# CVEs published 2015-01-26 10 CVEs were published on January 26, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2014-8148](https://cve.now/CVE-2014-8148.md): The default D-Bus access control rule in Midgard2 10.05.7.1 allows local users to send arbitrary method calls or signals to any process on t (no CVSS) - [CVE-2014-8157](https://cve.now/CVE-2014-8157.md): Off-by-one error in the jpc\_dec\_process\_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (cra (no CVSS) - [CVE-2014-8158](https://cve.now/CVE-2014-8158.md): Multiple stack-based buffer overflows in jpc\_qmfb.c in JasPer 1.900.1 and earlier allow remote attackers to cause a denial of service (crash (no CVSS) - [CVE-2014-9571](https://cve.now/CVE-2014-9571.md): Cross-site scripting (XSS) vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attacker (no CVSS) - [CVE-2014-9572](https://cve.now/CVE-2014-9572.md): MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to /\*/install.php, which allows remote attackers to o (no CVSS) - [CVE-2014-9573](https://cve.now/CVE-2014-9573.md): SQL injection vulnerability in manage\_user\_page.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote administrators wit (no CVSS) - [CVE-2015-1178](https://cve.now/CVE-2015-1178.md): Multiple cross-site scripting (XSS) vulnerabilities in cart.php in X-Cart 5.1.8 and earlier allow remote attackers to inject arbitrary web s (no CVSS) - [CVE-2015-1179](https://cve.now/CVE-2015-1179.md): Multiple cross-site scripting (XSS) vulnerabilities in data\_point\_details.shtm in Mango Automation 2.4.0 and earlier allow remote attackers (no CVSS) - [CVE-2015-1307](https://cve.now/CVE-2015-1307.md): plasma-workspace before 5.1.95 allows remote attackers to obtain passwords via a Trojan horse Look and Feel package. (no CVSS) - [CVE-2015-1308](https://cve.now/CVE-2015-1308.md): kde-workspace 4.2.0 and plasma-workspace before 5.1.95 allows remote attackers to obtain input events, and consequently obtain passwords, by (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-01-26 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.