# CVEs published 2014-08-12

79 CVEs were published on August 12, 2014: 0 critical, 2 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2014-1222](https://cve.now/CVE-2014-1222.md): Directory traversal vulnerability in kcfinder/browse.php in Vtiger CRM before 6.0.0 Security patch 1 allows remote authenticated users to re (no CVSS)
- [CVE-2014-3251](https://cve.now/CVE-2014-3251.md): The MCollective aes\_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new (no CVSS)
- [CVE-2014-3338](https://cve.now/CVE-2014-3338.md): The CTIManager module in Cisco Unified Communications Manager (CM) 10.0(1), when single sign-on is enabled, does not properly validate Kerbe (no CVSS)
- [CVE-2014-3339](https://cve.now/CVE-2014-3339.md): Multiple SQL injection vulnerabilities in the administrative web interface in Cisco Unified Communications Manager (CM) and Cisco Unified Pr (no CVSS)
- [CVE-2014-3901](https://cve.now/CVE-2014-3901.md): Raritan Japan Dominion KX2-101 switches before 2 allow remote attackers to cause a denial of service (device hang) via a crafted packet. (no CVSS)
- [CVE-2014-5202](https://cve.now/CVE-2014-5202.md): Cross-site scripting (XSS) vulnerability in compfight-search.php in the Compfight plugin 1.4 for WordPress allows remote authenticated users (no CVSS)
- [CVE-2014-0538](https://cve.now/CVE-2014-0538.md): Use-after-free vulnerability in Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 (no CVSS)
- [CVE-2014-0540](https://cve.now/CVE-2014-0540.md): Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0. (no CVSS)
- [CVE-2014-0541](https://cve.now/CVE-2014-0541.md): Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0. (no CVSS)
- [CVE-2014-0542](https://cve.now/CVE-2014-0542.md): Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0. (no CVSS)
- [CVE-2014-0543](https://cve.now/CVE-2014-0543.md): Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0. (no CVSS)
- [CVE-2014-0544](https://cve.now/CVE-2014-0544.md): Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0. (no CVSS)
- [CVE-2014-0545](https://cve.now/CVE-2014-0545.md): Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0. (no CVSS)
- [CVE-2014-3337](https://cve.now/CVE-2014-3337.md): The SIP implementation in Cisco Unified Communications Manager (CM) 8.6(.2) and earlier allows remote authenticated users to cause a denial (no CVSS)
- [CVE-2014-0316](https://cve.now/CVE-2014-0316.md): Memory leak in the Local RPC (LRPC) server implementation in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Wi (no CVSS)
- [CVE-2014-0318](https://cve.now/CVE-2014-0318.md): win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 (no CVSS)
- [CVE-2014-0546](https://cve.now/CVE-2014-0546.md): Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows allow attackers to bypass a sandbox protection mechanism, an (CVSS 8.8, KEV)
- [CVE-2014-1814](https://cve.now/CVE-2014-1814.md): The Windows Installer in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, (no CVSS)
- [CVE-2014-1819](https://cve.now/CVE-2014-1819.md): win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 (no CVSS)
- [CVE-2014-1820](https://cve.now/CVE-2014-1820.md): Cross-site scripting (XSS) vulnerability in Master Data Services (MDS) in Microsoft SQL Server 2012 SP1 and 2014 on 64-bit platforms allows (no CVSS)
- [CVE-2014-2774](https://cve.now/CVE-2014-2774.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2014-2784](https://cve.now/CVE-2014-2784.md): Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2014-2796](https://cve.now/CVE-2014-2796.md): Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (no CVSS)
- [CVE-2014-2808](https://cve.now/CVE-2014-2808.md): Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (no CVSS)
- [CVE-2014-2810](https://cve.now/CVE-2014-2810.md): Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS)
- [CVE-2014-2811](https://cve.now/CVE-2014-2811.md): Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS)
- [CVE-2014-2815](https://cve.now/CVE-2014-2815.md): Microsoft OneNote 2007 SP3 allows remote attackers to execute arbitrary code via a crafted OneNote file that triggers creation of an executa (no CVSS)
