# CVEs published 2014-09-04

23 CVEs were published on September 4, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2012-6153](https://cve.now/CVE-2012-6153.md): http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a do (no CVSS, org.apache.httpcomponents:httpclient)
- [CVE-2014-2685](https://cve.now/CVE-2014-2685.md): The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend\_OpenId\_Consumer class in Zend Framework 1 before (no CVSS)
- [CVE-2014-2957](https://cve.now/CVE-2014-2957.md): The dmarc\_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL\_DMARC is enabled, allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2014-2972](https://cve.now/CVE-2014-2972.md): expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and execute arbitrary comma (no CVSS)
- [CVE-2014-3529](https://cve.now/CVE-2014-3529.md): The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external (no CVSS, org.apache.poi:poi)
- [CVE-2014-3574](https://cve.now/CVE-2014-3574.md): Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a (no CVSS, org.apache.poi:poi)
- [CVE-2014-5269](https://cve.now/CVE-2014-5269.md): Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to bypass the whitelist (no CVSS)
- [CVE-2014-5377](https://cve.now/CVE-2014-5377.md): ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via (no CVSS)
- [CVE-2014-5504](https://cve.now/CVE-2014-5504.md): SolarWinds Log and Event Manager before 6.0 uses "static" credentials, which makes it easier for remote attackers to obtain access to the da (no CVSS)
- [CVE-2014-5505](https://cve.now/CVE-2014-5505.md): Stack-based buffer overflow in SAP Crystal Reports allows remote attackers to execute arbitrary code via a crafted data source string in an (no CVSS)
- [CVE-2014-5506](https://cve.now/CVE-2014-5506.md): Double free vulnerability in SAP Crystal Reports allows remote attackers to execute arbitrary code via crafted connection string record in a (no CVSS)
- [CVE-2014-6060](https://cve.now/CVE-2014-6060.md): The get\_option function in dhcpcd 4.0.0 through 6.x before 6.4.3 allows remote DHCP servers to cause a denial of service by resetting the DH (no CVSS)
- [CVE-2012-4234](https://cve.now/CVE-2012-4234.md): Cross-site scripting (XSS) vulnerability in the group moderation screen in the control center (control.php) in Phorum before 5.2.19 allows r (no CVSS)
- [CVE-2012-4768](https://cve.now/CVE-2012-4768.md): Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbit (no CVSS)
- [CVE-2014-3075](https://cve.now/CVE-2014-3075.md): Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.0.x al (no CVSS)
- [CVE-2014-3094](https://cve.now/CVE-2014-3094.md): Stack-based buffer overflow in IBM DB2 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linux, UNIX, and Windows (no CVSS)
- [CVE-2014-3095](https://cve.now/CVE-2014-3095.md): The SQL engine in IBM DB2 9.5 through FP10, 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linux, UNIX, and Win (no CVSS)
- [CVE-2014-3353](https://cve.now/CVE-2014-3353.md): Cisco IOS XR 4.3(.2) and earlier, as used in Cisco Carrier Routing System (CRS), allows remote attackers to cause a denial of service (CPU c (no CVSS)
- [CVE-2014-4758](https://cve.now/CVE-2014-4758.md): IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.x allow remote authenticated users to bypass inten (no CVSS)
- [CVE-2014-4759](https://cve.now/CVE-2014-4759.md): An unspecified Ajax service in the Content Management toolkit in IBM Business Process Manager (BPM) 8.5.x through 8.5.5 allows remote authen (no CVSS)
- [CVE-2014-4805](https://cve.now/CVE-2014-4805.md): IBM DB2 10.5 before FP4 on Linux and AIX creates temporary files during CDE table LOAD operations, which allows local users to obtain sensit (no CVSS)
- [CVE-2014-5285](https://cve.now/CVE-2014-5285.md): Unspecified vulnerability in the Authentication Module in TIBCO Spotfire Server before 4.5.2, 5.0.x before 5.0.3, 5.5.x before 5.5.2, 6.0.x (no CVSS)
- [CVE-2014-5461](https://cve.now/CVE-2014-5461.md): Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-09-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.