# CVEs published 2014-09-18

93 CVEs were published on September 18, 2014: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2014-2886](https://cve.now/CVE-2014-2886.md): GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute (no CVSS)
- [CVE-2014-4352](https://cve.now/CVE-2014-4352.md): Address Book in Apple iOS before 8 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attacke (no CVSS)
- [CVE-2014-4353](https://cve.now/CVE-2014-4353.md): Race condition in iMessage in Apple iOS before 8 allows attackers to obtain sensitive information by leveraging the presence of an attachmen (no CVSS)
- [CVE-2014-4354](https://cve.now/CVE-2014-4354.md): Apple iOS before 8 enables Bluetooth during all upgrade actions, which makes it easier for remote attackers to bypass intended access restri (no CVSS)
- [CVE-2014-4356](https://cve.now/CVE-2014-4356.md): Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen, which allows physically p (no CVSS)
- [CVE-2014-4357](https://cve.now/CVE-2014-4357.md): Accounts Framework in Apple iOS before 8 and Apple TV before 7 allows attackers to obtain sensitive information by reading log data that was (no CVSS)
- [CVE-2014-4361](https://cve.now/CVE-2014-4361.md): The Home & Lock Screen subsystem in Apple iOS before 8 does not properly restrict the private API for app prominence, which allows attackers (no CVSS)
- [CVE-2014-4362](https://cve.now/CVE-2014-4362.md): The Sandbox Profiles implementation in Apple iOS before 8 does not properly restrict the third-party app sandbox profile, which allows attac (no CVSS)
- [CVE-2014-4363](https://cve.now/CVE-2014-4363.md): Safari in Apple iOS before 8 does not properly restrict the autofilling of passwords in forms, which allows remote attackers to obtain sensi (no CVSS)
- [CVE-2014-4364](https://cve.now/CVE-2014-4364.md): The 802.1X subsystem in Apple iOS before 8 and Apple TV before 7 does not require strong authentication methods, which allows remote attacke (no CVSS)
- [CVE-2014-4366](https://cve.now/CVE-2014-4366.md): Mail in Apple iOS before 8 does not prevent sending a LOGIN command to a LOGINDISABLED IMAP server, which allows remote attackers to obtain (no CVSS)
- [CVE-2014-4367](https://cve.now/CVE-2014-4367.md): Apple iOS before 8 enables Voice Dial during all upgrade actions, which makes it easier for physically proximate attackers to launch uninten (no CVSS)
- [CVE-2014-4368](https://cve.now/CVE-2014-4368.md): The Accessibility subsystem in Apple iOS before 8 allows attackers to interfere with screen locking via vectors related to AssistiveTouch ev (no CVSS)
- [CVE-2014-4369](https://cve.now/CVE-2014-4369.md): The IOAcceleratorFamily API implementation in Apple iOS before 8 and Apple TV before 7 allows attackers to cause a denial of service (NULL p (no CVSS)
- [CVE-2014-4371](https://cve.now/CVE-2014-4371.md): The network-statistics interface in the kernel in Apple iOS before 8 and Apple TV before 7 does not properly initialize memory, which allows (no CVSS)
- [CVE-2014-4372](https://cve.now/CVE-2014-4372.md): syslogd in the syslog subsystem in Apple iOS before 8 and Apple TV before 7 allows local users to change the permissions of arbitrary files (no CVSS)
- [CVE-2014-4373](https://cve.now/CVE-2014-4373.md): The IntelAccelerator driver in the IOAcceleratorFamily subsystem in Apple iOS before 8 and Apple TV before 7 allows attackers to cause a den (no CVSS)
- [CVE-2014-4374](https://cve.now/CVE-2014-4374.md): NSXMLParser in Foundation in Apple iOS before 8 allows attackers to read arbitrary files via XML data containing an external entity declarat (no CVSS)
