# CVEs published 2015-02-10

12 CVEs were published on February 10, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-1042](https://cve.now/CVE-2015-1042.md): The string\_sanitize\_url function in core/string\_api.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allow (no CVSS)
- [CVE-2015-1169](https://cve.now/CVE-2015-1169.md): Apereo Central Authentication Service (CAS) Server before 3.5.3 allows remote attackers to conduct LDAP injection attacks via a crafted user (no CVSS)
- [CVE-2015-1377](https://cve.now/CVE-2015-1377.md): The Read Mail module in Webmin 1.720 allows local users to read arbitrary files via a symlink attack on an unspecified file. (no CVSS)
- [CVE-2015-1569](https://cve.now/CVE-2015-1569.md): Fortinet FortiClient 5.2.028 for iOS does not validate certificates, which makes it easier for man-in-the-middle attackers to spoof SSL VPN (no CVSS)
- [CVE-2015-1570](https://cve.now/CVE-2015-1570.md): The Endpoint Control protocol implementation in Fortinet FortiClient 5.2.3.091 for Android and 5.2.028 for iOS does not validate certificate (no CVSS)
- [CVE-2015-1571](https://cve.now/CVE-2015-1571.md): The CAPWAP DTLS protocol implementation in Fortinet FortiOS 5.0 Patch 7 build 4457 uses the same certificate and private key across differen (no CVSS)
- [CVE-2014-8733](https://cve.now/CVE-2014-8733.md): Cloudera Manager 5.2.0, 5.2.1, and 5.3.0 stores the LDAP bind password in plaintext in unspecified world-readable files under /etc/hadoop, w (no CVSS)
- [CVE-2015-1031](https://cve.now/CVE-2015-1031.md): Multiple use-after-free vulnerabilities in Privoxy before 3.0.22 allow remote attackers to have unspecified impact via vectors related to (1 (no CVSS)
- [CVE-2015-1548](https://cve.now/CVE-2015-1548.md): mini\_httpd 1.21 and earlier allows remote attackers to obtain sensitive information from process memory via an HTTP request with a long prot (no CVSS)
- [CVE-2015-1431](https://cve.now/CVE-2015-1431.md): Cross-site scripting (XSS) vulnerability in includes/startup.php in phpBB before 3.0.13 allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2015-1432](https://cve.now/CVE-2015-1432.md): The message\_options function in includes/ucp/ucp\_pm\_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows (no CVSS)
- [CVE-2015-1559](https://cve.now/CVE-2015-1559.md): Multiple cross-site request forgery (CSRF) vulnerabilities in administrator.php in Epignosis eFront Open Source Edition before 3.6.15.3 buil (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-02-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.