# CVEs published 2014-10-10

51 CVEs were published on October 10, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-3678](https://cve.now/CVE-2014-3678.md): Cross-site scripting (XSS) vulnerability in the Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to inject arbitrary web (no CVSS, org.jvnet.hudson.plugins:monitoring)
- [CVE-2014-4312](https://cve.now/CVE-2014-4312.md): Multiple cross-site scripting (XSS) vulnerabilities in Epicor Enterprise 7.4 before FS74SP6\_HotfixTL054181 allow remote attackers to inject (no CVSS)
- [CVE-2014-4313](https://cve.now/CVE-2014-4313.md): SQL injection vulnerability in Epicor Procurement before 7.4 SP2 allows remote attackers to execute arbitrary SQL commands via the User fiel (no CVSS)
- [CVE-2014-4737](https://cve.now/CVE-2014-4737.md): Cross-site scripting (XSS) vulnerability in Textpattern CMS before 4.5.7 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2014-6243](https://cve.now/CVE-2014-6243.md): Cross-site scripting (XSS) vulnerability in the EWWW Image Optimizer plugin before 2.0.2 for WordPress allows remote attackers to inject arb (no CVSS)
- [CVE-2014-6315](https://cve.now/CVE-2014-6315.md): Multiple cross-site scripting (XSS) vulnerabilities in the Web-Dorado Photo Gallery plugin 1.1.30 and earlier for WordPress allow remote att (no CVSS)
- [CVE-2014-7139](https://cve.now/CVE-2014-7139.md): Multiple cross-site scripting (XSS) vulnerabilities in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before (no CVSS)
- [CVE-2014-7200](https://cve.now/CVE-2014-7200.md): Cross-site scripting (XSS) vulnerability in pi1/class.tx\_dmmjobcontrol\_pi1.php in the JobControl (dmmjobcontrol) extension 2.14.0 and earlie (no CVSS)
- [CVE-2014-7201](https://cve.now/CVE-2014-7201.md): Multiple SQL injection vulnerabilities in the search function in pi1/class.tx\_dmmjobcontrol\_pi1.php in the JobControl (dmmjobcontrol) extens (no CVSS)
- [CVE-2014-3382](https://cve.now/CVE-2014-3382.md): The SQL\*Net inspection engine in Cisco ASA Software 7.2 before 7.2(5.13), 8.2 before 8.2(5.50), 8.3 before 8.3(2.42), 8.4 before 8.4(7.15), (no CVSS)
- [CVE-2014-3383](https://cve.now/CVE-2014-3383.md): The IKE implementation in the VPN component in Cisco ASA Software 9.1 before 9.1(5.1) allows remote attackers to cause a denial of service ( (no CVSS)
- [CVE-2014-3384](https://cve.now/CVE-2014-3384.md): The IKEv2 implementation in Cisco ASA Software 8.4 before 8.4(7.15), 8.6 before 8.6(1.14), 9.0 before 9.0(4.8), and 9.1 before 9.1(5.1) allo (no CVSS)
- [CVE-2014-3385](https://cve.now/CVE-2014-3385.md): Race condition in the Health and Performance Monitoring (HPM) for ASDM feature in Cisco ASA Software 8.3 before 8.3(2.42), 8.4 before 8.4(7. (no CVSS)
- [CVE-2014-3386](https://cve.now/CVE-2014-3386.md): The GPRS Tunneling Protocol (GTP) inspection engine in Cisco ASA Software 8.2 before 8.2(5.51), 8.4 before 8.4(7.15), 8.7 before 8.7(1.13), (no CVSS)
- [CVE-2014-3387](https://cve.now/CVE-2014-3387.md): The SunRPC inspection engine in Cisco ASA Software 7.2 before 7.2(5.14), 8.2 before 8.2(5.51), 8.3 before 8.3(2.42), 8.4 before 8.4(7.23), 8 (no CVSS)
- [CVE-2014-3388](https://cve.now/CVE-2014-3388.md): The DNS inspection engine in Cisco ASA Software 9.0 before 9.0(4.13), 9.1 before 9.1(5.7), and 9.2 before 9.2(2) allows remote attackers to (no CVSS)
