# CVEs published 2014-10-17 23 CVEs were published on October 17, 2014: 0 critical, 0 high. Days are UTC. - [CVE-2014-2278](https://cve.now/CVE-2014-2278.md): Unrestricted file upload vulnerability in op/op.AddFile2.php in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows remote attackers to (no CVSS) - [CVE-2014-2279](https://cve.now/CVE-2014-2279.md): Multiple directory traversal vulnerabilities in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allow (1) remote authenticated users with (no CVSS) - [CVE-2014-6283](https://cve.now/CVE-2014-6283.md): SAP Adaptive Server Enterprise (ASE) 15.7 before SP122 or SP63, 15.5 before ESD#5.4, and 15.0.3 before ESD#4.4 does not properly restrict ac (no CVSS) - [CVE-2014-2559](https://cve.now/CVE-2014-2559.md): Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote atta (no CVSS) - [CVE-2014-2995](https://cve.now/CVE-2014-2995.md): Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticat (no CVSS) - [CVE-2013-7330](https://cve.now/CVE-2013-7330.md): Jenkins before 1.502 allows remote authenticated users to configure an otherwise restricted project via vectors related to post-build action (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2014-2058](https://cve.now/CVE-2014-2058.md): BuildTrigger in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to bypass access restrictions and execute arbi (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2014-2060](https://cve.now/CVE-2014-2060.md): The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vec (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2014-2061](https://cve.now/CVE-2014-2061.md): The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2014-2062](https://cve.now/CVE-2014-2062.md): Jenkins before 1.551 and LTS before 1.532.2 does not invalidate the API token when a user is deleted, which allows remote authenticated user (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2014-2063](https://cve.now/CVE-2014-2063.md): Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors. (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2014-2064](https://cve.now/CVE-2014-2064.md): The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows rem (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2014-2065](https://cve.now/CVE-2014-2065.md): Cross-site scripting (XSS) vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to inject arbitrary web scri (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2014-2066](https://cve.now/CVE-2014-2066.md): Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors inv (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2014-2068](https://cve.now/CVE-2014-2068.md): The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenti (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2014-7960](https://cve.now/CVE-2014-7960.md): OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max\_meta\_count and other metadata constraints (no CVSS, swift) - [CVE-2014-8074](https://cve.now/CVE-2014-8074.md): Buffer overflow in the SetLogFile method in Foxit.FoxitPDFSDKProCtrl.5 in Foxit PDF SDK ActiveX 2.3 through 5.0.1820 before 5.0.2.924 allows (no CVSS) - [CVE-2014-8755](https://cve.now/CVE-2014-8755.md): Panasonic Network Camera View 3 and 4 allows remote attackers to execute arbitrary code via a crafted page, which triggers an invalid pointe (no CVSS) - [CVE-2014-8756](https://cve.now/CVE-2014-8756.md): The NcrCtl4.NcrNet.1 control in Panasonic Network Camera Recorder before 4.04R03 allows remote attackers to execute arbitrary code via a cra (no CVSS) - [CVE-2014-8317](https://cve.now/CVE-2014-8317.md): Cross-site scripting (XSS) vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.4 for Drupal allow (no CVSS) - [CVE-2014-8318](https://cve.now/CVE-2014-8318.md): Cross-site scripting (XSS) vulnerability in the Webform module 6.x-3.x before 6.x-3.20, 7.x-3.x before 7.x-3.20, and 7.x-4.x before 7.x-4.0- (no CVSS) - [CVE-2014-8319](https://cve.now/CVE-2014-8319.md): Cross-site scripting (XSS) vulnerability in the easy\_social\_admin\_summary function in the Easy Social module 7.x-2.x before 7.x-2.11 for Dru (no CVSS) - [CVE-2014-8320](https://cve.now/CVE-2014-8320.md): Cross-site scripting (XSS) vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows r (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2014-10-17 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.