CVEs published November 3, 2014
18 CVEs were published on November 3, 2014: 0 critical, 0 high.
- Published
- 18
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 18
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- plone
- 2
- keystone
- 1
- smarty/smarty
- 1
- zope2 · plone
- 1
Medium, low and unrated 18
- CVE-2013-0336The ipapwd_chpwop function in daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c in the directory server (dirsrv) in FreeIPA before 3.2
- CVE-2014-0204OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, whkeystone
- CVE-2012-5500The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titleplone
- CVE-2012-5508The error pages in Plone before 4.2.3 and 4.3 before beta 1 allow remote attackers to obtain random numbers and derive the PRNG state for paplone
- CVE-2012-6661Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG), which mzope2 · plone
- CVE-2014-0487APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unsp
- CVE-2014-0488APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attac
- CVE-2014-0489APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arb
- CVE-2014-0490The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remote attackers to execut
- CVE-2014-7228Akeeba Restore (restore.php), as used in Joomla! 2.5.4 through 2.5.25, 3.x through 3.2.5, and 3.3.0 through 3.3.4; Akeeba Backup for Joomla!
- CVE-2014-3654Multiple cross-site scripting (XSS) vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.5 and 5.6 all
- CVE-2014-3712Katello allows remote attackers to cause a denial of service (memory consumption) via the (1) mode parameter in the setup_utils function in
- CVE-2014-5271Heap-based buffer overflow in the encode_slice function in libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x be
- CVE-2014-5272libavcodec/iff.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.2.x before 2.2.7, and 2.3.x before 2.3.2 allows remote attackers to have uns
- CVE-2014-5507iBackup 10.0.0.32 and earlier uses weak permissions (Everyone: Full Control) for ib_service.exe, which allows local users to gain privileges
- CVE-2014-8080The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial
- CVE-2014-8350Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code as demonstrated by "{litesmarty/smarty
- CVE-2014-8494ESTsoft ALUpdate 8.5.1.0.0 uses weak permissions (Users: Full Control) for the (1) AlUpdate folder and (2) AlUpdate.exe, which allows local