# CVEs published 2014-12-02

26 CVEs were published on December 2, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-9182](https://cve.now/CVE-2014-9182.md): models/comment.php in Anchor CMS 0.9.2 and earlier allows remote attackers to inject arbitrary headers into mail messages via a crafted Host (no CVSS)
- [CVE-2014-9183](https://cve.now/CVE-2014-9183.md): ZTE ZXDSL 831CII has a default password of admin for the admin account, which allows remote attackers to gain administrator privileges. (no CVSS)
- [CVE-2014-9184](https://cve.now/CVE-2014-9184.md): ZTE ZXDSL 831CII allows remote attackers to bypass authentication via a direct request to (1) main.cgi, (2) adminpasswd.cgi, (3) userpasswd. (no CVSS)
- [CVE-2014-8728](https://cve.now/CVE-2014-8728.md): SQL injection vulnerability in the login page (login/login) in Subex ROC Fraud Management (aka Fraud Management System and FMS) 7.4 and earl (no CVSS)
- [CVE-2014-8754](https://cve.now/CVE-2014-8754.md): Open redirect vulnerability in track-click.php in the Ad-Manager plugin 1.1.2 for WordPress allows remote attackers to redirect users to arb (no CVSS)
- [CVE-2014-8788](https://cve.now/CVE-2014-8788.md): GleamTech FileVista before 6.1 allows remote authenticated users to obtain sensitive information via a crafted path when saving a zip file, (no CVSS)
- [CVE-2014-8789](https://cve.now/CVE-2014-8789.md): GleamTech FileVista before 6.1 allows remote authenticated users to create arbitrary files and possibly execute arbitrary code via a crafted (no CVSS)
- [CVE-2014-8874](https://cve.now/CVE-2014-8874.md): The ke\_questionnaire extension 2.5.2 and earlier for TYPO3 uses predictable names for the questionnaire answer forms, which makes it easier (no CVSS)
- [CVE-2014-9112](https://cve.now/CVE-2014-9112.md): Heap-based buffer overflow in the process\_copy\_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large (no CVSS)
- [CVE-2014-9113](https://cve.now/CVE-2014-9113.md): CCH Wolters Kluwer ProSystem fx Engagement (aka PFX Engagement) 7.1 and earlier uses weak permissions (Authenticated Users: Modify and Write (no CVSS)
- [CVE-2014-9116](https://cve.now/CVE-2014-9116.md): The write\_one\_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote a (no CVSS)
- [CVE-2014-9173](https://cve.now/CVE-2014-9173.md): SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote attackers to execute arb (no CVSS)
- [CVE-2014-9174](https://cve.now/CVE-2014-9174.md): Cross-site scripting (XSS) vulnerability in the Google Analytics by Yoast (google-analytics-for-wordpress) plugin before 5.1.3 for WordPress (no CVSS)
- [CVE-2014-9175](https://cve.now/CVE-2014-9175.md): SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote attackers to execut (no CVSS)
- [CVE-2014-9176](https://cve.now/CVE-2014-9176.md): Cross-site scripting (XSS) vulnerability in the InstaSqueeze Sexy Squeeze Pages plugin for WordPress allows remote attackers to inject arbit (no CVSS)
- [CVE-2014-9177](https://cve.now/CVE-2014-9177.md): The HTML5 MP3 Player with Playlist Free plugin before 2.7 for WordPress allows remote attackers to obtain the installation path via a reques (no CVSS)
- [CVE-2014-9178](https://cve.now/CVE-2014-9178.md): Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-docum (no CVSS)
- [CVE-2014-9179](https://cve.now/CVE-2014-9179.md): Cross-site scripting (XSS) vulnerability in the SupportEzzy Ticket System plugin 1.2.5 for WordPress allows remote authenticated users to in (no CVSS)
- [CVE-2014-9180](https://cve.now/CVE-2014-9180.md): Open redirect vulnerability in go.php in Eleanor CMS allows remote attackers to redirect users to arbitrary web sites and conduct phishing a (no CVSS)
- [CVE-2014-9181](https://cve.now/CVE-2014-9181.md): Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2013-6494](https://cve.now/CVE-2013-6494.md): fedup 0.9.0 in Fedora 19, 20, and 21 uses a temporary directory with a static name for its download cache, which allows local users to cause (no CVSS)
- [CVE-2014-3065](https://cve.now/CVE-2014-3065.md): Unspecified vulnerability in IBM Java Runtime Environment (JRE) 7 R1 before SR2 (7.1.2.0), 7 before SR8 (7.0.8.0), 6 R1 before SR8 FP2 (6.1. (no CVSS)
- [CVE-2014-3068](https://cve.now/CVE-2014-3068.md): IBM Java Runtime Environment (JRE) 7 R1 before SR1 FP1 (7.1.1.1), 7 before SR7 FP1 (7.0.7.1), 6 R1 before SR8 FP1 (6.1.8.1), 6 before SR16 F (no CVSS)
- [CVE-2014-3703](https://cve.now/CVE-2014-3703.md): OpenStack PackStack 2012.2.1, when the Open vSwitch (OVS) monolithic plug-in is not used, does not properly set the libvirt\_vif\_driver confi (no CVSS)
- [CVE-2014-5284](https://cve.now/CVE-2014-5284.md): host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without verifying ownership, which allows local user (no CVSS)
- [CVE-2014-8791](https://cve.now/CVE-2014-8791.md): project/register.php in Tuleap before 7.7, when sys\_create\_project\_in\_one\_step is disabled, allows remote authenticated users to conduct PHP (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-12-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.