# CVEs published 2014-12-01

18 CVEs were published on December 1, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-5268](https://cve.now/CVE-2014-5268.md): The Fasttoggle module 7.x-1.3 and 7.x-1.4 for Drupal allows remote attackers to block or unblock an account via a crafted user status link. (no CVSS)
- [CVE-2014-9151](https://cve.now/CVE-2014-9151.md): The Services module 7.x-3.x before 7.x-3.10 for Drupal does not properly limit the rate of authentication attempts, which makes it easier fo (no CVSS)
- [CVE-2014-9152](https://cve.now/CVE-2014-9152.md): The \_user\_resource\_create function in the Services module 7.x-3.x before 7.x-3.10 for Drupal uses a password of 1 when creating new user acc (no CVSS)
- [CVE-2014-9153](https://cve.now/CVE-2014-9153.md): Cross-site scripting (XSS) vulnerability in the Services module 7.x-3.x before 7.x-3.10 for Drupal allows remote authenticated users to inje (no CVSS)
- [CVE-2014-9154](https://cve.now/CVE-2014-9154.md): The Notify module 7.x-1.x before 7.x-1.1 for Drupal does not properly restrict access to (1) new or (2) modified nodes or (3) their fields, (no CVSS)
- [CVE-2014-9155](https://cve.now/CVE-2014-9155.md): Directory traversal vulnerability in the Avatar Uploader module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.0-beta6 for Drupal allows re (no CVSS)
- [CVE-2014-9156](https://cve.now/CVE-2014-9156.md): The FileField module 6.x-3.x before 6.x-3.13 for Drupal does not properly check permissions to view files, which allows remote authenticated (no CVSS)
- [CVE-2013-6497](https://cve.now/CVE-2013-6497.md): clamscan in ClamAV before 0.98.5, when using -a option, allows remote attackers to cause a denial of service (crash) as demonstrated by the (no CVSS)
- [CVE-2014-2232](https://cve.now/CVE-2014-2232.md): Absolute path traversal vulnerability in the MapAPI in Infoware MapSuite before 1.0.36 and 1.1.x before 1.1.49 allows remote attackers to re (no CVSS)
- [CVE-2014-2233](https://cve.now/CVE-2014-2233.md): Server-side request forgery (SSRF) vulnerability in the MapAPI in Infoware MapSuite before 1.0.36 and 1.1.x before 1.1.49 allows remote atta (no CVSS)
- [CVE-2014-5237](https://cve.now/CVE-2014-5237.md): Server-side request forgery (SSRF) vulnerability in the documentconverter component in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6 (no CVSS)
- [CVE-2014-7291](https://cve.now/CVE-2014-7291.md): Multiple cross-site scripting (XSS) vulnerabilities in api\_events.php in Springshare LibCal 2.0 allow remote attackers to inject arbitrary w (no CVSS)
- [CVE-2014-7816](https://cve.now/CVE-2014-7816.md): Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running (no CVSS, io.undertow:undertow-core)
- [CVE-2014-8749](https://cve.now/CVE-2014-8749.md): Server-side request forgery (SSRF) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPre (no CVSS)
- [CVE-2014-8866](https://cve.now/CVE-2014-8866.md): The compatibility mode hypercall argument translation in Xen 3.3.x through 4.4.x, when running on a 64-bit hypervisor, allows local 32-bit H (no CVSS)
- [CVE-2014-8867](https://cve.now/CVE-2014-8867.md): The acceleration support for the "REP MOVS" instruction in Xen 4.4.x, 3.2.x, and earlier lacks properly bounds checking for memory mapped I/ (no CVSS)
- [CVE-2014-9050](https://cve.now/CVE-2014-9050.md): Heap-based buffer overflow in the cli\_scanpe function in libclamav/pe.c in ClamAV before 0.98.5 allows remote attackers to cause a denial of (no CVSS)
- [CVE-2014-9087](https://cve.now/CVE-2014-9087.md): Integer underflow in the ksba\_oid\_to\_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of se (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-12-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.