# CVEs published 2014-09-02

12 CVEs were published on September 2, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-0485](https://cve.now/CVE-2014-0485.md): S3QL 1.18.1 and earlier uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serial (no CVSS)
- [CVE-2014-5136](https://cve.now/CVE-2014-5136.md): Cross-site scripting (XSS) vulnerability in Innovative Interfaces Sierra Library Services Platform 1.2\_3 allows remote attackers to inject a (no CVSS)
- [CVE-2014-5137](https://cve.now/CVE-2014-5137.md): Innovative Interfaces Sierra Library Services Platform 1.2\_3 provides different responses for login request depending on whether the user ac (no CVSS)
- [CVE-2014-5339](https://cve.now/CVE-2014-5339.md): Check\_MK before 1.2.4p4 and 1.2.5 before 1.2.5i4 allows remote authenticated users to write check\_mk config files (.mk files) to arbitrary l (no CVSS)
- [CVE-2014-5340](https://cve.now/CVE-2014-5340.md): The wato component in Check\_MK before 1.2.4p4 and 1.2.5 before 1.2.5i4 uses the pickle Python module unsafely, which allows remote attackers (no CVSS)
- [CVE-2014-5521](https://cve.now/CVE-2014-5521.md): plugins/useradmin/fingeruser.php in XRMS CRM, possibly 1.99.2, allows remote authenticated users to execute arbitrary code via shell metacha (no CVSS)
- [CVE-2014-6064](https://cve.now/CVE-2014-6064.md): The Accounts tab in the administrative user interface in McAfee Web Gateway (MWG) before 7.3.2.9 and 7.4.x before 7.4.2 allows remote authen (no CVSS)
- [CVE-2014-3861](https://cve.now/CVE-2014-3861.md): Cross-site scripting (XSS) vulnerability in CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2014-3862](https://cve.now/CVE-2014-3862.md): CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to discover potentially sensitive URLs via a crafted reference element that tri (no CVSS)
- [CVE-2014-5076](https://cve.now/CVE-2014-5076.md): The La Banque Postale application before 3.2.6 for Android does not prevent the launching of an activity by a component of another applicati (no CVSS)
- [CVE-2014-5452](https://cve.now/CVE-2014-5452.md): CDA.xsl in HL7 C-CDA 1.1 and earlier does not anticipate the possibility of invalid C-CDA documents with crafted XML attributes, which allow (no CVSS)
- [CVE-2014-6041](https://cve.now/CVE-2014-6041.md): The Android WebView in Android before 4.4 allows remote attackers to bypass the Same Origin Policy via a crafted attribute containing a \\u00 (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-09-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.