# CVEs published 2014-12-08

34 CVEs were published on December 8, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-5462](https://cve.now/CVE-2014-5462.md): Multiple SQL injection vulnerabilities in OpenEMR 4.1.2 (Patch 7) and earlier allow remote authenticated users to execute arbitrary SQL comm (no CVSS)
- [CVE-2014-8106](https://cve.now/CVE-2014-8106.md): Heap-based buffer overflow in the Cirrus VGA emulator (hw/display/cirrus\_vga.c) in QEMU before 2.2.0 allows local guest users to execute arb (no CVSS)
- [CVE-2014-9029](https://cve.now/CVE-2014-9029.md): Multiple off-by-one errors in the (1) jpc\_dec\_cp\_setfromcox and (2) jpc\_dec\_cp\_setfromrgn functions in jpc/jpc\_dec.c in JasPer 1.900.1 and e (no CVSS)
- [CVE-2014-9130](https://cve.now/CVE-2014-9130.md): scanner.c in LibYAML 0.1.5 and 0.1.6, as used in the YAML-LibYAML (aka YAML-XS) module for Perl, allows context-dependent attackers to cause (no CVSS)
- [CVE-2014-9263](https://cve.now/CVE-2014-9263.md): Multiple buffer overflows in the PocketNetNVRMediaClientAxCtrl.NVRMediaViewer.1 control in 3S Pocketnet Tech VMS allow remote attackers to e (no CVSS)
- [CVE-2014-9265](https://cve.now/CVE-2014-9265.md): Stack-based buffer overflow in the BackupToAvi method in the CNC\_Ctrl ActiveX control in Samsung SmartViewer allows remote attackers to exec (no CVSS)
- [CVE-2014-9266](https://cve.now/CVE-2014-9266.md): The STWConfig ActiveX control in Samsung SmartViewer does not properly initialize a variable, which allows remote attackers to execute arbit (no CVSS)
- [CVE-2014-9267](https://cve.now/CVE-2014-9267.md): Heap-based buffer overflow in the PTC IsoView ActiveX control allows remote attackers to execute arbitrary code via a crafted ViewPort prope (no CVSS)
- [CVE-2014-9268](https://cve.now/CVE-2014-9268.md): The AdView.AdViewer.1 ActiveX control in Autodesk Design Review (ADR) before 2013 Hotfix 1 allows remote attackers to execute arbitrary code (no CVSS)
- [CVE-2014-9270](https://cve.now/CVE-2014-9270.md): Cross-site scripting (XSS) vulnerability in the projax\_array\_serialize\_for\_autocomplete function in core/projax\_api.php in MantisBT 1.1.0a3 (no CVSS)
- [CVE-2014-9273](https://cve.now/CVE-2014-9273.md): lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers (no CVSS)
- [CVE-2014-9279](https://cve.now/CVE-2014-9279.md): The print\_test\_result function in admin/upgrade\_unattended.php in MantisBT 1.1.0a3 through 1.2.x before 1.2.18 allows remote attackers to ob (no CVSS)
- [CVE-2014-9280](https://cve.now/CVE-2014-9280.md): The current\_user\_get\_bug\_filter function in core/current\_user\_api.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2014-9305](https://cve.now/CVE-2014-9305.md): SQL injection vulnerability in the shortcodeProductsTable function in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.2 for WordP (no CVSS)
- [CVE-2014-9343](https://cve.now/CVE-2014-9343.md): Open redirect vulnerability in modules/system/controller/selectlanguage.class.php in Snowfox CMS 1.0 allows remote attackers to redirect use (no CVSS)
- [CVE-2014-9344](https://cve.now/CVE-2014-9344.md): Cross-site request forgery (CSRF) vulnerability in Snowfox CMS before 1.0.10 allows remote attackers to hijack the authentication of adminis (no CVSS)
- [CVE-2014-9345](https://cve.now/CVE-2014-9345.md): SQL injection vulnerability in Guruperl.net Advertise With Pleasure! Professional (aka AWP PRO) 6.6 and earlier allows remote attackers to e (no CVSS)
