# CVEs published 2014-09-30

83 CVEs were published on September 30, 2014: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2014-3395](https://cve.now/CVE-2014-3395.md): Cisco WebEx Meetings Server (WMS) 2.5 allows remote attackers to trigger the download of arbitrary files via a crafted URL, aka Bug ID CSCup (no CVSS)
- [CVE-2014-6837](https://cve.now/CVE-2014-6837.md): The Hillside (aka com.hillside.hermanus) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-i (no CVSS)
- [CVE-2014-6838](https://cve.now/CVE-2014-6838.md): The Groupama toujours la (aka com.groupama.toujoursla) application 1.3.0 for Android does not verify X.509 certificates from SSL servers, wh (no CVSS)
- [CVE-2014-6839](https://cve.now/CVE-2014-6839.md): The Alma Corinthiana (aka com.alma.corinthiana) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allow (no CVSS)
- [CVE-2014-6840](https://cve.now/CVE-2014-6840.md): The My Wedding Planner (aka app.wedding) application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-i (no CVSS)
- [CVE-2014-6841](https://cve.now/CVE-2014-6841.md): The RTI INDIA (aka com.vbulletin.build\_890) application 3.8.21 for Android does not verify X.509 certificates from SSL servers, which allows (no CVSS)
- [CVE-2014-6842](https://cve.now/CVE-2014-6842.md): The Daily Advertiser Print (aka com.lafayettedailyadv.android.prod) application 6.7 for Android does not verify X.509 certificates from SSL (no CVSS)
- [CVE-2014-6843](https://cve.now/CVE-2014-6843.md): The Sweatshop (aka com.orderingapps.sweatshop) application 2.96 for Android does not verify X.509 certificates from SSL servers, which allow (no CVSS)
- [CVE-2014-6844](https://cve.now/CVE-2014-6844.md): The ABC Song (aka com.tabtale.abcsingalong) application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows (no CVSS)
- [CVE-2014-6845](https://cve.now/CVE-2014-6845.md): The MediaFire (aka com.mediafire.android) application 1.1.1 for Android does not verify X.509 certificates from SSL servers, which allows ma (no CVSS)
- [CVE-2014-6846](https://cve.now/CVE-2014-6846.md): The Four Seasons Beverly Hills (aka com.intelitycorp.FourSeasons.android.ice) application @7F050007 for Android does not verify X.509 certif (no CVSS)
- [CVE-2014-6847](https://cve.now/CVE-2014-6847.md): The Horoscopes and Dreams (aka com.horoscopesanddreams) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, w (no CVSS)
- [CVE-2014-6848](https://cve.now/CVE-2014-6848.md): The DS file (aka com.synology.DSfile) application 4.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in (no CVSS)
- [CVE-2014-6850](https://cve.now/CVE-2014-6850.md): The SED Account (aka com.starkville.smartapps) application 1.153.0034 for Android does not verify X.509 certificates from SSL servers, which (no CVSS)
- [CVE-2014-4330](https://cve.now/CVE-2014-4330.md): The Dumper method in Data::Dumper before 2.154, as used in Perl 5.20.1 and earlier, allows context-dependent attackers to cause a denial of (no CVSS)
- [CVE-2014-4727](https://cve.now/CVE-2014-4727.md): Cross-site scripting (XSS) vulnerability in the DHCP clients page in the TP-LINK N750 Wireless Dual Band Gigabit Router (TL-WDR4300) with fi (no CVSS)
- [CVE-2014-4728](https://cve.now/CVE-2014-4728.md): The web server in the TP-LINK N750 Wireless Dual Band Gigabit Router (TL-WDR4300) with firmware before 140916 allows remote attackers to cau (no CVSS)
- [CVE-2014-6051](https://cve.now/CVE-2014-6051.md): Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a den (no CVSS)
- [CVE-2014-6055](https://cve.now/CVE-2014-6055.md): Multiple stack-based buffer overflows in the File Transfer feature in rfbserver.c in LibVNCServer 0.9.9 and earlier allow remote authenticat (no CVSS)
- [CVE-2014-6618](https://cve.now/CVE-2014-6618.md): Cross-site scripting (XSS) vulnerability in Your Online Shop allows remote attackers to inject arbitrary web script or HTML via the products (no CVSS)
