CVEs published January 27, 2015
28 CVEs were published on January 27, 2015: 0 critical, 0 high.
- Published
- 28
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 28
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Schneider Electric ETG3000 FactoryCast HMI Gateway
- 2
- marked
- 1
- sequelize
- 1
Medium, low and unrated 28
- CVE-2014-9649Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to in
- CVE-2014-9650CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitra
- CVE-2015-1362Buffer overflow in the Customize 35mm tab in Two Pilots Exif Pilot 4.7.2 allows remote attackers to execute arbitrary code via a long string
- CVE-2015-1363Cross-site scripting (XSS) vulnerability in Free Reprintables ArticleFR 3.0.5 allows remote attackers to inject arbitrary web script or HTML
- CVE-2015-1364SQL injection vulnerability in the getProfile function in system/profile.functions.php in Free Reprintables ArticleFR 3.0.5 allows remote at
- CVE-2015-1365Directory traversal vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to wri
- CVE-2015-1366Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers
- CVE-2015-1367SQL injection vulnerability in index.php in CatBot 0.4.2 allows remote attackers to execute arbitrary SQL commands via the lastcatbot parame
- CVE-2015-1368Multiple cross-site scripting (XSS) vulnerabilities in Ansible Tower (aka Ansible UI) before 2.0.5 allow remote attackers to inject arbitrar
- CVE-2015-1369SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the ordesequelize
- CVE-2015-1370Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attmarked
- CVE-2015-1371Unrestricted file upload vulnerability in ferretCMS 1.0.4-alpha allows remote administrators to execute arbitrary code by uploading a file w
- CVE-2015-1372SQL injection vulnerability in ferretCMS 1.0.4-alpha allows remote attackers to execute arbitrary SQL commands via the p parameter in an upd
- CVE-2015-1373Multiple cross-site scripting (XSS) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inject arbitrary web scr
- CVE-2015-1374Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to hijack the authen
- CVE-2014-5211Stack-based buffer overflow in the Attachmate Reflection FTP Client before 14.1.433 allows remote FTP servers to execute arbitrary code via
- CVE-2014-8154The Gst.MapInfo function in Vala 0.26.0 and 0.26.1 uses an incorrect buffer length declaration for the Gstreamer bindings, which allows cont
- CVE-2015-1182The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize
- CVE-2014-9197Schneider Electric ETG3000 FactoryCast HMI Gateway Missing Authentication for Critical FunctionSchneider Electric ETG3000 FactoryCast HMI Gateway
- CVE-2014-9198Schneider Electric ETG3000 FactoryCast HMI Gateway Use of Hard-coded CredentialsSchneider Electric ETG3000 FactoryCast HMI Gateway
- CVE-2014-9646Unquoted Windows search path vulnerability in the GoogleChromeDistribution::DoPostUninstallOperations function in installer/util/google_chro
- CVE-2014-9647Use-after-free vulnerability in PDFium, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service o
- CVE-2014-9648components/navigation_interception/intercept_navigation_resource_throttle.cc in Google Chrome before 40.0.2214.91 on Android does not proper
- CVE-2015-0231Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.
- CVE-2015-0232The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attacke
- CVE-2015-1359Multiple off-by-one errors in fpdfapi/fpdf_font/font_int.h in PDFium, as used in Google Chrome before 40.0.2214.91, allow remote attackers t
- CVE-2015-1360Skia, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (buffer over-read) or possibly have
- CVE-2015-1361platform/image-decoders/ImageFrame.h in Blink, as used in Google Chrome before 40.0.2214.91, does not initialize a variable that is used in