# CVEs published 2014-10-08

42 CVEs were published on October 8, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-3641](https://cve.now/CVE-2014-3641.md): The (1) GlusterFS and (2) Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from (no CVSS, cinder)
- [CVE-2014-5300](https://cve.now/CVE-2014-5300.md): Adaptive Computing Moab before 7.2.9 and 8 before 8.0.0 allows remote attackers to bypass the signature check, impersonate arbitrary users, (no CVSS)
- [CVE-2014-5375](https://cve.now/CVE-2014-5375.md): The server in Adaptive Computing Moab before 7.2.9 and 8 before 8.0.0 does not properly validate the message owner matches the submitting us (no CVSS)
- [CVE-2014-5376](https://cve.now/CVE-2014-5376.md): Adaptive Computing Moab before 7.2.9 and 8 before 8.0.0, when a pre-generated key is used, does not validate that the requesting user matche (no CVSS)
- [CVE-2014-6631](https://cve.now/CVE-2014-6631.md): Cross-site scripting (XSS) vulnerability in com\_media in Joomla! 3.2.x before 3.2.5 and 3.3.x before 3.3.4 allows remote attackers to inject (no CVSS)
- [CVE-2014-6632](https://cve.now/CVE-2014-6632.md): Joomla! 2.5.x before 2.5.25, 3.x before 3.2.4, and 3.3.x before 3.3.4 allows remote attackers to authenticate and bypass intended access res (no CVSS)
- [CVE-2014-7202](https://cve.now/CVE-2014-7202.md): stream\_engine.cpp in libzmq (aka ZeroMQ/C++)) 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct downgrade attacks via a craft (no CVSS)
- [CVE-2014-7203](https://cve.now/CVE-2014-7203.md): libzmq (aka ZeroMQ/C++) 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct repla (no CVSS)
- [CVE-2014-7229](https://cve.now/CVE-2014-7229.md): Unspecified vulnerability in Joomla! before 2.5.4 before 2.5.26, 3.x before 3.2.6, and 3.3.x before 3.3.5 allows attackers to cause a denial (no CVSS)
- [CVE-2014-7230](https://cve.now/CVE-2014-7230.md): The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 allows loc (no CVSS)
- [CVE-2014-7231](https://cve.now/CVE-2014-7231.md): The strutils.mask\_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1. (no CVSS, oslo-utils)
- [CVE-2014-7296](https://cve.now/CVE-2014-7296.md): The default configuration in the accessibility engine in SpagoBI 5.0.0 does not set FEATURE\_SECURE\_PROCESSING, which allows remote authentic (no CVSS)
- [CVE-2014-7981](https://cve.now/CVE-2014-7981.md): SQL injection vulnerability in Joomla! CMS 3.1.x and 3.2.x before 3.2.3 allows remote attackers to execute arbitrary SQL commands via unspec (no CVSS)
- [CVE-2014-7982](https://cve.now/CVE-2014-7982.md): Cross-site scripting (XSS) vulnerability in Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2014-7983](https://cve.now/CVE-2014-7983.md): Cross-site scripting (XSS) vulnerability in com\_contact in Joomla! CMS 3.1.2 through 3.2.x before 3.2.3 allows remote attackers to inject ar (no CVSS)
- [CVE-2014-7984](https://cve.now/CVE-2014-7984.md): Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to authenticate and bypass intended restrictions via vectors in (no CVSS)
- [CVE-2014-7978](https://cve.now/CVE-2014-7978.md): Cross-site scripting (XSS) vulnerability in the BlueMasters theme 7.x-2.x before 7.x-2.1 for Drupal allows remote authenticated users with t (no CVSS)
- [CVE-2014-7979](https://cve.now/CVE-2014-7979.md): Cross-site scripting (XSS) vulnerability in the SimpleCorp theme 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with th (no CVSS)
- [CVE-2014-7980](https://cve.now/CVE-2014-7980.md): Multiple cross-site scripting (XSS) vulnerabilities in template.php in Zen theme 7.x-3.x before 7.x-3.3 and 7.x-5.x before 7.x-5.5 for Drupa (no CVSS)
- [CVE-2014-5308](https://cve.now/CVE-2014-5308.md): Multiple SQL injection vulnerabilities in TestLink 1.9.11 allow remote authenticated users to execute arbitrary SQL commands via the (1) nam (no CVSS)
- [CVE-2014-6394](https://cve.now/CVE-2014-6394.md): visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which all (no CVSS, send)
- [CVE-2014-7185](https://cve.now/CVE-2014-7185.md): Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive information from process me (no CVSS)
