# CVEs published 2014-09-11

45 CVEs were published on September 11, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-3609](https://cve.now/CVE-2014-3609.md): HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via a request (no CVSS)
- [CVE-2014-3740](https://cve.now/CVE-2014-3740.md): Cross-site scripting (XSS) vulnerability in SpiceWorks before 7.2.00195 allows remote authenticated users to inject arbitrary web script or (no CVSS)
- [CVE-2014-3985](https://cve.now/CVE-2014-3985.md): The getHTTPResponse function in miniwget.c in MiniUPnP 1.9 allows remote attackers to cause a denial of service (crash) via crafted headers (no CVSS)
- [CVE-2014-5879](https://cve.now/CVE-2014-5879.md): The tvguide (aka kenneth.tvguide) application 1.9.14 for Android does not verify X.509 certificates from SSL servers, which allows man-in-th (no CVSS)
- [CVE-2014-5881](https://cve.now/CVE-2014-5881.md): The Yahoo! Japan Box (aka jp.co.yahoo.android.ybox) application 1.5.1 for Android does not verify X.509 certificates from SSL servers, which (no CVSS)
- [CVE-2014-5882](https://cve.now/CVE-2014-5882.md): The Homoo Ijiri (aka jp.co.applica) application 3.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the (no CVSS)
- [CVE-2014-5129](https://cve.now/CVE-2014-5129.md): Cross-site scripting (XSS) vulnerability in Avolve Software ProjectDox 8.1 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2014-5391](https://cve.now/CVE-2014-5391.md): Cross-site scripting (XSS) vulnerability in the JobScheduler Operations Center (JOC) in SOS JobScheduler before 1.6.4246 and 1.7.x before 1. (no CVSS)
- [CVE-2014-5393](https://cve.now/CVE-2014-5393.md): Directory traversal vulnerability in the JobScheduler Operations Center (JOC) in SOS JobScheduler before 1.6.4246 and 1.7.x before 1.7.4241 (no CVSS)
- [CVE-2014-5460](https://cve.now/CVE-2014-5460.md): Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated user (no CVSS)
- [CVE-2014-6043](https://cve.now/CVE-2014-6043.md): ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 does not properly restrict access to the database browser, which allow (no CVSS)
- [CVE-2011-4887](https://cve.now/CVE-2011-4887.md): Cross-site scripting (XSS) vulnerability in the Violations Table in the management GUI in the MX Management Server in Imperva SecureSphere W (no CVSS)
- [CVE-2012-0984](https://cve.now/CVE-2012-0984.md): Multiple cross-site scripting (XSS) vulnerabilities in XOOPS before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2012-4240](https://cve.now/CVE-2012-4240.md): SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authenticated users to execut (no CVSS)
- [CVE-2014-2223](https://cve.now/CVE-2014-2223.md): Unrestricted file upload vulnerability in plog-admin/plog-upload.php in Plogger 1.0 RC1 and earlier allows remote authenticated users to exe (no CVSS)
- [CVE-2014-5519](https://cve.now/CVE-2014-5519.md): The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the ed (no CVSS)
- [CVE-2014-6070](https://cve.now/CVE-2014-6070.md): Multiple cross-site scripting (XSS) vulnerabilities in Adiscon LogAnalyzer before 3.6.6 allow remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2014-6231](https://cve.now/CVE-2014-6231.md): Unspecified vulnerability in the CWT Frontend Edit (cwt\_feedit) extension before 1.2.5 for TYPO3 allows remote authenticated users to execut (no CVSS)
- [CVE-2014-6232](https://cve.now/CVE-2014-6232.md): Unspecified vulnerability in the LDAP (eu\_ldap) extension before 2.8.18 for TYPO3 allows remote authenticated users to obtain sensitive info (no CVSS)
- [CVE-2014-6233](https://cve.now/CVE-2014-6233.md): SQL injection vulnerability in the Flat Manager (flatmgr) extension before 2.7.10 for TYPO3 allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2014-6234](https://cve.now/CVE-2014-6234.md): Cross-site scripting (XSS) vulnerability in the Open Graph protocol (jh\_opengraphprotocol) extension before 1.0.2 for TYPO3 allows remote at (no CVSS)
- [CVE-2014-6235](https://cve.now/CVE-2014-6235.md): Unspecified vulnerability in the ke DomPDF extension before 0.0.5 for TYPO3 allows remote attackers to execute arbitrary code via unknown ve (no CVSS)
- [CVE-2014-6236](https://cve.now/CVE-2014-6236.md): Unspecified vulnerability in the LumoNet PHP Include (lumophpinclude) extension before 1.2.1 for TYPO3 allows remote attackers to execute ar (no CVSS)
