# CVEs published 2014-12-10 69 CVEs were published on December 10, 2014: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2014-0580](https://cve.now/CVE-2014-0580.md): Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows rem (no CVSS) - [CVE-2014-0587](https://cve.now/CVE-2014-0587.md): Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows att (no CVSS) - [CVE-2014-2608](https://cve.now/CVE-2014-2608.md): Unspecified vulnerability in HP Smart Update Manager 6.x before 6.4.1 on Windows, and 6.2.x through 6.4.x before 6.4.1 on Linux, allows loca (no CVSS) - [CVE-2014-4465](https://cve.now/CVE-2014-4465.md): WebKit in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1 allows remote attackers to bypass the Same Origin Policy via cra (no CVSS) - [CVE-2014-4466](https://cve.now/CVE-2014-4466.md): WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or c (no CVSS) - [CVE-2014-4468](https://cve.now/CVE-2014-4468.md): WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or c (no CVSS) - [CVE-2014-4469](https://cve.now/CVE-2014-4469.md): WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or c (no CVSS) - [CVE-2014-4470](https://cve.now/CVE-2014-4470.md): WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or c (no CVSS) - [CVE-2014-4471](https://cve.now/CVE-2014-4471.md): WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or c (no CVSS) - [CVE-2014-4472](https://cve.now/CVE-2014-4472.md): WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or c (no CVSS) - [CVE-2014-4473](https://cve.now/CVE-2014-4473.md): WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or c (no CVSS) - [CVE-2014-4474](https://cve.now/CVE-2014-4474.md): WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or c (no CVSS) - [CVE-2014-4475](https://cve.now/CVE-2014-4475.md): WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or c (no CVSS) - [CVE-2014-7879](https://cve.now/CVE-2014-7879.md): HP HP-UX B.11.11, B.11.23, and B.11.31, when the PAM configuration includes libpam\_updbe, allows remote authenticated users to bypass authen (no CVSS) - [CVE-2014-8003](https://cve.now/CVE-2014-8003.md): Cisco Integrated Management Controller in Cisco Unified Computing System 2.2(2c)A and earlier allows local users to obtain shell access via (no CVSS) - [CVE-2014-8009](https://cve.now/CVE-2014-8009.md): The Management subsystem in Cisco Unified Computing System 2.1(3f) and earlier allows remote attackers to obtain sensitive information by re (no CVSS) - [CVE-2014-8010](https://cve.now/CVE-2014-8010.md): The web framework in Cisco Unified Communications Domain Manager 8 allows remote authenticated administrators to execute arbitrary OS comman (no CVSS) - [CVE-2014-8443](https://cve.now/CVE-2014-8443.md): Use-after-free vulnerability in Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before (no CVSS) - [CVE-2014-8445](https://cve.now/CVE-2014-8445.md): Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allow attackers to execute arbitrary code or cause (no CVSS) - [CVE-2014-8446](https://cve.now/CVE-2014-8446.md): Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allow attackers to execute arbitrary code or cause (no CVSS) - [CVE-2014-8447](https://cve.now/CVE-2014-8447.md): Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allow attackers to execute arbitrary code or cause (no CVSS) - [CVE-2014-8448](https://cve.now/CVE-2014-8448.md): An unspecified JavaScript API in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers t (no CVSS) - [CVE-2014-8449](https://cve.now/CVE-2014-8449.md): Integer overflow in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to execute arb (no CVSS) - [CVE-2014-8451](https://cve.now/CVE-2014-8451.md): An unspecified JavaScript API in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers t (no CVSS) - [CVE-2014-8452](https://cve.now/CVE-2014-8452.md): Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allow remote attackers to read