# CVEs published 2014-12-03

23 CVEs were published on December 3, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2013-7416](https://cve.now/CVE-2013-7416.md): canto\_curses/guibase.py in Canto Curses before 0.9.0 allows remote feed servers to execute arbitrary commands via shell metacharacters in a (no CVSS)
- [CVE-2014-9134](https://cve.now/CVE-2014-9134.md): Unrestricted file upload vulnerability in Huawei Honor Cube Wireless Router WS860s before V100R001C02B222 allows remote attackers to execute (no CVSS)
- [CVE-2014-9157](https://cve.now/CVE-2014-9157.md): Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via (no CVSS)
- [CVE-2014-9234](https://cve.now/CVE-2014-9234.md): Directory traversal vulnerability in cgi-bin/sddownload.cgi in D-link IP camera DCS-2103 with firmware 1.0.0 allows remote attackers to read (no CVSS)
- [CVE-2014-9235](https://cve.now/CVE-2014-9235.md): Multiple SQL injection vulnerabilities in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allow remote authenticated users to execute arb (no CVSS)
- [CVE-2014-9236](https://cve.now/CVE-2014-9236.md): Cross-site scripting (XSS) vulnerability in php/edit\_photos.php in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allows remote attacker (no CVSS)
- [CVE-2014-9237](https://cve.now/CVE-2014-9237.md): SQL injection vulnerability in Proticaret E-Commerce 3.0 allows remote attackers to execute arbitrary SQL commands via a tem:Code element in (no CVSS)
- [CVE-2014-9238](https://cve.now/CVE-2014-9238.md): D-link IP camera DCS-2103 with firmware 1.0.0 allows remote attackers to obtain the installation path via the file parameter to cgi-bin/sddo (no CVSS)
- [CVE-2014-9239](https://cve.now/CVE-2014-9239.md): SQL injection vulnerability in the IPS Connect service (interface/ipsconnect/ipsconnect.php) in Invision Power Board (aka IPB or IP.Board) 3 (no CVSS)
- [CVE-2014-9240](https://cve.now/CVE-2014-9240.md): SQL injection vulnerability in member.php in MyBB (aka MyBulletinBoard) 1.8.x before 1.8.2 allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2014-9241](https://cve.now/CVE-2014-9241.md): Multiple cross-site scripting (XSS) vulnerabilities in MyBB (aka MyBulletinBoard) 1.8.x before 1.8.2 allow remote attackers to inject arbitr (no CVSS)
- [CVE-2014-9242](https://cve.now/CVE-2014-9242.md): SQL injection vulnerability in admin/pages/modify.php in WebsiteBaker 2.8.3 allows remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2014-9243](https://cve.now/CVE-2014-9243.md): Multiple cross-site scripting (XSS) vulnerabilities in WebsiteBaker 2.8.3 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2014-8104](https://cve.now/CVE-2014-8104.md): OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service (no CVSS)
- [CVE-2014-8771](https://cve.now/CVE-2014-8771.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the admin area in X3 CMS 0.5.1 and 0.5.1.1 allow remote attackers to hijack th (no CVSS)
- [CVE-2014-8772](https://cve.now/CVE-2014-8772.md): Cross-site scripting (XSS) vulnerability in the search\_controller in X3 CMS 0.5.1 and 0.5.1.1 allows remote authenticated users to inject ar (no CVSS)
- [CVE-2014-8773](https://cve.now/CVE-2014-8773.md): MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism by (1) omitti (no CVSS)
- [CVE-2014-8774](https://cve.now/CVE-2014-8774.md): Cross-site scripting (XSS) vulnerability in manager/index.php in MODX Revolution 2.x before 2.2.15 allows remote attackers to inject arbitra (no CVSS)
- [CVE-2014-8775](https://cve.now/CVE-2014-8775.md): MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier fo (no CVSS)
- [CVE-2014-9018](https://cve.now/CVE-2014-9018.md): Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensitive information, rela (no CVSS)
- [CVE-2014-3988](https://cve.now/CVE-2014-3988.md): Cross-site scripting (XSS) vulnerability in index.php in SunHater KCFinder 3.11 and earlier allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2014-9141](https://cve.now/CVE-2014-9141.md): The installer in Thomson Reuters Fixed Assets CS 13.1.4 and earlier uses weak permissions for connectbgdl.exe, which allows local users to e (no CVSS)
- [CVE-2014-9220](https://cve.now/CVE-2014-9220.md): SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote attackers to execute arbitrary SQL commands v (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-12-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.