# CVEs published 2014-10-31

29 CVEs were published on October 31, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-3473](https://cve.now/CVE-2014-3473.md): Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (H (no CVSS, horizon)
- [CVE-2014-3474](https://cve.now/CVE-2014-3474.md): Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboar (no CVSS, horizon)
- [CVE-2014-3475](https://cve.now/CVE-2014-3475.md): Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2 (no CVSS)
- [CVE-2014-8578](https://cve.now/CVE-2014-8578.md): Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and J (no CVSS)
- [CVE-2013-0334](https://cve.now/CVE-2013-0334.md): Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with (no CVSS, bundler)
- [CVE-2014-2334](https://cve.now/CVE-2014-2334.md): Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiAnalyzer before 5.0.7 allow remote attackers (no CVSS)
- [CVE-2014-2335](https://cve.now/CVE-2014-2335.md): Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 allow remote attackers t (no CVSS)
- [CVE-2014-2336](https://cve.now/CVE-2014-2336.md): Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 and FortiAnalyzer before (no CVSS)
- [CVE-2014-3708](https://cve.now/CVE-2014-3708.md): OpenStack Compute (Nova) before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (CPU co (no CVSS, nova)
- [CVE-2014-7177](https://cve.now/CVE-2014-7177.md): XML External Entity vulnerability in Enalean Tuleap 7.2 and earlier allows remote authenticated users to read arbitrary files via a crafted (no CVSS)
- [CVE-2014-7985](https://cve.now/CVE-2014-7985.md): Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary local files via a .. (no CVSS)
- [CVE-2014-7986](https://cve.now/CVE-2014-7986.md): install/index.php in EspoCRM before 2.6.0 allows remote attackers to re-install the application via a 1 value in the installProcess paramete (no CVSS)
- [CVE-2014-7987](https://cve.now/CVE-2014-7987.md): Cross-site scripting (XSS) vulnerability in EspoCRM before 2.6.0 allows remote attackers to inject arbitrary web script or HTML via the desc (no CVSS)
- [CVE-2014-8081](https://cve.now/CVE-2014-8081.md): lib/execute/execSetResults.php in TestLink before 1.9.13 allows remote attackers to conduct PHP object injection attacks and execute arbitra (no CVSS)
- [CVE-2014-8082](https://cve.now/CVE-2014-8082.md): lib/functions/database.class.php in TestLink before 1.9.13 allows remote attackers to obtain sensitive information via unspecified vectors, (no CVSS)
- [CVE-2014-8333](https://cve.now/CVE-2014-8333.md): The VMware driver in OpenStack Compute (Nova) before 2014.1.4 allows remote authenticated users to cause a denial of service (disk consumpti (no CVSS, nova)
- [CVE-2014-8334](https://cve.now/CVE-2014-8334.md): The WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote authenticated users to execute arbitrary commands vi (no CVSS)
- [CVE-2014-8399](https://cve.now/CVE-2014-8399.md): The default configuration in systemd-shim 8 enables the Abandon debugging clause, which allows local users to cause a denial of service via (no CVSS)
- [CVE-2014-8495](https://cve.now/CVE-2014-8495.md): Citrix XenMobile MDX Toolkit before 9.0.4, when used to wrap iOS 8 applications, does not properly encrypt cached application data, which al (no CVSS)
- [CVE-2014-8509](https://cve.now/CVE-2014-8509.md): The lazy\_bdecode function in BitTorrent bootstrap-dht (aka Bootstrap) allows remote attackers to execute arbitrary code via a crafted packet (no CVSS)
- [CVE-2014-8577](https://cve.now/CVE-2014-8577.md): Multiple cross-site scripting (XSS) vulnerabilities in Croogo before 2.1.0 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2014-3366](https://cve.now/CVE-2014-3366.md): SQL injection vulnerability in the administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to (no CVSS)
- [CVE-2014-3372](https://cve.now/CVE-2014-3372.md): Multiple cross-site scripting (XSS) vulnerabilities in the CCM reports interface in the Server in Cisco Unified Communications Manager allow (no CVSS)
- [CVE-2014-3373](https://cve.now/CVE-2014-3373.md): Multiple cross-site scripting (XSS) vulnerabilities in the CCM Dialed Number Analyzer interface in the Server in Cisco Unified Communication (no CVSS)
- [CVE-2014-3374](https://cve.now/CVE-2014-3374.md): Multiple cross-site scripting (XSS) vulnerabilities in the CCM admin interface in the Server in Cisco Unified Communications Manager allow r (no CVSS)
- [CVE-2014-3375](https://cve.now/CVE-2014-3375.md): Multiple cross-site scripting (XSS) vulnerabilities in the CCM Service interface in the Server in Cisco Unified Communications Manager allow (no CVSS)
- [CVE-2014-6101](https://cve.now/CVE-2014-6101.md): Cross-site scripting (XSS) vulnerability in the redirect-login feature in IBM Business Process Manager (BPM) Advanced 7.5 through 8.5.5 allo (no CVSS)
- [CVE-2014-6148](https://cve.now/CVE-2014-6148.md): IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.2.0.0 through 7.2.0.10, 7.2.1.0 through 7.2.1.6, and 7.2.2.0 through 7.2.2.2 d (no CVSS)
- [CVE-2014-6150](https://cve.now/CVE-2014-6150.md): Cross-site scripting (XSS) vulnerability in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.2.1.0 through 7.2.1.6 and 7.2.2.0 (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-10-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.