- [CVE-2014-2816](https://cve.now/CVE-2014-2816.md): Microsoft SharePoint Server 2013 Gold and SP1 and SharePoint Foundation 2013 Gold and SP1 allow remote authenticated users to gain privilege (no CVSS)
- [CVE-2014-2817](https://cve.now/CVE-2014-2817.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation (CVSS 8.8, KEV)
- [CVE-2014-2818](https://cve.now/CVE-2014-2818.md): Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS)
- [CVE-2014-2819](https://cve.now/CVE-2014-2819.md): Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation (no CVSS)
- [CVE-2014-2820](https://cve.now/CVE-2014-2820.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2014-2821](https://cve.now/CVE-2014-2821.md): Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a (no CVSS)
- [CVE-2014-2822](https://cve.now/CVE-2014-2822.md): Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS)
- [CVE-2014-2823](https://cve.now/CVE-2014-2823.md): Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS)
- [CVE-2014-2824](https://cve.now/CVE-2014-2824.md): Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft (no CVSS)
- [CVE-2014-2825](https://cve.now/CVE-2014-2825.md): Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (no CVSS)
- [CVE-2014-2826](https://cve.now/CVE-2014-2826.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2014-2827](https://cve.now/CVE-2014-2827.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2014-4050](https://cve.now/CVE-2014-4050.md): Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (no CVSS)
- [CVE-2014-4051](https://cve.now/CVE-2014-4051.md): Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2014-4052](https://cve.now/CVE-2014-4052.md): Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (no CVSS)
- [CVE-2014-4055](https://cve.now/CVE-2014-4055.md): Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (no CVSS)
- [CVE-2014-4056](https://cve.now/CVE-2014-4056.md): Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2014-4057](https://cve.now/CVE-2014-4057.md): Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS)
- [CVE-2014-4058](https://cve.now/CVE-2014-4058.md): Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2014-4060](https://cve.now/CVE-2014-4060.md): Use-after-free vulnerability in MCPlayer.dll in Microsoft Windows Media Center TV Pack for Windows Vista, Windows 7 SP1, and Windows Media C (no CVSS)
- [CVE-2014-4061](https://cve.now/CVE-2014-4061.md): Microsoft SQL Server 2008 SP3, 2008 R2 SP2, and 2012 SP1 does not properly control use of stack memory for processing of T-SQL batch command (no CVSS)
- [CVE-2014-4062](https://cve.now/CVE-2014-4062.md): Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, and 3.5.1 does not properly implement the ASLR protection mechanism, which allows r (no CVSS)
- [CVE-2014-4063](https://cve.now/CVE-2014-4063.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2014-4064](https://cve.now/CVE-2014-4064.md): The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows S (no CVSS)
- [CVE-2014-4067](https://cve.now/CVE-2014-4067.md): Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (no CVSS)
- [CVE-2011-2593](https://cve.now/CVE-2011-2593.md): Integer overflow in the StartEpa method in the nsepacom ActiveX control (nsepa.exe) in Citrix Access Gateway Enterprise Edition Plug-in for (no CVSS)
- [CVE-2011-2944](https://cve.now/CVE-2011-2944.md): SQL injection vulnerability in login.php in MegaLab The Uploader before 2.0.5 allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2012-4241](https://cve.now/CVE-2012-4241.md): Multiple cross-site scripting (XSS) vulnerabilities in Microcart 1.0 allow remote attackers to inject arbitrary web script or HTML via the ( (no CVSS)
- [CVE-2014-5196](https://cve.now/CVE-2014-5196.md): Cross-site request forgery (CSRF) vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend (no CVSS)
- [CVE-2014-5197](https://cve.now/CVE-2014-5197.md): Directory traversal vulnerability in (1) Splunk Web or the (2) Splunkd HTTP Server in Splunk Enterprise 6.1.x before 6.1.3 allows remote aut (no CVSS)
- [CVE-2014-5198](https://cve.now/CVE-2014-5198.md): Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.1.x before 6.1.3 allows remote attackers to inject arbitrary w (no CVSS)