- [CVE-2014-6619](https://cve.now/CVE-2014-6619.md): Multiple cross-site scripting (XSS) vulnerabilities in register-exec.php in Restaurant Script (PizzaInn\_Project) 1.0.0 allow remote attacker (no CVSS)
- [CVE-2014-7190](https://cve.now/CVE-2014-7190.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Openfiler 2.99.1 allow remote attackers to hijack the authentication of admini (no CVSS)
- [CVE-2012-5485](https://cve.now/CVE-2012-5485.md): registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, rel (no CVSS, plone)
- [CVE-2012-5486](https://cve.now/CVE-2012-5486.md): ZPublisher.HTTPRequest.\_scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrar (no CVSS, plone · zope2)
- [CVE-2012-5487](https://cve.now/CVE-2012-5487.md): The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certai (no CVSS, plone)
- [CVE-2012-5488](https://cve.now/CVE-2012-5488.md): python\_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to c (no CVSS, plone)
- [CVE-2012-5489](https://cve.now/CVE-2012-5489.md): The App.Undo.UndoSupport.get\_request\_var\_or\_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 an (no CVSS, plone · zope2)
- [CVE-2012-5490](https://cve.now/CVE-2012-5490.md): Cross-site scripting (XSS) vulnerability in kssdevel.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitr (no CVSS, plone)
- [CVE-2012-5491](https://cve.now/CVE-2012-5491.md): z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging (no CVSS, plone)
- [CVE-2012-5492](https://cve.now/CVE-2012-5492.md): uid\_catalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to obtain metadata about hidden objects via a crafted URL (no CVSS, plone)
- [CVE-2012-5493](https://cve.now/CVE-2012-5493.md): gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python sandbox (no CVSS, plone)
- [CVE-2012-5494](https://cve.now/CVE-2012-5494.md): Cross-site scripting (XSS) vulnerability in python\_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject (no CVSS, plone)
- [CVE-2012-5495](https://cve.now/CVE-2012-5495.md): python\_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to " (no CVSS, plone)
- [CVE-2012-5496](https://cve.now/CVE-2012-5496.md): kupu\_spellcheck.py in Kupu in Plone before 4.0 allows remote attackers to cause a denial of service (ZServer thread lock) via a crafted URL. (no CVSS, plone)
- [CVE-2012-5497](https://cve.now/CVE-2012-5497.md): membership\_tool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL. (no CVSS, plone)
- [CVE-2012-5498](https://cve.now/CVE-2012-5498.md): queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of service via a cr (no CVSS, plone)
- [CVE-2012-5499](https://cve.now/CVE-2012-5499.md): python\_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (memory consumption) via (no CVSS, plone)
- [CVE-2012-5501](https://cve.now/CVE-2012-5501.md): at\_download.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs (Files and Images) stored on cust (no CVSS, plone)
- [CVE-2012-5502](https://cve.now/CVE-2012-5502.md): Cross-site scripting (XSS) vulnerability in safe\_html.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with (no CVSS, plone)
- [CVE-2012-5503](https://cve.now/CVE-2012-5503.md): ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors. (no CVSS, plone)
- [CVE-2012-5504](https://cve.now/CVE-2012-5504.md): Cross-site scripting (XSS) vulnerability in widget\_traversal.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to injec (no CVSS, plone)
- [CVE-2012-5505](https://cve.now/CVE-2012-5505.md): atat.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a request for a view without (no CVSS, plone)
- [CVE-2012-5506](https://cve.now/CVE-2012-5506.md): python\_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (infinite loop) via an RS (no CVSS, plone)