- [CVE-2014-9346](https://cve.now/CVE-2014-9346.md): Multiple cross-site scripting (XSS) vulnerabilities in the Hierarchical Select module 6.x-3.x before 6.x-3.9 for Drupal allow remote authent (no CVSS)
- [CVE-2014-9347](https://cve.now/CVE-2014-9347.md): SQL injection vulnerability in dosearch.php in phpMyRecipes 1.2.2 allows remote attackers to execute arbitrary SQL commands via the words\_ex (no CVSS)
- [CVE-2014-9348](https://cve.now/CVE-2014-9348.md): SQL injection vulnerability in the formulaireRobot function in admin/robots.lib.php in RobotStats 1.0 allows remote attackers to execute arb (no CVSS)
- [CVE-2014-9349](https://cve.now/CVE-2014-9349.md): Multiple cross-site scripting (XSS) vulnerabilities in admin/robots.lib.php in RobotStats 1.0 allow remote attackers to inject arbitrary web (no CVSS)
- [CVE-2014-9350](https://cve.now/CVE-2014-9350.md): TP-Link TL-WR740N 4 with firmware 3.17.0 Build 140520, 3.16.6 Build 130529, and 3.16.4 Build 130205 allows remote attackers to cause a denia (no CVSS)
- [CVE-2013-2810](https://cve.now/CVE-2013-2810.md): Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with softwa (no CVSS)
- [CVE-2014-1693](https://cve.now/CVE-2014-1693.md): Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP com (no CVSS)
- [CVE-2014-3616](https://cve.now/CVE-2014-3616.md): nginx 0.5.6 through 1.7.4, when using the same shared ssl\_session\_cache or ssl\_session\_ticket\_key for multiple servers, can reuse a cached S (no CVSS)
- [CVE-2014-3797](https://cve.now/CVE-2014-3797.md): Cross-site scripting (XSS) vulnerability in VMware vCenter Server Appliance (vCSA) 5.1 before Update 3 allows remote attackers to inject arb (no CVSS)
- [CVE-2014-4631](https://cve.now/CVE-2014-4631.md): RSA Adaptive Authentication (On-Premise) 6.0.2.1 through 7.1 P3, when using device binding in a Challenge SOAP call or using the RSA Adaptiv (no CVSS)
- [CVE-2014-4880](https://cve.now/CVE-2014-4880.md): Buffer overflow in Hikvision DVR DS-7204 Firmware 2.2.10 build 131009, and other models and versions, allows remote attackers to execute arb (no CVSS)
- [CVE-2014-8371](https://cve.now/CVE-2014-8371.md): VMware vCenter Server Appliance (vCSA) 5.5 before Update 2, 5.1 before Update 3, and 5.0 before Update 3c does not properly validate certifi (no CVSS)
- [CVE-2014-8600](https://cve.now/CVE-2014-8600.md): Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3 and earlier, kwebkitpart 1.3.4 and earlier, and kio-extras 5.1.1 a (no CVSS)
- [CVE-2014-9217](https://cve.now/CVE-2014-9217.md): Graylog2 before 0.92 allows remote attackers to bypass LDAP authentication via crafted wildcards. (no CVSS)
- [CVE-2014-9218](https://cve.now/CVE-2014-9218.md): libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows remote attackers to ca (no CVSS)
- [CVE-2014-9219](https://cve.now/CVE-2014-9219.md): Cross-site scripting (XSS) vulnerability in the redirection feature in url.php in phpMyAdmin 4.2.x before 4.2.13.1 allows remote attackers t (no CVSS)
- [CVE-2014-9342](https://cve.now/CVE-2014-9342.md): Cross-site scripting (XSS) vulnerability in the tree view (pl\_tree.php) feature in Application Security Manager (ASM) in F5 BIG-IP 11.3.0 al (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-12-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.