# CVEs published 2014-10-02

54 CVEs were published on October 2, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-3621](https://cve.now/CVE-2014-3621.md): The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users (no CVSS, keystone)
- [CVE-2014-6242](https://cve.now/CVE-2014-6242.md): Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated (no CVSS)
- [CVE-2014-6414](https://cve.now/CVE-2014-6414.md): OpenStack Neutron before 2014.2.4 and 2014.1 before 2014.1.2 allows remote authenticated users to set admin network attributes to default va (no CVSS)
- [CVE-2014-7144](https://cve.now/CVE-2014-7144.md): OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification whe (no CVSS, keystonemiddleware · python-keystoneclient)
- [CVE-2014-7154](https://cve.now/CVE-2014-7154.md): Race condition in HVMOP\_track\_dirty\_vram in Xen 4.0.0 through 4.4.x does not ensure possession of the guarding lock for dirty video RAM trac (no CVSS)
- [CVE-2014-7155](https://cve.now/CVE-2014-7155.md): The x86\_emulate function in arch/x86/x86\_emulate/x86\_emulate.c in Xen 4.4.x and earlier does not properly check supervisor mode permissions, (no CVSS)
- [CVE-2014-7156](https://cve.now/CVE-2014-7156.md): The x86\_emulate function in arch/x86/x86\_emulate/x86\_emulate.c in Xen 3.3.x through 4.4.x does not check the supervisor mode permissions for (no CVSS)
- [CVE-2014-7157](https://cve.now/CVE-2014-7157.md): Cross-site scripting (XSS) vulnerability in Exinda WAN Optimization Suite 7.0.0 (2160) allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2014-7158](https://cve.now/CVE-2014-7158.md): Cross-site request forgery (CSRF) vulnerability in Exinda WAN Optimization Suite 7.0.0 (2160) allows remote attackers to hijack the authenti (no CVSS)
- [CVE-2014-7188](https://cve.now/CVE-2014-7188.md): The hvm\_msr\_read\_intercept function in arch/x86/hvm/hvm.c in Xen 4.1 through 4.4.x uses an improper MSR range for x2APIC emulation, which al (no CVSS)
- [CVE-2014-6856](https://cve.now/CVE-2014-6856.md): The AHRAH (aka com.vet2pet.aid219426) application 219426 for Android does not verify X.509 certificates from SSL servers, which allows man-i (no CVSS)
- [CVE-2014-6857](https://cve.now/CVE-2014-6857.md): The Car Wallpapers HD (aka com.arab4x4.gallery.app) application 1.3 for Android does not verify X.509 certificates from SSL servers, which a (no CVSS)
- [CVE-2014-6858](https://cve.now/CVE-2014-6858.md): The Mostafa Shemeas (aka com.mostafa.shemeas.website) application 1.0 for Android does not verify X.509 certificates from SSL servers, which (no CVSS)
- [CVE-2014-6859](https://cve.now/CVE-2014-6859.md): The Daum Maps - Subway (aka net.daum.android.map) application 3.9.1 for Android does not verify X.509 certificates from SSL servers, which a (no CVSS)
- [CVE-2014-6860](https://cve.now/CVE-2014-6860.md): The Trial Tracker (aka com.etcweb.android.trial\_tracker) application 1.1.9 for Android does not verify X.509 certificates from SSL servers, (no CVSS)
- [CVE-2014-6861](https://cve.now/CVE-2014-6861.md): The Terrarienbilder.com Forum (aka com.tapatalk.terrarienbildercomvb) application 3.8.20 for Android does not verify X.509 certificates from (no CVSS)
- [CVE-2014-6862](https://cve.now/CVE-2014-6862.md): The ArtAcces (aka cat.gencat.mobi.artacces) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows ma (no CVSS)
- [CVE-2014-6863](https://cve.now/CVE-2014-6863.md): The Mootorratturid & biker.ee (aka ee.digitalfruit.mootorratturid) application 1.0 for Android does not verify X.509 certificates from SSL s (no CVSS)