- [CVE-2014-4375](https://cve.now/CVE-2014-4375.md): Double free vulnerability in Apple iOS before 8 and Apple TV before 7 allows local users to gain privileges or cause a denial of service (de (no CVSS)
- [CVE-2014-4377](https://cve.now/CVE-2014-4377.md): Integer overflow in CoreGraphics in Apple iOS before 8 and Apple TV before 7 allows remote attackers to execute arbitrary code or cause a de (no CVSS)
- [CVE-2014-4378](https://cve.now/CVE-2014-4378.md): CoreGraphics in Apple iOS before 8 and Apple TV before 7 allows remote attackers to obtain sensitive information or cause a denial of servic (no CVSS)
- [CVE-2014-4379](https://cve.now/CVE-2014-4379.md): An unspecified IOHIDFamily function in Apple iOS before 8 and Apple TV before 7 lacks proper bounds checking to prevent reading of kernel po (no CVSS)
- [CVE-2014-4380](https://cve.now/CVE-2014-4380.md): The IOHIDFamily kernel extension in Apple iOS before 8 and Apple TV before 7 lacks proper bounds checking on write operations, which allows (no CVSS)
- [CVE-2014-4381](https://cve.now/CVE-2014-4381.md): Libnotify in Apple iOS before 8 and Apple TV before 7 lacks proper bounds checking on write operations, which allows attackers to execute ar (no CVSS)
- [CVE-2014-4383](https://cve.now/CVE-2014-4383.md): The Assets subsystem in Apple iOS before 8 and Apple TV before 7 allows man-in-the-middle attackers to spoof a device's update status via a (no CVSS)
- [CVE-2014-4384](https://cve.now/CVE-2014-4384.md): Directory traversal vulnerability in the App Installation feature in Apple iOS before 8 allows local users to install unverified apps by tri (no CVSS)
- [CVE-2014-4386](https://cve.now/CVE-2014-4386.md): Race condition in the App Installation feature in Apple iOS before 8 allows local users to gain privileges and install unverified apps by le (no CVSS)
- [CVE-2014-4388](https://cve.now/CVE-2014-4388.md): IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata, which allows attackers to execute (no CVSS)
- [CVE-2014-4389](https://cve.now/CVE-2014-4389.md): Integer overflow in IOKit in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via (no CVSS)
- [CVE-2014-4404](https://cve.now/CVE-2014-4404.md): Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privil (CVSS 7.8, KEV)
- [CVE-2014-4405](https://cve.now/CVE-2014-4405.md): IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context or cause a denial (no CVSS)
- [CVE-2014-4407](https://cve.now/CVE-2014-4407.md): IOKit in Apple iOS before 8 and Apple TV before 7 does not properly initialize kernel memory, which allows attackers to obtain sensitive mem (no CVSS)
- [CVE-2014-4408](https://cve.now/CVE-2014-4408.md): The rt\_setgate function in the kernel in Apple iOS before 8 and Apple TV before 7 allows local users to gain privileges or cause a denial of (no CVSS)
- [CVE-2014-4409](https://cve.now/CVE-2014-4409.md): WebKit in Apple iOS before 8 makes it easier for remote attackers to track users during private browsing via a crafted web site that reads H (no CVSS)
- [CVE-2014-4410](https://cve.now/CVE-2014-4410.md): WebKit, as used in Apple iOS before 8 and Apple TV before 7, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2014-4411](https://cve.now/CVE-2014-4411.md): WebKit, as used in Apple iOS before 8 and Apple TV before 7, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2014-4412](https://cve.now/CVE-2014-4412.md): WebKit, as used in Apple iOS before 8 and Apple TV before 7, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2014-4413](https://cve.now/CVE-2014-4413.md): WebKit, as used in Apple iOS before 8 and Apple TV before 7, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2014-4414](https://cve.now/CVE-2014-4414.md): WebKit, as used in Apple iOS before 8 and Apple TV before 7, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2014-4415](https://cve.now/CVE-2014-4415.md): WebKit, as used in Apple iOS before 8 and Apple TV before 7, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2014-4418](https://cve.now/CVE-2014-4418.md): IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata, which allows attackers to execute (no CVSS)
