# CVEs published 2014-09-25 27 CVEs were published on September 25, 2014: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2014-1568](https://cve.now/CVE-2014-1568.md): Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 3 (no CVSS) - [CVE-2014-3354](https://cve.now/CVE-2014-3354.md): Cisco IOS 12.0, 12.2, 12.4, 15.0, 15.1, 15.2, and 15.3 and IOS XE 2.x and 3.x before 3.7.4S; 3.2.xSE and 3.3.xSE before 3.3.2SE; 3.3.xSG and (no CVSS) - [CVE-2014-3355](https://cve.now/CVE-2014-3355.md): The metadata flow feature in Cisco IOS 15.1 through 15.3 and IOS XE 3.3.xXO before 3.3.1XO, 3.6.xS and 3.7.xS before 3.7.6S, and 3.8.xS, 3.9 (no CVSS) - [CVE-2014-3356](https://cve.now/CVE-2014-3356.md): The metadata flow feature in Cisco IOS 15.1 through 15.3 and IOS XE 3.3.xXO before 3.3.1XO, 3.6.xS and 3.7.xS before 3.7.6S, and 3.8.xS, 3.9 (no CVSS) - [CVE-2014-3357](https://cve.now/CVE-2014-3357.md): Cisco IOS 15.0, 15.1, 15.2, and 15.4 and IOS XE 3.3.xSE before 3.3.2SE, 3.3.xXO before 3.3.1XO, 3.5.xE before 3.5.2E, and 3.11.xS before 3.1 (no CVSS) - [CVE-2014-3358](https://cve.now/CVE-2014-3358.md): Memory leak in Cisco IOS 15.0, 15.1, 15.2, and 15.4 and IOS XE 3.3.xSE before 3.3.2SE, 3.3.xXO before 3.3.1XO, 3.5.xE before 3.5.2E, and 3.1 (no CVSS) - [CVE-2014-3359](https://cve.now/CVE-2014-3359.md): Memory leak in Cisco IOS 15.1 through 15.4 and IOS XE 3.4.xS, 3.5.xS, 3.6.xS, and 3.7.xS before 3.7.6S; 3.8.xS, 3.9.xS, and 3.10.xS before 3 (no CVSS) - [CVE-2014-3360](https://cve.now/CVE-2014-3360.md): Cisco IOS 12.4 and 15.0 through 15.4 and IOS XE 3.1.xS, 3.2.xS, 3.3.xS, 3.4.xS, 3.5.xS, 3.6.xS, and 3.7.xS before 3.7.6S; 3.8.xS, 3.9.xS, an (no CVSS) - [CVE-2014-3361](https://cve.now/CVE-2014-3361.md): The ALG module in Cisco IOS 15.0 through 15.4 does not properly implement SIP over NAT, which allows remote attackers to cause a denial of s (no CVSS) - [CVE-2014-6702](https://cve.now/CVE-2014-6702.md): The StarSat International (aka com.conduit.app\_b15a1814d2d840198e70e3c235af5e8b.app) application 1.41.54.9222 for Android does not verify X. (no CVSS) - [CVE-2014-6703](https://cve.now/CVE-2014-6703.md): The phonearabs4 (aka com.phonearabs4.myapps) application 1.4 for Android does not verify X.509 certificates from SSL servers, which allows m (no CVSS) - [CVE-2014-6704](https://cve.now/CVE-2014-6704.md): The Utah Jazz (aka com.sportinginnovations.jazz) application 2.0.0 for Android does not verify X.509 certificates from SSL servers, which al (no CVSS) - [CVE-2014-6705](https://cve.now/CVE-2014-6705.md): The Maher Zain (aka com.vanagas.app.maher\_zain) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allow (no CVSS) - [CVE-2014-6706](https://cve.now/CVE-2014-6706.md): The Embry-Riddle (aka com.dub.app.erau) application 1.4.04 for Android does not verify X.509 certificates from SSL servers, which allows man (no CVSS) - [CVE-2014-6707](https://cve.now/CVE-2014-6707.md): The 7Sage LSAT Prep - Proctor (aka com.sevensage.lsat) application 2.1.1 for Android does not verify X.509 certificates from SSL servers, wh (no CVSS) - [CVE-2014-6708](https://cve.now/CVE-2014-6708.md): The Sporting Club Uphoria (aka com.sportinginnovations.skc) application 2.1.0 for Android does not verify X.509 certificates from SSL server (no CVSS) - [CVE-2014-6709](https://cve.now/CVE-2014-6709.md): The TechRadar News (aka com.techradar.news) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows ma (no CVSS) - [CVE-2014-6710](https://cve.now/CVE-2014-6710.md): The Chifro Kids Coloring Game (aka com.chifro.kids\_coloring\_game) application 1.6 for Android does not verify X.509 certificates from SSL se (no CVSS) - [CVE-2014-6711](https://cve.now/CVE-2014-6711.md): The ABC Lounge Webradio (aka com.nobexinc.wls\_66087017.rc) application 3.3.10 for Android does not verify X.509 certificates from SSL server (no CVSS) - [CVE-2014-6712](https://cve.now/CVE-2014-6712.md): The Airlines International (aka org.iata.IAMagazine) application 1.0 for Android does not verify X.509 certificates from SSL servers, which (no CVSS) - [CVE-2014-6713](https://cve.now/CVE-2014-6713.md): The MedQuiz: Medical Chat and MCQs (aka com.pdevsmedd.med) application 1.5 for Android does not verify X.509 certificates from SSL servers, (no CVSS) - [CVE-2014-6714](https://cve.now/CVE-2014-6714.md): The WebMD (aka com.webmd.android) application 3.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-m (no CVSS) - [CVE-2014-6715](https://cve.now/CVE-2014-6715.md): The SlotMachine (aka com.popoinnovation.SlotMachine) application 1.03 for Android does not verify X.509 certificates from SSL servers, which (no CVSS) - [CVE-2014-6716](https://cve.now/CVE-2014-6716.md): The fastin (aka moda.azyae.fastin.net) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in- (no CVSS) - [CVE-2014-6717](https://cve.now/CVE-2014-6717.md): The iTriage Health (aka com.healthagen.iTriage) application 5.29 for Android does not verify X.509 certificates from SSL servers, which allo (no CVSS) - [CVE-2014-6718](https://cve.now/CVE-2014-6718.md): The My Mobile Day (aka com.mymobileday) application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in (no CVSS) - [CVE-2014-7169](https://cve.now/CVE-2014-7169.md): GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variabl (CVSS 9.8, KEV) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2014-09-25 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.