arbitrary files via (no CVSS) - [CVE-2014-8453](https://cve.now/CVE-2014-8453.md): Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allow remote attackers to bypass the Same Origin Po (no CVSS) - [CVE-2014-8454](https://cve.now/CVE-2014-8454.md): Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to (no CVSS) - [CVE-2014-8455](https://cve.now/CVE-2014-8455.md): Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to (no CVSS) - [CVE-2014-8456](https://cve.now/CVE-2014-8456.md): Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allow attackers to execute arbitrary code or cause (no CVSS) - [CVE-2014-8457](https://cve.now/CVE-2014-8457.md): Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to e (no CVSS) - [CVE-2014-8458](https://cve.now/CVE-2014-8458.md): Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allow attackers to execute arbitrary code or cause (no CVSS) - [CVE-2014-8459](https://cve.now/CVE-2014-8459.md): Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allow attackers to execute arbitrary code or cause (no CVSS) - [CVE-2014-8460](https://cve.now/CVE-2014-8460.md): Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to e (no CVSS) - [CVE-2014-8461](https://cve.now/CVE-2014-8461.md): Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allow attackers to execute arbitrary code or cause (no CVSS) - [CVE-2014-9158](https://cve.now/CVE-2014-9158.md): Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allow attackers to execute arbitrary code or cause (no CVSS) - [CVE-2014-9159](https://cve.now/CVE-2014-9159.md): Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to e (no CVSS) - [CVE-2014-9162](https://cve.now/CVE-2014-9162.md): Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows att (no CVSS) - [CVE-2014-9163](https://cve.now/CVE-2014-9163.md): Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2. (CVSS 7.8, KEV) - [CVE-2014-9164](https://cve.now/CVE-2014-9164.md): Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows att (no CVSS) - [CVE-2014-9165](https://cve.now/CVE-2014-9165.md): Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to (no CVSS) - [CVE-2014-9166](https://cve.now/CVE-2014-9166.md): Adobe ColdFusion 10 before Update 15 and 11 before Update 3 allows attackers to cause a denial of service (resource consumption) via unspeci (no CVSS) - [CVE-2014-9361](https://cve.now/CVE-2014-9361.md): The LoginToboggan module 7.x-1.x before 7.x-1.4 for Drupal does not properly unset the authorized user role for certain users, which allows (no CVSS) - [CVE-2014-9362](https://cve.now/CVE-2014-9362.md): Cross-site scripting (XSS) vulnerability in the path-based meta tag editing form in the Meta tags quick module 7.x-2.x before 7.x-2.8 for Dr (no CVSS) - [CVE-2014-9363](https://cve.now/CVE-2014-9363.md): Open redirect vulnerability in the path-based meta tag editing form in the Meta tags quick module 7.x-2.x before 7.x-2.8 for Drupal allows r (no CVSS) - [CVE-2014-9364](https://cve.now/CVE-2014-9364.md): Cross-site scripting (XSS) vulnerability in the Unified Login form in the LoginToboggan module 7.x-1.x before 7.x-1.4 for Drupal allows remo (no CVSS) - [CVE-2014-7866](https://cve.now/CVE-2014-7866.md): Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social IT (no CVSS) - [CVE-2014-7807](https://cve.now/CVE-2014-7807.md): Apache CloudStack 4.3.x before 4.3.2 and 4.4.x before 4.4.2 allows remote attackers to bypass authentication via a login request without a p (no CVSS) - [CVE-2014-7809](https://cve.now/CVE-2014-7809.md): Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable \ values, which allows remote attackers to bypass the CSRF protect (no CVSS, org.apache.struts:struts2-core) - [CVE-2014-8091](https://cve.now/CVE-2014-8091.md): X.Org X Window System (aka X11 and X) X11R5 and X.Org Server (aka xserver and xorg-server) before 1.16.3, when using SUN-DES-1 (Secure RPC) (no CVSS) - [CVE-2014-8092](https://cve.now/CVE-2014-8092.md): Multiple