- [CVE-2014-4419](https://cve.now/CVE-2014-4419.md): The network-statistics interface in the kernel in Apple iOS before 8 and Apple TV before 7 does not properly initialize memory, which allows (no CVSS)
- [CVE-2014-4420](https://cve.now/CVE-2014-4420.md): The network-statistics interface in the kernel in Apple iOS before 8 and Apple TV before 7 does not properly initialize memory, which allows (no CVSS)
- [CVE-2014-4421](https://cve.now/CVE-2014-4421.md): The network-statistics interface in the kernel in Apple iOS before 8 and Apple TV before 7 does not properly initialize memory, which allows (no CVSS)
- [CVE-2014-4422](https://cve.now/CVE-2014-4422.md): The kernel in Apple iOS before 8 and Apple TV before 7 uses a predictable random number generator during the early portion of the boot proce (no CVSS)
- [CVE-2014-4423](https://cve.now/CVE-2014-4423.md): The Accounts subsystem in Apple iOS before 8 allows attackers to bypass a sandbox protection mechanism and obtain an active iCloud account's (no CVSS)
- [CVE-2014-4819](https://cve.now/CVE-2014-4819.md): The web user interface in IBM WebSphere Message Broker 8.0 before 8.0.0.6 and IBM Integration Bus 9.0 before 9.0.0.3 allows remote authentic (no CVSS)
- [CVE-2014-4820](https://cve.now/CVE-2014-4820.md): Cross-site scripting (XSS) vulnerability in IBM Integration Bus Manufacturing Pack 1.x before 1.0.0.1 allows remote attackers to inject arbi (no CVSS)
- [CVE-2014-4824](https://cve.now/CVE-2014-4824.md): SQL injection vulnerability in IBM Security QRadar SIEM 7.2 before 7.2.3 Patch 1 allows remote authenticated users to execute arbitrary SQL (no CVSS)
- [CVE-2014-4826](https://cve.now/CVE-2014-4826.md): IBM Security QRadar SIEM 7.2 before 7.2.3 Patch 1 does not properly handle SSH connections, which allows remote attackers to obtain sensitiv (no CVSS)
- [CVE-2014-5317](https://cve.now/CVE-2014-5317.md): Cross-site scripting (XSS) vulnerability in php365.com 365 Links 3.11 and earlier, 365 Links2 3.11 and earlier, 365 Links+ 2.10 and earlier, (no CVSS)
- [CVE-2014-5411](https://cve.now/CVE-2014-5411.md): Schneider Electric SCADA Expert ClearSCADA Cross-site Scripting (no CVSS, Schneider Electric ClearSCADA · Schneider Electric SCADA Ex…)
- [CVE-2014-5412](https://cve.now/CVE-2014-5412.md): Schneider Electric SCADA Expert ClearSCADA Improper Authentication (no CVSS, Schneider Electric ClearSCADA · Schneider Electric SCADA Ex…)
- [CVE-2014-5413](https://cve.now/CVE-2014-5413.md): Schneider Electric SCADA Expert ClearSCADA Cryptographic Issues (no CVSS, Schneider Electric ClearSCADA · Schneider Electric SCADA Ex…)
- [CVE-2014-5919](https://cve.now/CVE-2014-5919.md): The SurDoc - 100GB+ FREE storage (aka com.jd.surdoc) application 1.3.4.0 for Android does not verify X.509 certificates from SSL servers, wh (no CVSS)
- [CVE-2014-5920](https://cve.now/CVE-2014-5920.md): The VK Amberfog (aka com.amberfog.vkfree) application 3.5.6 for Android does not verify X.509 certificates from SSL servers, which allows ma (no CVSS)
- [CVE-2014-5921](https://cve.now/CVE-2014-5921.md): The Need for Speed Network (aka com.ea.nfsautolog.bv) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, whi (no CVSS)
