# CVEs published 2015-02-03

36 CVEs were published on February 3, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2014-8013](https://cve.now/CVE-2014-8013.md): The TACACS+ command-authorization implementation in Cisco NX-OS allows local users to cause a denial of service (device reload) via a long C (no CVSS)
- [CVE-2014-8021](https://cve.now/CVE-2014-8021.md): Cross-site scripting (XSS) vulnerability in Cisco AnyConnect Secure Mobility Client 3.1(.02043) and earlier and Cisco HostScan Engine 3.1(.0 (no CVSS)
- [CVE-2015-0599](https://cve.now/CVE-2015-0599.md): The web interface in Cisco Integrated Management Controller in Cisco Unified Computing System (UCS) on C-Series Rack Servers does not proper (no CVSS)
- [CVE-2015-0929](https://cve.now/CVE-2015-0929.md): time.htm in the web interface on SerVision HVG Video Gateway devices with firmware before 2.2.26a78 allows remote attackers to bypass authen (no CVSS)
- [CVE-2015-0930](https://cve.now/CVE-2015-0930.md): The web interface on SerVision HVG Video Gateway devices with firmware before 2.2.26a100 has a hardcoded administrative password, which make (no CVSS)
- [CVE-2015-1469](https://cve.now/CVE-2015-1469.md): time.htm in the web interface on SerVision HVG Video Gateway devices with firmware through 2.2.26a100 allows remote authenticated users to g (no CVSS)
- [CVE-2014-5360](https://cve.now/CVE-2014-5360.md): Cross-site scripting (XSS) vulnerability in the admin interface in LANDESK Management Suite before 9.6 SP1 allows remote attackers to inject (no CVSS)
- [CVE-2014-8779](https://cve.now/CVE-2014-8779.md): Pexip Infinity before 8 uses the same SSH host keys across different customers' installations, which allows man-in-the-middle attackers to s (no CVSS)
- [CVE-2014-9328](https://cve.now/CVE-2014-9328.md): ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upack packer file, related to a "heap out of bounds co (no CVSS)
- [CVE-2014-9556](https://cve.now/CVE-2014-9556.md): Integer overflow in the qtmd\_decompress function in libmspack 0.4 allows remote attackers to cause a denial of service (hang) via a crafted (no CVSS)
- [CVE-2014-9559](https://cve.now/CVE-2014-9559.md): Cross-site scripting (XSS) vulnerability in SnipSnap 0.5.2a, 1.0b1, and 1.0b2 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2014-9568](https://cve.now/CVE-2014-9568.md): puppetlabs-rabbitmq 3.0 through 4.1 stores the RabbitMQ Erlang cookie value in the facts of a node, which allows local users to obtain sensi (no CVSS)
- [CVE-2014-9574](https://cve.now/CVE-2014-9574.md): Directory traversal vulnerability in install.php in FluxBB before 1.5.8 allows remote attackers to include and execute arbitrary local insta (no CVSS)
- [CVE-2014-9633](https://cve.now/CVE-2014-9633.md): The bdisk.sys driver in COMODO Backup before 4.4.1.23 allows remote attackers to gain privileges via a crafted device handle, which triggers (no CVSS)
- [CVE-2015-1348](https://cve.now/CVE-2015-1348.md): Heap-based buffer overflow in Aruba Instant (IAP) with firmware before 4.0.0.7 and 4.1.x before 4.1.1.2 allows remote attackers to cause a d (no CVSS)
- [CVE-2015-1380](https://cve.now/CVE-2015-1380.md): jcc.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (abort) via a crafted chunk-encoded body. (no CVSS)
- [CVE-2015-1381](https://cve.now/CVE-2015-1381.md): Multiple unspecified vulnerabilities in pcrs.c in Privoxy before 3.0.23 allow remote attackers to cause a denial of service (segmentation fa (no CVSS)
- [CVE-2015-1382](https://cve.now/CVE-2015-1382.md): parsers.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (invalid read and crash) via vectors related to an H (no CVSS)
- [CVE-2015-1384](https://cve.now/CVE-2015-1384.md): Cross-site scripting (XSS) vulnerability in the Banner Effect Header plugin before 1.2.8 for WordPress allows remote attackers to inject arb (no CVSS)
- [CVE-2015-1400](https://cve.now/CVE-2015-1400.md): SQL injection vulnerability in search.php in NPDS Revolution 13 allows remote attackers to execute arbitrary SQL commands via the query para (no CVSS)
- [CVE-2015-1402](https://cve.now/CVE-2015-1402.md): Cross-site scripting (XSS) vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to inject arbit (no CVSS)
- [CVE-2015-1403](https://cve.now/CVE-2015-1403.md): SQL injection vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL com (no CVSS)
- [CVE-2015-1404](https://cve.now/CVE-2015-1404.md): Cross-site scripting (XSS) vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to inje (no CVSS)
- [CVE-2015-1405](https://cve.now/CVE-2015-1405.md): SQL injection vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2015-1428](https://cve.now/CVE-2015-1428.md): Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1) remote attackers to execute arbitrary SQL commands via the sefreng (no CVSS)
- [CVE-2015-1433](https://cve.now/CVE-2015-1433.md): program/lib/Roundcube/rcube\_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct (no CVSS)
- [CVE-2015-1441](https://cve.now/CVE-2015-1441.md): SQL injection vulnerability in Piwigo before 2.5.6, 2.6.x before 2.6.5, and 2.7.x before 2.7.3 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2015-1455](https://cve.now/CVE-2015-1455.md): Fortinet FortiAuthenticator 3.0.0 has a password of (1) slony for the slony PostgreSQL user and (2) www-data for the www-data PostgreSQL use (no CVSS)
- [CVE-2015-1456](https://cve.now/CVE-2015-1456.md): Fortinet FortiAuthenticator 3.0.0 logs the PostgreSQL usernames and passwords in cleartext, which allows remote administrators to obtain sen (no CVSS)
- [CVE-2015-1457](https://cve.now/CVE-2015-1457.md): Fortinet FortiAuthenticator 3.0.0 allows local users to read arbitrary files via the -f flag to the dig command. (no CVSS)
- [CVE-2015-1458](https://cve.now/CVE-2015-1458.md): Fortinet FortiAuthenticator 3.0.0 allows local users to bypass intended restrictions and gain privileges by creating /tmp/privexec/dbgcore\_e (no CVSS)
- [CVE-2015-1459](https://cve.now/CVE-2015-1459.md): Cross-site scripting (XSS) vulnerability in Fortinet FortiAuthenticator 3.0.0 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2015-1460](https://cve.now/CVE-2015-1460.md): Huawei Quidway switches with firmware before V200R005C00SPC300 allows remote attackers to gain privileges via a crafted packet. (no CVSS)
- [CVE-2015-1461](https://cve.now/CVE-2015-1461.md): ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted (1) Yoda's crypter or (2) mew packer file, related to (no CVSS)
- [CVE-2015-1462](https://cve.now/CVE-2015-1462.md): ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upx packer file, related to a "heap out of bounds cond (no CVSS)
- [CVE-2015-1463](https://cve.now/CVE-2015-1463.md): ClamAV before 0.98.6 allows remote attackers to cause a denial of service (crash) via a crafted petite packer file, related to an "incorrect (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-02-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.