# CVEs published 2014-11-24

38 CVEs were published on November 24, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2012-6662](https://cve.now/CVE-2012-6662.md): Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.1 (no CVSS, jquery-ui · jquery-ui-rails +2)
- [CVE-2014-8349](https://cve.now/CVE-2014-8349.md): Cross-site scripting (XSS) vulnerability in Liferay Portal Enterprise Edition (EE) 6.2 SP8 and earlier allows remote authenticated users to (no CVSS)
- [CVE-2014-1424](https://cve.now/CVE-2014-1424.md): apparmor\_parser in the apparmor package before 2.8.95~2430-0ubuntu5.1 in Ubuntu 14.04 allows attackers to bypass AppArmor policies via unspe (no CVSS)
- [CVE-2014-7817](https://cve.now/CVE-2014-7817.md): The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE\_NOCMD flag, which allows context-dependent attackers to exe (no CVSS)
- [CVE-2014-7821](https://cve.now/CVE-2014-7821.md): OpenStack Neutron before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (crash) via a (no CVSS)
- [CVE-2014-8412](https://cve.now/CVE-2014-8412.md): The (1) VoIP channel drivers, (2) DUNDi, and (3) Asterisk Manager Interface (AMI) in Asterisk Open Source 1.8.x before 1.8.32.1, 11.x before (no CVSS)
- [CVE-2014-8413](https://cve.now/CVE-2014-8413.md): The res\_pjsip\_acl module in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 does not properly create and load ACLs defined in (no CVSS)
- [CVE-2014-8414](https://cve.now/CVE-2014-8414.md): ConfBridge in Asterisk 11.x before 11.14.1 and Certified Asterisk 11.6 before 11.6-cert8 does not properly handle state changes, which allow (no CVSS)
- [CVE-2014-8415](https://cve.now/CVE-2014-8415.md): Race condition in the chan\_pjsip channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 allows remote attackers to (no CVSS)
- [CVE-2014-8416](https://cve.now/CVE-2014-8416.md): Use-after-free vulnerability in the PJSIP channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1, when using the r (no CVSS)
- [CVE-2014-8417](https://cve.now/CVE-2014-8417.md): ConfBridge in Asterisk 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 11.6 before 11.6-cert8 allows (no CVSS)
- [CVE-2014-8418](https://cve.now/CVE-2014-8418.md): The DB dialplan function in Asterisk Open Source 1.8.x before 1.8.32, 11.x before 11.1.4.1, 12.x before 12.7.1, and 13.x before 13.0.1 and C (no CVSS)
- [CVE-2014-8627](https://cve.now/CVE-2014-8627.md): PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote attackers to conduct downgrade attacks via un (no CVSS)
- [CVE-2014-8986](https://cve.now/CVE-2014-8986.md): Cross-site scripting (XSS) vulnerability in the selection list in the filters in the Configuration Report page (adm\_config\_report.php) in Ma (no CVSS)
- [CVE-2014-8988](https://cve.now/CVE-2014-8988.md): MantisBT before 1.2.18 allows remote authenticated users to bypass the $g\_download\_attachments\_threshold and $g\_view\_attachments\_threshold r (no CVSS)
- [CVE-2014-8991](https://cve.now/CVE-2014-8991.md): pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-\* fi (no CVSS, pip)
- [CVE-2014-9015](https://cve.now/CVE-2014-9015.md): Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted re (no CVSS)
- [CVE-2014-9016](https://cve.now/CVE-2014-9016.md): The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allo (no CVSS)
- [CVE-2014-9030](https://cve.now/CVE-2014-9030.md): The do\_mmu\_update function in arch/x86/mm.c in Xen 3.2.x through 4.4.x does not properly manage page references, which allows remote domains (no CVSS)
- [CVE-2014-7830](https://cve.now/CVE-2014-7830.md): Cross-site scripting (XSS) vulnerability in mod/feedback/mapcourse.php in the Feedback module in Moodle through 2.4.11, 2.5.x before 2.5.9, (no CVSS, moodle/moodle)
- [CVE-2014-7831](https://cve.now/CVE-2014-7831.md): lib/classes/grades\_external.php in Moodle 2.7.x before 2.7.3 does not consider the moodle/grade:viewhidden capability before displaying hidd (no CVSS, moodle/moodle)
- [CVE-2014-7832](https://cve.now/CVE-2014-7832.md): mod/lti/launch.php in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 performs acces (no CVSS, moodle/moodle)
- [CVE-2014-7833](https://cve.now/CVE-2014-7833.md): mod/data/edit.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 sets a certain group ID to zero u (no CVSS, moodle/moodle)
- [CVE-2014-7834](https://cve.now/CVE-2014-7834.md): mod/forum/externallib.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not verify group permissions, which allows remote authent (no CVSS, moodle/moodle)
- [CVE-2014-7835](https://cve.now/CVE-2014-7835.md): webservice/upload.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not ensure that a file upload is for a private or draft area, (no CVSS, moodle/moodle)
- [CVE-2014-7836](https://cve.now/CVE-2014-7836.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6. (no CVSS, moodle/moodle)
- [CVE-2014-7837](https://cve.now/CVE-2014-7837.md): mod/wiki/admin.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote authenticated user (no CVSS, moodle/moodle)
- [CVE-2014-7838](https://cve.now/CVE-2014-7838.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2. (no CVSS, moodle/moodle)
- [CVE-2014-7845](https://cve.now/CVE-2014-7845.md): The generate\_password function in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide a s (no CVSS, moodle/moodle)
- [CVE-2014-7846](https://cve.now/CVE-2014-7846.md): tag/tag\_autocomplete.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not consider the mood (no CVSS, moodle/moodle)
- [CVE-2014-7847](https://cve.now/CVE-2014-7847.md): iplookup/index.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote attackers to cause (no CVSS, moodle/moodle)
- [CVE-2014-7848](https://cve.now/CVE-2014-7848.md): lib/phpunit/bootstrap.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 allows remote attackers to obtain sensitive information via a (no CVSS, moodle/moodle)
- [CVE-2014-9059](https://cve.now/CVE-2014-9059.md): lib/setup.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide charset information (no CVSS, moodle/moodle)
- [CVE-2014-9060](https://cve.now/CVE-2014-9060.md): The LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not properly restrict the param (no CVSS, moodle/moodle)
- [CVE-2014-5314](https://cve.now/CVE-2014-5314.md): Buffer overflow in Cybozu Office 9 and 10 before 10.1.0, Mailwise 4 and 5 before 5.1.4, and Dezie 8 before 8.1.1 allows remote authenticated (no CVSS)
- [CVE-2014-5325](https://cve.now/CVE-2014-5325.md): The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in Direct Web Remoting (DWR) through 2.0.10 and (no CVSS, org.directwebremoting:dwr)
- [CVE-2014-5326](https://cve.now/CVE-2014-5326.md): Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inje (no CVSS, org.directwebremoting:dwr)
- [CVE-2010-5312](https://cve.now/CVE-2010-5312.md): Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to i (no CVSS, jquery-ui · org.webjars.npm:jquery-ui +2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-11-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.