- [CVE-2014-5922](https://cve.now/CVE-2014-5922.md): The ga6748 (aka com.g.ga6748) application 1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle (no CVSS)
- [CVE-2014-5923](https://cve.now/CVE-2014-5923.md): The Facebook Status Via (aka com.StatusViaAdvanced) application 3.5 for Android does not verify X.509 certificates from SSL servers, which a (no CVSS)
- [CVE-2014-5924](https://cve.now/CVE-2014-5924.md): The Monster Makeup (aka com.bearhugmedia.android\_monster) application 1.0.0.0 for Android does not verify X.509 certificates from SSL server (no CVSS)
- [CVE-2014-5925](https://cve.now/CVE-2014-5925.md): The 10000 Kindle Books Downloads (aka com.ww10000KindleBooksLatestnBestSellers) application 0.312 for Android does not verify X.509 certific (no CVSS)
- [CVE-2014-5926](https://cve.now/CVE-2014-5926.md): The DCU Mobile Banking (aka com.Vertifi.Mobile.P211391825) application 2 for Android does not verify X.509 certificates from SSL servers, wh (no CVSS)
- [CVE-2014-5927](https://cve.now/CVE-2014-5927.md): The FastCustomer -- Fast Customer (aka www.fastcustomer.com) application 3 for Android does not verify X.509 certificates from SSL servers, (no CVSS)
- [CVE-2014-5928](https://cve.now/CVE-2014-5928.md): The Steganos Online Shield VPN (aka com.steganos.onlineshield) application 1.0.3 for Android does not verify X.509 certificates from SSL ser (no CVSS)
- [CVE-2014-5929](https://cve.now/CVE-2014-5929.md): The emartmall (aka kr.co.emart.emartmall) application 1.3.3 for Android does not verify X.509 certificates from SSL servers, which allows ma (no CVSS)
- [CVE-2014-5930](https://cve.now/CVE-2014-5930.md): The Store and Share (aka sg.com.singnet.mystorage.android) application 2.0.18 for Android does not verify X.509 certificates from SSL server (no CVSS)
- [CVE-2014-5931](https://cve.now/CVE-2014-5931.md): The Stop & Shop SCAN IT! Mobile (aka com.modivmedia.scanitss) application 7.21.00 for Android does not verify X.509 certificates from SSL se (no CVSS)
- [CVE-2014-5932](https://cve.now/CVE-2014-5932.md): The Vodafone Mobile@Work (aka com.mobileiron.vodafone.MIClient) application 6.0.0.1.12R for Android does not verify X.509 certificates from (no CVSS)
- [CVE-2014-5933](https://cve.now/CVE-2014-5933.md): The Coke Studio 7 (aka com.cokeshare.pakistan) application 1 for Android does not verify X.509 certificates from SSL servers, which allows m (no CVSS)
- [CVE-2014-5934](https://cve.now/CVE-2014-5934.md): The Flurv Chat (aka com.flurv.android) application 4.3.3 for Android does not verify X.509 certificates from SSL servers, which allows man-i (no CVSS)
- [CVE-2014-5935](https://cve.now/CVE-2014-5935.md): The Daily Free App @ Amazon (aka com.kattanweb.android.dfaa) application 1.5.2 for Android does not verify X.509 certificates from SSL serve (no CVSS)
- [CVE-2014-5936](https://cve.now/CVE-2014-5936.md): The INCOgnito Private Browser (aka com.SL.InCoBrowser) application 1.4.0 for Android does not verify X.509 certificates from SSL servers, wh (no CVSS)
- [CVE-2014-5937](https://cve.now/CVE-2014-5937.md): The Social Networking (aka com.wSocialNetworkingSites) application 0.33.13320.99980 for Android does not verify X.509 certificates from SSL (no CVSS)
- [CVE-2014-5938](https://cve.now/CVE-2014-5938.md): The AllDealsAsia All Deals ADA app (aka com.ada.deals) application 4.2.1 for Android does not verify X.509 certificates from SSL servers, wh (no CVSS)
- [CVE-2014-5939](https://cve.now/CVE-2014-5939.md): The travelzadcomvb (aka com.tapatalk.travelzadcomvb) application 3.3.10 for Android does not verify X.509 certificates from SSL servers, whi (no CVSS)
