# CVEs published 2014-10-07

20 CVEs were published on October 7, 2014: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2014-3565](https://cve.now/CVE-2014-3565.md): snmplib/mib.c in net-snmp 5.7.0 and earlier, when the -OQ option is used, allows remote attackers to cause a denial of service (snmptrapd cr (no CVSS)
- [CVE-2014-3632](https://cve.now/CVE-2014-3632.md): The default configuration in a sudoers file in the Red Hat openstack-neutron package before 2014.1.2-4, as used in Red Hat Enterprise Linux (no CVSS)
- [CVE-2014-5501](https://cve.now/CVE-2014-5501.md): Stack-based buffer overflow in the diagnose service in the Sophos Cyberoam appliances with CyberoamOS before 10.6.1 GA allows remote attacke (no CVSS)
- [CVE-2014-5502](https://cve.now/CVE-2014-5502.md): The Sophos Cyberoam appliances with CyberoamOS before 10.6.1 GA allows remote authenticated users to inject arbitrary commands via a (1) che (no CVSS)
- [CVE-2014-5503](https://cve.now/CVE-2014-5503.md): SQL injection vulnerability in the Guest Login Portal in the Sophos Cyberoam appliances with CyberoamOS before 10.6.1 GA allows remote attac (no CVSS)
- [CVE-2014-6433](https://cve.now/CVE-2014-6433.md): gpExec in GoPro HERO 3+ allows remote attackers to execute arbitrary files via a the (1) a1 or (2) a2 parameter in a start action. (no CVSS)
- [CVE-2014-6434](https://cve.now/CVE-2014-6434.md): gpExec in GoPro HERO 3+ allows remote attackers to execute arbitrary commands via a the (1) a1 or (2) a2 parameter in a restart action. (no CVSS)
- [CVE-2014-6603](https://cve.now/CVE-2014-6603.md): The SSHParseBanner function in SSH parser (app-layer-ssh.c) in Suricata before 2.0.4 allows remote attackers to bypass SSH rules, cause a de (no CVSS)
- [CVE-2014-7189](https://cve.now/CVE-2014-7189.md): crpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the-middle attackers to spoof clients via unspecifi (no CVSS, stdlib)
- [CVE-2014-7204](https://cve.now/CVE-2014-7204.md): jscript.c in Exuberant Ctags 5.8 allows remote attackers to cause a denial of service (infinite loop and CPU and disk consumption) via a cra (no CVSS)
- [CVE-2014-7235](https://cve.now/CVE-2014-7235.md): htdocs\_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 bef (no CVSS)
- [CVE-2014-7295](https://cve.now/CVE-2014-7295.md): The (1) Special:Preferences and (2) Special:UserLogin pages in MediaWiki before 1.19.20, 1.22.x before 1.22.12 and 1.23.x before 1.23.5 allo (no CVSS)
- [CVE-2014-0940](https://cve.now/CVE-2014-0940.md): Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Service Automation Manager 7.2.2.2 before 7.2.2.2-TIV-TSAM-LA0041 allow re (no CVSS)
- [CVE-2014-3399](https://cve.now/CVE-2014-3399.md): The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.2(.2.4) and earlier does not properly manage session inform (no CVSS)
- [CVE-2014-4802](https://cve.now/CVE-2014-4802.md): The Saved Search Admin component in the Process Admin Console in IBM Business Process Manager (BPM) 8.0 through 8.5.5 does not properly rest (no CVSS)
- [CVE-2014-4868](https://cve.now/CVE-2014-4868.md): The management console on the Brocade Vyatta 5400 vRouter 6.4R(x), 6.6R(x), and 6.7R1 allows remote authenticated users to execute arbitrary (no CVSS)
- [CVE-2014-4869](https://cve.now/CVE-2014-4869.md): The Brocade Vyatta 5400 vRouter 6.4R(x), 6.6R(x), and 6.7R1 allows attackers to obtain sensitive encrypted-password information by leveragin (no CVSS)
- [CVE-2014-4870](https://cve.now/CVE-2014-4870.md): /opt/vyatta/bin/sudo-users/vyatta-clear-dhcp-lease.pl on the Brocade Vyatta 5400 vRouter 6.4R(x), 6.6R(x), and 6.7R1 does not properly valid (no CVSS)
- [CVE-2014-4871](https://cve.now/CVE-2014-4871.md): Cross-site scripting (XSS) vulnerability in wlsecurity.html on NetCommWireless NB604N routers with firmware before GAN5.CZ56T-B-NC.AU-R4B030 (no CVSS)
- [CVE-2014-6287](https://cve.now/CVE-2014-6287.md): The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attacke (CVSS 9.8, KEV)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-10-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.