# CVEs published 2014-11-20

28 CVEs were published on November 20, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-3625](https://cve.now/CVE-2014-3625.md): Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before… (no CVSS, org.springframework:spring-webmvc)
- [CVE-2014-8493](https://cve.now/CVE-2014-8493.md): ZTE ZXHN H108L with firmware 4.0.0d\_ZRQ\_GR4 allows remote attackers to modify the CWMP configuration via a crafted request to… (no CVSS)
- [CVE-2014-8767](https://cve.now/CVE-2014-8767.md): Integer underflow in the olsr\_print function in tcpdump 3.9.6 through 4.6.2, when in verbose mode, allows remote attackers to cause a… (no CVSS)
- [CVE-2014-8768](https://cve.now/CVE-2014-8768.md): Multiple Integer underflows in the geonet\_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow remote attackers to… (no CVSS)
- [CVE-2014-8769](https://cve.now/CVE-2014-8769.md): tcpdump 3.8 through 4.6.2 might allow remote attackers to obtain sensitive information from memory or cause a denial of service (packet… (no CVSS)
- [CVE-2014-9019](https://cve.now/CVE-2014-9019.md): Multiple cross-site request forgery (CSRF) vulnerabilities in ZTE ZXDSL 831CII allow remote attackers to hijack the authentication of… (no CVSS)
- [CVE-2014-9020](https://cve.now/CVE-2014-9020.md): Cross-site scripting (XSS) vulnerability in the Quick Stats page (psilan.cgi) in ZTE ZXDSL 831 and 831CII allows remote attackers to… (no CVSS)
- [CVE-2014-9021](https://cve.now/CVE-2014-9021.md): Multiple cross-site scripting (XSS) vulnerabilities in ZTE ZXDSL 831 allow remote attackers to inject arbitrary web script or HTML via the… (no CVSS)
- [CVE-2014-9022](https://cve.now/CVE-2014-9022.md): The Webform Component Roles module 6.x-1.x before 6.x-1.8 and 7.x-1.x before 7.x-1.8 for Drupal allows remote attackers to bypass the… (no CVSS)
- [CVE-2014-9023](https://cve.now/CVE-2014-9023.md): The Twilio module 7.x-1.x before 7.x-1.9 for Drupal does not properly restrict access to the Twilio administration pages, which allows… (no CVSS)
- [CVE-2014-9024](https://cve.now/CVE-2014-9024.md): The Protected Pages module 7.x-2.x before 7.x-2.4 for Drupal allows remote attackers to bypass the password protection via a crafted path. (no CVSS)
- [CVE-2014-9025](https://cve.now/CVE-2014-9025.md): The default checkout completion rule in the commerce\_order module in the Drupal Commerce module 7.x-1.x before 7.x-1.10 for Drupal uses… (no CVSS)
- [CVE-2014-9026](https://cve.now/CVE-2014-9026.md): The Ubercart module 7.x-3.x before 7.x-3.7 for Drupal does not properly protect the per-user order history view, which allows remote… (no CVSS)
- [CVE-2014-9027](https://cve.now/CVE-2014-9027.md): Multiple cross-site request forgery (CSRF) vulnerabilities in ZTE ZXDSL 831CII allow remote attackers to hijack the authentication of… (no CVSS)
- [CVE-2014-2382](https://cve.now/CVE-2014-2382.md): The DfDiskLo.sys driver in Faronics Deep Freeze Standard and Enterprise 8.10 and earlier allows local administrators to cause a denial of… (no CVSS)
- [CVE-2014-8387](https://cve.now/CVE-2014-8387.md): cgi/utility.cgi in Advantech EKI-6340 2.05 Wi-Fi Mesh Access Point allows remote authenticated users to execute arbitrary commands via… (no CVSS)
- [CVE-2014-8995](https://cve.now/CVE-2014-8995.md): SQL injection vulnerability in Maarch LetterBox 2.8 allows remote attackers to execute arbitrary SQL commands via the UserId cookie. (no CVSS)
- [CVE-2014-8996](https://cve.now/CVE-2014-8996.md): Multiple cross-site scripting (XSS) vulnerabilities in Nibbleblog before 4.0.2 allow remote attackers to inject arbitrary web script or… (no CVSS)
- [CVE-2014-8997](https://cve.now/CVE-2014-8997.md): Unrestricted file upload vulnerability in the Photo functionality in DigitalVidhya Digi Online Examination System 2.0 allows remote… (no CVSS)
- [CVE-2014-8998](https://cve.now/CVE-2014-8998.md): lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a crafted HTTP header… (no CVSS)
- [CVE-2014-8999](https://cve.now/CVE-2014-8999.md): SQL injection vulnerability in htdocs/modules/system/admin.php in XOOPS before 2.5.7 Final allows remote authenticated users to execute… (no CVSS)
- [CVE-2014-9000](https://cve.now/CVE-2014-9000.md): Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote… (no CVSS)
- [CVE-2014-9001](https://cve.now/CVE-2014-9001.md): reminders/index.php in Incredible PBX 11 2.0.6.5.0 allows remote authenticated users to execute arbitrary commands via shell… (no CVSS)
- [CVE-2014-9002](https://cve.now/CVE-2014-9002.md): Lantronix xPrintServer does not properly restrict access to ips/, which allows remote attackers to execute arbitrary commands via the c… (no CVSS)
- [CVE-2014-9003](https://cve.now/CVE-2014-9003.md): Cross-site request forgery (CSRF) vulnerability in Lantronix xPrintServer allows remote attackers to hijack the authentication of… (no CVSS)
- [CVE-2014-9004](https://cve.now/CVE-2014-9004.md): Cross-site scripting (XSS) vulnerability in vldPersonals before 2.7.1 allows remote attackers to inject arbitrary web script or HTML via… (no CVSS)
- [CVE-2014-9005](https://cve.now/CVE-2014-9005.md): Multiple SQL injection vulnerabilities in vldPersonals before 2.7.1 allow remote attackers to execute arbitrary SQL commands via the (1)… (no CVSS)
- [CVE-2014-9006](https://cve.now/CVE-2014-9006.md): Monstra 3.0.1 and earlier uses a cookie to track how many login attempts have been attempted, which allows remote attackers to conduct… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2014-11-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.