# CVEs published 2014-08-26 21 CVEs were published on August 26, 2014: 0 critical, 0 high. Days are UTC. - [CVE-2014-0480](https://cve.now/CVE-2014-0480.md): The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 d (no CVSS, django) - [CVE-2014-0481](https://cve.now/CVE-2014-0481.md): The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 befor (no CVSS, django) - [CVE-2014-0482](https://cve.now/CVE-2014-0482.md): The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before (no CVSS, django) - [CVE-2014-0483](https://cve.now/CVE-2014-0483.md): The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candida (no CVSS, django) - [CVE-2014-2527](https://cve.now/CVE-2014-2527.md): kcleanup.cpp in KDirStat 2.7.0 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary (no CVSS) - [CVE-2014-2528](https://cve.now/CVE-2014-2528.md): kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary (no CVSS) - [CVE-2014-3034](https://cve.now/CVE-2014-3034.md): Cross-site scripting (XSS) vulnerability in IBM Emptoris Contract Management 9.5.x before 9.5.0.6 iFix 10, 10.0.0.x before 10.0.0.1 iFix 10, (no CVSS) - [CVE-2014-3035](https://cve.now/CVE-2014-3035.md): Cross-site scripting (XSS) vulnerability in IBM Emptoris Spend Analysis 9.5.x before 9.5.0.4, 10.0.1.x before 10.0.1.3, and 10.0.2.x before (no CVSS) - [CVE-2014-3041](https://cve.now/CVE-2014-3041.md): SQL injection vulnerability in IBM Emptoris Contract Management 9.5.x before 9.5.0.6 iFix 10, 10.0.0.x before 10.0.0.1 iFix 10, 10.0.1.x bef (no CVSS) - [CVE-2014-3061](https://cve.now/CVE-2014-3061.md): Cross-site request forgery (CSRF) vulnerability in IBM Emptoris Spend Analysis 9.5.x before 9.5.0.4, 10.0.1.x before 10.0.1.3, and 10.0.2.x (no CVSS) - [CVE-2014-3524](https://cve.now/CVE-2014-3524.md): Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecified impact via a crafte (no CVSS) - [CVE-2014-3907](https://cve.now/CVE-2014-3907.md): Cross-site request forgery (CSRF) vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.11 for WordPress allows r (no CVSS) - [CVE-2014-5035](https://cve.now/CVE-2014-5035.md): The Netconf (TCP) service in OpenDaylight 1.0 allows remote attackers to read arbitrary files via an XML external entity declaration in conj (no CVSS) - [CVE-2014-5263](https://cve.now/CVE-2014-5263.md): vmstate\_xhci\_event in hw/usb/hcd-xhci.c in QEMU 1.6.0 does not terminate the list with the VMSTATE\_END\_OF\_LIST macro, which allows attackers (no CVSS) - [CVE-2014-5307](https://cve.now/CVE-2014-5307.md): Heap-based buffer overflow in the PavTPK.sys kernel mode driver of Panda Security 2014 products before hft131306s24\_r1 allows local users to (no CVSS) - [CVE-2014-5336](https://cve.now/CVE-2014-5336.md): Monkey HTTP Server before 1.5.3, when the File Descriptor Table (FDT) is enabled and custom error messages are set, allows remote attackers (no CVSS) - [CVE-2013-6335](https://cve.now/CVE-2013-6335.md): The Backup-Archive client in IBM Tivoli Storage Manager (TSM) for Space Management 5.x and 6.x before 6.2.5.3, 6.3.x before 6.3.2, 6.4.x bef (no CVSS) - [CVE-2014-3033](https://cve.now/CVE-2014-3033.md): Cross-site scripting (XSS) vulnerability in IBM Emptoris Sourcing Portfolio 9.5.x before 9.5.1.3, 10.0.0.x before 10.0.0.1, 10.0.1.x before (no CVSS) - [CVE-2014-3040](https://cve.now/CVE-2014-3040.md): Cross-site request forgery (CSRF) vulnerability in IBM Emptoris Contract Management 9.5.x before 9.5.0.6 iFix 10, 10.0.0.x before 10.0.0.1 i (no CVSS) - [CVE-2014-3335](https://cve.now/CVE-2014-3335.md): Cisco IOS XR 4.3(.2) and earlier on ASR 9000 devices does not properly perform NetFlow sampling of packets with multicast destination MAC ad (no CVSS) - [CVE-2014-4790](https://cve.now/CVE-2014-4790.md): IBM Emptoris Sourcing Portfolio 9.5.x before 9.5.1.3, 10.0.0.x before 10.0.0.1, 10.0.1.x before 10.0.1.3, and 10.0.2.x before 10.0.2.4 and E (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2014-08-26 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.