- [CVE-2014-5940](https://cve.now/CVE-2014-5940.md): The PocketPC.ch (aka com.tapatalk.pocketpcch) application 3.9.51 for Android does not verify X.509 certificates from SSL servers, which allo (no CVSS)
- [CVE-2014-5941](https://cve.now/CVE-2014-5941.md): The Armpit Spa & Girl Games (aka com.freegames.spamakeover) application 1.0.2 for Android does not verify X.509 certificates from SSL server (no CVSS)
- [CVE-2014-5942](https://cve.now/CVE-2014-5942.md): The Baby Stomach Surgery (aka com.harriskerioe.stomachsurgery) application 1.0.2 for Android does not verify X.509 certificates from SSL ser (no CVSS)
- [CVE-2014-5943](https://cve.now/CVE-2014-5943.md): The LabMSF Antivirus beta (aka com.ReSync.RNGN) 1.0.2 application Beta for Android does not verify X.509 certificates from SSL servers, whic (no CVSS)
- [CVE-2014-5944](https://cve.now/CVE-2014-5944.md): The Soccer Blitz (aka soccer.blitz) application 1.06 for Android does not verify X.509 certificates from SSL servers, which allows man-in-th (no CVSS)
- [CVE-2014-5945](https://cve.now/CVE-2014-5945.md): The Edline Mobile (aka com.wEdlineFree) application 0.63.13369.34294 for Android does not verify X.509 certificates from SSL servers, which (no CVSS)
- [CVE-2014-5946](https://cve.now/CVE-2014-5946.md): The forumhawaaworldcom (aka com.tapatalk.forumhawaaworldcom) application 3.4.12 for Android does not verify X.509 certificates from SSL serv (no CVSS)
- [CVE-2014-5947](https://cve.now/CVE-2014-5947.md): The psicofxp (aka com.tapatalk.psicofxpcom) application 2.4.12.15 for Android does not verify X.509 certificates from SSL servers, which all (no CVSS)
- [CVE-2014-5948](https://cve.now/CVE-2014-5948.md): The Obama for America (aka com.barackobama.ofa) application 1.02 for Android does not verify X.509 certificates from SSL servers, which allo (no CVSS)
- [CVE-2014-5949](https://cve.now/CVE-2014-5949.md): The TICKET APP - Concerts & Sports (aka com.xcr.android.ticketapp) application 3.0.1 for Android does not verify X.509 certificates from SSL (no CVSS)
- [CVE-2014-5950](https://cve.now/CVE-2014-5950.md): The NOW (aka com.smtown.smtownnow.androidapp) application 0.9.8 for Android does not verify X.509 certificates from SSL servers, which allow (no CVSS)
- [CVE-2014-5951](https://cve.now/CVE-2014-5951.md): The SinoPac (aka com.sionpac.app.SinoPac) application 2.4.2 for Android does not verify X.509 certificates from SSL servers, which allows ma (no CVSS)
- [CVE-2014-5952](https://cve.now/CVE-2014-5952.md): The E-Dziennik (aka com.librus.dziennik) application 0.5.2 for Android does not verify X.509 certificates from SSL servers, which allows man (no CVSS)
- [CVE-2014-5953](https://cve.now/CVE-2014-5953.md): The KASKUS (aka com.kaskus.android) application 2.13.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in- (no CVSS)
- [CVE-2014-5954](https://cve.now/CVE-2014-5954.md): The State Bank Anywhere (aka com.sbi.SBIFreedomPlus) application 2.0.1 for Android does not verify X.509 certificates from SSL servers, whic (no CVSS)
- [CVE-2014-5955](https://cve.now/CVE-2014-5955.md): The Atomic Fusion (aka com.bytesized.fusion) application 1.7 for Android does not verify X.509 certificates from SSL servers, which allows m (no CVSS)
- [CVE-2014-5956](https://cve.now/CVE-2014-5956.md): The VPlayer Video Player (aka me.abitno.vplayer.t) application 3.2.6 for Android does not verify X.509 certificates from SSL servers, which (no CVSS)
- [CVE-2014-5957](https://cve.now/CVE-2014-5957.md): The Alien War Survivors (aka com.ly.a13.gp) application 1.3.1 for Android does not verify X.509 certificates from SSL servers, which allows (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-09-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.