- [CVE-2012-5507](https://cve.now/CVE-2012-5507.md): AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain (no CVSS, plone · zope2)
- [CVE-2012-6316](https://cve.now/CVE-2012-6316.md): Multiple cross-site scripting (XSS) vulnerabilities in the TP-LINK TL-WR841N router with firmware 3.13.9 Build 120201 Rel.54965n and earlier (no CVSS)
- [CVE-2014-0170](https://cve.now/CVE-2014-0170.md): Teiid before 8.4.3 and before 8.7 and Red Hat JBoss Data Virtualization 6.0.0 before patch 3 allows remote attackers to read arbitrary files (no CVSS)
- [CVE-2014-3558](https://cve.now/CVE-2014-3558.md): ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x befo (no CVSS, org.hibernate:hibernate-validator)
- [CVE-2014-5267](https://cve.now/CVE-2014-5267.md): modules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31 allows remote attackers to have unspecified impact via a crafted DOCTY (no CVSS)
- [CVE-2014-5444](https://cve.now/CVE-2014-5444.md): Geary before 0.6.3 does not present the user with a warning when a TLS certificate error is detected, which makes it easier for remote attac (no CVSS)
- [CVE-2014-6269](https://cve.now/CVE-2014-6269.md): Multiple integer overflows in the http\_request\_forward\_body function in proto\_http.c in HAProxy 1.5-dev23 before 1.5.4 allow remote attacker (no CVSS)
- [CVE-2014-6273](https://cve.now/CVE-2014-6273.md): Buffer overflow in the HTTP transport code in apt-get in APT 1.0.1 and earlier allows man-in-the-middle attackers to cause a denial of servi (no CVSS)
- [CVE-2014-7199](https://cve.now/CVE-2014-7199.md): Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.19, 1.22.x before 1.22.11, and 1.23.x before 1.23.4 allows remote attacker (no CVSS)
- [CVE-2014-6278](https://cve.now/CVE-2014-6278.md): GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote att (CVSS 8.8, KEV)
- [CVE-2014-6805](https://cve.now/CVE-2014-6805.md): The weibo (aka magic.weibo) application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle (no CVSS)
- [CVE-2014-6806](https://cve.now/CVE-2014-6806.md): The Thanodi - Setswana Translator (aka com.thanodi.thanodi) application 1.0.0 for Android does not verify X.509 certificates from SSL server (no CVSS)
- [CVE-2014-6807](https://cve.now/CVE-2014-6807.md): The OLA School (aka com.conduit.app\_00f9890a4f0145f2aae9d714e20b273a.app) application 1.2.7.132 for Android does not verify X.509 certificat (no CVSS)
- [CVE-2014-6808](https://cve.now/CVE-2014-6808.md): The Active 24 (aka com.zentity.app.active24) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows (no CVSS)
- [CVE-2014-6810](https://cve.now/CVE-2014-6810.md): The RIMS 2014 Annual Conference (aka com.coreapps.android.followme.rims2014) application 6.0.7.4 for Android does not verify X.509 certifica (no CVSS)
- [CVE-2014-6812](https://cve.now/CVE-2014-6812.md): The Aloha Guide (aka com.aloha.guide.english) application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows (no CVSS)
- [CVE-2014-6813](https://cve.now/CVE-2014-6813.md): The klassens (aka com.mcreda.klassens.apps) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows ma (no CVSS)
- [CVE-2014-6814](https://cve.now/CVE-2014-6814.md): The Sentinels Randomizer (aka com.mikehipps.sentinelsrandomizer) application 1.1.0 for Android does not verify X.509 certificates from SSL s (no CVSS)
- [CVE-2014-6815](https://cve.now/CVE-2014-6815.md): The Vouch! (aka com.voucherry.voucherry) application 2.1.6 for Android does not verify X.509 certificates from SSL servers, which allows man (no CVSS)
- [CVE-2014-6816](https://cve.now/CVE-2014-6816.md): The WISDOM (aka lvtu99.com.nescmxiaoniuniu) application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows ma (no CVSS)