- [CVE-2014-6864](https://cve.now/CVE-2014-6864.md): The Forest River Forums (aka com.socialknowledge.forestriverforums) application 3.7.5 for Android does not verify X.509 certificates from SS (no CVSS)
- [CVE-2014-6865](https://cve.now/CVE-2014-6865.md): The Jamal Bates Show (aka com.conduit.app\_3a95e13827c54c4da9056fafb33ecc8d.app) application 1.3.14.254 for Android does not verify X.509 cer (no CVSS)
- [CVE-2014-6866](https://cve.now/CVE-2014-6866.md): The HomeAdvisor Mobile (aka com.servicemagic.consumer) application 3.0.3 for Android does not verify X.509 certificates from SSL servers, wh (no CVSS)
- [CVE-2014-6867](https://cve.now/CVE-2014-6867.md): The Sortir en Alsace (aka com.axessweb.sortirenalsace) application 0.5b for Android does not verify X.509 certificates from SSL servers, whi (no CVSS)
- [CVE-2014-6868](https://cve.now/CVE-2014-6868.md): The DS audio (aka com.synology.DSaudio) application 3.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in (no CVSS)
- [CVE-2014-6869](https://cve.now/CVE-2014-6869.md): The barcode scanner (aka tw.com.books.android.plus) application 2.3.0 for Android does not verify X.509 certificates from SSL servers, which (no CVSS)
- [CVE-2014-6870](https://cve.now/CVE-2014-6870.md): The BGEnergy (aka com.bluegrass.smartapps) application 1.153.0034 for Android does not verify X.509 certificates from SSL servers, which all (no CVSS)
- [CVE-2014-6871](https://cve.now/CVE-2014-6871.md): The Hogs Fly Crazy (aka com.pedrojayme.hogsflycrazy) application 1.0.0 for Android does not verify X.509 certificates from SSL servers, whic (no CVSS)
- [CVE-2014-6872](https://cve.now/CVE-2014-6872.md): The TTNET Muzik (aka com.ttnet.muzik) application 3.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-t (no CVSS)
- [CVE-2014-6873](https://cve.now/CVE-2014-6873.md): The AMGC (aka com.amec.uae) application 6.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle (no CVSS)
- [CVE-2014-6874](https://cve.now/CVE-2014-6874.md): The ModSim Connected (aka com.concursive.modsim) application 2.0 for Android does not verify X.509 certificates from SSL servers, which allo (no CVSS)
- [CVE-2014-6875](https://cve.now/CVE-2014-6875.md): The Woodforest Mobile Banking (aka com.woodforest) application 3.1 for Android does not verify X.509 certificates from SSL servers, which al (no CVSS)
- [CVE-2014-6876](https://cve.now/CVE-2014-6876.md): The American Express Serve (aka com.serve.mobile) application @7F0901E4 for Android does not verify X.509 certificates from SSL servers, whi (no CVSS)
- [CVE-2014-6877](https://cve.now/CVE-2014-6877.md): The Santander Personal Banking (aka com.sovereign.santander) application 2.1 for Android does not verify X.509 certificates from SSL servers (no CVSS)
- [CVE-2014-6878](https://cve.now/CVE-2014-6878.md): The RBFCU Mobile (aka com.Vertifi.DeposZip.P314089681) application 3.1 for Android does not verify X.509 certificates from SSL servers, whic (no CVSS)
- [CVE-2014-6879](https://cve.now/CVE-2014-6879.md): The Equifax Mobile (aka com.equifax) application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-th (no CVSS)
- [CVE-2014-6880](https://cve.now/CVE-2014-6880.md): The TradeHero (aka com.tradehero.th) application 2.2.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in- (no CVSS)
- [CVE-2014-6881](https://cve.now/CVE-2014-6881.md): The PNC Virtual Wallet (aka com.pnc.ecommerce.mobile.vw.android) application before 2.2 for Android does not verify X.509 certificates from (no CVSS)