- [CVE-2014-3389](https://cve.now/CVE-2014-3389.md): The VPN implementation in Cisco ASA Software 7.2 before 7.2(5.15), 8.2 before 8.2(5.51), 8.3 before 8.3(2.42), 8.4 before 8.4(7.23), 8.6 bef (no CVSS)
- [CVE-2014-3390](https://cve.now/CVE-2014-3390.md): The Virtual Network Management Center (VNMC) policy implementation in Cisco ASA Software 8.7 before 8.7(1.14), 9.2 before 9.2(2.8), and 9.3 (no CVSS)
- [CVE-2014-3391](https://cve.now/CVE-2014-3391.md): Untrusted search path vulnerability in Cisco ASA Software 8.x before 8.4(3), 8.5, and 8.7 before 8.7(1.13) allows local users to gain privil (no CVSS)
- [CVE-2014-3392](https://cve.now/CVE-2014-3392.md): The Clientless SSL VPN portal in Cisco ASA Software 8.2 before 8.2(5.51), 8.3 before 8.3(2.42), 8.4 before 8.4(7.23), 8.6 before 8.6(1.15), (no CVSS)
- [CVE-2014-3393](https://cve.now/CVE-2014-3393.md): The Clientless SSL VPN portal customization framework in Cisco ASA Software 8.2 before 8.2(5.51), 8.3 before 8.3(2.42), 8.4 before 8.4(7.23) (no CVSS)
- [CVE-2014-3394](https://cve.now/CVE-2014-3394.md): The Smart Call Home (SCH) implementation in Cisco ASA Software 8.2 before 8.2(5.50), 8.4 before 8.4(7.15), 8.6 before 8.6(1.14), 8.7 before (no CVSS)
- [CVE-2014-3402](https://cve.now/CVE-2014-3402.md): The authentication-manager process in the web framework in Cisco Intrusion Prevention System (IPS) 7.0(8)E4 and earlier in Cisco Intrusion D (no CVSS)
- [CVE-2014-3581](https://cve.now/CVE-2014-3581.md): The cache\_merge\_headers\_out function in modules/cache/cache\_util.c in the mod\_cache module in the Apache HTTP Server before 2.4.11 allows re (no CVSS)
- [CVE-2014-4761](https://cve.now/CVE-2014-4761.md): IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 before 8.0.0.1 CF14, and 8.5.0 th (no CVSS)
- [CVE-2014-4867](https://cve.now/CVE-2014-4867.md): Cryoserver Security Appliance 7.3.x uses weak permissions for /etc/init.d/cryoserver, which allows local users to gain privileges by leverag (no CVSS)
- [CVE-2014-4872](https://cve.now/CVE-2014-4872.md): BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows remote attackers to upload arbitrary files, execute (no CVSS)
- [CVE-2014-4873](https://cve.now/CVE-2014-4873.md): SQL injection vulnerability in TrackItWeb/Grid/GetData in BMC Track-It! 11.3.0.355 allows remote authenticated users to execute arbitrary SQ (no CVSS)
- [CVE-2014-4874](https://cve.now/CVE-2014-4874.md): BMC Track-It! 11.3.0.355 allows remote authenticated users to read arbitrary files by visiting the TrackItWeb/Attachment page. (no CVSS)
- [CVE-2013-4488](https://cve.now/CVE-2013-4488.md): libgadu before 1.12.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers. (no CVSS)
- [CVE-2014-2635](https://cve.now/CVE-2014-2635.md): Unspecified vulnerability in HP Sprinter 12.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2343. (no CVSS)
- [CVE-2014-2636](https://cve.now/CVE-2014-2636.md): Unspecified vulnerability in HP Sprinter 12.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2336. (no CVSS)
- [CVE-2014-2637](https://cve.now/CVE-2014-2637.md): Unspecified vulnerability in HP Sprinter 12.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2342. (no CVSS)
- [CVE-2014-2638](https://cve.now/CVE-2014-2638.md): Unspecified vulnerability in HP Sprinter 12.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2344. (no CVSS)
