# CVEs published 2014-11-28

16 CVEs were published on November 28, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-7178](https://cve.now/CVE-2014-7178.md): Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the pas (no CVSS)
- [CVE-2014-7850](https://cve.now/CVE-2014-7850.md): Cross-site scripting (XSS) vulnerability in the Web UI in FreeIPA 4.x before 4.1.2 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2014-8423](https://cve.now/CVE-2014-8423.md): Unspecified vulnerability in the management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to execute arbitrary commands via (no CVSS)
- [CVE-2014-8424](https://cve.now/CVE-2014-8424.md): ARRIS VAP2500 before FW08.41 does not properly validate passwords, which allows remote attackers to bypass authentication. (no CVSS)
- [CVE-2014-8425](https://cve.now/CVE-2014-8425.md): The management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to obtain credentials by reading the configuration files. (no CVSS)
- [CVE-2014-8429](https://cve.now/CVE-2014-8429.md): Cross-site request forgery (CSRF) vulnerability in Xavoc Technocrats xEpan CMS 1.0.4.1, 1.0.4, 1.0.1, and earlier allows remote attackers to (no CVSS)
- [CVE-2014-8799](https://cve.now/CVE-2014-8799.md): Directory traversal vulnerability in the dp\_img\_resize function in php/dp-functions.php in the DukaPress plugin before 2.5.4 for WordPress a (no CVSS)
- [CVE-2014-8801](https://cve.now/CVE-2014-8801.md): Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote attac (no CVSS)
- [CVE-2014-8994](https://cve.now/CVE-2014-8994.md): The check\_diskio plugin 3.2.6 and earlier for Nagios and Icinga allows local users to write to arbitrary files via a symlink attack on a tem (no CVSS)
- [CVE-2014-9089](https://cve.now/CVE-2014-9089.md): Multiple SQL injection vulnerabilities in view\_all\_bug\_page.php in MantisBT before 1.2.18 allow remote attackers to execute arbitrary SQL co (no CVSS)
- [CVE-2014-3407](https://cve.now/CVE-2014-3407.md): The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.3(.2) and earlier does not properly allocate memory blocks (no CVSS)
- [CVE-2014-4829](https://cve.now/CVE-2014-4829.md): Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7. (no CVSS)
- [CVE-2014-4831](https://cve.now/CVE-2014-4831.md): IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 b (no CVSS)
- [CVE-2014-4832](https://cve.now/CVE-2014-4832.md): IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 b (no CVSS)
- [CVE-2014-4883](https://cve.now/CVE-2014-4883.md): resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and s (no CVSS)
- [CVE-2014-6075](https://cve.now/CVE-2014-6075.md): IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 b (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-11-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.