# CVEs published 2014-12-15

27 CVEs were published on December 15, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-1569](https://cve.now/CVE-2014-1569.md): The definite\_length\_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before… (no CVSS)
- [CVE-2014-3583](https://cve.now/CVE-2014-3583.md): The handle\_headers function in mod\_proxy\_fcgi.c in the mod\_proxy\_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI… (no CVSS)
- [CVE-2014-6052](https://cve.now/CVE-2014-6052.md): The HandleRFBServerMessage function in libvncclient/rfbproto.c in LibVNCServer 0.9.9 and earlier does not check certain malloc return… (no CVSS)
- [CVE-2014-6053](https://cve.now/CVE-2014-6053.md): The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier does not properly handle attempts… (no CVSS)
- [CVE-2014-6253](https://cve.now/CVE-2014-6253.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Zenoss Core through 5 Beta 3 allow remote attackers to hijack the… (no CVSS)
- [CVE-2014-6254](https://cve.now/CVE-2014-6254.md): Multiple cross-site scripting (XSS) vulnerabilities in Zenoss Core through 5 Beta 3 allow remote attackers to inject arbitrary web script… (no CVSS)
- [CVE-2014-6255](https://cve.now/CVE-2014-6255.md): Open redirect vulnerability in the login form in Zenoss Core before 4.2.5 SP161 allows remote attackers to redirect users to arbitrary web… (no CVSS)
- [CVE-2014-6256](https://cve.now/CVE-2014-6256.md): Zenoss Core through 5 Beta 3 allows remote attackers to bypass intended access restrictions and place files in a directory with public (1)… (no CVSS)
- [CVE-2014-6257](https://cve.now/CVE-2014-6257.md): Zenoss Core through 5 Beta 3 allows remote attackers to bypass intended access restrictions by using a web-endpoint URL to invoke an… (no CVSS)
- [CVE-2014-6258](https://cve.now/CVE-2014-6258.md): An unspecified endpoint in Zenoss Core through 5 Beta 3 allows remote attackers to cause a denial of service (CPU consumption) by… (no CVSS)
- [CVE-2014-6259](https://cve.now/CVE-2014-6259.md): Zenoss Core through 5 Beta 3 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial… (no CVSS)
- [CVE-2014-6260](https://cve.now/CVE-2014-6260.md): Zenoss Core through 5 Beta 3 does not require a password for modifying the pager command string, which allows remote attackers to execute… (no CVSS)
- [CVE-2014-6261](https://cve.now/CVE-2014-6261.md): Zenoss Core through 5 Beta 3 does not properly implement the Check For Updates feature, which allows remote attackers to execute arbitrary… (no CVSS)
- [CVE-2014-7911](https://cve.now/CVE-2014-7911.md): luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.0 does not verify… (no CVSS)
- [CVE-2014-8507](https://cve.now/CVE-2014-8507.md): Multiple SQL injection vulnerabilities in the queryLastApp method in packages/WAPPushManager/src/com/android/smspush/WapPushManager.java… (no CVSS)
- [CVE-2014-8609](https://cve.now/CVE-2014-8609.md): The addAccount method in src/com/android/settings/accounts/AddAccountSettings.java in the Settings application in Android before 5.0.0… (no CVSS)
- [CVE-2014-8610](https://cve.now/CVE-2014-8610.md): AndroidManifest.xml in Android before 5.0.0 does not require the SEND\_SMS permission for the SmsReceiver receiver, which allows attackers… (no CVSS)
- [CVE-2014-8967](https://cve.now/CVE-2014-8967.md): Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute arbitrary code via a crafted HTML document… (no CVSS)
- [CVE-2014-9245](https://cve.now/CVE-2014-9245.md): Zenoss Core through 5 Beta 3 allows remote attackers to obtain sensitive information by attempting a product-rename action with an invalid… (no CVSS)
- [CVE-2014-9247](https://cve.now/CVE-2014-9247.md): Zenoss Core through 5 Beta 3 allows remote authenticated users to obtain sensitive (1) user account, (2) e-mail address, and (3) role… (no CVSS)
- [CVE-2014-9248](https://cve.now/CVE-2014-9248.md): Zenoss Core through 5 Beta 3 does not require complex passwords, which makes it easier for remote attackers to obtain access via a… (no CVSS)
- [CVE-2014-9249](https://cve.now/CVE-2014-9249.md): The default configuration of Zenoss Core before 5 allows remote attackers to read or modify database information by connecting to… (no CVSS)
- [CVE-2014-9250](https://cve.now/CVE-2014-9250.md): Zenoss Core through 5 Beta 3 does not include the HTTPOnly flag in a Set-Cookie header for the authentication cookie, which makes it… (no CVSS)
- [CVE-2014-9251](https://cve.now/CVE-2014-9251.md): Zenoss Core through 5 Beta 3 uses a weak algorithm to hash passwords, which makes it easier for context-dependent attackers to obtain… (no CVSS)
- [CVE-2014-9252](https://cve.now/CVE-2014-9252.md): Zenoss Core through 5 Beta 3 stores cleartext passwords in the session database, which might allow local users to obtain sensitive… (no CVSS)
- [CVE-2014-9385](https://cve.now/CVE-2014-9385.md): Cross-site request forgery (CSRF) vulnerability in Zenoss Core through 5 Beta 3 allows remote attackers to hijack the authentication of… (no CVSS)
- [CVE-2014-9386](https://cve.now/CVE-2014-9386.md): Zenoss Core before 4.2.5 SP161 sets an infinite lifetime for the session ID cookie, which makes it easier for remote attackers to hijack… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2014-12-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.