- [CVE-2014-7205](https://cve.now/CVE-2014-7205.md): Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server frame (no CVSS, bassmaster)
- [CVE-2014-3187](https://cve.now/CVE-2014-3187.md): Google Chrome before 37.0.2062.60 and 38.x before 38.0.2125.59 on iOS does not properly restrict processing of (1) facetime:// and (2) facet (no CVSS)
- [CVE-2014-3188](https://cve.now/CVE-2014-3188.md): Google Chrome before 38.0.2125.101 and Chrome OS before 38.0.2125.101 do not properly handle the interaction of IPC and Google V8, which all (no CVSS)
- [CVE-2014-3189](https://cve.now/CVE-2014-3189.md): The chrome\_pdf::CopyImage function in pdf/draw\_utils.cc in the PDFium component in Google Chrome before 38.0.2125.101 does not properly vali (no CVSS)
- [CVE-2014-3190](https://cve.now/CVE-2014-3190.md): Use-after-free vulnerability in the Event::currentTarget function in core/events/Event.cpp in Blink, as used in Google Chrome before 38.0.21 (no CVSS)
- [CVE-2014-3191](https://cve.now/CVE-2014-3191.md): Use-after-free vulnerability in Blink, as used in Google Chrome before 38.0.2125.101, allows remote attackers to cause a denial of service o (no CVSS)
- [CVE-2014-3192](https://cve.now/CVE-2014-3192.md): Use-after-free vulnerability in the ProcessingInstruction::setXSLStyleSheet function in core/dom/ProcessingInstruction.cpp in the DOM implem (no CVSS)
- [CVE-2014-3193](https://cve.now/CVE-2014-3193.md): The SessionService::GetLastSession function in browser/sessions/session\_service.cc in Google Chrome before 38.0.2125.101 allows remote attac (no CVSS)
- [CVE-2014-3194](https://cve.now/CVE-2014-3194.md): Use-after-free vulnerability in the Web Workers implementation in Google Chrome before 38.0.2125.101 allows remote attackers to cause a deni (no CVSS)
- [CVE-2014-3195](https://cve.now/CVE-2014-3195.md): Google V8, as used in Google Chrome before 38.0.2125.101, does not properly track JavaScript heap-memory allocations as allocations of unini (no CVSS)
- [CVE-2014-3196](https://cve.now/CVE-2014-3196.md): base/memory/shared\_memory\_win.cc in Google Chrome before 38.0.2125.101 on Windows does not properly implement read-only restrictions on shar (no CVSS)
- [CVE-2014-3197](https://cve.now/CVE-2014-3197.md): The NavigationScheduler::schedulePageBlock function in core/loader/NavigationScheduler.cpp in Blink, as used in Google Chrome before 38.0.21 (no CVSS)
- [CVE-2014-3198](https://cve.now/CVE-2014-3198.md): The Instance::HandleInputEvent function in pdf/instance.cc in the PDFium component in Google Chrome before 38.0.2125.101 interprets a certai (no CVSS)
- [CVE-2014-3199](https://cve.now/CVE-2014-3199.md): The wrap function in bindings/core/v8/custom/V8EventCustom.cpp in the V8 bindings in Blink, as used in Google Chrome before 38.0.2125.101, h (no CVSS)
- [CVE-2014-3200](https://cve.now/CVE-2014-3200.md): Multiple unspecified vulnerabilities in Google Chrome before 38.0.2125.101 allow attackers to cause a denial of service or possibly have oth (no CVSS)
- [CVE-2014-7967](https://cve.now/CVE-2014-7967.md): Multiple unspecified vulnerabilities in Google V8 before 3.28.71.15, as used in Google Chrome before 38.0.2125.101, allow attackers to cause (no CVSS)
- [CVE-2014-7273](https://cve.now/CVE-2014-7273.md): The IMAP-over-SSL implementation in getmail 4.0.0 through 4.43.0 does not verify X.509 certificates from SSL servers, which allows man-in-th (no CVSS)
- [CVE-2014-7274](https://cve.now/CVE-2014-7274.md): The IMAP-over-SSL implementation in getmail 4.44.0 does not verify that the server hostname matches a domain name in the subject's Common Na (no CVSS)
- [CVE-2014-7275](https://cve.now/CVE-2014-7275.md): The POP3-over-SSL implementation in getmail 4.0.0 through 4.44.0 does not verify X.509 certificates from SSL servers, which allows man-in-th (no CVSS)
- [CVE-2014-7299](https://cve.now/CVE-2014-7299.md): Unspecified vulnerability in administrative interfaces in ArubaOS 6.3.1.11, 6.3.1.11-FIPS, 6.4.2.1, and 6.4.2.1-FIPS on Aruba controllers al (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-10-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.