# CVEs published 2014-11-04

46 CVEs were published on November 4, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-2718](https://cve.now/CVE-2014-2718.md): ASUS RT-AC68U, RT-AC66R, RT-AC66U, RT-AC56R, RT-AC56U, RT-N66R, RT-N66U, RT-N56R, RT-N56U, and possibly other RT-series routers before firmw (no CVSS)
- [CVE-2013-4148](https://cve.now/CVE-2013-4148.md): Integer signedness error in the virtio\_net\_load function in hw/net/virtio-net.c in QEMU 1.x before 1.7.2 allows remote attackers to execute (no CVSS)
- [CVE-2013-4149](https://cve.now/CVE-2013-4149.md): Buffer overflow in virtio\_net\_load function in net/virtio-net.c in QEMU 1.3.0 through 1.7.x before 1.7.2 might allow remote attackers to exe (no CVSS)
- [CVE-2013-4150](https://cve.now/CVE-2013-4150.md): The virtio\_net\_load function in hw/net/virtio-net.c in QEMU 1.5.0 through 1.7.x before 1.7.2 allows remote attackers to cause a denial of se (no CVSS)
- [CVE-2013-4151](https://cve.now/CVE-2013-4151.md): The virtio\_load function in virtio/virtio.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm (no CVSS)
- [CVE-2013-4526](https://cve.now/CVE-2013-4526.md): Buffer overflow in hw/ide/ahci.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary co (no CVSS)
- [CVE-2013-4527](https://cve.now/CVE-2013-4527.md): Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via vectors related to the nu (no CVSS)
- [CVE-2013-4529](https://cve.now/CVE-2013-4529.md): Buffer overflow in hw/pci/pcie\_aer.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrar (no CVSS)
- [CVE-2013-4530](https://cve.now/CVE-2013-4530.md): Buffer overflow in hw/ssi/pl022.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary co (no CVSS)
- [CVE-2013-4531](https://cve.now/CVE-2013-4531.md): Buffer overflow in target-arm/machine.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbit (no CVSS)
- [CVE-2013-4533](https://cve.now/CVE-2013-4533.md): Buffer overflow in the pxa2xx\_ssp\_load function in hw/arm/pxa2xx.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2013-4534](https://cve.now/CVE-2013-4534.md): Buffer overflow in hw/intc/openpic.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary (no CVSS)
- [CVE-2013-4537](https://cve.now/CVE-2013-4537.md): The ssi\_sd\_transfer function in hw/sd/ssi-sd.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted arglen v (no CVSS)
- [CVE-2013-4538](https://cve.now/CVE-2013-4538.md): Multiple buffer overflows in the ssd0323\_load function in hw/display/ssd0323.c in QEMU before 1.7.2 allow remote attackers to cause a denial (no CVSS)
- [CVE-2013-4539](https://cve.now/CVE-2013-4539.md): Multiple buffer overflows in the tsc210x\_load function in hw/input/tsc210x.c in QEMU before 1.7.2 might allow remote attackers to execute ar (no CVSS)
- [CVE-2013-4540](https://cve.now/CVE-2013-4540.md): Buffer overflow in scoop\_gpio\_handler\_update in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a large (1) pre (no CVSS)
- [CVE-2013-4541](https://cve.now/CVE-2013-4541.md): The usb\_device\_post\_load function in hw/usb/bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted (no CVSS)
- [CVE-2013-4542](https://cve.now/CVE-2013-4542.md): The virtio\_scsi\_load\_request function in hw/scsi/scsi-bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2013-6399](https://cve.now/CVE-2013-6399.md): Array index error in the virtio\_load function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code v (no CVSS)
- [CVE-2014-0182](https://cve.now/CVE-2014-0182.md): Heap-based buffer overflow in the virtio\_load function in hw/virtio/virtio.c in QEMU before 1.7.2 might allow remote attackers to execute ar (no CVSS)
- [CVE-2014-0222](https://cve.now/CVE-2014-0222.md): Integer overflow in the qcow\_open function in block/qcow.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service (crash) (no CVSS)
- [CVE-2014-0223](https://cve.now/CVE-2014-0223.md): Integer overflow in the qcow\_open function in block/qcow.c in QEMU before 1.7.2 allows local users to cause a denial of service (crash) and (no CVSS)
- [CVE-2014-3461](https://cve.now/CVE-2014-3461.md): hw/usb/bus.c in QEMU 1.6.2 allows remote attackers to execute arbitrary code via crafted savevm data, which triggers a heap-based buffer ove (no CVSS)
- [CVE-2014-8471](https://cve.now/CVE-2014-8471.md): CA Cloud Service Management (CSM) before Summer 2014 allows remote attackers to conduct replay attacks via unspecified vectors. (no CVSS)