- [CVE-2014-6237](https://cve.now/CVE-2014-6237.md): Cross-site scripting (XSS) vulnerability in the News Pack extension 0.1.0 and earlier for TYPO3 allows remote authenticated users to inject (no CVSS)
- [CVE-2014-6238](https://cve.now/CVE-2014-6238.md): Cross-site scripting (XSS) vulnerability in the Akronymmanager (aka SB Folderdownload) extension 0.5.0 and earlier for TYPO3 allows remote a (no CVSS)
- [CVE-2014-6239](https://cve.now/CVE-2014-6239.md): SQL injection vulnerability in the Address visualization with Google Maps (st\_address\_map) extension before 0.3.6 allows remote attackers to (no CVSS)
- [CVE-2014-6240](https://cve.now/CVE-2014-6240.md): Cross-site scripting (XSS) vulnerability in the Google Sitemap (weeaar\_googlesitemap) extension 0.4.3 and earlier for TYPO3 allows remote at (no CVSS)
- [CVE-2014-6241](https://cve.now/CVE-2014-6241.md): SQL injection vulnerability in the wt\_directory extension before 1.4.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands v (no CVSS)
- [CVE-2014-5863](https://cve.now/CVE-2014-5863.md): The mpang.gp (aka air.com.cjenm.mpang.gp) application 4.0.0 for Android does not verify X.509 certificates from SSL servers, which allows ma (no CVSS)
- [CVE-2014-5864](https://cve.now/CVE-2014-5864.md): The Swish payments (aka se.bankgirot.swish) application 2 for Android does not verify X.509 certificates from SSL servers, which allows man- (no CVSS)
- [CVE-2014-5865](https://cve.now/CVE-2014-5865.md): The Ask.com (aka com.ask.android) application 2.2.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the (no CVSS)
- [CVE-2014-5866](https://cve.now/CVE-2014-5866.md): The CA DMV (aka gov.ca.dmv) application 2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle at (no CVSS)
- [CVE-2014-5867](https://cve.now/CVE-2014-5867.md): The Capital One Spark Pay (aka com.capitalone.sparkpay) application 0.9.81 for Android does not verify X.509 certificates from SSL servers, (no CVSS)
- [CVE-2014-5868](https://cve.now/CVE-2014-5868.md): The Cisco Technical Support (aka com.cisco.swtg\_android) application 3.7.1 for Android does not verify X.509 certificates from SSL servers, (no CVSS)
- [CVE-2014-5869](https://cve.now/CVE-2014-5869.md): The CNNMoney Portfolio (aka com.cnn.cnnmoney) application 1.03 for Android does not verify X.509 certificates from SSL servers, which allows (no CVSS)
- [CVE-2014-5870](https://cve.now/CVE-2014-5870.md): The Kmart (aka com.kmart.android) application 6.2.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the (no CVSS)
- [CVE-2014-5871](https://cve.now/CVE-2014-5871.md): The Piwik Mobile 2 (aka org.piwik.mobile2) application 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows m (no CVSS)
- [CVE-2014-5872](https://cve.now/CVE-2014-5872.md): The SafeNetMobile Pass (aka securecomputing.devices.android.controller) application 8.3.7.11 for Android does not verify X.509 certificates (no CVSS)
- [CVE-2014-5873](https://cve.now/CVE-2014-5873.md): The Sears (aka com.sears.android) application 6.2.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the (no CVSS)
- [CVE-2014-5874](https://cve.now/CVE-2014-5874.md): The SplashID (aka com.splashidandroid) application 7.2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-i (no CVSS)
- [CVE-2014-5875](https://cve.now/CVE-2014-5875.md): The Sylphone (aka com.sylpheo.prospectosyl) application 5.3.8 for Android does not verify X.509 certificates from SSL servers, which allows (no CVSS)
- [CVE-2014-5876](https://cve.now/CVE-2014-5876.md): The WD My Cloud (aka com.wdc.wd2go) application 4.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-t (no CVSS)
- [CVE-2014-5877](https://cve.now/CVE-2014-5877.md): The TV Guide (aka net.micene.minigroup.palimpsests.lite) application 5.4.3 for Android does not verify X.509 certificates from SSL servers, (no CVSS)
- [CVE-2014-5878](https://cve.now/CVE-2014-5878.md): The ium (aka net.ium.mobile.android) application 3.3.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in- (no CVSS)
- [CVE-2014-2624](https://cve.now/CVE-2014-2624.md): Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.0x, 9.1x, and 9.2x allows remote attackers to execute arbitrary code via unk (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-09-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.