# CVEs published 2014-11-28

16 CVEs were published on November 28, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-7178](https://cve.now/CVE-2014-7178.md): Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the… (no CVSS)
- [CVE-2014-7850](https://cve.now/CVE-2014-7850.md): Cross-site scripting (XSS) vulnerability in the Web UI in FreeIPA 4.x before 4.1.2 allows remote attackers to inject arbitrary web script… (no CVSS)
- [CVE-2014-8423](https://cve.now/CVE-2014-8423.md): Unspecified vulnerability in the management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to execute arbitrary commands… (no CVSS)
- [CVE-2014-8424](https://cve.now/CVE-2014-8424.md): ARRIS VAP2500 before FW08.41 does not properly validate passwords, which allows remote attackers to bypass authentication. (no CVSS)
- [CVE-2014-8425](https://cve.now/CVE-2014-8425.md): The management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to obtain credentials by reading the configuration files. (no CVSS)
- [CVE-2014-8429](https://cve.now/CVE-2014-8429.md): Cross-site request forgery (CSRF) vulnerability in Xavoc Technocrats xEpan CMS 1.0.4.1, 1.0.4, 1.0.1, and earlier allows remote attackers… (no CVSS)
- [CVE-2014-8799](https://cve.now/CVE-2014-8799.md): Directory traversal vulnerability in the dp\_img\_resize function in php/dp-functions.php in the DukaPress plugin before 2.5.4 for WordPress… (no CVSS)
- [CVE-2014-8801](https://cve.now/CVE-2014-8801.md): Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote… (no CVSS)
- [CVE-2014-8994](https://cve.now/CVE-2014-8994.md): The check\_diskio plugin 3.2.6 and earlier for Nagios and Icinga allows local users to write to arbitrary files via a symlink attack on a… (no CVSS)
- [CVE-2014-9089](https://cve.now/CVE-2014-9089.md): Multiple SQL injection vulnerabilities in view\_all\_bug\_page.php in MantisBT before 1.2.18 allow remote attackers to execute arbitrary SQL… (no CVSS)
- [CVE-2014-3407](https://cve.now/CVE-2014-3407.md): The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.3(.2) and earlier does not properly allocate memory… (no CVSS)
- [CVE-2014-4829](https://cve.now/CVE-2014-4829.md): Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before… (no CVSS)
- [CVE-2014-4831](https://cve.now/CVE-2014-4831.md): IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2… (no CVSS)
- [CVE-2014-4832](https://cve.now/CVE-2014-4832.md): IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2… (no CVSS)
- [CVE-2014-4883](https://cve.now/CVE-2014-4883.md): resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and… (no CVSS)
- [CVE-2014-6075](https://cve.now/CVE-2014-6075.md): IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2014-11-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.