# CVEs published 2014-11-21

13 CVEs were published on November 21, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-5395](https://cve.now/CVE-2014-5395.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI bef (no CVSS)
- [CVE-2014-7137](https://cve.now/CVE-2014-7137.md): Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands v (no CVSS)
- [CVE-2014-7871](https://cve.now/CVE-2014-7871.md): SQL injection vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users (no CVSS)
- [CVE-2014-8090](https://cve.now/CVE-2014-8090.md): The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attacker (no CVSS)
- [CVE-2014-8469](https://cve.now/CVE-2014-8469.md): Cross-site scripting (XSS) vulnerability in Guests/Boots in AdminCP in Moxi9 PHPFox before 4 Beta allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2014-8539](https://cve.now/CVE-2014-8539.md): Cross-site scripting (XSS) vulnerability in Simple Email Form 1.8.5 and earlier allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2014-8681](https://cve.now/CVE-2014-8681.md): SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before 0.5.6.1 (no CVSS, gogs.io/gogs · github.com/gogits/gogs)
- [CVE-2014-8682](https://cve.now/CVE-2014-8682.md): Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to e (no CVSS, gogs.io/gogs)
- [CVE-2014-8683](https://cve.now/CVE-2014-8683.md): Cross-site scripting (XSS) vulnerability in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.8 allows remote at (no CVSS, gogs.io/gogs)
- [CVE-2014-7194](https://cve.now/CVE-2014-7194.md): TIBCO Managed File Transfer Internet Server before 7.2.4, Managed File Transfer Command Center before 7.2.4, Slingshot before 1.9.3, and Vau (no CVSS)
- [CVE-2014-7195](https://cve.now/CVE-2014-7195.md): Spotfire Web Player Engine in TIBCO Spotfire Web Player 6.0.x before 6.0.2 and 6.5.x before 6.5.2, Spotfire Deployment Kit 6.0.x before 6.0. (no CVSS)
- [CVE-2014-8000](https://cve.now/CVE-2014-8000.md): Cisco Unified Communications Manager IM and Presence Service 9.1(1) produces different returned messages for URL requests depending on wheth (no CVSS)
- [CVE-2014-8388](https://cve.now/CVE-2014-8388.md): Stack-based buffer overflow in Advantech WebAccess, formerly BroadWin WebAccess, before 8.0 allows remote attackers to execute arbitrary cod (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-11-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.