CVEs published October 25, 2014
21 CVEs were published on October 25, 2014: 0 critical, 0 high.
- Published
- 21
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 21
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- python-gnupg
- 3
- bottle
- 1
- ca.juliusdavies:not-yet-commons-ssl
- 1
Medium, low and unrated 21
- CVE-2013-4594The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous
- CVE-2014-0476The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a
- CVE-2014-3137Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attabottle
- CVE-2014-1927The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrarpython-gnupg
- CVE-2014-1928The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbipython-gnupg
- CVE-2014-1929python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection throupython-gnupg
- CVE-2014-5075The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server hostn
- CVE-2014-3636D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of service (prevention of new connec
- CVE-2014-3409The Ethernet Connectivity Fault Management (CFM) handling feature in Cisco IOS 12.2(33)SRE9a and earlier and IOS XE 3.13S and earlier allows
- CVE-2014-4620The EMC NetWorker Module for MEDITECH (aka NMMEDI) 3.0 build 87 through 90, when EMC RecoverPoint and Plink are used, stores cleartext Recov
- CVE-2014-4623EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store (ADS) GEN4(S) and Avamar Virtual Edition (AVE), when Password Hardening before 2.0.0
- CVE-2014-4624EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x through 7.0.2-43 do not require authentication for Java API calls
- CVE-2014-6151CRLF injection vulnerability in IBM Tivoli Integrated Portal (TIP) 2.2.x allows remote authenticated users to inject arbitrary HTTP headers
- CVE-2014-6152Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Integrated Portal (TIP) 2.2.x allow remote authenticated users to inject a
- CVE-2014-6611The BlackBerry World app before 5.0.0.262 on BlackBerry 10 OS 10.2.0, before 5.0.0.263 on BlackBerry 10 OS 10.2.1, and before 5.1.0.53 on Bl
- CVE-2014-2021Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.2.2 and earlier, and 5.0.x through 5.0.5 allows remote authent
- CVE-2014-3604Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subjecca.juliusdavies:not-yet-commons-ssl
- CVE-2014-6230WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the IP blacklist via a c
- CVE-2014-6251Stack-based buffer overflow in CPUMiner before 2.4.1 allows remote attackers to have an unspecified impact by sending a mining.subscribe res
- CVE-2014-7180Electric Cloud ElectricCommander before 4.2.6 and 5.x before 5.0.3 uses world-writable permissions for (1) eccert.pl and (2) ecconfigure.pl,
- CVE-2014-8760ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connection