- [CVE-2014-6882](https://cve.now/CVE-2014-6882.md): The Western Federal Credit Union (aka com.kerrata.pulse.western) application 2.1 for Android does not verify X.509 certificates from SSL ser (no CVSS)
- [CVE-2014-6883](https://cve.now/CVE-2014-6883.md): The CNNMoney Portfolio for stocks (aka com.cnn.portfolio) application 1.0.2 for Android does not verify X.509 certificates from SSL servers, (no CVSS)
- [CVE-2014-6884](https://cve.now/CVE-2014-6884.md): The Ford Credit Account Manager (aka com.fordcredit.accountmanager) application 1.0.1 for Android does not verify X.509 certificates from SS (no CVSS)
- [CVE-2014-6885](https://cve.now/CVE-2014-6885.md): The Academy Sports + Outdoors Visa (aka com.usbank.icsmobile.academysports) application 1.18 for Android does not verify X.509 certificates (no CVSS)
- [CVE-2014-6886](https://cve.now/CVE-2014-6886.md): The WePhone - phone calls vs skype (aka com.wephoneapp) application 1.03.00 for Android does not verify X.509 certificates from SSL servers, (no CVSS)
- [CVE-2014-6888](https://cve.now/CVE-2014-6888.md): The PennyTalk Mobile (aka net.idt.pennytalk.android) application 2.0.3.0 for Android does not verify X.509 certificates from SSL servers, wh (no CVSS)
- [CVE-2014-6889](https://cve.now/CVE-2014-6889.md): The GunBroker.com (aka com.gunbroker.android) application 1.1.2 for Android does not verify X.509 certificates from SSL servers, which allow (no CVSS)
- [CVE-2014-6890](https://cve.now/CVE-2014-6890.md): The CouponCabin - Coupons & Deals (aka com.couponcabin) application 3.6 for Android does not verify X.509 certificates from SSL servers, whi (no CVSS)
- [CVE-2014-6892](https://cve.now/CVE-2014-6892.md): The kalahari.com Shopping (aka com.kalahari.shop) application 1.4.2.1 for Android does not verify X.509 certificates from SSL servers, which (no CVSS)
- [CVE-2014-6893](https://cve.now/CVE-2014-6893.md): The Pushpins Grocery Coupons (aka com.pushpinsapp.pushpins) application 1.56 for Android does not verify X.509 certificates from SSL servers (no CVSS)
- [CVE-2014-2640](https://cve.now/CVE-2014-2640.md): Cross-site scripting (XSS) vulnerability in HP System Management Homepage (SMH) before 7.4 allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2014-2641](https://cve.now/CVE-2014-2641.md): Cross-site request forgery (CSRF) vulnerability in HP System Management Homepage (SMH) before 7.4 allows remote authenticated users to hijac (no CVSS)
- [CVE-2014-2642](https://cve.now/CVE-2014-2642.md): HP System Management Homepage (SMH) before 7.4 allows remote attackers to conduct clickjacking attacks via unspecified vectors. (no CVSS)
- [CVE-2014-3059](https://cve.now/CVE-2014-3059.md): Unspecified vulnerability in the Administrative Console on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain (no CVSS)
- [CVE-2014-3060](https://cve.now/CVE-2014-3060.md): Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by l (no CVSS)
- [CVE-2014-3097](https://cve.now/CVE-2014-3097.md): Open redirect vulnerability in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0-TIV-TFIM-IF0015, 6.2.1 before 6.2.1-TIV-TFIM- (no CVSS)
- [CVE-2014-4765](https://cve.now/CVE-2014-4765.md): IBM Maximo Asset Management 7.1 through 7.1.1.13 and 7.5 through 7.5.0.6, Maximo Asset Management 7.5.0 through 7.5.0.3 and 7.5.1 through 7. (no CVSS)
- [CVE-2014-4793](https://cve.now/CVE-2014-4793.md): IBM WebSphere MQ 8.x before 8.0.0.1 does not properly enforce CHLAUTH rules for blocking client connections in certain circumstances related (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-10-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.