md): The customization template in Red Hat CloudForms 3.1 Management Engine (CFME) 5.3 uses a default password for the root account when a passwo (no CVSS)
- [CVE-2014-6382](https://cve.now/CVE-2014-6382.md): The Juniper MX Series routers with Junos 13.3R3 through 13.3Rx before 13.3R6, 14.1 before 14.1R4, 14.1X50 before 14.1X50-D70, and 14.2 befor (no CVSS)
- [CVE-2014-6383](https://cve.now/CVE-2014-6383.md): The stateless firewall in Juniper Junos 13.3R3, 14.1R1, and 14.1R2, when using Trio-based PFE modules, does not properly match ports, which (no CVSS)
- [CVE-2014-6384](https://cve.now/CVE-2014-6384.md): Juniper Junos 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D25, 12.1X47 before 12.1X47-D15, 12.3 before 12.3R9, 13.1 before 13.1R4-S3, (no CVSS)
- [CVE-2014-6385](https://cve.now/CVE-2014-6385.md): Juniper Junos 11.4 before 11.4R13, 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D15, 12.2 before 12.2R9, 1 (no CVSS)
- [CVE-2014-6386](https://cve.now/CVE-2014-6386.md): Juniper Junos 11.4 before 11.4R8, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, 12.1X47 before 12.1X47 (no CVSS)
- [CVE-2014-7814](https://cve.now/CVE-2014-7814.md): SQL injection vulnerability in Red Hat CloudForms 3.1 Management Engine (CFME) 5.3 allows remote authenticated users to execute arbitrary SQ (no CVSS)
- [CVE-2014-9471](https://cve.now/CVE-2014-9471.md): The parse\_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code (no CVSS)
- [CVE-2014-9475](https://cve.now/CVE-2014-9475.md): Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.19.23, 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x bef (no CVSS)
- [CVE-2014-9476](https://cve.now/CVE-2014-9476.md): MediaWiki 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote attackers to bypass CORS restrictions in $wgCros (no CVSS)
- [CVE-2014-9477](https://cve.now/CVE-2014-9477.md): Multiple cross-site scripting (XSS) vulnerabilities in the Listings extension for MediaWiki allow remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2014-9478](https://cve.now/CVE-2014-9478.md): Cross-site scripting (XSS) vulnerability in the preview in the ExpandTemplates extension for MediaWiki, when $wgRawHTML is set to true, allo (no CVSS)
- [CVE-2014-9479](https://cve.now/CVE-2014-9479.md): Cross-site scripting (XSS) vulnerability in the preview in the TemplateSandbox extension for MediaWiki allows remote attackers to inject arb (no CVSS)
- [CVE-2014-9480](https://cve.now/CVE-2014-9480.md): Cross-site scripting (XSS) vulnerability in the Hovercards extension for MediaWiki allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2014-9496](https://cve.now/CVE-2014-9496.md): The sd2\_parse\_rsrc\_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via vectors related to a (1) map offset (no CVSS)
- [CVE-2014-9601](https://cve.now/CVE-2014-9601.md): Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size wh (no CVSS, pillow)
- [CVE-2015-0219](https://cve.now/CVE-2015-0219.md): Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an \_ (underscore) c (no CVSS, django)
- [CVE-2015-0220](https://cve.now/CVE-2015-0220.md): The django.util.http.is\_safe\_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle lead (no CVSS, django)
- [CVE-2015-0221](https://cve.now/CVE-2015-0221.md): The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time (no CVSS, django)
- [CVE-2015-0222](https://cve.now/CVE-2015-0222.md): ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show\_hidden\_initial is set to True, allows remote attack (no CVSS, django)
- [CVE-2015-1029](https://cve.now/CVE-2015-1029.md): The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8.8 and earlier allows remote authenticated u (no CVSS)
- [CVE-2014-9599](https://cve.now/CVE-2014-9599.md): Cross-site scripting (XSS) vulnerability in the filemanager in b2evolution before 5.2.1 allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2014-9600](https://cve.now/CVE-2014-9600.md): Untrusted search path vulnerability in Macroplant iExplorer 3.6.3.0 allows local users to execute arbitrary code and conduct DLL hijacking a (no CVSS)
- [CVE-2015-1053](https://cve.now/CVE-2015-1053.md): Cross-site scripting (XSS) vulnerability in the administrative backend in Croogo before 2.2.1 allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2015-1054](https://cve.now/CVE-2015-1054.md): Cross-site scripting (XSS) vulnerability in the Games feature in Crea8Social 2.0 allows remote authenticated users to inject arbitrary web s (no CVSS)
- [CVE-2015-1055](https://cve.now/CVE-2015-1055.md): SQL injection vulnerability in the Photo Gallery plugin 1.2.7 for WordPress allows remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2015-1056](https://cve.now/CVE-2015-1056.md): Cross-site scripting (XSS) vulnerability in Brother MFC-J4410DW printer with firmware before L allows remote attackers to inject arbitrary w (no CVSS)
- [CVE-2015-1057](https://cve.now/CVE-2015-1057.md): Cross-site scripting (XSS) vulnerability in usersettings.php in e107 2.0.0 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2015-1058](https://cve.now/CVE-2015-1058.md): Multiple cross-site scripting (XSS) vulnerabilities in AdaptCMS 3.0.3 allow remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2015-1059](https://cve.now/CVE-2015-1059.md): Unrestricted file upload vulnerability in admin/files/add in AdaptCMS 3.0.3 allows remote authenticated users to execute arbitrary PHP code (no CVSS)
- [CVE-2015-1060](https://cve.now/CVE-2015-1060.md): Open redirect vulnerability in lib/Cake/Controller/Controller.php in AdaptCMS 3.0.3 allows remote attackers to redirect users to arbitrary w (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-01-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.