# CVEs published 2015-03-10

8 CVEs were published on March 10, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2014-8105](https://cve.now/CVE-2014-8105.md): 389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which (no CVSS)
- [CVE-2014-8112](https://cve.now/CVE-2014-8112.md): 389 Directory Server 1.3.1.x, 1.3.2.x before 1.3.2.27, and 1.3.3.x before 1.3.3.9 stores "unhashed" passwords even when the nsslapd-unhashed (no CVSS)
- [CVE-2014-9566](https://cve.now/CVE-2014-9566.md): Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwinds Orion Platform 20 (no CVSS)
- [CVE-2015-0201](https://cve.now/CVE-2015-0201.md): The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to se (no CVSS, org.springframework:spring-core)
- [CVE-2015-0271](https://cve.now/CVE-2015-0271.md): The log-viewing function in the Red Hat redhat-access-plugin before 6.0.3 for OpenStack Dashboard (horizon) allows remote attackers to read (no CVSS)
- [CVE-2015-2183](https://cve.now/CVE-2015-2183.md): Multiple SQL injection vulnerabilities in the administrative backend in ZeusCart 4 allow remote administrators to execute arbitrary SQL comm (no CVSS)
- [CVE-2015-2184](https://cve.now/CVE-2015-2184.md): ZeusCart 4 allows remote attackers to obtain configuration information via a getphpinfo action to admin/, which calls the phpinfo function. (no CVSS)
- [CVE-2015-2217](https://cve.now/CVE-2015-2217.md): Multiple cross-site scripting (XSS) vulnerabilities in Ultimate PHP Board (aka myUPB) before 2.2.8 allow remote attackers to inject arbitrar (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-03-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.