- [CVE-2014-2646](https://cve.now/CVE-2014-2646.md): Unspecified vulnerability in HP Network Automation 9.10 and 9.20 allows local users to bypass intended access restrictions via unknown vecto (no CVSS)
- [CVE-2014-2648](https://cve.now/CVE-2014-2648.md): Unspecified vulnerability in HP Operations Manager 9.10 and 9.11 on UNIX allows remote attackers to execute arbitrary code via unknown vecto (no CVSS)
- [CVE-2014-2649](https://cve.now/CVE-2014-2649.md): Unspecified vulnerability in HP Operations Manager 9.20 on UNIX allows remote attackers to execute arbitrary code via unknown vectors. (no CVSS)
- [CVE-2014-3147](https://cve.now/CVE-2014-3147.md): Cross-site scripting (XSS) vulnerability in the auto-complete feature in Splunk Enterprise before 6.0.4 allows remote authenticated users to (no CVSS)
- [CVE-2014-3201](https://cve.now/CVE-2014-3201.md): core/rendering/compositing/RenderLayerCompositor.cpp in Blink, as used in Google Chrome before 38.0.2125.102 on Android, does not properly h (no CVSS)
- [CVE-2014-3403](https://cve.now/CVE-2014-3403.md): The Autonomic Networking Infrastructure (ANI) component in Cisco IOS XE does not properly validate certificates, which allows remote attacke (no CVSS)
- [CVE-2014-3404](https://cve.now/CVE-2014-3404.md): The Autonomic Networking Infrastructure (ANI) component in Cisco IOS XE does not properly validate certificates, which allows remote attacke (no CVSS)
- [CVE-2014-3405](https://cve.now/CVE-2014-3405.md): Cisco IOS XE enables the IPv6 Routing Protocol for Low-Power and Lossy Networks (aka RPL) on both the Autonomic Control Plane (ACP) and exte (no CVSS)
- [CVE-2014-4661](https://cve.now/CVE-2014-4661.md): Cross-site scripting (XSS) vulnerability in HP Records Manager before 7.3.5 and 8.x before 8.1 Patch 3 allows remote attackers to inject arb (no CVSS)
- [CVE-2014-5270](https://cve.now/CVE-2014-5270.md): Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization (no CVSS)
- [CVE-2014-5297](https://cve.now/CVE-2014-5297.md): The actionSendErrorReport method in protected/controllers/SiteController.php in X2Engine 2.8 through 4.1.7 allows remote attackers to conduc (no CVSS)
- [CVE-2014-5298](https://cve.now/CVE-2014-5298.md): FileUploadsFilter.php in X2Engine 4.1.7 and earlier, when running on case-insensitive file systems, allows remote attackers to bypass the up (no CVSS)
- [CVE-2014-5351](https://cve.now/CVE-2014-5351.md): The kadm5\_randkey\_principal\_3 function in lib/kadm5/srv/svr\_principal.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13 sends old keys i (no CVSS)
- [CVE-2014-6439](https://cve.now/CVE-2014-6439.md): Cross-site scripting (XSS) vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1 allows remote attackers to inject arb (no CVSS, org.elasticsearch:elasticsearch)
- [CVE-2014-7046](https://cve.now/CVE-2014-7046.md): The George Wassouf (aka com.devkhr32.georgewassouf) application 1.0 for Android does not verify X.509 certificates from SSL servers, which a (no CVSS)
- [CVE-2014-7047](https://cve.now/CVE-2014-7047.md): The Ocean Avenue Mobile Pro (aka com.oceanavenue.mobile) application 2.0 for Android does not verify X.509 certificates from SSL servers, wh (no CVSS)
- [CVE-2014-7226](https://cve.now/CVE-2014-7226.md): The file comment feature in Rejetto HTTP File Server (hfs) 2.3c and earlier allows remote attackers to execute arbitrary code by uploading a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-10-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.