# CVEs published 2015-02-13 20 CVEs were published on February 13, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2013-2027](https://cve.now/CVE-2013-2027.md): Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restr (no CVSS, org.python:jython-standalone) - [CVE-2014-0151](https://cve.now/CVE-2014-0151.md): Cross-site request forgery (CSRF) vulnerability in oVirt Engine before 3.5.0 beta2 allows remote attackers to hijack the authentication of u (no CVSS) - [CVE-2014-0154](https://cve.now/CVE-2014-0154.md): oVirt Engine before 3.5.0 does not include the HTTPOnly flag in a Set-Cookie header for the session IDs, which makes it easier for remote at (no CVSS) - [CVE-2014-7827](https://cve.now/CVE-2014-7827.md): The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application Platform (no CVSS) - [CVE-2014-7849](https://cve.now/CVE-2014-7849.md): The Role Based Access Control (RBAC) implementation in JBoss Enterprise Application Platform (EAP) 6.2.0 through 6.3.2 does not properly ver (no CVSS) - [CVE-2014-7853](https://cve.now/CVE-2014-7853.md): The JBoss Application Server (WildFly) JacORB subsystem in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 does not properl (no CVSS) - [CVE-2014-8122](https://cve.now/CVE-2014-8122.md): Race condition in JBoss Weld before 2.2.8 and 3.x before 3.0.0 Alpha3 allows remote attackers to obtain information from a previous conversa (no CVSS, org.jboss.weld:weld-core-bom) - [CVE-2015-0245](https://cve.now/CVE-2015-0245.md): D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure sign (no CVSS) - [CVE-2015-0255](https://cve.now/CVE-2015-0255.md): X.Org Server (aka xserver and xorg-server) before 1.16.3 and 1.17.x before 1.17.1 allows remote attackers to obtain sensitive information fr (no CVSS) - [CVE-2014-4771](https://cve.now/CVE-2014-4771.md): IBM WebSphere MQ 7.0.1 before 7.0.1.13, 7.1 before 7.1.0.6, 7.5 before 7.5.0.5, and 8 before 8.0.0.1 allows remote authenticated users to ca (no CVSS) - [CVE-2014-4781](https://cve.now/CVE-2014-4781.md): The alert module in IBM InfoSphere BigInsights 2.1.2 and 3.x before 3.0.0.2 allows remote attackers to obtain sensitive Alert management-ser (no CVSS) - [CVE-2014-4803](https://cve.now/CVE-2014-4803.md): CRLF injection vulnerability in the Universal Access implementation in IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before (no CVSS) - [CVE-2014-4813](https://cve.now/CVE-2014-4813.md): Race condition in the client in IBM Tivoli Storage Manager (TSM) 5.4.0.0 through 5.4.3.6, 5.5.0.0 through 5.5.4.3, 6.1.0.0 through 6.1.5.6, (no CVSS) - [CVE-2014-6139](https://cve.now/CVE-2014-6139.md): The Search REST API in IBM Business Process Manager 8.0.1.3, 8.5.0.1, and 8.5.5.0 allows remote authenticated users to bypass intended acces (no CVSS) - [CVE-2014-6154](https://cve.now/CVE-2014-6154.md): Directory traversal vulnerability in IBM Optim Performance Manager for DB2 4.1.0.1 through 4.1.1 on Linux, UNIX, and Windows and IBM InfoSph (no CVSS) - [CVE-2014-6185](https://cve.now/CVE-2014-6185.md): dsmtca in the client in IBM Tivoli Storage Manager (TSM) 6.3 before 6.3.2.3, 6.4 before 6.4.2.2, and 7.1 before 7.1.1.3 does not properly re (no CVSS) - [CVE-2014-8385](https://cve.now/CVE-2014-8385.md): Buffer overflow on Advantech EKI-1200 gateways with firmware before 1.63 allows remote attackers to execute arbitrary code via unspecified v (no CVSS) - [CVE-2014-8909](https://cve.now/CVE-2014-8909.md): Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through (no CVSS) - [CVE-2015-0593](https://cve.now/CVE-2015-0593.md): The Zone-Based Firewall implementation in Cisco IOS 12.4(122)T and earlier does not properly manage session-object structures, which allows (no CVSS) - [CVE-2015-0873](https://cve.now/CVE-2015-0873.md): Cross-site scripting (XSS) vulnerability in Homepage Decorator PerlTreeBBS 2.30 and earlier allows remote attackers to inject arbitrary web (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-02-13 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.