- [CVE-2014-5199](https://cve.now/CVE-2014-5199.md): Cross-site request forgery (CSRF) vulnerability in the WordPress File Upload plugin (wp-file-upload) before 2.4.2 for WordPress allows remot (no CVSS)
- [CVE-2014-5200](https://cve.now/CVE-2014-5200.md): SQL injection vulnerability in game\_play.php in the FB Gorilla plugin for WordPress allows remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2014-5201](https://cve.now/CVE-2014-5201.md): SQL injection vulnerability in the Gallery Objects plugin 0.4 for WordPress allows remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2007-6756](https://cve.now/CVE-2007-6756.md): ZOLL Defibrillator / Monitor M Series, E Series, and R Series have a default password for System Configuration mode, which allows physically (no CVSS)
- [CVE-2013-7395](https://cve.now/CVE-2013-7395.md): ZOLL Defibrillator / Monitor X Series has a default (1) supervisor password and (2) service password, which allows physically proximate atta (no CVSS)
- [CVE-2014-2629](https://cve.now/CVE-2014-2629.md): HP NonStop Safeguard Security Software G, H06.03 through H06.28.01, and J06.03 through J06.17.01 does not properly evaluate the DISKFILE-PAT (no CVSS)
- [CVE-2014-3072](https://cve.now/CVE-2014-3072.md): Unspecified vulnerability in the Automation Server in IBM Security AppScan Source 8 through 8.0.0.2, 8.5 through 8.5.0.1, 8.6 through 8.6.0. (no CVSS)
- [CVE-2014-0953](https://cve.now/CVE-2014-0953.md): Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.0 through 6.1.0.6 CF27, 6.1.5.0 through 6.1.5.3 CF27, 7.0.0 through 7 (no CVSS)
- [CVE-2014-2630](https://cve.now/CVE-2014-2630.md): Unspecified vulnerability in HP Operations Agent 11.00, when Glance is used, allows local users to gain privileges via unknown vectors. (no CVSS)
- [CVE-2014-3102](https://cve.now/CVE-2014-3102.md): Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.0.0 through 7.0.0.2 CF28 and 8.0.0 before 8.0.0.1 CF13 allows remote auth (no CVSS)
- [CVE-2014-3899](https://cve.now/CVE-2014-3899.md): Gretech GOM Player 2.2.51.5149 and earlier allows remote attackers to cause a denial of service (launch outage) via a crafted image file. (no CVSS)
- [CVE-2014-4746](https://cve.now/CVE-2014-4746.md): IBM WebSphere Portal 8.0.0 before 8.0.0.1 CF13 and 8.5.0 through CF01 provides different error codes for firewall-traversal requests dependi (no CVSS)
- [CVE-2014-4751](https://cve.now/CVE-2014-4751.md): Cross-site scripting (XSS) vulnerability in IBM Security Access Manager for Mobile 8.0.0.0, 8.0.0.1, and 8.0.0.3 allows remote attackers to (no CVSS)
- [CVE-2014-4760](https://cve.now/CVE-2014-4760.md): Open redirect vulnerability in IBM WebSphere Portal 6.1.0.0 through 6.1.0.6 CF27, 6.1.5.0 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF28, (no CVSS)
- [CVE-2013-5433](https://cve.now/CVE-2013-5433.md): The Data Growth Solution for JD Edwards EnterpriseOne in IBM InfoSphere Optim 3.0 through 9.1 has hardcoded database credentials, which allo (no CVSS)
- [CVE-2014-2628](https://cve.now/CVE-2014-2628.md): Unspecified vulnerability in HP Enterprise Maps 1 allows remote authenticated users to obtain sensitive information via unknown vectors. (no CVSS)
- [CVE-2014-2631](https://cve.now/CVE-2014-2631.md): Unspecified vulnerability in HP Application Lifecycle Management (aka Quality Center) 11.5x and 12.0x allows local users to gain privileges (no CVSS)
- [CVE-2014-3031](https://cve.now/CVE-2014-3031.md): Cross-site scripting (XSS) vulnerability in IBM Tivoli Business Service Manager 4.2.0 before 4.2.0.0 IF12 and 4.2.1 before 4.2.1.3 IF9 allow (no CVSS)
- [CVE-2014-3069](https://cve.now/CVE-2014-3069.md): Multiple CRLF injection vulnerabilities in the Universal Access component in IBM Curam Social Program Management (SPM) 6.0.5.5, when WebSphe (no CVSS)
- [CVE-2014-3086](https://cve.now/CVE-2014-3086.md): Unspecified vulnerability in the IBM Java Virtual Machine, as used in IBM WebSphere Real Time 3 before Service Refresh 7 FP1 and other produ (no CVSS)
- [CVE-2014-4757](https://cve.now/CVE-2014-4757.md): The Outlook Extension in IBM Content Collector 4.0.0.x before 4.0.0.0-ICC-OE-IF004 allows local users to bypass the intended Reviewer privil (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-08-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.