# CVEs published 2014-11-05 19 CVEs were published on November 5, 2014: 0 critical, 0 high. Days are UTC. - [CVE-2014-8622](https://cve.now/CVE-2014-8622.md): Cross-site scripting (XSS) vulnerability in compfight-search.php in the Compfight plugin 1.4 for WordPress allows remote authenticated users (no CVSS) - [CVE-2014-2373](https://cve.now/CVE-2014-2373.md): Accuenergy Accuenergy Acuvim II Client-Side Enforcement of Server-Side Security (no CVSS, Accuenergy Acuvim II AXN-NET Ethernet module) - [CVE-2014-2374](https://cve.now/CVE-2014-2374.md): Accuenergy Accuenergy Acuvim II Client-Side Enforcement of Server-Side Security (no CVSS, Accuenergy Acuvim II AXN-NET Ethernet module) - [CVE-2014-3710](https://cve.now/CVE-2014-3710.md): The donote function in readelf.c in file through 5.20, as used in the Fileinfo component in PHP 5.4.34, does not ensure that sufficient note (no CVSS) - [CVE-2014-4769](https://cve.now/CVE-2014-4769.md): IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.8 allows remote authenticated users to read arbitrary files or send TCP re (no CVSS) - [CVE-2014-4810](https://cve.now/CVE-2014-4810.md): IBM Cognos Mobile 10.1.1 before FP3 IF1, 10.2.0 before FP2 IF1, and 10.2.1 before FP4 IF1 preserves a session between the Cognos Mobile serv (no CVSS) - [CVE-2014-4834](https://cve.now/CVE-2014-4834.md): IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.8 does not properly detect recursion during entity expansion, which allows (no CVSS) - [CVE-2014-5408](https://cve.now/CVE-2014-5408.md): Nordex NC2 Cross-site Scripting (no CVSS, Nordex Control 2 (NC2) SCADA) - [CVE-2014-5417](https://cve.now/CVE-2014-5417.md): Meinberg Radio Clocks LANTIME M-Series (no CVSS, Meinberg Radio Clocks LANTIME M-Series) - [CVE-2014-8326](https://cve.now/CVE-2014-8326.md): Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.5, 4.1.x before 4.1.14.6, and 4.2.x before 4.2.10.1 al (no CVSS, phpmyadmin/phpmyadmin) - [CVE-2014-8541](https://cve.now/CVE-2014-8541.md): libavcodec/mjpegdec.c in FFmpeg before 2.4.2 considers only dimension differences, and not bits-per-pixel differences, when determining whet (no CVSS) - [CVE-2014-8542](https://cve.now/CVE-2014-8542.md): libavcodec/utils.c in FFmpeg before 2.4.2 omits a certain codec ID during enforcement of alignment, which allows remote attackers to cause a (no CVSS) - [CVE-2014-8543](https://cve.now/CVE-2014-8543.md): libavcodec/mmvideo.c in FFmpeg before 2.4.2 does not consider all lines of HHV Intra blocks during validation of image height, which allows (no CVSS) - [CVE-2014-8544](https://cve.now/CVE-2014-8544.md): libavcodec/tiff.c in FFmpeg before 2.4.2 does not properly validate bits-per-pixel fields, which allows remote attackers to cause a denial o (no CVSS) - [CVE-2014-8545](https://cve.now/CVE-2014-8545.md): libavcodec/pngdec.c in FFmpeg before 2.4.2 accepts the monochrome-black format without verifying that the bits-per-pixel value is 1, which a (no CVSS) - [CVE-2014-8546](https://cve.now/CVE-2014-8546.md): Integer underflow in libavcodec/cinepak.c in FFmpeg before 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) (no CVSS) - [CVE-2014-8547](https://cve.now/CVE-2014-8547.md): libavcodec/gifdec.c in FFmpeg before 2.4.2 does not properly compute image heights, which allows remote attackers to cause a denial of servi (no CVSS) - [CVE-2014-8548](https://cve.now/CVE-2014-8548.md): Off-by-one error in libavcodec/smc.c in FFmpeg before 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) or p (no CVSS) - [CVE-2014-8549](https://cve.now/CVE-2014-8549.md): libavcodec/on2avc.c in FFmpeg before 2.4.2 does not constrain the number of channels to at most 2, which allows remote attackers to cause a (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2014-11-05 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.