# CVEs published 2015-02-02 27 CVEs were published on February 2, 2015: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2015-0313](https://cve.now/CVE-2015-0313.md): Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before (CVSS 7.8, KEV) - [CVE-2014-0998](https://cve.now/CVE-2014-0998.md): Integer signedness error in the vt console driver (formerly Newcons) in FreeBSD 9.3 before p10 and 10.1 before p6 allows local users to caus (no CVSS) - [CVE-2014-8612](https://cve.now/CVE-2014-8612.md): Multiple array index errors in the Stream Control Transmission Protocol (SCTP) module in FreeBSD 10.1 before p5, 10.0 before p17, 9.3 before (no CVSS) - [CVE-2014-8613](https://cve.now/CVE-2014-8613.md): The sctp module in FreeBSD 10.1 before p5, 10.0 before p17, 9.3 before p9, and 8.4 before p23 allows remote attackers to cause a denial of s (no CVSS) - [CVE-2015-0223](https://cve.now/CVE-2015-0223.md): Unspecified vulnerability in Apache Qpid 0.30 and earlier allows remote attackers to bypass access restrictions on qpidd via unknown vectors (no CVSS) - [CVE-2015-1451](https://cve.now/CVE-2015-1451.md): Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiOS 5.0 Patch 7 build 4457 allow remote authenticated users to inject ar (no CVSS) - [CVE-2015-1452](https://cve.now/CVE-2015-1452.md): The Control and Provisioning of Wireless Access Points (CAPWAP) daemon in Fortinet FortiOS 5.0 Patch 7 build 4457 allows remote attackers to (no CVSS) - [CVE-2015-1453](https://cve.now/CVE-2015-1453.md): The qm class in Fortinet FortiClient 5.2.3.091 for Android uses a hardcoded encryption key of FoRtInEt!AnDrOiD, which makes it easier for at (no CVSS) - [CVE-2015-1454](https://cve.now/CVE-2015-1454.md): Blue Coat ProxyClient before 3.3.3.3 and 3.4.x before 3.4.4.10 and Unified Agent before 4.1.3.151952 does not properly validate certain cert (no CVSS) - [CVE-2015-0866](https://cve.now/CVE-2015-0866.md): Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to (no CVSS) - [CVE-2015-1049](https://cve.now/CVE-2015-1049.md): The web server on Siemens SCALANCE X-200IRT switches with firmware before 5.2.0 allows remote attackers to hijack sessions via unspecified v (no CVSS) - [CVE-2015-1357](https://cve.now/CVE-2015-1357.md): Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware before SS4.4.4624.35, WIN70xx devices wi (no CVSS) - [CVE-2015-1383](https://cve.now/CVE-2015-1383.md): Cross-site scripting (XSS) vulnerability in the geo search widget in the Geo Mashup plugin before 1.8.3 for WordPress allows remote attacker (no CVSS) - [CVE-2015-1385](https://cve.now/CVE-2015-1385.md): Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to i (no CVSS) - [CVE-2015-1393](https://cve.now/CVE-2015-1393.md): SQL injection vulnerability in the Photo Gallery plugin before 1.2.11 for WordPress allows remote authenticated users to execute arbitrary S (no CVSS) - [CVE-2015-1448](https://cve.now/CVE-2015-1448.md): The integrated management service on Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware bef (no CVSS) - [CVE-2015-1449](https://cve.now/CVE-2015-1449.md): Buffer overflow in the integrated web server on Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with f (no CVSS) - [CVE-2015-1450](https://cve.now/CVE-2015-1450.md): SQL injection vulnerability in Restaurant Biller allows remote attackers to execute arbitrary SQL commands via the cid parameter in a catego (no CVSS) - [CVE-2014-6136](https://cve.now/CVE-2014-6136.md): IBM Security AppScan Standard 8.x and 9.x before 9.0.1.1 FP1 supports unencrypted sessions, which allows remote attackers to obtain sensitiv (no CVSS) - [CVE-2014-6141](https://cve.now/CVE-2014-6141.md): IBM Tivoli Monitoring (ITM) 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP09, 6.2.3 through FP05, and 6.3.0 before FP04 allows rem (no CVSS) - [CVE-2014-6170](https://cve.now/CVE-2014-6170.md): The HTTPInput node in IBM WebSphere Message Broker 7.0 before 7.0.0.8 and 8.0 before 8.0.0.6 and IBM Integration Bus 9.0 before 9.0.0.4 allo (no CVSS) - [CVE-2014-7882](https://cve.now/CVE-2014-7882.md): Unspecified vulnerability in HP SiteScope 11.1x and 11.2x allows remote authenticated users to gain privileges via unknown vectors. (no CVSS) - [CVE-2014-8918](https://cve.now/CVE-2014-8918.md): IBM Security AppScan Standard 8.x and 9.x before 9.0.1.1 FP1 does not properly verify X.509 certificates from SSL servers, which allows man- (no CVSS) - [CVE-2015-0512](https://cve.now/CVE-2015-0512.md): Open redirect vulnerability in EMC Unisphere Central before 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct (no CVSS) - [CVE-2015-0595](https://cve.now/CVE-2015-0595.md): The XMLAPI in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to obtain sensitive information by reading return (no CVSS) - [CVE-2015-0596](https://cve.now/CVE-2015-0596.md): Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to hijack the (no CVSS) - [CVE-2015-0597](https://cve.now/CVE-2015-0597.md): The Forgot Password feature in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to enumerate administrative accou (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-02-02 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.