# CVEs published 2014-08-14

24 CVEs were published on August 14, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-5248](https://cve.now/CVE-2014-5248.md): Cross-site scripting (XSS) vulnerability in MyBB before 1.6.15 allows remote attackers to inject arbitrary web script or HTML via vectors re (no CVSS)
- [CVE-2014-5249](https://cve.now/CVE-2014-5249.md): SQL injection vulnerability in the "Biblio self autocomplete" submodule in the Biblio Autocomplete module 6.x-1.x before 6.x-1.1 and 7.x-1.x (no CVSS)
- [CVE-2014-5250](https://cve.now/CVE-2014-5250.md): Unspecified vulnerability in the AJAX autocompletion callback in the Biblio Autocomplete module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7. (no CVSS)
- [CVE-2012-0938](https://cve.now/CVE-2012-0938.md): Multiple SQL injection vulnerabilities in TestLink 1.9.3, 1.8.5b, and earlier allow remote authenticated users with certain permissions to e (no CVSS)
- [CVE-2012-0939](https://cve.now/CVE-2012-0939.md): Multiple SQL injection vulnerabilities in TestLink 1.8.5b and earlier allow remote authenticated users with the Requirement view permission (no CVSS)
- [CVE-2012-3820](https://cve.now/CVE-2012-3820.md): Multiple SQL injection vulnerabilities in Campaign11.exe in Arial Software Campaign Enterprise before 11.0.551 allow remote attackers to exe (no CVSS)
- [CVE-2012-5683](https://cve.now/CVE-2012-5683.md): Multiple cross-site request forgery (CSRF) vulnerabilities in ZPanel 10.0.1 and earlier allow remote attackers to hijack the authentication (no CVSS)
- [CVE-2012-5684](https://cve.now/CVE-2012-5684.md): Cross-site scripting (XSS) vulnerability in ZPanel 10.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2012-5685](https://cve.now/CVE-2012-5685.md): SQL injection vulnerability in ZPanel 10.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the inEmailAddress pa (no CVSS)
- [CVE-2012-6654](https://cve.now/CVE-2012-6654.md): Multiple SQL injection vulnerabilities in ZPanel 10.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) res (no CVSS)
- [CVE-2014-1384](https://cve.now/CVE-2014-1384.md): WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS)
- [CVE-2014-1385](https://cve.now/CVE-2014-1385.md): WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS)
- [CVE-2014-1386](https://cve.now/CVE-2014-1386.md): WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS)
- [CVE-2014-1387](https://cve.now/CVE-2014-1387.md): WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS)
- [CVE-2014-1388](https://cve.now/CVE-2014-1388.md): WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS)
- [CVE-2014-1389](https://cve.now/CVE-2014-1389.md): WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS)
- [CVE-2014-1390](https://cve.now/CVE-2014-1390.md): WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS)
- [CVE-2014-1546](https://cve.now/CVE-2014-1546.md): The response function in the JSONP endpoint in WebService/Server/JSONRPC.pm in jsonrpc.cgi in Bugzilla 3.x and 4.x before 4.0.14, 4.1.x and (no CVSS)
- [CVE-2014-1980](https://cve.now/CVE-2014-1980.md): Cross-site scripting (XSS) vulnerability in include/functions\_metadata.inc.php in Piwigo before 2.4.6 allows remote attackers to inject arbi (no CVSS)
- [CVE-2014-3898](https://cve.now/CVE-2014-3898.md): Cross-site scripting (XSS) vulnerability in Fujitsu ServerView Operations Manager 5.00.09 through 6.30.05 allows remote attackers to inject (no CVSS)
- [CVE-2014-4343](https://cve.now/CVE-2014-4343.md): Double free vulnerability in the init\_ctx\_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego\_mech.c in MIT Kerberos 5 (ak (no CVSS)
- [CVE-2014-4344](https://cve.now/CVE-2014-4344.md): The acc\_ctx\_cont function in the SPNEGO acceptor in lib/gssapi/spnego/spnego\_mech.c in MIT Kerberos 5 (aka krb5) 1.5.x through 1.12.x before (no CVSS)
- [CVE-2014-4345](https://cve.now/CVE-2014-4345.md): Off-by-one error in the krb5\_encode\_krbsecretkey function in plugins/kdb/ldap/libkdb\_ldap/ldap\_principal2.c in the LDAP KDB module in kadmin (no CVSS)
- [CVE-2014-5239](https://cve.now/CVE-2014-5239.md): The Microsoft Outlook.com application before 7.8.2.12.49.7090 for Android does not verify X.509 certificates from SSL servers, which allows (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-08-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.