- [CVE-2014-6817](https://cve.now/CVE-2014-6817.md): The Cove (aka org.covechurch.app) application 1.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the (no CVSS)
- [CVE-2014-6818](https://cve.now/CVE-2014-6818.md): The OHBM 20th Annual Meeting (aka com.coreapps.android.followme.ohbm2014) application 6.0.9.2 for Android does not verify X.509 certificates (no CVSS)
- [CVE-2014-6819](https://cve.now/CVE-2014-6819.md): The Lapp Group Catalogue (aka com.prinovis.LappKabel) application 1.4 for Android does not verify X.509 certificates from SSL servers, which (no CVSS)
- [CVE-2014-6820](https://cve.now/CVE-2014-6820.md): The Amebra Ameba (aka jp.honeytrap15.amebra) application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows (no CVSS)
- [CVE-2014-6821](https://cve.now/CVE-2014-6821.md): The voetbal (aka nl.jborsje.android.voetbal.az) application 4.7.2 for Android does not verify X.509 certificates from SSL servers, which all (no CVSS)
- [CVE-2014-6822](https://cve.now/CVE-2014-6822.md): The Nerdico (aka com.nerdico.danielepais) application 1.9 Stable for Android does not verify X.509 certificates from SSL servers, which allo (no CVSS)
- [CVE-2014-6823](https://cve.now/CVE-2014-6823.md): The kuailecaidengmi (aka com.licai.kuailecaidengmi) application 1.7.12.15 for Android does not verify X.509 certificates from SSL servers, w (no CVSS)
- [CVE-2014-6824](https://cve.now/CVE-2014-6824.md): The kamkomesan (aka com.anek.kamkomesan) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-i (no CVSS)
- [CVE-2014-6825](https://cve.now/CVE-2014-6825.md): The Teatro Franco Parenti (aka com.mintlab.mx.teatroparenti) application 1.4.0 for Android does not verify X.509 certificates from SSL serve (no CVSS)
- [CVE-2014-6826](https://cve.now/CVE-2014-6826.md): The Tic-Tac To The MAX FREE (aka com.tothemax) application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows (no CVSS)
- [CVE-2014-6827](https://cve.now/CVE-2014-6827.md): The DK ONLINE Beta (aka com.sgmobile.dkonline) application 1.0.2 for Android does not verify X.509 certificates from SSL servers, which allo (no CVSS)
- [CVE-2014-6828](https://cve.now/CVE-2014-6828.md): The Gulf Credit Union (aka Fi\_Mobile.Gulf) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man (no CVSS)
- [CVE-2014-6829](https://cve.now/CVE-2014-6829.md): The Hook (aka com.hook.android) application 0.9.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-m (no CVSS)
- [CVE-2014-6830](https://cve.now/CVE-2014-6830.md): The Covet Fashion - Shopping Game (aka com.crowdstar.covetfashion) application 2.14.40 for Android does not verify X.509 certificates from S (no CVSS)
- [CVE-2014-6831](https://cve.now/CVE-2014-6831.md): The Hippo Studio (aka com.appgreen.hippostudio) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allow (no CVSS)
- [CVE-2014-6832](https://cve.now/CVE-2014-6832.md): The Bersa Forum (aka com.gcspublishing.bersaforum) application 3.9.16 for Android does not verify X.509 certificates from SSL servers, which (no CVSS)
- [CVE-2014-6833](https://cve.now/CVE-2014-6833.md): The AuctionTrac Dealer (aka com.adesa.dealer.phone) application 2.0.3 for Android does not verify X.509 certificates from SSL servers, which (no CVSS)
- [CVE-2014-6834](https://cve.now/CVE-2014-6834.md): The Instaroid - Instagram Viewer (aka net.muik.instaroid) application 1.2.1 for Android does not verify X.509 certificates from SSL servers, (no CVSS)
- [CVE-2014-6835](https://cve.now/CVE-2014-6835.md): The Herbal Guide (aka com.pocket.herbal.guide) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows (no CVSS)
- [CVE-2014-6836](https://cve.now/CVE-2014-6836.md): The DS photo+ (aka com.synology.dsphoto) application 3.3 for Android does not verify X.509 certificates from SSL servers, which allows man-i (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-09-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.