# CVEs published 2014-11-11 50 CVEs were published on November 11, 2014: 0 critical, 2 high. 2 are now in CISA KEV. Days are UTC. - [CVE-2014-0573](https://cve.now/CVE-2014-0573.md): Use-after-free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2 (no CVSS) - [CVE-2014-0574](https://cve.now/CVE-2014-0574.md): Double free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.20 (no CVSS) - [CVE-2014-0576](https://cve.now/CVE-2014-0576.md): Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR bef (no CVSS) - [CVE-2014-0577](https://cve.now/CVE-2014-0577.md): Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR bef (no CVSS) - [CVE-2014-0581](https://cve.now/CVE-2014-0581.md): Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR bef (no CVSS) - [CVE-2014-0582](https://cve.now/CVE-2014-0582.md): Heap-based buffer overflow in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.2 (no CVSS) - [CVE-2014-0583](https://cve.now/CVE-2014-0583.md): Heap-based buffer overflow in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.2 (no CVSS) - [CVE-2014-0584](https://cve.now/CVE-2014-0584.md): Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR bef (no CVSS) - [CVE-2014-0585](https://cve.now/CVE-2014-0585.md): Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR bef (no CVSS) - [CVE-2014-0586](https://cve.now/CVE-2014-0586.md): Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR bef (no CVSS) - [CVE-2014-0588](https://cve.now/CVE-2014-0588.md): Use-after-free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2 (no CVSS) - [CVE-2014-0589](https://cve.now/CVE-2014-0589.md): Heap-based buffer overflow in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.2 (no CVSS) - [CVE-2014-0590](https://cve.now/CVE-2014-0590.md): Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR bef (no CVSS) - [CVE-2014-8437](https://cve.now/CVE-2014-8437.md): Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR bef (no CVSS) - [CVE-2014-8438](https://cve.now/CVE-2014-8438.md): Use-after-free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2 (no CVSS) - [CVE-2014-8440](https://cve.now/CVE-2014-8440.md): Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR bef (no CVSS) - [CVE-2014-8441](https://cve.now/CVE-2014-8441.md): Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR bef (no CVSS) - [CVE-2014-8442](https://cve.now/CVE-2014-8442.md): Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR bef (no CVSS) - [CVE-2014-4076](https://cve.now/CVE-2014-4076.md): Microsoft Windows Server 2003 SP2 allows local users to gain privileges via a crafted IOCTL call to (1) tcpip.sys or (2) tcpip6.sys, aka "TC (no CVSS) - [CVE-2014-4077](https://cve.now/CVE-2014-4077.md): Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Office 2007 SP3, when IMJPDCT.E (CVSS 7.8, KEV) - [CVE-2014-4078](https://cve.now/CVE-2014-4078.md): The IP Security feature in Microsoft Internet Information Services (IIS) 8.0 and 8.5 does not properly process wildcard allow and deny rules (no CVSS) - [CVE-2014-4116](https://cve.now/CVE-2014-4116.md): Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2010 SP2 allows remote authenticated users to inject arbitrary w (no CVSS) - [CVE-2014-4118](https://cve.now/CVE-2014-4118.md): XML Core Services (aka MSXML) 3.0 in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1 (no CVSS) - [CVE-2014-4143](https://cve.now/CVE-2014-4143.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS) - [CVE-2014-4149](https://cve.now/CVE-2014-4149.md): Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly perform TypeFilterLevel checks, which allo (no CVSS) - [CVE-2014-6317](https://cve.now/CVE-2014-6317.md): Array index error in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 (no CVSS) - [CVE-2014-6318](https://cve.now/CVE-2014-6318.md): The audit logon feature in Remote Desktop Protocol (RDP) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, (no CVSS) - [CVE-2014-6321](https://cve.now/CVE-2014-6321.md): Schannel in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, (no CVSS) - [CVE-2014-6322](https://cve.now/CVE-2014-6322.md): The Windows Audio service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows (no CVSS) - [CVE-2014-6323](https://cve.now/CVE-2014-6323.md): Microsoft Internet Explorer 7 through 11 allows remote attackers to obtain sensitive clipboard information via a crafted web site, aka "Inte (no CVSS) - [CVE-2014-6331](https://cve.now/CVE-2014-6331.md): Microsoft Active Directory Federation Services (AD FS) 2.0, 2.1, and 3.0, when a configured SAML Relying Party lacks a sign-out endpoint, do (no CVSS) - [CVE-2014-6332](https://cve.now/CVE-2014-6332.md): OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, W (CVSS 8.8, KEV) - [CVE-2014-6333](https://cve.now/CVE-2014-6333.md): Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Offic (no CVSS) - [CVE-2014-6334](https://cve.now/CVE-2014-6334.md): Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial o (no CVSS) - [CVE-2014-6335](https://cve.now/CVE-2014-6335.md): Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial o (no CVSS) - [CVE-2014-6337](https://cve.now/CVE-2014-6337.md): Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (no CVSS) - [CVE-2014-6339](https://cve.now/CVE-2014-6339.md): Microsoft Internet Explorer 8 and 9 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Ex (no CVSS) - [CVE-2014-6340](https://cve.now/CVE-2014-6340.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web s (no CVSS) - [CVE-2014-6341](https://cve.now/CVE-2014-6341.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS) - [CVE-2014-6342](https://cve.now/CVE-2014-6342.md): Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft (no CVSS) - [CVE-2014-6343](https://cve.now/CVE-2014-6343.md): Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS) - [CVE-2014-6344](https://cve.now/CVE-2014-6344.md): Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a (no CVSS) - [CVE-2014-6345](https://cve.now/CVE-2014-6345.md): Microsoft Internet Explorer 9 and 10 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, (no CVSS) - [CVE-2014-6346](https://cve.now/CVE-2014-6346.md): Microsoft Internet Explorer 8 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web s (no CVSS) - [CVE-2014-6347](https://cve.now/CVE-2014-6347.md): Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS) - [CVE-2014-6348](https://cve.now/CVE-2014-6348.md): Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft (no CVSS) - [CVE-2014-6349](https://cve.now/CVE-2014-6349.md): Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of (no CVSS) - [CVE-2014-6350](https://cve.now/CVE-2014-6350.md): Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of (no CVSS) - [CVE-2014-6351](https://cve.now/CVE-2014-6351.md): Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS) - [CVE-2014-6353](https://cve.now/CVE-2014-6353.md): Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2014-11-11 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.