# CVEs published 2014-11-18

28 CVEs were published on November 18, 2014: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2014-4817](https://cve.now/CVE-2014-4817.md): The server in IBM Tivoli Storage Manager (TSM) 5.x and 6.x before 6.3.5.10 and 7.x before 7.1.1.100 allows remote attackers to bypass intend (no CVSS)
- [CVE-2014-6324](https://cve.now/CVE-2014-6324.md): The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Wind (CVSS 8.8, KEV)
- [CVE-2014-7829](https://cve.now/CVE-2014-7829.md): Directory traversal vulnerability in actionpack/lib/action\_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, (no CVSS, actionpack)
- [CVE-2014-7996](https://cve.now/CVE-2014-7996.md): Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Integrated Management Controller in Cisco Unified Computing Sy (no CVSS)
- [CVE-2014-3613](https://cve.now/CVE-2014-3613.md): cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies fo (no CVSS)
- [CVE-2014-3620](https://cve.now/CVE-2014-3620.md): cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cook (no CVSS)
- [CVE-2014-7146](https://cve.now/CVE-2014-7146.md): The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted (1) descriptio (no CVSS)
- [CVE-2014-7824](https://cve.now/CVE-2014-7824.md): D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cause a denial of service (preven (no CVSS)
- [CVE-2014-8475](https://cve.now/CVE-2014-8475.md): FreeBSD 9.1, 9.2, and 10.0, when compiling OpenSSH with Kerberos support, uses incorrect library ordering when linking sshd, which causes sy (no CVSS)
- [CVE-2014-8598](https://cve.now/CVE-2014-8598.md): The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to (1) upload arbitrary XML files via (no CVSS)
- [CVE-2014-4451](https://cve.now/CVE-2014-4451.md): Apple iOS before 8.1.1 does not properly enforce the failed-passcode limit, which makes it easier for physically proximate attackers to bypa (no CVSS)
- [CVE-2014-4452](https://cve.now/CVE-2014-4452.md): WebKit, as used in Apple iOS before 8.1.1 and Apple TV before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of (no CVSS)
- [CVE-2014-4453](https://cve.now/CVE-2014-4453.md): Apple iOS before 8.1.1 and OS X before 10.10.1 include location data during establishment of a Spotlight Suggestions server connection by Sp (no CVSS)
- [CVE-2014-4455](https://cve.now/CVE-2014-4455.md): dyld in Apple iOS before 8.1.1 and Apple TV before 7.0.2 does not properly handle overlapping segments in Mach-O executable files, which all (no CVSS)
- [CVE-2014-4457](https://cve.now/CVE-2014-4457.md): The Sandbox Profiles subsystem in Apple iOS before 8.1.1 does not properly implement the debugserver sandbox, which allows attackers to bypa (no CVSS)
- [CVE-2014-4458](https://cve.now/CVE-2014-4458.md): The "System Profiler About This Mac" component in Apple OS X before 10.10.1 includes extraneous cookie data in system-model requests, which (no CVSS)
- [CVE-2014-4459](https://cve.now/CVE-2014-4459.md): Use-after-free vulnerability in WebKit, as used in Apple OS X before 10.10.1, allows remote attackers to execute arbitrary code via crafted (no CVSS)
- [CVE-2014-4460](https://cve.now/CVE-2014-4460.md): CFNetwork in Apple iOS before 8.1.1 and OS X before 10.10.1 does not properly clear the browsing cache upon a transition out of private-brow (no CVSS)
- [CVE-2014-4461](https://cve.now/CVE-2014-4461.md): The kernel in Apple iOS before 8.1.1 and Apple TV before 7.0.2 does not properly validate IOSharedDataQueue object metadata, which allows at (no CVSS)
- [CVE-2014-4462](https://cve.now/CVE-2014-4462.md): WebKit, as used in Apple iOS before 8.1.1 and Apple TV before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of (no CVSS)
- [CVE-2014-4463](https://cve.now/CVE-2014-4463.md): Apple iOS before 8.1.1 allows physically proximate attackers to bypass the lock-screen protection mechanism, and view or transmit a Photo Li (no CVSS)
- [CVE-2014-6095](https://cve.now/CVE-2014-6095.md): Directory traversal vulnerability in IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to read arbitrary files v (no CVSS)
- [CVE-2014-6096](https://cve.now/CVE-2014-6096.md): Cross-site scripting (XSS) vulnerability in IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2014-6098](https://cve.now/CVE-2014-6098.md): IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to discover cleartext passwords via a crafted request. (no CVSS)
- [CVE-2014-6105](https://cve.now/CVE-2014-6105.md): IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to conduct clickjacking attacks via unspecified vectors. (no CVSS)
- [CVE-2014-6107](https://cve.now/CVE-2014-6107.md): IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to obtain sensitive cookie information by sniffing the network (no CVSS)
- [CVE-2014-6110](https://cve.now/CVE-2014-6110.md): IBM Security Identity Manager 6.x before 6.0.0.3 IF14 does not properly perform logout actions, which allows remote attackers to access sess (no CVSS)
- [CVE-2014-7992](https://cve.now/CVE-2014-7992.md): The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensitive credential inform (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-11-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.