integer overflows in X.Org X Window System (aka X11 or X) X11R1 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allow (no CVSS) - [CVE-2014-8093](https://cve.now/CVE-2014-8093.md): Multiple integer overflows in the GLX extension in XFree86 4.0, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver (no CVSS) - [CVE-2014-8094](https://cve.now/CVE-2014-8094.md): Integer overflow in the ProcDRI2GetBuffers function in the DRI2 extension in X.Org Server (aka xserver and xorg-server) 1.7.0 through 1.16.x (no CVSS) - [CVE-2014-8095](https://cve.now/CVE-2014-8095.md): The XInput extension in X.Org X Window System (aka X11 or X) X11R4 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remot (no CVSS) - [CVE-2014-8096](https://cve.now/CVE-2014-8096.md): The SProcXCMiscGetXIDList function in the XC-MISC extension in X.Org X Window System (aka X11 or X) X11R6.0 and X.Org Server (aka xserver an (no CVSS) - [CVE-2014-8097](https://cve.now/CVE-2014-8097.md): The DBE extension in X.Org X Window System (aka X11 or X) X11R6.1 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote (no CVSS) - [CVE-2014-8098](https://cve.now/CVE-2014-8098.md): The GLX extension in XFree86 4.0, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before 1.16.3 (no CVSS) - [CVE-2014-8099](https://cve.now/CVE-2014-8099.md): The XVideo extension in XFree86 4.0.0, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before 1 (no CVSS) - [CVE-2014-8100](https://cve.now/CVE-2014-8100.md): The Render extension in XFree86 4.0.1, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before 1 (no CVSS) - [CVE-2014-8101](https://cve.now/CVE-2014-8101.md): The RandR extension in XFree86 4.2.0, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before 1. (no CVSS) - [CVE-2014-8102](https://cve.now/CVE-2014-8102.md): The SProcXFixesSelectSelectionInput function in the XFixes extension in X.Org X Window System (aka X11 or X) X11R6.8.0 and X.Org Server (aka (no CVSS) - [CVE-2014-8103](https://cve.now/CVE-2014-8103.md): X.Org Server (aka xserver and xorg-server) 1.15.0 through 1.16.x before 1.16.3 allows remote authenticated users to cause a denial of servic (no CVSS) - [CVE-2014-8298](https://cve.now/CVE-2014-8298.md): The NVIDIA Linux Discrete GPU drivers before R304.125, R331.x before R331.113, R340.x before R340.65, R343.x before R343.36, and R346.x befo (no CVSS) - [CVE-2014-8601](https://cve.now/CVE-2014-8601.md): PowerDNS Recursor before 3.6.2 does not limit delegation chaining, which allows remote attackers to cause a denial of service ("performance (no CVSS) - [CVE-2014-9091](https://cve.now/CVE-2014-9091.md): Icecast before 2.4.0 does not change the supplementary group privileges when \ is configured, which allows local users to gain p (no CVSS) - [CVE-2014-9120](https://cve.now/CVE-2014-9120.md): Cross-site scripting (XSS) vulnerability in Subrion CMS before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via the (no CVSS, intelliants/subrion) - [CVE-2014-9360](https://cve.now/CVE-2014-9360.md): XML external entity (XXE) vulnerability in Scalix Web Access 11.4.6.12377 and 12.2.0.14697 allows remote attackers to read arbitrary files a (no CVSS) - [CVE-2014-8488](https://cve.now/CVE-2014-8488.md): Cross-site scripting (XSS) vulnerability in the administrator panel in Yourls 1.7 allows remote attackers to inject arbitrary web script or (no CVSS) - [CVE-2014-8496](https://cve.now/CVE-2014-8496.md): Digicom DG-5514T ADSL router with firmware 3.2 generates predictable session IDs, which allows remote attackers to gain administrator privil (no CVSS) - [CVE-2014-8730](https://cve.now/CVE-2014-8730.md): The SSL profiles component in F5 BIG-IP LTM, APM, and ASM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, AAM 11.4.0 through 11.5.1, AFM 11 (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2014-12-10 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.