# CVEs published 2014-12-05

30 CVEs were published on December 5, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-9292](https://cve.now/CVE-2014-9292.md): Server-side request forgery (SSRF) vulnerability in proxy.php in the jRSS Widget plugin 1.2 and earlier for WordPress allows remote attacker (no CVSS)
- [CVE-2014-8877](https://cve.now/CVE-2014-8877.md): The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for (no CVSS)
- [CVE-2014-7243](https://cve.now/CVE-2014-7243.md): LG Electronics Mobile WiFi router L-09C, L-03E, and L-04D does not restrict access to the web administration interface, which allows remote (no CVSS)
- [CVE-2014-7252](https://cve.now/CVE-2014-7252.md): Multiple unspecified vulnerabilities in the Syslink driver for Texas Instruments OMAP mobile processor, as used on NTT DOCOMO ARROWS Tab LTE (no CVSS)
- [CVE-2014-7253](https://cve.now/CVE-2014-7253.md): FUJITSU F-12C, ARROWS Tab LTE F-01D, ARROWS Kiss F-03D, and REGZA Phone T-01D for Android allows local users to execute arbitrary commands v (no CVSS)
- [CVE-2014-7254](https://cve.now/CVE-2014-7254.md): Unspecified vulnerability in ARROWS Me F-11D allows physically proximate attackers to read or modify flash memory via unknown vectors. (no CVSS)
- [CVE-2014-7255](https://cve.now/CVE-2014-7255.md): Internet Initiative Japan Inc. (no CVSS)
- [CVE-2014-7256](https://cve.now/CVE-2014-7256.md): The (1) PPP Access Concentrator (PPPAC) and (2) Dial-Up Networking Internet Initiative Japan Inc. (no CVSS)
- [CVE-2014-7258](https://cve.now/CVE-2014-7258.md): Cross-site scripting (XSS) vulnerability in KENT-WEB Clip Board 2.91 and earlier, when running certain versions of Internet Explorer, allows (no CVSS)
- [CVE-2014-7259](https://cve.now/CVE-2014-7259.md): SQUARE ENIX Co., Ltd. (no CVSS)
- [CVE-2012-6656](https://cve.now/CVE-2012-6656.md): iconvdata/ibm930.c in GNU C Library (aka glibc) before 2.16 allows context-dependent attackers to cause a denial of service (out-of-bounds r (no CVSS)
- [CVE-2014-2273](https://cve.now/CVE-2014-2273.md): The hx170dec device driver in Huawei P2-6011 before V100R001C00B043 allows local users to read and write to arbitrary memory locations via u (no CVSS)
- [CVE-2014-3561](https://cve.now/CVE-2014-3561.md): The rhevm-log-collector package in Red Hat Enterprise Virtualization 3.4 uses the PostgreSQL database password on the command line when call (no CVSS)
- [CVE-2014-3627](https://cve.now/CVE-2014-3627.md): The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote (no CVSS, org.apache.hadoop:hadoop-client)
- [CVE-2014-4701](https://cve.now/CVE-2014-4701.md): The check\_dhcp plugin in Nagios Plugins before 2.0.2 allows local users to obtain sensitive information from INI configuration files via the (no CVSS)
- [CVE-2014-4702](https://cve.now/CVE-2014-4702.md): The check\_icmp plugin in Nagios Plugins before 2.0.2 allows local users to obtain sensitive information from INI configuration files via the (no CVSS)
- [CVE-2014-4703](https://cve.now/CVE-2014-4703.md): lib/parse\_ini.c in Nagios Plugins 2.0.2 allows local users to obtain sensitive information via a symlink attack on the configuration file in (no CVSS)
- [CVE-2014-6040](https://cve.now/CVE-2014-6040.md): GNU C Library (aka glibc) before 2.20 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a m (no CVSS)
- [CVE-2014-8123](https://cve.now/CVE-2014-8123.md): Buffer overflow in the bGetPPS function in wordole.c in Antiword 0.37 allows remote attackers to cause a denial of service (crash) via a cra (no CVSS)
- [CVE-2014-8990](https://cve.now/CVE-2014-8990.md): default-rsyncssh.lua in Lsyncd 2.1.5 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a filenam (no CVSS)
- [CVE-2014-9140](https://cve.now/CVE-2014-9140.md): Buffer overflow in the ppp\_hdlc function in print-ppp.c in tcpdump 4.6.2 and earlier allows remote attackers to cause a denial of service (c (no CVSS)
- [CVE-2014-3996](https://cve.now/CVE-2014-3996.md): SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central Managed Service Pro (no CVSS)
- [CVE-2014-3997](https://cve.now/CVE-2014-3997.md): SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Servi (no CVSS)
- [CVE-2014-8800](https://cve.now/CVE-2014-8800.md): Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect plugin before 1.5.1 for WordPress (no CVSS)
- [CVE-2014-9129](https://cve.now/CVE-2014-9129.md): Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager plugin before 2.0.7 for WordPress allows remote at (no CVSS)
- [CVE-2014-9142](https://cve.now/CVE-2014-9142.md): Cross-site scripting (XSS) vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to inject arbitrary w (no CVSS)
- [CVE-2014-9143](https://cve.now/CVE-2014-9143.md): Open redirect vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to redirect users to arbitrary web (no CVSS)
- [CVE-2014-9144](https://cve.now/CVE-2014-9144.md): Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to execute arbitrary commands via shell metacharacters in the pin (no CVSS)
- [CVE-2014-9212](https://cve.now/CVE-2014-9212.md): Multiple cross-site scripting (XSS) vulnerabilities in Altitude uAgent in Altitude uCI (Unified Customer Interaction) 7.5 allow remote attac (no CVSS)
- [CVE-2014-9215](https://cve.now/CVE-2014-9215.md): SQL injection vulnerability in the CheckEmail function in includes/functions.class.php in PBBoard 3.0.1 before 20141128 allows remote attack (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-12-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.