# CVEs published 2014-11-03

18 CVEs were published on November 3, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2013-0336](https://cve.now/CVE-2013-0336.md): The ipapwd\_chpwop function in daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa\_pwd\_extop.c in the directory server (dirsrv) in FreeIPA before 3.2 (no CVSS)
- [CVE-2014-0204](https://cve.now/CVE-2014-0204.md): OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, wh (no CVSS, keystone)
- [CVE-2012-5500](https://cve.now/CVE-2012-5500.md): The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the title (no CVSS, plone)
- [CVE-2012-5508](https://cve.now/CVE-2012-5508.md): The error pages in Plone before 4.2.3 and 4.3 before beta 1 allow remote attackers to obtain random numbers and derive the PRNG state for pa (no CVSS, plone)
- [CVE-2012-6661](https://cve.now/CVE-2012-6661.md): Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG), which m (no CVSS, zope2 · plone)
- [CVE-2014-0487](https://cve.now/CVE-2014-0487.md): APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unsp (no CVSS)
- [CVE-2014-0488](https://cve.now/CVE-2014-0488.md): APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attac (no CVSS)
- [CVE-2014-0489](https://cve.now/CVE-2014-0489.md): APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arb (no CVSS)
- [CVE-2014-0490](https://cve.now/CVE-2014-0490.md): The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remote attackers to execut (no CVSS)
- [CVE-2014-7228](https://cve.now/CVE-2014-7228.md): Akeeba Restore (restore.php), as used in Joomla! 2.5.4 through 2.5.25, 3.x through 3.2.5, and 3.3.0 through 3.3.4; Akeeba Backup for Joomla! (no CVSS)
- [CVE-2014-3654](https://cve.now/CVE-2014-3654.md): Multiple cross-site scripting (XSS) vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.5 and 5.6 all (no CVSS)
- [CVE-2014-3712](https://cve.now/CVE-2014-3712.md): Katello allows remote attackers to cause a denial of service (memory consumption) via the (1) mode parameter in the setup\_utils function in (no CVSS)
- [CVE-2014-5271](https://cve.now/CVE-2014-5271.md): Heap-based buffer overflow in the encode\_slice function in libavcodec/proresenc\_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x be (no CVSS)
- [CVE-2014-5272](https://cve.now/CVE-2014-5272.md): libavcodec/iff.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.2.x before 2.2.7, and 2.3.x before 2.3.2 allows remote attackers to have uns (no CVSS)
- [CVE-2014-5507](https://cve.now/CVE-2014-5507.md): iBackup 10.0.0.32 and earlier uses weak permissions (Everyone: Full Control) for ib\_service.exe, which allows local users to gain privileges (no CVSS)
- [CVE-2014-8080](https://cve.now/CVE-2014-8080.md): The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial (no CVSS)
- [CVE-2014-8350](https://cve.now/CVE-2014-8350.md): Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code as demonstrated by "{lite (no CVSS, smarty/smarty)
- [CVE-2014-8494](https://cve.now/CVE-2014-8494.md): ESTsoft ALUpdate 8.5.1.0.0 uses weak permissions (Users: Full Control) for the (1) AlUpdate folder and (2) AlUpdate.exe, which allows local (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-11-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.