CVEs published October 22, 2014
19 CVEs were published on October 22, 2014: 0 critical, 1 high. 1 is now in CISA KEV.
- Published
- 19
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 18
- Now in CISA KEV
- 1
- Fix available
- 1
Most affected products
- zendframework/zendframework · zendframework/zendframework1
- 1
High 1
Medium, low and unrated 18
- CVE-2013-7407Cross-site request forgery (CSRF) vulnerability in the MRBS module for Drupal allows remote attackers to hijack the authentication of unspec
- CVE-2014-3675Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 packet.
- CVE-2014-3676Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via a crafted IPv6 address, related to the "tftp:// DHC
- CVE-2014-3677Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list, which triggers memory corruption.
- CVE-2014-6387gpc_api.php in MantisBT 1.2.17 and earlier allows remote attackers to bypass authenticated via a password starting will a null byte, which t
- CVE-2014-7182Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps plugin before 6.0.27 for WordPress allow remote attackers to injec
- CVE-2014-7183Multiple cross-site scripting (XSS) vulnerabilities in the search.php in LiteCart 1.1.2.1 and earlier allow remote attackers to inject arbit
- CVE-2014-7968VDSM allows remote attackers to cause a denial of service (connection blocking) by keeping an SSL connection open.
- CVE-2014-8088The (1) Zend_Ldap class in Zend before 1.12.9 and (2) Zend\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote attazendframework/zendframework · zendframework/zendframework1
- CVE-2014-8325The Calendar Base (cal) extension before 1.5.9 and 1.6.x before 1.6.1 for TYPO3 allows remote attackers to cause a denial of service (resour
- CVE-2014-8381Multiple cross-site scripting (XSS) vulnerabilities in Megapolis.Portal Manager allow remote attackers to inject arbitrary web script or HTM
- CVE-2014-8761inc/template.php in DokuWiki before 2014-05-05a only checks for access to the root namespace, which allows remote attackers to access arbitr
- CVE-2014-8762The ajax_mediadiff function in DokuWiki before 2014-05-05a allows remote attackers to access arbitrary images via a crafted namespace in the
- CVE-2014-8763DokuWiki before 2014-05-05b, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a pas
- CVE-2014-8764DokuWiki 2014-05-05a and earlier, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via
- CVE-2014-4448House Arrest in Apple iOS before 8.1 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attac
- CVE-2014-4449iCloud Data Access in Apple iOS before 8.1 does not verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to
- CVE-2014-4450The QuickType feature in the Keyboards subsystem in Apple iOS before 8.1 collects typing-prediction data from fields with an off autocomplet