# CVEs published 2014-11-25 20 CVEs were published on November 25, 2014: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2014-8439](https://cve.now/CVE-2014-8439.md): Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR bef (CVSS 8.8, KEV) - [CVE-2014-9031](https://cve.now/CVE-2014-9031.md): Cross-site scripting (XSS) vulnerability in the wptexturize function in WordPress before 3.7.5, 3.8.x before 3.8.5, and 3.9.x before 3.9.3 a (no CVSS) - [CVE-2014-9032](https://cve.now/CVE-2014-9032.md): Cross-site scripting (XSS) vulnerability in the media-playlists feature in WordPress before 3.9.x before 3.9.3 and 4.x before 4.0.1 allows r (no CVSS) - [CVE-2014-9033](https://cve.now/CVE-2014-9033.md): Cross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack (no CVSS) - [CVE-2014-9034](https://cve.now/CVE-2014-9034.md): wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers (no CVSS) - [CVE-2014-9035](https://cve.now/CVE-2014-9035.md): Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0 (no CVSS) - [CVE-2014-9036](https://cve.now/CVE-2014-9036.md): Cross-site scripting (XSS) vulnerability in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remo (no CVSS) - [CVE-2014-9037](https://cve.now/CVE-2014-9037.md): WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an acc (no CVSS) - [CVE-2014-9038](https://cve.now/CVE-2014-9038.md): wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cond (no CVSS) - [CVE-2014-9039](https://cve.now/CVE-2014-9039.md): wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset p (no CVSS) - [CVE-2014-8001](https://cve.now/CVE-2014-8001.md): Buffer overflow in decode.cpp in Cisco OpenH264 1.2.0 and earlier allows remote attackers to execute arbitrary code via an encoded media fil (no CVSS) - [CVE-2014-8002](https://cve.now/CVE-2014-8002.md): Use-after-free vulnerability in decode\_slice.cpp in Cisco OpenH264 1.2.0 and earlier allows remote attackers to execute arbitrary code via a (no CVSS) - [CVE-2014-8004](https://cve.now/CVE-2014-8004.md): Cisco IOS XR allows remote attackers to cause a denial of service (LISP process reload) by establishing many LISP TCP sessions, aka Bug ID C (no CVSS) - [CVE-2014-1421](https://cve.now/CVE-2014-1421.md): mountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, which allows local users to bypass (no CVSS) - [CVE-2014-7839](https://cve.now/CVE-2014-7839.md): DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities feature (no CVSS, org.jboss.resteasy:resteasy-jaxrs) - [CVE-2014-8367](https://cve.now/CVE-2014-8367.md): SQL injection vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) 6.2.x, 6.3.x before 6.3.6, and 6.4.x before 6.4.2 allows remot (no CVSS) - [CVE-2014-8368](https://cve.now/CVE-2014-8368.md): The web interface in Aruba Networks AirWave before 7.7.14 and 8.x before 8.0.5 allows remote authenticated users to gain privileges and exec (no CVSS) - [CVE-2014-8420](https://cve.now/CVE-2014-8420.md): The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before 7.2 SP2, and SonicW (no CVSS) - [CVE-2014-8558](https://cve.now/CVE-2014-8558.md): JExperts Channel Platform 5.0.33\_CCB allows remote authenticated users to bypass access restrictions via crafted action and key parameters. (no CVSS) - [CVE-2014-8678](https://cve.now/CVE-2014-8678.md): The ConfigSaveServlet servlet in ManageEngine OpUtils before build 71024 allows remote attackers to "disclose" files via a crafted filename, (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2014-11-25 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.