# CVEs published 2015-02-04

22 CVEs were published on February 4, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2014-5341](https://cve.now/CVE-2014-5341.md): The SFTP external storage driver (files\_external) in ownCloud Server before 6.0.5 validates the RSA Host key after login, which allows remot (no CVSS)
- [CVE-2014-9041](https://cve.now/CVE-2014-9041.md): The import functionality in the bookmarks application in ownCloud server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 does not vali (no CVSS)
- [CVE-2014-9042](https://cve.now/CVE-2014-9042.md): Cross-site scripting (XSS) vulnerability in the import functionality in the bookmarks application in ownCloud before 5.0.18, 6.x before 6.0. (no CVSS)
- [CVE-2014-9043](https://cve.now/CVE-2014-9043.md): The user\_ldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote (no CVSS)
- [CVE-2014-9044](https://cve.now/CVE-2014-9044.md): Asset Pipeline in ownCloud 7.x before 7.0.3 uses an MD5 hash of the absolute file paths of the original CSS and JS files as the name of the (no CVSS)
- [CVE-2014-9045](https://cve.now/CVE-2014-9045.md): The FTP backend in user\_external in ownCloud Server before 5.0.18 and 6.x before 6.0.6 allows remote attackers to bypass intended authentica (no CVSS)
- [CVE-2014-9046](https://cve.now/CVE-2014-9046.md): The OC\_Util::getUrlContent function in ownCloud Server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to read (no CVSS)
- [CVE-2014-9047](https://cve.now/CVE-2014-9047.md): Multiple unspecified vulnerabilities in the preview system in ownCloud 6.x before 6.0.6 and 7.x before 7.0.3 allow remote attackers to read (no CVSS)
- [CVE-2014-9048](https://cve.now/CVE-2014-9048.md): The documents application in ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3 allows remote attackers to bypass the password-protection (no CVSS)
- [CVE-2014-9049](https://cve.now/CVE-2014-9049.md): The documents application in ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3 allows remote authenticated users to obtain all valid ses (no CVSS)
- [CVE-2014-9562](https://cve.now/CVE-2014-9562.md): Cross-site scripting (XSS) vulnerability in display\_dialog.php in M2 OptimalSite 0.1 and 2.4 allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2015-1481](https://cve.now/CVE-2015-1481.md): Ansible Tower (aka Ansible UI) before 2.0.5 allows remote organization administrators to gain privileges by creating a superuser account. (no CVSS)
- [CVE-2015-1482](https://cve.now/CVE-2015-1482.md): Ansible Tower (aka Ansible UI) before 2.0.5 allows remote attackers to bypass authentication and obtain sensitive information via a websocke (no CVSS)
- [CVE-2014-7864](https://cve.now/CVE-2014-7864.md): Multiple SQL injection vulnerabilities in the FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine OpManager 8 through 11.5 (no CVSS)
- [CVE-2014-9331](https://cve.now/CVE-2014-9331.md): Cross-site request forgery (CSRF) vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote attackers to hijack (no CVSS)
- [CVE-2015-1437](https://cve.now/CVE-2015-1437.md): Multiple cross-site scripting (XSS) vulnerabilities in Asus RT-N10+ D1 router with firmware 2.1.1.1.70 allow remote attackers to inject arbi (no CVSS)
- [CVE-2015-1475](https://cve.now/CVE-2015-1475.md): Multiple cross-site scripting (XSS) vulnerabilities in my little forum 2.3.3, 2.2, and 1.7 allow remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2015-1476](https://cve.now/CVE-2015-1476.md): Multiple SQL injection vulnerabilities in xlinkerz ecommerceMajor allow remote attackers to execute arbitrary SQL commands via the (1) produ (no CVSS)
- [CVE-2015-1477](https://cve.now/CVE-2015-1477.md): SQL injection vulnerability in the CMSJunkie J-ClassifiedsManager component for Joomla! allows remote attackers to execute arbitrary SQL com (no CVSS)
- [CVE-2015-1478](https://cve.now/CVE-2015-1478.md): Cross-site scripting (XSS) vulnerability in the CMSJunkie J-ClassifiedsManager component for Joomla! allows remote attackers to inject arbit (no CVSS)
- [CVE-2015-1479](https://cve.now/CVE-2015-1479.md): SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote (no CVSS)
- [CVE-2015-1480](https://cve.now/CVE-2015-1480.md): ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to obtain sensitive ticket information via (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-02-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.