# CVEs published 2015-01-27 28 CVEs were published on January 27, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2014-9649](https://cve.now/CVE-2014-9649.md): Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to in (no CVSS) - [CVE-2014-9650](https://cve.now/CVE-2014-9650.md): CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitra (no CVSS) - [CVE-2015-1362](https://cve.now/CVE-2015-1362.md): Buffer overflow in the Customize 35mm tab in Two Pilots Exif Pilot 4.7.2 allows remote attackers to execute arbitrary code via a long string (no CVSS) - [CVE-2015-1363](https://cve.now/CVE-2015-1363.md): Cross-site scripting (XSS) vulnerability in Free Reprintables ArticleFR 3.0.5 allows remote attackers to inject arbitrary web script or HTML (no CVSS) - [CVE-2015-1364](https://cve.now/CVE-2015-1364.md): SQL injection vulnerability in the getProfile function in system/profile.functions.php in Free Reprintables ArticleFR 3.0.5 allows remote at (no CVSS) - [CVE-2015-1365](https://cve.now/CVE-2015-1365.md): Directory traversal vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to wri (no CVSS) - [CVE-2015-1366](https://cve.now/CVE-2015-1366.md): Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers (no CVSS) - [CVE-2015-1367](https://cve.now/CVE-2015-1367.md): SQL injection vulnerability in index.php in CatBot 0.4.2 allows remote attackers to execute arbitrary SQL commands via the lastcatbot parame (no CVSS) - [CVE-2015-1368](https://cve.now/CVE-2015-1368.md): Multiple cross-site scripting (XSS) vulnerabilities in Ansible Tower (aka Ansible UI) before 2.0.5 allow remote attackers to inject arbitrar (no CVSS) - [CVE-2015-1369](https://cve.now/CVE-2015-1369.md): SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the orde (no CVSS, sequelize) - [CVE-2015-1370](https://cve.now/CVE-2015-1370.md): Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) att (no CVSS, marked) - [CVE-2015-1371](https://cve.now/CVE-2015-1371.md): Unrestricted file upload vulnerability in ferretCMS 1.0.4-alpha allows remote administrators to execute arbitrary code by uploading a file w (no CVSS) - [CVE-2015-1372](https://cve.now/CVE-2015-1372.md): SQL injection vulnerability in ferretCMS 1.0.4-alpha allows remote attackers to execute arbitrary SQL commands via the p parameter in an upd (no CVSS) - [CVE-2015-1373](https://cve.now/CVE-2015-1373.md): Multiple cross-site scripting (XSS) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inject arbitrary web scr (no CVSS) - [CVE-2015-1374](https://cve.now/CVE-2015-1374.md): Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to hijack the authen (no CVSS) - [CVE-2014-5211](https://cve.now/CVE-2014-5211.md): Stack-based buffer overflow in the Attachmate Reflection FTP Client before 14.1.433 allows remote FTP servers to execute arbitrary code via (no CVSS) - [CVE-2014-8154](https://cve.now/CVE-2014-8154.md): The Gst.MapInfo function in Vala 0.26.0 and 0.26.1 uses an incorrect buffer length declaration for the Gstreamer bindings, which allows cont (no CVSS) - [CVE-2015-1182](https://cve.now/CVE-2015-1182.md): The asn1\_get\_sequence\_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize (no CVSS) - [CVE-2014-9197](https://cve.now/CVE-2014-9197.md): Schneider Electric ETG3000 FactoryCast HMI Gateway Missing Authentication for Critical Function (no CVSS, Schneider Electric ETG3000 FactoryCast HMI Gateway) - [CVE-2014-9198](https://cve.now/CVE-2014-9198.md): Schneider Electric ETG3000 FactoryCast HMI Gateway Use of Hard-coded Credentials (no CVSS, Schneider Electric ETG3000 FactoryCast HMI Gateway) - [CVE-2014-9646](https://cve.now/CVE-2014-9646.md): Unquoted Windows search path vulnerability in the GoogleChromeDistribution::DoPostUninstallOperations function in installer/util/google\_chro (no CVSS) - [CVE-2014-9647](https://cve.now/CVE-2014-9647.md): Use-after-free vulnerability in PDFium, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service o (no CVSS) - [CVE-2014-9648](https://cve.now/CVE-2014-9648.md): components/navigation\_interception/intercept\_navigation\_resource\_throttle.cc in Google Chrome before 40.0.2214.91 on Android does not proper (no CVSS) - [CVE-2015-0231](https://cve.now/CVE-2015-0231.md): Use-after-free vulnerability in the process\_nested\_data function in ext/standard/var\_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5. (no CVSS) - [CVE-2015-0232](https://cve.now/CVE-2015-0232.md): The exif\_process\_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attacke (no CVSS) - [CVE-2015-1359](https://cve.now/CVE-2015-1359.md): Multiple off-by-one errors in fpdfapi/fpdf\_font/font\_int.h in PDFium, as used in Google Chrome before 40.0.2214.91, allow remote attackers t (no CVSS) - [CVE-2015-1360](https://cve.now/CVE-2015-1360.md): Skia, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (buffer over-read) or possibly have (no CVSS) - [CVE-2015-1361](https://cve.now/CVE-2015-1361.md): platform/image-decoders/ImageFrame.h in Blink, as used in Google Chrome before 40.0.2214.91, does not initialize a variable that is used in (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-01-27 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.