# CVEs published 2014-10-25

21 CVEs were published on October 25, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2013-4594](https://cve.now/CVE-2013-4594.md): The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous (no CVSS)
- [CVE-2014-0476](https://cve.now/CVE-2014-0476.md): The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a (no CVSS)
- [CVE-2014-3137](https://cve.now/CVE-2014-3137.md): Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote atta (no CVSS, bottle)
- [CVE-2014-1927](https://cve.now/CVE-2014-1927.md): The shell\_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrar (no CVSS, python-gnupg)
- [CVE-2014-1928](https://cve.now/CVE-2014-1928.md): The shell\_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbi (no CVSS, python-gnupg)
- [CVE-2014-1929](https://cve.now/CVE-2014-1929.md): python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection throu (no CVSS, python-gnupg)
- [CVE-2014-5075](https://cve.now/CVE-2014-5075.md): The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server hostn (no CVSS)
- [CVE-2014-3636](https://cve.now/CVE-2014-3636.md): D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of service (prevention of new connec (no CVSS)
- [CVE-2014-3409](https://cve.now/CVE-2014-3409.md): The Ethernet Connectivity Fault Management (CFM) handling feature in Cisco IOS 12.2(33)SRE9a and earlier and IOS XE 3.13S and earlier allows (no CVSS)
- [CVE-2014-4620](https://cve.now/CVE-2014-4620.md): The EMC NetWorker Module for MEDITECH (aka NMMEDI) 3.0 build 87 through 90, when EMC RecoverPoint and Plink are used, stores cleartext Recov (no CVSS)
- [CVE-2014-4623](https://cve.now/CVE-2014-4623.md): EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store (ADS) GEN4(S) and Avamar Virtual Edition (AVE), when Password Hardening before 2.0.0 (no CVSS)
- [CVE-2014-4624](https://cve.now/CVE-2014-4624.md): EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x through 7.0.2-43 do not require authentication for Java API calls (no CVSS)
- [CVE-2014-6151](https://cve.now/CVE-2014-6151.md): CRLF injection vulnerability in IBM Tivoli Integrated Portal (TIP) 2.2.x allows remote authenticated users to inject arbitrary HTTP headers (no CVSS)
- [CVE-2014-6152](https://cve.now/CVE-2014-6152.md): Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Integrated Portal (TIP) 2.2.x allow remote authenticated users to inject a (no CVSS)
- [CVE-2014-6611](https://cve.now/CVE-2014-6611.md): The BlackBerry World app before 5.0.0.262 on BlackBerry 10 OS 10.2.0, before 5.0.0.263 on BlackBerry 10 OS 10.2.1, and before 5.1.0.53 on Bl (no CVSS)
- [CVE-2014-2021](https://cve.now/CVE-2014-2021.md): Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.2.2 and earlier, and 5.0.x through 5.0.5 allows remote authent (no CVSS)
- [CVE-2014-3604](https://cve.now/CVE-2014-3604.md): Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subjec (no CVSS, ca.juliusdavies:not-yet-commons-ssl)
- [CVE-2014-6230](https://cve.now/CVE-2014-6230.md): WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the IP blacklist via a c (no CVSS)
- [CVE-2014-6251](https://cve.now/CVE-2014-6251.md): Stack-based buffer overflow in CPUMiner before 2.4.1 allows remote attackers to have an unspecified impact by sending a mining.subscribe res (no CVSS)
- [CVE-2014-7180](https://cve.now/CVE-2014-7180.md): Electric Cloud ElectricCommander before 4.2.6 and 5.x before 5.0.3 uses world-writable permissions for (1) eccert.pl and (2) ecconfigure.pl, (no CVSS)
- [CVE-2014-8760](https://cve.now/CVE-2014-8760.md): ejabberd before 2.1.13 does not enforce the starttls\_required setting when compression is used, which causes clients to establish connection (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-10-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.