# CVEs published 2015-02-17

13 CVEs were published on February 17, 2015: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2014-8757](https://cve.now/CVE-2014-8757.md): LG On-Screen Phone (OSP) before 4.3.010 allows remote attackers to bypass authorization via a crafted request. (no CVSS)
- [CVE-2014-9466](https://cve.now/CVE-2014-9466.md): Open-Xchange (OX) AppSuite and Server before 7.4.2-rev42, 7.6.0 before 7.6.0-rev36, and 7.6.1 before 7.6.1-rev14 does not properly handle di (no CVSS)
- [CVE-2015-0247](https://cve.now/CVE-2015-0247.md): Heap-based buffer overflow in openfs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code via (no CVSS)
- [CVE-2015-1427](https://cve.now/CVE-2015-1427.md): The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection me (CVSS 9.8, KEV, org.elasticsearch:elasticsearch)
- [CVE-2015-1494](https://cve.now/CVE-2015-1494.md): The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cro (no CVSS)
- [CVE-2015-1616](https://cve.now/CVE-2015-1616.md): SQL injection vulnerability in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows remote authenticated e (no CVSS)
- [CVE-2015-1617](https://cve.now/CVE-2015-1617.md): Cross-site scripting (XSS) vulnerability in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows remote au (no CVSS)
- [CVE-2015-1618](https://cve.now/CVE-2015-1618.md): The ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows remote authenticated users to obtain sensitive passwo (no CVSS)
- [CVE-2015-1619](https://cve.now/CVE-2015-1619.md): Cross-site scripting (XSS) vulnerability in the Secure Web Mail Client user interface in McAfee Email Gateway (MEG) 7.6.x before 7.6.3.2, 7. (no CVSS)
- [CVE-2015-1621](https://cve.now/CVE-2015-1621.md): Cross-site scripting (XSS) vulnerability in the Webform prepopulate block module before 7.x-3.1 for Drupal allows remote authenticated users (no CVSS)
- [CVE-2014-6102](https://cve.now/CVE-2014-6102.md): IBM Maximo Asset Management 7.1 through 7.1.1.13 and 7.5.0 before 7.5.0.6 IFIX008, Maximo Asset Management 7.5.0 through 7.5.0.3 and 7.5.1 t (no CVSS)
- [CVE-2014-6194](https://cve.now/CVE-2014-6194.md): Directory traversal vulnerability in an unspecified web form in IBM Maximo Asset Management 7.1 through 7.1.1.13 and 7.5.0 before 7.5.0.6 IF (no CVSS)
- [CVE-2014-8023](https://cve.now/CVE-2014-8023.md): Cisco Adaptive Security Appliance (ASA) Software 9.2(.3) and earlier, when challenge-response authentication is used, does not properly sele (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-02-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.