# CVEs published 2014-11-26 26 CVEs were published on November 26, 2014: 0 critical, 0 high. Days are UTC. - [CVE-2014-2037](https://cve.now/CVE-2014-2037.md): Openswan 2.6.40 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets tha (no CVSS) - [CVE-2014-6609](https://cve.now/CVE-2014-6609.md): The res\_pjsip\_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash (no CVSS) - [CVE-2014-6610](https://cve.now/CVE-2014-6610.md): Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res\_fax\_spands (no CVSS) - [CVE-2014-7141](https://cve.now/CVE-2014-7141.md): The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds rea (no CVSS) - [CVE-2014-7142](https://cve.now/CVE-2014-7142.md): The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a craf (no CVSS) - [CVE-2014-8419](https://cve.now/CVE-2014-8419.md): Wibu-Systems CodeMeter Runtime before 5.20 uses weak permissions (read and write access for all users) for codemeter.exe, which allows local (no CVSS) - [CVE-2014-8962](https://cve.now/CVE-2014-8962.md): Stack-based buffer overflow in stream\_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .fla (no CVSS) - [CVE-2014-9028](https://cve.now/CVE-2014-9028.md): Heap-based buffer overflow in stream\_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac (no CVSS) - [CVE-2014-9093](https://cve.now/CVE-2014-9093.md): LibreOffice before 4.3.5 allows remote attackers to cause a denial of service (invalid write operation and crash) and possibly execute arbit (no CVSS) - [CVE-2014-9094](https://cve.now/CVE-2014-9094.md): Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for (no CVSS) - [CVE-2014-9095](https://cve.now/CVE-2014-9095.md): Multiple SQL injection vulnerabilities in Raritan Power IQ 4.1.0 and 4.2.1 allow remote attackers to execute arbitrary SQL commands via the (no CVSS) - [CVE-2014-9096](https://cve.now/CVE-2014-9096.md): Multiple SQL injection vulnerabilities in recover.php in Pligg CMS 2.0.1 and earlier allow remote attackers to execute arbitrary SQL command (no CVSS) - [CVE-2014-9097](https://cve.now/CVE-2014-9097.md): Multiple SQL injection vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly as distributed befo (no CVSS) - [CVE-2014-9098](https://cve.now/CVE-2014-9098.md): Multiple cross-site scripting (XSS) vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly before (no CVSS) - [CVE-2014-9099](https://cve.now/CVE-2014-9099.md): Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to hijack the auth (no CVSS) - [CVE-2014-9100](https://cve.now/CVE-2014-9100.md): Cross-site scripting (XSS) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to inject arbitrary web s (no CVSS) - [CVE-2014-9101](https://cve.now/CVE-2014-9101.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Oxwall 1.7.0 (build 7907 and 7906) and SkaDate Lite 2.0 (build 7651) allow rem (no CVSS) - [CVE-2014-9102](https://cve.now/CVE-2014-9102.md): Multiple SQL injection vulnerabilities in the Kunena component before 3.0.6 for Joomla! allow remote authenticated users to execute arbitrar (no CVSS) - [CVE-2014-9103](https://cve.now/CVE-2014-9103.md): Multiple cross-site scripting (XSS) vulnerabilities in the Kunena component before 3.0.6 for Joomla! allow remote attackers to inject arbitr (no CVSS) - [CVE-2014-9104](https://cve.now/CVE-2014-9104.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the XML-RPC API in the Desktop Client in OpenVPN Access Server 1.5.6 and earli (no CVSS) - [CVE-2014-8551](https://cve.now/CVE-2014-8551.md): The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 (no CVSS) - [CVE-2014-8552](https://cve.now/CVE-2014-8552.md): The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 (no CVSS) - [CVE-2014-6093](https://cve.now/CVE-2014-6093.md): Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.0.x before 7.0.0.2 CF29, 8.0.x through 8.0.0.1 CF14, and 8.5.x before 8.5 (no CVSS) - [CVE-2014-6196](https://cve.now/CVE-2014-6196.md): Cross-site scripting (XSS) vulnerability in IBM Web Experience Factory (WEF) 6.1.5 through 8.5.0.1, as used in WebSphere Dashboard Framework (no CVSS) - [CVE-2014-7247](https://cve.now/CVE-2014-7247.md): Unspecified vulnerability in JustSystems Ichitaro 2008 through 2011; Ichitaro Government 6, 7, 2008, 2009, and 2010; Ichitaro Pro; Ichitaro (no CVSS) - [CVE-2014-8005](https://cve.now/CVE-2014-8005.md): Race condition in the lighttpd module in Cisco IOS XR 5.1 and earlier on Network Convergence System 6000 devices allows remote attackers to (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2014-11-26 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.