# CVEs published 2015-02-19

32 CVEs were published on February 19, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2014-3578](https://cve.now/CVE-2014-3578.md): Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrar (no CVSS, org.springframework:spring-core)
- [CVE-2012-6687](https://cve.now/CVE-2012-6687.md): FastCGI (aka fcgi and libfcgi) 2.4.0 allows remote attackers to cause a denial of service (segmentation fault and crash) via a large number (no CVSS)
- [CVE-2014-1831](https://cve.now/CVE-2014-1831.md): Phusion Passenger before 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control\_process.pid (no CVSS, passenger)
- [CVE-2014-1832](https://cve.now/CVE-2014-1832.md): Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control\_process.pid or a ( (no CVSS, passenger)
- [CVE-2014-8165](https://cve.now/CVE-2014-8165.md): scripts/amsvis/powerpcAMS/amsnet.py in powerpc-utils-python uses the pickle Python module unsafely, which allows remote attackers to execute (no CVSS)
- [CVE-2014-8690](https://cve.now/CVE-2014-8690.md): Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, and 2.3.x before 2.3.1 (no CVSS)
- [CVE-2014-9465](https://cve.now/CVE-2014-9465.md): senddocument.php in Zarafa WebApp before 2.0 beta 3 and WebAccess in Zarafa Collaboration Platform (ZCP) 7.x before 7.1.12 beta 1 and 7.2.x (no CVSS)
- [CVE-2014-9468](https://cve.now/CVE-2014-9468.md): Multiple cross-site scripting (XSS) vulnerabilities in InstantASP InstantForum.NET 4.1.3, 4.1.2, 4.1.1, 4.0.0, 4.1.0, and 3.4.0 allow remote (no CVSS)
- [CVE-2014-9679](https://cve.now/CVE-2014-9679.md): Integer underflow in the cupsRasterReadPixels function in filter/raster.c in CUPS before 2.0.2 allows remote attackers to have unspecified i (no CVSS)
- [CVE-2015-1515](https://cve.now/CVE-2015-1515.md): The dwall.sys driver in SoftSphere DefenseWall Personal Firewall 3.24 allows local users to write data to arbitrary memory locations, and co (no CVSS)
- [CVE-2015-1585](https://cve.now/CVE-2015-1585.md): Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the authentici (no CVSS, fat\_free\_crm)
- [CVE-2015-1587](https://cve.now/CVE-2015-1587.md): Unrestricted file upload vulnerability in file\_to\_index.php in Maarch LetterBox 2.8 and earlier and GEC/GED 1.4 and earlier allows remote at (no CVSS)
- [CVE-2015-1592](https://cve.now/CVE-2015-1592.md): Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::t (no CVSS)
- [CVE-2015-1603](https://cve.now/CVE-2015-1603.md): Multiple cross-site scripting (XSS) vulnerabilities in Adminsystems CMS before 4.0.2 allow remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2015-1604](https://cve.now/CVE-2015-1604.md): Unrestricted file upload vulnerability in asys/site/files.php in Adminsystems CMS before 4.0.2 allows remote authenticated users to execute (no CVSS)
- [CVE-2015-1614](https://cve.now/CVE-2015-1614.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Image Metadata Cruncher plugin for WordPress allow remote attackers to hij (no CVSS)
- [CVE-2015-1879](https://cve.now/CVE-2015-1879.md): Cross-site scripting (XSS) vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arb (no CVSS)
- [CVE-2014-5352](https://cve.now/CVE-2014-5352.md): The krb5\_gss\_process\_context\_token function in lib/gssapi/krb5/process\_context\_token.c in the libgssapi\_krb5 library in MIT Kerberos 5 (aka (no CVSS)
- [CVE-2014-6301](https://cve.now/CVE-2014-6301.md): Multiple cross-site scripting (XSS) vulnerabilities in the tables-management module in PNMsoft Sequence Kinetics before 7.7 allow remote att (no CVSS)
- [CVE-2014-6302](https://cve.now/CVE-2014-6302.md): The Monitoring Administration pages in PNMsoft Sequence Kinetics before 7.7 allow remote attackers to read arbitrary files via an XML extern (no CVSS)
- [CVE-2014-6303](https://cve.now/CVE-2014-6303.md): The Monitoring Administration pages in PNMsoft Sequence Kinetics before 7.7 do not properly detect recursion during entity expansion, which (no CVSS)
- [CVE-2014-6304](https://cve.now/CVE-2014-6304.md): The Form Controls CSS file in PNMsoft Sequence Kinetics before 7.7 allows remote attackers to obtain sensitive source-code information via u (no CVSS)
- [CVE-2014-9421](https://cve.now/CVE-2014-9421.md): The auth\_gssapi\_unwrap\_data function in lib/rpc/auth\_gssapi\_misc.c in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1 (no CVSS)
- [CVE-2014-9422](https://cve.now/CVE-2014-9422.md): The check\_rpcsec\_auth function in kadmin/server/kadm\_rpc\_svc.c in kadmind in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2 (no CVSS)
- [CVE-2014-9423](https://cve.now/CVE-2014-9423.md): The svcauth\_gss\_accept\_sec\_context function in lib/rpc/svc\_auth\_gss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5, 1.12.x through 1.1 (no CVSS)
- [CVE-2014-5286](https://cve.now/CVE-2014-5286.md): The ActiveMatrix Policy Manager Authentication module in TIBCO ActiveMatrix Policy Agent 3.x before 3.1.2, ActiveMatrix Policy Manager 3.x b (no CVSS)
- [CVE-2014-6147](https://cve.now/CVE-2014-6147.md): IBM Flex System Manager (FSM) 1.1.x.x, 1.2.0.x, 1.2.1.x, 1.3.0.0, 1.3.1.0, and 1.3.2.0 allows local users to obtain sensitive information, a (no CVSS)
- [CVE-2015-1349](https://cve.now/CVE-2015-1349.md): named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC validation and the managed-keys feature are e (no CVSS)
- [CVE-2015-0622](https://cve.now/CVE-2015-0622.md): The Wireless Intrusion Detection (aka WIDS) functionality on Cisco Wireless LAN Controller (WLC) devices allows remote attackers to cause a (no CVSS)
- [CVE-2015-0623](https://cve.now/CVE-2015-0623.md): Cross-site scripting (XSS) vulnerability in the Administrator report page on Cisco Web Security Appliance (WSA) devices allows remote attack (no CVSS)
- [CVE-2015-0626](https://cve.now/CVE-2015-0626.md): The SOAP interface in Cisco Hosted Collaboration Solution (HCS) allows remote attackers to obtain access to system-management tools via craf (no CVSS)
- [CVE-2015-1197](https://cve.now/CVE-2015-1197.md): cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-02-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.