# CVEs published 2014-08-25

16 CVEs were published on August 25, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-5335](https://cve.now/CVE-2014-5335.md): Multiple cross-site request forgery (CSRF) vulnerabilities in innovaphone PBX 10.00 sr11 and earlier allow remote attackers to hijack the au (no CVSS)
- [CVE-2014-5453](https://cve.now/CVE-2014-5453.md): Ubisoft Uplay PC before 4.6.1.3217 use weak permissions (Everyone: Full Control) for the program installation directory (%PROGRAMFILES%\\Ubis (no CVSS)
- [CVE-2014-5454](https://cve.now/CVE-2014-5454.md): Unrestricted file upload vulnerability in the image upload module in SAS Visual Analytics 6.4M1 allows remote authenticated users to execute (no CVSS)
- [CVE-2014-5455](https://cve.now/CVE-2014-5455.md): Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel version 3.0 (Windows) and OpenVPN Connect version (CVSS 5.3)
- [CVE-2014-5456](https://cve.now/CVE-2014-5456.md): Cross-site scripting (XSS) vulnerability in the Social Stats module before 7.x-1.5 for Drupal allows remote authenticated users with the "\[C (no CVSS)
- [CVE-2014-5457](https://cve.now/CVE-2014-5457.md): QNAP TS-469U with firmware 4.0.7 Build 20140410, TS-459U, TS-EC1679U-RP, and SS-839 use world-readable permissions for /etc/config/shadow, w (no CVSS)
- [CVE-2014-5458](https://cve.now/CVE-2014-5458.md): SQL injection vulnerability in sqrl\_verify.php in php-sqrl allows remote attackers to execute arbitrary SQL commands via the message paramet (no CVSS)
- [CVE-2014-2216](https://cve.now/CVE-2014-2216.md): The FortiManager protocol service in Fortinet FortiOS before 4.3.16 and 5.0.0 before 5.0.8 on FortiGate devices allows remote attackers to c (no CVSS)
- [CVE-2014-3589](https://cve.now/CVE-2014-3589.md): PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a den (no CVSS, pillow)
- [CVE-2014-5251](https://cve.now/CVE-2014-5251.md): The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorre (no CVSS, keystone)
- [CVE-2014-5252](https://cve.now/CVE-2014-5252.md): The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued\_at value for UUID v2 tokens (no CVSS, keystone)
- [CVE-2014-5253](https://cve.now/CVE-2014-5253.md): OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not properly revoke tokens when a domain is invalidated (no CVSS, keystone)
- [CVE-2014-5356](https://cve.now/CVE-2014-5356.md): OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4, 2014.x before 2014.1.3, and Juno before Juno-3, when using the V2 AP (no CVSS, glance)
- [CVE-2014-0973](https://cve.now/CVE-2014-0973.md): The image\_verify function in platform/msm\_shared/image\_verify.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovatio (no CVSS)
- [CVE-2014-0974](https://cve.now/CVE-2014-0974.md): The boot\_linux\_from\_mmc function in app/aboot/aboot.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center ( (no CVSS)
- [CVE-2014-4325](https://cve.now/CVE-2014-4325.md): The cmd\_boot function in app/aboot/aboot.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center (QuIC) Andro (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-08-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.