# CVEs published 2014-11-06

30 CVEs were published on November 6, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-5258](https://cve.now/CVE-2014-5258.md): Directory traversal vulnerability in showTempFile.php in webEdition CMS before 6.3.9.0 Beta allows remote authenticated users to read arbitr (no CVSS)
- [CVE-2014-5451](https://cve.now/CVE-2014-5451.md): Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attac (no CVSS)
- [CVE-2014-6030](https://cve.now/CVE-2014-6030.md): Multiple SQL injection vulnerabilities in ClassApps SelectSurvey.NET before 4.125.002 allow (1) remote attackers to execute arbitrary SQL co (no CVSS)
- [CVE-2014-0995](https://cve.now/CVE-2014-0995.md): The Standalone Enqueue Server in SAP Netweaver 7.20, 7.01, and earlier allows remote attackers to cause a denial of service (uncontrolled re (no CVSS)
- [CVE-2014-4664](https://cve.now/CVE-2014-4664.md): Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.4 for WordPress allows remote attackers to inject arbit (no CVSS)
- [CVE-2014-5257](https://cve.now/CVE-2014-5257.md): Multiple cross-site scripting (XSS) vulnerabilities in Forma Lms before 1.2.1 p01 allow remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2014-7958](https://cve.now/CVE-2014-7958.md): Cross-site scripting (XSS) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allow (no CVSS)
- [CVE-2014-7959](https://cve.now/CVE-2014-7959.md): SQL injection vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote auth (no CVSS)
- [CVE-2014-8351](https://cve.now/CVE-2014-8351.md): SQL injection vulnerability in info.php in French National Commission on Informatics and Liberty (aka CNIL) CookieViz before 1.0.1 allows re (no CVSS)
- [CVE-2014-8352](https://cve.now/CVE-2014-8352.md): Cross-site scripting (XSS) vulnerability in json.php in French National Commission on Informatics and Liberty (aka CNIL) CookieViz allows re (no CVSS)
- [CVE-2014-8483](https://cve.now/CVE-2014-8483.md): The blowfishECB function in core/cipher.cpp in Quassel IRC 0.10.0 allows remote attackers to cause a denial of service (out-of-bounds read) (no CVSS)
- [CVE-2014-8508](https://cve.now/CVE-2014-8508.md): Cross-site scripting (XSS) vulnerability in s\_network.asp in the Denon AVR-3313CI audio/video receiver allows remote attackers to inject arb (no CVSS)
- [CVE-2014-8653](https://cve.now/CVE-2014-8653.md): Cross-site scripting (XSS) vulnerability in Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3. (no CVSS)
- [CVE-2014-8654](https://cve.now/CVE-2014-8654.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway hardware (no CVSS)
- [CVE-2014-8655](https://cve.now/CVE-2014-8655.md): The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows remote attackers to b (no CVSS)
- [CVE-2014-8656](https://cve.now/CVE-2014-8656.md): The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH have a default password of ( (no CVSS)
- [CVE-2014-8657](https://cve.now/CVE-2014-8657.md): The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows remote attackers to c (no CVSS)
- [CVE-2014-8658](https://cve.now/CVE-2014-8658.md): Cross-site scripting (XSS) vulnerability in RefinedWiki Original Theme 3.x before 3.5.13 and 4.x before 4.0.12 for Confluence allows remote (no CVSS)
- [CVE-2014-8659](https://cve.now/CVE-2014-8659.md): Directory traversal vulnerability in SAP Environment, Health, and Safety allows remote attackers to read arbitrary files via unspecified vec (no CVSS)
- [CVE-2014-8660](https://cve.now/CVE-2014-8660.md): SAP Document Management Services allows local users to execute arbitrary commands via unspecified vectors. (no CVSS)
- [CVE-2014-8661](https://cve.now/CVE-2014-8661.md): The SAP CRM Internet Sales module allows remote attackers to execute arbitrary commands via unspecified vectors. (no CVSS)
- [CVE-2014-8662](https://cve.now/CVE-2014-8662.md): Unspecified vulnerability in SAP Payroll Process allows remote attackers to cause a denial of service via vectors related to session handlin (no CVSS)
- [CVE-2014-8663](https://cve.now/CVE-2014-8663.md): SQL injection vulnerability in Data Basis (BW-WHM-DBA) in SAP NetWeaver Business Warehouse allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2014-8664](https://cve.now/CVE-2014-8664.md): SQL injection vulnerability in Product Safety (EHS-SAF) component in SAP Environment, Health, and Safety Management allows remote attackers (no CVSS)
- [CVE-2014-8665](https://cve.now/CVE-2014-8665.md): The SAP Business Intelligence Development Workbench allows remote attackers to obtain sensitive information by reading unspecified files. (no CVSS)
- [CVE-2014-8666](https://cve.now/CVE-2014-8666.md): The User & Server configuration, InfoView refresh, user rights (BI-BIP-ADM) component in SAP Business Intellignece allows remote attackers t (no CVSS)
- [CVE-2014-8667](https://cve.now/CVE-2014-8667.md): Cross-site scripting (XSS) vulnerability in SAP HANA Web-based Development Workbench allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2014-8668](https://cve.now/CVE-2014-8668.md): SQL injection vulnerability in SAP Contract Accounting allows remote attackers to execute arbitrary SQL commands via unspecified vectors. (no CVSS)
- [CVE-2014-8669](https://cve.now/CVE-2014-8669.md): The SAP Promotion Guidelines (CRM-MKT-MPL-TPM-PPG) module for SAP CRM allows remote attackers to execute arbitrary code via unspecified vect (no CVSS)
- [CVE-2014-8670](https://cve.now/CVE-2014-8670.md): Open redirect vulnerability in go.php in vBulletin 4.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-11-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.