- [CVE-2014-8472](https://cve.now/CVE-2014-8472.md): CA Cloud Service Management (CSM) before Summer 2014 does not properly verify authentication tokens from an Identity Provider, which allows (no CVSS)
- [CVE-2014-8473](https://cve.now/CVE-2014-8473.md): Cross-site request forgery (CSRF) vulnerability in CA Cloud Service Management (CSM) before Summer 2014 allows remote attackers to hijack th (no CVSS)
- [CVE-2014-8474](https://cve.now/CVE-2014-8474.md): CA Cloud Service Management (CSM) before Summer 2014 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers (no CVSS)
- [CVE-2014-6130](https://cve.now/CVE-2014-6130.md): The IBM Notes Traveler application before 9.0.1.3 for Android lacks a warning message during selection of an HTTP session, which makes it ea (no CVSS)
- [CVE-2014-7875](https://cve.now/CVE-2014-7875.md): Unspecified vulnerability on the HP LaserJet CM3530 Multifunction Printer CC519A and CC520A with firmware before 53.236.2 allows remote atta (no CVSS)
- [CVE-2014-3660](https://cve.now/CVE-2014-3660.md): parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows co (no CVSS)
- [CVE-2014-4974](https://cve.now/CVE-2014-4974.md): The ESET Personal Firewall NDIS filter (EpFwNdis.sys) kernel mode driver, aka Personal Firewall module before Build 1212 (20140609), as used (no CVSS)
- [CVE-2014-8593](https://cve.now/CVE-2014-8593.md): Multiple cross-site scripting (XSS) vulnerabilities in Allomani Weblinks 1.0 allow remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2013-7057](https://cve.now/CVE-2013-7057.md): Cross-site request forgery (CSRF) vulnerability in Axway SecureTransport 5.1 SP2 and earlier allows remote attackers to hijack the authentic (no CVSS)
- [CVE-2014-5387](https://cve.now/CVE-2014-5387.md): Multiple SQL injection vulnerabilities in EllisLab ExpressionEngine before 2.9.1 allow remote authenticated users to execute arbitrary SQL c (no CVSS)
- [CVE-2014-7176](https://cve.now/CVE-2014-7176.md): SQL injection vulnerability in Enalean Tuleap before 7.5.99.4 allows remote authenticated users to execute arbitrary SQL commands via the lo (no CVSS)
- [CVE-2014-8339](https://cve.now/CVE-2014-8339.md): SQL injection vulnerability in midroll.php in Nuevolab Nuevoplayer for ClipShare 8.0 and earlier allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2014-8584](https://cve.now/CVE-2014-8584.md): Cross-site scripting (XSS) vulnerability in the Web Dorado Spider Video Player (aka WordPress Video Player) plugin before 1.5.2 for WordPres (no CVSS)
- [CVE-2014-8585](https://cve.now/CVE-2014-8585.md): Directory traversal vulnerability in the WordPress Download Manager plugin for WordPress allows remote attackers to read arbitrary files via (no CVSS)
- [CVE-2014-8586](https://cve.now/CVE-2014-8586.md): SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to execute arbitrary SQL c (no CVSS)
- [CVE-2014-8587](https://cve.now/CVE-2014-8587.md): SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in SAP NetWeaver AS for ABAP and SAP HANA, allows remot (no CVSS)
- [CVE-2014-8588](https://cve.now/CVE-2014-8588.md): SQL injection vulnerability in metadata.xsjs in SAP HANA 1.00.60.379371 allows remote attackers to execute arbitrary SQL commands via unspec (no CVSS)
- [CVE-2014-8589](https://cve.now/CVE-2014-8589.md): Integer overflow in SAP Network Interface Router (SAProuter) 40.4 allows remote attackers to cause a denial of service (resource consumption (no CVSS)
- [CVE-2014-8590](https://cve.now/CVE-2014-8590.md): XML external entity (XXE) vulnerability in the Web Service Navigator in SAP NetWeaver Application Server (AS) Java allows remote attackers t (no CVSS)
- [CVE-2014-8591](https://cve.now/CVE-2014-8591.md): Unspecified vulnerability in SAP Internet Communication Manager (ICM), as used in SAP NetWeaver 7.02 and 7.3, allows remote attackers to cau (no CVSS)
- [CVE-2014-8592](https://cve.now/CVE-2014-8592.md): Unspecified vulnerability in SAP Host Agent, as used in SAP NetWeaver 7.02 and 7.3, allows remote attackers to cause a denial of service (pr (no CVSS)
- [CVE-2014-4311](https://cve.now/CVE-2014-4311.md): Epicor Enterprise 7.4 before FS74SP6\_HotfixTL054181 allows attackers to obtain the (1) Database Connection and (2) E-mail Connection passwor (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-11-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.