# CVEs published 2014-09-12

22 CVEs were published on September 12, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-5883](https://cve.now/CVE-2014-5883.md): The 7-ELEVEN (aka ecowork.seven) application 2.08.000 for Android does not verify X.509 certificates from SSL servers, which allows man-in-t (no CVSS)
- [CVE-2014-5884](https://cve.now/CVE-2014-5884.md): The 1&1 Online Storage (aka de.einsundeins.smartdrive) application 5.0.11 for Android does not verify X.509 certificates from SSL servers, w (no CVSS)
- [CVE-2014-5885](https://cve.now/CVE-2014-5885.md): The Disaster Alert (aka disasterAlert.PDC) application 3.2 for Android does not verify X.509 certificates from SSL servers, which allows man (no CVSS)
- [CVE-2014-5886](https://cve.now/CVE-2014-5886.md): The iVysilani ceske televize (aka cz.motion.ivysilani) application 1.6 for Android does not verify X.509 certificates from SSL servers, whic (no CVSS)
- [CVE-2014-5887](https://cve.now/CVE-2014-5887.md): The Yell Local Search (aka com.yell.launcher2) application 4.2.1.4 for Android does not verify X.509 certificates from SSL servers, which al (no CVSS)
- [CVE-2014-5888](https://cve.now/CVE-2014-5888.md): The SLOTS: Bible Slots Free (aka com.topfreegames.topbibleslots) application 1.122 for Android does not verify X.509 certificates from SSL s (no CVSS)
- [CVE-2012-1556](https://cve.now/CVE-2012-1556.md): Cross-site scripting (XSS) vulnerability in Synology Photo Station 5 for DiskStation Manager (DSM) 3.2-1955 allows remote attackers to injec (no CVSS)
- [CVE-2014-2008](https://cve.now/CVE-2014-2008.md): SQL injection vulnerability in confirm.php in the mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to execute arbitra (no CVSS)
- [CVE-2014-2009](https://cve.now/CVE-2014-2009.md): The mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to obtain credentials, the installation path, and other sensitiv (no CVSS)
- [CVE-2014-4735](https://cve.now/CVE-2014-4735.md): Cross-site scripting (XSS) vulnerability in MyWebSQL 3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2014-5259](https://cve.now/CVE-2014-5259.md): Cross-site scripting (XSS) vulnerability in cattranslate.php in the CatTranslate JQuery plugin in BlackCat CMS 1.0.3 and earlier allows remo (no CVSS)
- [CVE-2014-5440](https://cve.now/CVE-2014-5440.md): SQL injection vulnerability in Login.aspx in MPEX Business Solutions MX-SmartTimer before 13.19.18 allows remote attackers to execute arbitr (no CVSS)
- [CVE-2014-5441](https://cve.now/CVE-2014-5441.md): Multiple cross-site scripting (XSS) vulnerabilities in app/views/layouts/application.html.haml in Fat Free CRM before 0.13.3 allow remote at (no CVSS, fat\_free\_crm)
- [CVE-2014-6270](https://cve.now/CVE-2014-6270.md): Off-by-one error in the snmpHandleUdp function in snmp\_core.cc in Squid 2.x and 3.x, when an SNMP port is configured, allows remote attacker (no CVSS)
- [CVE-2013-4444](https://cve.now/CVE-2013-4444.md): Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2014-3092](https://cve.now/CVE-2014-3092.md): IBM Jazz Team Server, as used in Rational Collaborative Lifecycle Management; Rational Quality Manager 3.x before 3.0.1.6 iFix 3, 4.x before (no CVSS)
- [CVE-2014-3342](https://cve.now/CVE-2014-3342.md): The CLI in Cisco IOS XR allows remote authenticated users to obtain sensitive information via unspecified commands, aka Bug IDs CSCuq42336, (no CVSS)
- [CVE-2014-3362](https://cve.now/CVE-2014-3362.md): Memory leak in Cisco TelePresence System Edge MXP Series Software F9.3.3 and earlier allows remote attackers to cause a denial of service (m (no CVSS)
- [CVE-2014-3363](https://cve.now/CVE-2014-3363.md): Cross-site scripting (XSS) vulnerability in the web framework in Cisco Unified Communications Manager (UCM) 9.1(2.10000.28) allows remote au (no CVSS)
- [CVE-2014-4762](https://cve.now/CVE-2014-4762.md): Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.0 through 8.0.0.1 CF13 and 8.5.0 before CF02 allows remote authenticate (no CVSS)
- [CVE-2014-4792](https://cve.now/CVE-2014-4792.md): IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF28, 8.0.0 through 8.0.0.1 CF13, and 8.5 (no CVSS)
- [CVE-2014-4811](https://cve.now/CVE-2014-4811.md): IBM Storwize 3500, 3700, 5000, and 7000 devices and SAN Volume Controller 6.x and 7.x before 7.2.0.8 allow remote attackers to reset the adm (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-09-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.