# CVEs published 2014-10-03

30 CVEs were published on October 3, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-0754](https://cve.now/CVE-2014-0754.md): Schneider Electric (no CVSS, Schneider Electric Ethernet modules for M340, Quantum and P…)
- [CVE-2014-5410](https://cve.now/CVE-2014-5410.md): Rockwell Automation Micrologix 1400 Improper Input Validation (no CVSS, Rockwell Automation Allen-Bradley MicroLogix)
- [CVE-2014-3947](https://cve.now/CVE-2014-3947.md): Unrestricted file upload vulnerability in the powermail extension before 1.6.11 and 2.x before 2.0.14 for TYPO3 allows remote attackers to e (no CVSS, in2code/powermail)
- [CVE-2014-6288](https://cve.now/CVE-2014-6288.md): The powermail extension 2.x before 2.0.11 for TYPO3 allows remote attackers to bypass the CAPTCHA protection mechanism via unspecified vecto (no CVSS, in2code/powermail)
- [CVE-2014-6289](https://cve.now/CVE-2014-6289.md): The Ajax dispatcher for Extbase in the Yet Another Gallery (yag) extension before 3.0.1 and Tools for Extbase development (pt\_extbase) exten (no CVSS, dl/yag · punktde/pt\_extbase)
- [CVE-2014-6290](https://cve.now/CVE-2014-6290.md): The News (tt\_news) extension before 3.5.2 for TYPO3 allows remote attackers to have unspecified impact via vectors related to an "insecure u (no CVSS)
- [CVE-2014-6291](https://cve.now/CVE-2014-6291.md): Cross-site scripting (XSS) vulnerability in the Alphabetic Sitemap (alpha\_sitemap) extension 0.0.3 and earlier for TYPO3 allows remote attac (no CVSS)
- [CVE-2014-6292](https://cve.now/CVE-2014-6292.md): The femanager extension before 1.0.9 for TYPO3 allows remote frontend users to modify or delete the records of other frontend users via unsp (no CVSS, in2code/femanager)
- [CVE-2014-6293](https://cve.now/CVE-2014-6293.md): SQL injection vulnerability in the Statistics (ke\_stats) extension before 1.1.2 for TYPO3 allows remote attackers to execute arbitrary SQL c (no CVSS)
- [CVE-2014-6294](https://cve.now/CVE-2014-6294.md): Cross-site scripting (XSS) vulnerability in the External links click statistics (outstats) extension 0.0.3 and earlier for TYPO3 allows remo (no CVSS)
- [CVE-2014-6295](https://cve.now/CVE-2014-6295.md): SQL injection vulnerability in the WEC Map (wec\_map) extension before 3.0.3 for TYPO3 allows remote attackers to execute arbitrary SQL comma (no CVSS, web-tp3/wec\_map · jbartels/wec-map)
- [CVE-2014-6296](https://cve.now/CVE-2014-6296.md): Cross-site scripting (XSS) vulnerability in the WEC Map (wec\_map) extension before 3.0.3 for TYPO3 allows remote attackers to inject arbitra (no CVSS, web-tp3/wec\_map · jbartels/wec-map)
- [CVE-2014-6297](https://cve.now/CVE-2014-6297.md): Cross-site scripting (XSS) vulnerability in the mm\_forum extension before 1.9.3 for TYPO3 allows remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2014-6298](https://cve.now/CVE-2014-6298.md): Unrestricted file upload vulnerability in the mm\_forum extension before 1.9.3 for TYPO3 allows remote attackers to execute arbitrary code by (no CVSS)
- [CVE-2014-6299](https://cve.now/CVE-2014-6299.md): Cross-site request forgery (CSRF) vulnerability in the mm\_forum extension before 1.9.3 for TYPO3 allows remote attackers to hijack the authe (no CVSS)
- [CVE-2014-4809](https://cve.now/CVE-2014-4809.md): The WebSEAL component in IBM Security Access Manager for Web 7.x before 7.0.0-ISS-WGA-IF0009 and 8.x before 8.0.0-ISS-WGA-FP0005, when e-com (no CVSS)
- [CVE-2014-4823](https://cve.now/CVE-2014-4823.md): The administration console in IBM Security Access Manager for Web 7.x before 7.0.0-ISS-WGA-IF0009 and 8.x before 8.0.0-ISS-WGA-FP0005, and S (no CVSS)
- [CVE-2014-6079](https://cve.now/CVE-2014-6079.md): Cross-site scripting (XSS) vulnerability in the Local Management Interface in IBM Security Access Manager for Web 7.x before 7.0.0-ISS-WGA-I (no CVSS)
- [CVE-2014-6894](https://cve.now/CVE-2014-6894.md): The Lucktastic (aka com.lucktastic.scratch) application 1.2.6 for Android does not verify X.509 certificates from SSL servers, which allows (no CVSS)
- [CVE-2014-6895](https://cve.now/CVE-2014-6895.md): The Throne Rush (aka com.progrestar.bft) application 2.3.10 for Android does not verify X.509 certificates from SSL servers, which allows ma (no CVSS)
- [CVE-2014-6896](https://cve.now/CVE-2014-6896.md): The Yik Yak (aka com.yik.yak) application 2.0.002 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-m (no CVSS)
- [CVE-2014-6897](https://cve.now/CVE-2014-6897.md): The Skyrim Map (aka com.neko.skyrimmap) application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in (no CVSS)
- [CVE-2014-6898](https://cve.now/CVE-2014-6898.md): The Boopsie MyLibrary (aka com.bredir.boopsie.mylibrary) application 4.5.110 for Android does not verify X.509 certificates from SSL servers (no CVSS)
- [CVE-2014-6899](https://cve.now/CVE-2014-6899.md): The Jazeera Airways (aka com.winit.jazeeraairways) application 2.7 for Android does not verify X.509 certificates from SSL servers, which al (no CVSS)
- [CVE-2014-6900](https://cve.now/CVE-2014-6900.md): The EAGE Amsterdam 2014 (aka com.coreapps.android.followme.eage\_2014) application 6.1.1.2 for Android does not verify X.509 certificates fro (no CVSS)
- [CVE-2014-6901](https://cve.now/CVE-2014-6901.md): The RADIOS DEL ECUADOR (aka com.nobexinc.wls\_87612622.rc) application 3.2.4 for Android does not verify X.509 certificates from SSL servers, (no CVSS)
- [CVE-2014-6902](https://cve.now/CVE-2014-6902.md): The Anjuke (aka com.anjuke.android.app) application 7.1.7 for Android does not verify X.509 certificates from SSL servers, which allows man- (no CVSS)
- [CVE-2014-6903](https://cve.now/CVE-2014-6903.md): The Gulf Power Mobile Bill Pay (aka com.tionetworks.gulf) application 1 for Android does not verify X.509 certificates from SSL servers, whi (no CVSS)
- [CVE-2014-6905](https://cve.now/CVE-2014-6905.md): The H2O Human Harmony Organization (aka com.netpia.ha.theh2o) application 1.6.5 for Android does not verify X.509 certificates from SSL serv (no CVSS)
- [CVE-2014-7217](https://cve.now/CVE-2014-7217.md): Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.4, 4.1.x before 4.1.14.5, and 4.2.x before 4.2.9.1 all (no CVSS, phpmyadmin/phpmyadmin)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-10-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.