# CVEs published 2014-11-16 22 CVEs were published on November 16, 2014: 0 critical, 0 high. Days are UTC. - [CVE-2014-0228](https://cve.now/CVE-2014-0228.md): Apache Hive before 0.13.1, when in SQL standards based authorization mode, does not properly check the file permissions for (1) import and ( (no CVSS, org.apache.hive:hive · org.apache.hive:hive-exec +1) - [CVE-2014-0250](https://cve.now/CVE-2014-0250.md): Multiple integer overflows in client/X11/xf\_graphics.c in FreeRDP allow remote attackers to have an unspecified impact via the width and hei (no CVSS) - [CVE-2014-3248](https://cve.now/CVE-2014-3248.md): Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x b (no CVSS, facter · hiera +2) - [CVE-2014-3916](https://cve.now/CVE-2014-3916.md): The str\_buf\_cat function in string.c in Ruby 1.9.3, 2.0.0, and 2.1 allows context-dependent attackers to cause a denial of service (segmenta (no CVSS) - [CVE-2014-8950](https://cve.now/CVE-2014-8950.md): Unspecified vulnerability in Check Point Security Gateway R77 and R77.10, when the (1) URL Filtering or (2) Identity Awareness blade is used (no CVSS) - [CVE-2014-8951](https://cve.now/CVE-2014-8951.md): Unspecified vulnerability in Check Point Security Gateway R75, R76, R77, and R77.10, when UserCheck is enabled and the (1) Application Contr (no CVSS) - [CVE-2014-8952](https://cve.now/CVE-2014-8952.md): Multiple unspecified vulnerabilities in Check Point Security Gateway R75.40VS, R75.45, R75.46, R75.47, R76, R77, and R77.10, when the (1) IP (no CVSS) - [CVE-2013-0347](https://cve.now/CVE-2013-0347.md): The Gentoo init script for webfs uses world-readable permissions for /var/log/webfsd.log, which allows local users to have unspecified impac (no CVSS) - [CVE-2014-0233](https://cve.now/CVE-2014-0233.md): Red Hat OpenShift Enterprise 2.0 and 2.1 and OpenShift Origin allow remote authenticated users to execute arbitrary commands via shell metac (no CVSS) - [CVE-2014-3755](https://cve.now/CVE-2014-3755.md): The QSvg module in Qt, as used in the Mumble client 1.2.x before 1.2.6, allows remote attackers to cause a denial of service (hang and resou (no CVSS) - [CVE-2014-3756](https://cve.now/CVE-2014-3756.md): The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of an external file and cause a denial of service (hang (no CVSS) - [CVE-2014-8948](https://cve.now/CVE-2014-8948.md): Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote attackers to hi (no CVSS) - [CVE-2014-8949](https://cve.now/CVE-2014-8949.md): The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitrary commands via she (no CVSS) - [CVE-2012-2301](https://cve.now/CVE-2012-2301.md): The Ubercart module 6.x-2.x before 6.x-2.8 for Drupal allows remote authenticated users with the "administer product classes" permission to (no CVSS) - [CVE-2013-3737](https://cve.now/CVE-2013-3737.md): The MobileUI (aka RT-Extension-MobileUI) extension before 1.04 in Request Tracker (RT) 4.0.0 before 4.0.13, when using the file-based sessio (no CVSS) - [CVE-2014-2268](https://cve.now/CVE-2014-2268.md): views/Index.php in the Install module in vTiger 6.0 before Security Patch 2 does not properly restrict access, which allows remote attackers (no CVSS) - [CVE-2014-2667](https://cve.now/CVE-2014-2667.md): Race condition in the \_get\_masked\_mode function in Lib/os.py in Python 3.2 through 3.5, when exist\_ok is set to true and multiple threads ar (no CVSS) - [CVE-2014-3209](https://cve.now/CVE-2014-3209.md): The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow local users to obtain (no CVSS) - [CVE-2014-2681](https://cve.now/CVE-2014-2681.md): Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService\_AudioScrobbler (no CVSS, zendframework/zendframework1 · zendframework/zendopenid +8) - [CVE-2014-2682](https://cve.now/CVE-2014-2682.md): Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService\_AudioScrobbler (no CVSS, zendframework/zendframework1 · zendframework/zendopenid +8) - [CVE-2014-2683](https://cve.now/CVE-2014-2683.md): Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService\_AudioScrobbler (no CVSS, zendframework/zendframework1 · zendframework/zendopenid +8) - [CVE-2014-2684](https://cve.now/CVE-2014-2684.md): The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend\_OpenId\_Consumer class in Zend Framework 1 before (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2014-11-16 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.