# CVEs published 2014-08-07

25 CVEs were published on August 7, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2013-6771](https://cve.now/CVE-2013-6771.md): Directory traversal vulnerability in the collect script in Splunk before 5.0.5 allows remote attackers to execute arbitrary commands via a… (no CVSS)
- [CVE-2013-7394](https://cve.now/CVE-2013-7394.md): The "runshellscript echo.sh" script in Splunk before 5.0.5 allows remote authenticated users to execute arbitrary commands via a crafted… (no CVSS)
- [CVE-2014-3429](https://cve.now/CVE-2014-3429.md): IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute… (no CVSS, ipython)
- [CVE-2014-3459](https://cve.now/CVE-2014-3459.md): Heap-based buffer overflow in SolarWinds Network Configuration Manager (NCM) before 7.3 allows remote attackers to execute arbitrary code… (no CVSS)
- [CVE-2014-3517](https://cve.now/CVE-2014-3517.md): api/metadata/handler.py in OpenStack Compute (Nova) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2, when proxying… (no CVSS, nova)
- [CVE-2014-3771](https://cve.now/CVE-2014-3771.md): TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via the language file path in a (1) request to index.php or… (no CVSS)
- [CVE-2014-3772](https://cve.now/CVE-2014-3772.md): TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via a request to index.php followed by a direct request to a… (no CVSS)
- [CVE-2014-3773](https://cve.now/CVE-2014-3773.md): Multiple SQL injection vulnerabilities in TeamPass before 2.1.20 allow remote attackers to execute arbitrary SQL commands via the login… (no CVSS)
- [CVE-2014-3774](https://cve.now/CVE-2014-3774.md): Multiple cross-site scripting (XSS) vulnerabilities in items.php in TeamPass before 2.1.20 allow remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2014-3800](https://cve.now/CVE-2014-3800.md): XBMC 13.0 uses world-readable permissions for .xbmc/userdata/sources.xml, which allows local users to obtain user names and passwords by… (no CVSS)
- [CVE-2014-3851](https://cve.now/CVE-2014-3851.md): usr/lib/cgi-bin/create\_passwd\_file.py in Pyplate 0.08 uses world-readable permissions for passwd.db, which allows local users to obtain… (no CVSS)
- [CVE-2014-3852](https://cve.now/CVE-2014-3852.md): Pyplate 0.08 does not include the HTTPOnly flag in a Set-Cookie header for the id cookie, which makes it easier for remote attackers to… (no CVSS)
- [CVE-2014-3853](https://cve.now/CVE-2014-3853.md): Pyplate 0.08 does not set the secure flag for the id cookie in an https session, which makes it easier for remote attackers to capture… (no CVSS)
- [CVE-2014-3854](https://cve.now/CVE-2014-3854.md): Cross-site request forgery (CSRF) vulnerability in admin/addScript.py in Pyplate 0.08 allows remote attackers to hijack the authentication… (no CVSS)
- [CVE-2014-3855](https://cve.now/CVE-2014-3855.md): Directory traversal vulnerability in download.py in Pyplate 0.08 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2014-3914](https://cve.now/CVE-2014-3914.md): Directory traversal vulnerability in the Admin Center for Tivoli Storage Manager (TSM) in Rocket ServerGraph 1.2 allows remote attackers… (no CVSS)
- [CVE-2014-4647](https://cve.now/CVE-2014-4647.md): Stack-based buffer overflow in the loadExtensionFactory method in the TSVisualization ActiveX control in Embarcadero ER/Studio Data… (no CVSS)
- [CVE-2014-5188](https://cve.now/CVE-2014-5188.md): Cross-site scripting (XSS) vulnerability in doemailpassword.tml in Lyris ListManager (LM) 8.95a allows remote attackers to inject… (no CVSS)
- [CVE-2014-5189](https://cve.now/CVE-2014-5189.md): SQL injection vulnerability in lib/optin/optin\_page.php in the Lead Octopus plugin for WordPress allows remote attackers to execute… (no CVSS)
- [CVE-2014-5190](https://cve.now/CVE-2014-5190.md): Cross-site scripting (XSS) vulnerability in captcha-secureimage/test/index.php in the SI CAPTCHA Anti-Spam plugin 2.7.4 for WordPress… (no CVSS)
- [CVE-2014-5191](https://cve.now/CVE-2014-5191.md): Cross-site scripting (XSS) vulnerability in the Preview plugin before 4.4.3 in CKEditor allows remote attackers to inject arbitrary web… (no CVSS, ckeditor/ckeditor)
- [CVE-2014-5192](https://cve.now/CVE-2014-5192.md): SQL injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to execute arbitrary SQL commands via the filter… (no CVSS)
- [CVE-2014-5193](https://cve.now/CVE-2014-5193.md): Cross-site scripting (XSS) vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to inject arbitrary web script or… (no CVSS)
- [CVE-2014-5194](https://cve.now/CVE-2014-5194.md): Static code injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote authenticated users to inject arbitrary PHP code… (no CVSS)
- [CVE-2014-5195](https://cve.now/CVE-2014-5195.md): Unity before 7.2.3 and 7.3.x before 7.3.1, as used in Ubuntu, does not properly take focus of the keyboard when switching to the lock… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2014-08-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.