# CVEs published 2014-12-02

26 CVEs were published on December 2, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-9182](https://cve.now/CVE-2014-9182.md): models/comment.php in Anchor CMS 0.9.2 and earlier allows remote attackers to inject arbitrary headers into mail messages via a crafted… (no CVSS)
- [CVE-2014-9183](https://cve.now/CVE-2014-9183.md): ZTE ZXDSL 831CII has a default password of admin for the admin account, which allows remote attackers to gain administrator privileges. (no CVSS)
- [CVE-2014-9184](https://cve.now/CVE-2014-9184.md): ZTE ZXDSL 831CII allows remote attackers to bypass authentication via a direct request to (1) main.cgi, (2) adminpasswd.cgi, (3)… (no CVSS)
- [CVE-2014-8728](https://cve.now/CVE-2014-8728.md): SQL injection vulnerability in the login page (login/login) in Subex ROC Fraud Management (aka Fraud Management System and FMS) 7.4 and… (no CVSS)
- [CVE-2014-8754](https://cve.now/CVE-2014-8754.md): Open redirect vulnerability in track-click.php in the Ad-Manager plugin 1.1.2 for WordPress allows remote attackers to redirect users to… (no CVSS)
- [CVE-2014-8788](https://cve.now/CVE-2014-8788.md): GleamTech FileVista before 6.1 allows remote authenticated users to obtain sensitive information via a crafted path when saving a zip… (no CVSS)
- [CVE-2014-8789](https://cve.now/CVE-2014-8789.md): GleamTech FileVista before 6.1 allows remote authenticated users to create arbitrary files and possibly execute arbitrary code via a… (no CVSS)
- [CVE-2014-8874](https://cve.now/CVE-2014-8874.md): The ke\_questionnaire extension 2.5.2 and earlier for TYPO3 uses predictable names for the questionnaire answer forms, which makes it… (no CVSS)
- [CVE-2014-9112](https://cve.now/CVE-2014-9112.md): Heap-based buffer overflow in the process\_copy\_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a… (no CVSS)
- [CVE-2014-9113](https://cve.now/CVE-2014-9113.md): CCH Wolters Kluwer ProSystem fx Engagement (aka PFX Engagement) 7.1 and earlier uses weak permissions (Authenticated Users: Modify and… (no CVSS)
- [CVE-2014-9116](https://cve.now/CVE-2014-9116.md): The write\_one\_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote… (no CVSS)
- [CVE-2014-9173](https://cve.now/CVE-2014-9173.md): SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote attackers to execute… (no CVSS)
- [CVE-2014-9174](https://cve.now/CVE-2014-9174.md): Cross-site scripting (XSS) vulnerability in the Google Analytics by Yoast (google-analytics-for-wordpress) plugin before 5.1.3 for… (no CVSS)
- [CVE-2014-9175](https://cve.now/CVE-2014-9175.md): SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote attackers to… (no CVSS)
- [CVE-2014-9176](https://cve.now/CVE-2014-9176.md): Cross-site scripting (XSS) vulnerability in the InstaSqueeze Sexy Squeeze Pages plugin for WordPress allows remote attackers to inject… (no CVSS)
- [CVE-2014-9177](https://cve.now/CVE-2014-9177.md): The HTML5 MP3 Player with Playlist Free plugin before 2.7 for WordPress allows remote attackers to obtain the installation path via a… (no CVSS)
- [CVE-2014-9178](https://cve.now/CVE-2014-9178.md): Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin… (no CVSS)
- [CVE-2014-9179](https://cve.now/CVE-2014-9179.md): Cross-site scripting (XSS) vulnerability in the SupportEzzy Ticket System plugin 1.2.5 for WordPress allows remote authenticated users to… (no CVSS)
- [CVE-2014-9180](https://cve.now/CVE-2014-9180.md): Open redirect vulnerability in go.php in Eleanor CMS allows remote attackers to redirect users to arbitrary web sites and conduct phishing… (no CVSS)
- [CVE-2014-9181](https://cve.now/CVE-2014-9181.md): Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2013-6494](https://cve.now/CVE-2013-6494.md): fedup 0.9.0 in Fedora 19, 20, and 21 uses a temporary directory with a static name for its download cache, which allows local users to… (no CVSS)
- [CVE-2014-3065](https://cve.now/CVE-2014-3065.md): Unspecified vulnerability in IBM Java Runtime Environment (JRE) 7 R1 before SR2 (7.1.2.0), 7 before SR8 (7.0.8.0), 6 R1 before SR8 FP2… (no CVSS)
- [CVE-2014-3068](https://cve.now/CVE-2014-3068.md): IBM Java Runtime Environment (JRE) 7 R1 before SR1 FP1 (7.1.1.1), 7 before SR7 FP1 (7.0.7.1), 6 R1 before SR8 FP1 (6.1.8.1), 6 before SR16… (no CVSS)
- [CVE-2014-3703](https://cve.now/CVE-2014-3703.md): OpenStack PackStack 2012.2.1, when the Open vSwitch (OVS) monolithic plug-in is not used, does not properly set the libvirt\_vif\_driver… (no CVSS)
- [CVE-2014-5284](https://cve.now/CVE-2014-5284.md): host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without verifying ownership, which allows local… (no CVSS)
- [CVE-2014-8791](https://cve.now/CVE-2014-8791.md): project/register.php in Tuleap before 7.7, when sys\_create\_project\_in\_one\_step is disabled, allows remote authenticated users to conduct… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2014-12-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.