# CVEs published 2014-10-06

28 CVEs were published on October 6, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2013-1436](https://cve.now/CVE-2013-1436.md): The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page titl (no CVSS)
- [CVE-2013-7329](https://cve.now/CVE-2013-7329.md): The CGI::Application module before 4.50\_50 and 4.50\_51 for Perl, when run modes are not specified, allows remote attackers to obtain sensiti (no CVSS)
- [CVE-2014-0397](https://cve.now/CVE-2014-0397.md): Multiple unspecified vulnerabilities in libXtsol in Oracle Solaris 10 and 11.1 have unspecified impact and attack vectors related to "Buffer (no CVSS)
- [CVE-2014-1224](https://cve.now/CVE-2014-1224.md): Incomplete blacklist vulnerability in the user registration feature in rexx Recruitment R6.1 and R7 without "fixes from 2014-01-15" allows r (no CVSS)
- [CVE-2014-1868](https://cve.now/CVE-2014-1868.md): Restlet Framework 2.1.x before 2.1.7 and 2.x.x before 2.2 RC1, when using XMLRepresentation or XML serializers, allows attackers to cause a (no CVSS, org.restlet.jse:org.restlet)
- [CVE-2014-1875](https://cve.now/CVE-2014-1875.md): The Capture::Tiny module before 0.24 for Perl allows local users to write to arbitrary files via a symlink attack on a temporary file. (no CVSS)
- [CVE-2014-2044](https://cve.now/CVE-2014-2044.md): Incomplete blacklist vulnerability in ajax/upload.php in ownCloud before 5.0, when running on Windows, allows remote authenticated users to (no CVSS)
- [CVE-2014-4043](https://cve.now/CVE-2014-4043.md): The posix\_spawn\_file\_actions\_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specificatio (no CVSS)
- [CVE-2014-4510](https://cve.now/CVE-2014-4510.md): Cross-site scripting (XSS) vulnerability in job.cc in apt-cacher-ng 0.7.26 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2014-6389](https://cve.now/CVE-2014-6389.md): backup.php in PHPCompta/NOALYSS before 6.7.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the d paramet (no CVSS)
- [CVE-2014-6409](https://cve.now/CVE-2014-6409.md): Cross-site request forgery (CSRF) vulnerability in M/Monit 3.3.2 and earlier allows remote attackers to hijack the authentication of adminis (no CVSS)
- [CVE-2014-6607](https://cve.now/CVE-2014-6607.md): M/Monit 3.3.2 and earlier does not verify the original password before changing passwords, which allows remote attackers to change the passw (no CVSS)
- [CVE-2013-6496](https://cve.now/CVE-2013-6496.md): Red Hat Conga 0.12.2 allows remote attackers to obtain sensitive information via a crafted request to the (1) homebase, (2) cluster, (3) sto (no CVSS)
- [CVE-2014-0074](https://cve.now/CVE-2014-0074.md): Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication (no CVSS)
- [CVE-2014-0140](https://cve.now/CVE-2014-0140.md): Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to access sensitive controllers and actions via (no CVSS)
- [CVE-2014-0168](https://cve.now/CVE-2014-0168.md): Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for re (no CVSS, org.jolokia:jolokia-core)
- [CVE-2014-0994](https://cve.now/CVE-2014-0994.md): Heap-based buffer overflow in the ReadDIB function in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) (no CVSS)
- [CVE-2014-3521](https://cve.now/CVE-2014-3521.md): The component in (1) /luci/homebase and (2) /luci/cluster menu in Red Hat Conga 0.12.2 allows remote authenticated users to bypass intended (no CVSS)
- [CVE-2014-3608](https://cve.now/CVE-2014-3608.md): The VMWare driver in OpenStack Compute (Nova) before 2014.1.3 allows remote authenticated users to bypass the quota limit and cause a denial (no CVSS, nova)
- [CVE-2014-3633](https://cve.now/CVE-2014-3633.md): The qemuDomainGetBlockIoTune function in qemu/qemu\_driver.c in libvirt before 1.2.9, when a disk has been hot-plugged or removed from the li (no CVSS)
- [CVE-2014-3642](https://cve.now/CVE-2014-3642.md): vmdb/app/controllers/application\_controller/performance.rb in Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authe (no CVSS)
- [CVE-2014-3657](https://cve.now/CVE-2014-3657.md): The virDomainListPopulate function in conf/domain\_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which al (no CVSS)
- [CVE-2014-5389](https://cve.now/CVE-2014-5389.md): SQL injection vulnerability in content-audit-schedule.php in the Content Audit plugin before 1.6.1 for WordPress allows remote attackers to (no CVSS)
- [CVE-2014-6054](https://cve.now/CVE-2014-6054.md): The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier allows remote attackers to cause a (no CVSS)
- [CVE-2014-7869](https://cve.now/CVE-2014-7869.md): Cross-site scripting (XSS) vulnerability in the configuration UI in the Context Form Alteration module 7.x-1.x before 7.x-1.2 for Drupal all (no CVSS)
- [CVE-2014-7870](https://cve.now/CVE-2014-7870.md): Cross-site scripting (XSS) vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows r (no CVSS)
- [CVE-2013-2645](https://cve.now/CVE-2013-2645.md): Multiple cross-site request forgery (CSRF) vulnerabilities on the TP-LINK WR1043N router with firmware TL-WR1043ND\_V1\_120405 allow remote at (no CVSS)
- [CVE-2014-2644](https://cve.now/CVE-2014-2644.md): Cross-site scripting (XSS) vulnerability in HP Systems Insight Manager (SIM) before 7.4 allows remote attackers to inject arbitrary web scri (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-10-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.