# CVEs published 2014-10-25

21 CVEs were published on October 25, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2013-4594](https://cve.now/CVE-2013-4594.md): The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote… (no CVSS)
- [CVE-2014-0476](https://cve.now/CVE-2014-0476.md): The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via… (no CVSS)
- [CVE-2014-3137](https://cve.now/CVE-2014-3137.md): Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote… (no CVSS, bottle)
- [CVE-2014-1927](https://cve.now/CVE-2014-1927.md): The shell\_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute… (no CVSS, python-gnupg)
- [CVE-2014-1928](https://cve.now/CVE-2014-1928.md): The shell\_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute… (no CVSS, python-gnupg)
- [CVE-2014-1929](https://cve.now/CVE-2014-1929.md): python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection… (no CVSS, python-gnupg)
- [CVE-2014-5075](https://cve.now/CVE-2014-5075.md): The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server… (no CVSS)
- [CVE-2014-3636](https://cve.now/CVE-2014-3636.md): D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of service (prevention of new… (no CVSS)
- [CVE-2014-3409](https://cve.now/CVE-2014-3409.md): The Ethernet Connectivity Fault Management (CFM) handling feature in Cisco IOS 12.2(33)SRE9a and earlier and IOS XE 3.13S and earlier… (no CVSS)
- [CVE-2014-4620](https://cve.now/CVE-2014-4620.md): The EMC NetWorker Module for MEDITECH (aka NMMEDI) 3.0 build 87 through 90, when EMC RecoverPoint and Plink are used, stores cleartext… (no CVSS)
- [CVE-2014-4623](https://cve.now/CVE-2014-4623.md): EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store (ADS) GEN4(S) and Avamar Virtual Edition (AVE), when Password Hardening before… (no CVSS)
- [CVE-2014-4624](https://cve.now/CVE-2014-4624.md): EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x through 7.0.2-43 do not require authentication for Java API… (no CVSS)
- [CVE-2014-6151](https://cve.now/CVE-2014-6151.md): CRLF injection vulnerability in IBM Tivoli Integrated Portal (TIP) 2.2.x allows remote authenticated users to inject arbitrary HTTP… (no CVSS)
- [CVE-2014-6152](https://cve.now/CVE-2014-6152.md): Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Integrated Portal (TIP) 2.2.x allow remote authenticated users to inject… (no CVSS)
- [CVE-2014-6611](https://cve.now/CVE-2014-6611.md): The BlackBerry World app before 5.0.0.262 on BlackBerry 10 OS 10.2.0, before 5.0.0.263 on BlackBerry 10 OS 10.2.1, and before 5.1.0.53 on… (no CVSS)
- [CVE-2014-2021](https://cve.now/CVE-2014-2021.md): Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.2.2 and earlier, and 5.0.x through 5.0.5 allows remote… (no CVSS)
- [CVE-2014-3604](https://cve.now/CVE-2014-3604.md): Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the… (no CVSS, ca.juliusdavies:not-yet-commons-ssl)
- [CVE-2014-6230](https://cve.now/CVE-2014-6230.md): WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the IP blacklist via a… (no CVSS)
- [CVE-2014-6251](https://cve.now/CVE-2014-6251.md): Stack-based buffer overflow in CPUMiner before 2.4.1 allows remote attackers to have an unspecified impact by sending a mining.subscribe… (no CVSS)
- [CVE-2014-7180](https://cve.now/CVE-2014-7180.md): Electric Cloud ElectricCommander before 4.2.6 and 5.x before 5.0.3 uses world-writable permissions for (1) eccert.pl and (2)… (no CVSS)
- [CVE-2014-8760](https://cve.now/CVE-2014-8760.md): ejabberd before 2.1.13 does not enforce the starttls\_required setting when compression is used, which causes clients to establish… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2014-10-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.