# CVEs published 2014-10-22 19 CVEs were published on October 22, 2014: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2013-7407](https://cve.now/CVE-2013-7407.md): Cross-site request forgery (CSRF) vulnerability in the MRBS module for Drupal allows remote attackers to hijack the authentication of unspec (no CVSS) - [CVE-2014-3675](https://cve.now/CVE-2014-3675.md): Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 packet. (no CVSS) - [CVE-2014-3676](https://cve.now/CVE-2014-3676.md): Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via a crafted IPv6 address, related to the "tftp:// DHC (no CVSS) - [CVE-2014-3677](https://cve.now/CVE-2014-3677.md): Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list, which triggers memory corruption. (no CVSS) - [CVE-2014-6352](https://cve.now/CVE-2014-6352.md): Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and (CVSS 7.8, KEV) - [CVE-2014-6387](https://cve.now/CVE-2014-6387.md): gpc\_api.php in MantisBT 1.2.17 and earlier allows remote attackers to bypass authenticated via a password starting will a null byte, which t (no CVSS) - [CVE-2014-7182](https://cve.now/CVE-2014-7182.md): Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps plugin before 6.0.27 for WordPress allow remote attackers to injec (no CVSS) - [CVE-2014-7183](https://cve.now/CVE-2014-7183.md): Multiple cross-site scripting (XSS) vulnerabilities in the search.php in LiteCart 1.1.2.1 and earlier allow remote attackers to inject arbit (no CVSS) - [CVE-2014-7968](https://cve.now/CVE-2014-7968.md): VDSM allows remote attackers to cause a denial of service (connection blocking) by keeping an SSL connection open. (no CVSS) - [CVE-2014-8088](https://cve.now/CVE-2014-8088.md): The (1) Zend\_Ldap class in Zend before 1.12.9 and (2) Zend\\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote atta (no CVSS, zendframework/zendframework ยท zendframework/zendframework1) - [CVE-2014-8325](https://cve.now/CVE-2014-8325.md): The Calendar Base (cal) extension before 1.5.9 and 1.6.x before 1.6.1 for TYPO3 allows remote attackers to cause a denial of service (resour (no CVSS) - [CVE-2014-8381](https://cve.now/CVE-2014-8381.md): Multiple cross-site scripting (XSS) vulnerabilities in Megapolis.Portal Manager allow remote attackers to inject arbitrary web script or HTM (no CVSS) - [CVE-2014-8761](https://cve.now/CVE-2014-8761.md): inc/template.php in DokuWiki before 2014-05-05a only checks for access to the root namespace, which allows remote attackers to access arbitr (no CVSS) - [CVE-2014-8762](https://cve.now/CVE-2014-8762.md): The ajax\_mediadiff function in DokuWiki before 2014-05-05a allows remote attackers to access arbitrary images via a crafted namespace in the (no CVSS) - [CVE-2014-8763](https://cve.now/CVE-2014-8763.md): DokuWiki before 2014-05-05b, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a pas (no CVSS) - [CVE-2014-8764](https://cve.now/CVE-2014-8764.md): DokuWiki 2014-05-05a and earlier, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via (no CVSS) - [CVE-2014-4448](https://cve.now/CVE-2014-4448.md): House Arrest in Apple iOS before 8.1 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attac (no CVSS) - [CVE-2014-4449](https://cve.now/CVE-2014-4449.md): iCloud Data Access in Apple iOS before 8.1 does not verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to (no CVSS) - [CVE-2014-4450](https://cve.now/CVE-2014-4450.md): The QuickType feature in the Keyboards subsystem in Apple iOS before 8.1 collects typing-prediction data from fields with an off autocomplet (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2014-10-22 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.