# CVEs published 2014-10-27

16 CVEs were published on October 27, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2012-5580](https://cve.now/CVE-2012-5580.md): Format string vulnerability in the print\_proxies function in bin/proxy.c in libproxy 0.3.1 might allow context-dependent attackers to cause (no CVSS)
- [CVE-2014-4586](https://cve.now/CVE-2014-4586.md): Multiple cross-site scripting (XSS) vulnerabilities in the wp-football plugin 1.1 and earlier for WordPress allow remote attackers to inject (no CVSS)
- [CVE-2003-1599](https://cve.now/CVE-2003-1599.md): PHP remote file inclusion vulnerability in wp-links/links.all.php in WordPress 0.70 allows remote attackers to execute arbitrary PHP code vi (no CVSS)
- [CVE-2010-5077](https://cve.now/CVE-2010-5077.md): server/sv\_main.c in Quake3 Arena, as used in ioquake3 before r1762, OpenArena, Tremulous, and other products, allows remote attackers to cau (no CVSS)
- [CVE-2011-2702](https://cve.now/CVE-2011-2702.md): Integer signedness error in Glibc before 2.13 and eglibc before 2.13, when using Supplemental Streaming SIMD Extensions 3 (SSSE3) optimizati (no CVSS)
- [CVE-2012-1111](https://cve.now/CVE-2012-1111.md): lightdm before 1.0.9 does not properly close file descriptors before opening a child process, which allows local users to write to the light (no CVSS)
- [CVE-2014-3711](https://cve.now/CVE-2014-3711.md): namei in FreeBSD 9.1 through 10.1-RC2 allows remote attackers to cause a denial of service (memory exhaustion) via vectors that trigger a sa (no CVSS)
- [CVE-2014-3954](https://cve.now/CVE-2014-3954.md): Stack-based buffer overflow in rtsold in FreeBSD 9.1 through 10.1-RC2 allows remote attackers to cause a denial of service (crash) or possib (no CVSS)
- [CVE-2014-3955](https://cve.now/CVE-2014-3955.md): routed in FreeBSD 8.4 through 10.1-RC2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an RIP r (no CVSS)
- [CVE-2014-8327](https://cve.now/CVE-2014-8327.md): The fal\_sftp extension before 0.2.6 for TYPO3 uses weak permissions for sFTP driver files and folders, which allows remote authenticated use (no CVSS, co-stack/fal\_sftp · vertexvaar/falsftp)
- [CVE-2010-4820](https://cve.now/CVE-2010-4820.md): Untrusted search path vulnerability in Ghostscript 8.62 allows local users to execute arbitrary PostScript code via a Trojan horse Postscrip (no CVSS)
- [CVE-2011-4103](https://cve.now/CVE-2011-4103.md): emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to (no CVSS, django-piston)
- [CVE-2011-4104](https://cve.now/CVE-2011-4104.md): The from\_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attacke (no CVSS, django-tastypie)
- [CVE-2011-4953](https://cve.now/CVE-2011-4953.md): The set\_mgmt\_parameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors (no CVSS, cobbler)
- [CVE-2014-0136](https://cve.now/CVE-2014-0136.md): The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to inse (no CVSS)
- [CVE-2014-2988](https://cve.now/CVE-2014-2988.md): EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-10-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.