# CVEs published 2014-12-11

50 CVEs were published on December 11, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-6215](https://cve.now/CVE-2014-6215.md): Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 before 7.0.0. (no CVSS)
- [CVE-2014-7264](https://cve.now/CVE-2014-7264.md): Multiple cross-site scripting (XSS) vulnerabilities in admin/themes/default/pages/manage\_users.twig in the Users Management feature in the a (no CVSS)
- [CVE-2014-3058](https://cve.now/CVE-2014-3058.md): Cross-site request forgery (CSRF) vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authentic (no CVSS)
- [CVE-2014-6143](https://cve.now/CVE-2014-6143.md): The IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows local users to obtain sensitive information by reading a response. (no CVSS)
- [CVE-2014-6163](https://cve.now/CVE-2014-6163.md): Cross-site scripting (XSS) vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated us (no CVSS)
- [CVE-2014-7852](https://cve.now/CVE-2014-7852.md): Cross-site scripting (XSS) vulnerability in JBoss RichFaces, as used in JBoss Portal 6.1.1, allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2014-8372](https://cve.now/CVE-2014-8372.md): AirWatch by VMware On-Premise 7.3.x before 7.3.3.0 (FP3) allows remote authenticated users to obtain the organizational information and stat (no CVSS)
- [CVE-2014-8373](https://cve.now/CVE-2014-8373.md): The VMware Remote Console (VMRC) function in VMware vCloud Automation Center (vCAC) 6.0.1 through 6.1.1 allows remote authenticated users to (no CVSS)
- [CVE-2014-9192](https://cve.now/CVE-2014-9192.md): Trihedral Engineering Limited VTScada Integer Overflow (no CVSS, Trihedral Engineering VTS)
- [CVE-2014-9264](https://cve.now/CVE-2014-9264.md): Stack-based buffer overflow in the .NET Data Provider in SAP SQL Anywhere allows remote attackers to execute arbitrary code via a crafted co (no CVSS)
- [CVE-2014-1587](https://cve.now/CVE-2014-1587.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before (no CVSS)
- [CVE-2014-1588](https://cve.now/CVE-2014-1588.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 34.0 and SeaMonkey before 2.31 allow remote attackers t (no CVSS)
- [CVE-2014-1589](https://cve.now/CVE-2014-1589.md): Mozilla Firefox before 34.0 and SeaMonkey before 2.31 provide stylesheets with an incorrect primary namespace, which allows remote attackers (no CVSS)
- [CVE-2014-1590](https://cve.now/CVE-2014-1590.md): The XMLHttpRequest.prototype.send method in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonke (no CVSS)
- [CVE-2014-1591](https://cve.now/CVE-2014-1591.md): Mozilla Firefox 33.0 and SeaMonkey before 2.31 include path strings in CSP violation reports, which allows remote attackers to obtain sensit (no CVSS)
- [CVE-2014-1592](https://cve.now/CVE-2014-1592.md): Use-after-free vulnerability in the nsHtml5TreeOperation function in xul.dll in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, T (no CVSS)
- [CVE-2014-1593](https://cve.now/CVE-2014-1593.md): Stack-based buffer overflow in the mozilla::FileBlockCache::Read function in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thun (no CVSS)
- [CVE-2014-1594](https://cve.now/CVE-2014-1594.md): Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 might allow remote attackers t (no CVSS)
- [CVE-2014-1595](https://cve.now/CVE-2014-1595.md): Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, and Thunderbird before 31.3 on Apple OS X 10.10 omit a CoreGraphics disable-loggi (no CVSS)
- [CVE-2014-6114](https://cve.now/CVE-2014-6114.md): The Hosted Transparent Decision Service in the Rule Execution Server in IBM WebSphere ILOG JRules 7.1 before MP1 FP5 IF43; WebSphere Operati (no CVSS)
- [CVE-2014-7192](https://cve.now/CVE-2014-7192.md): Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application De (no CVSS, syntax-error)
- [CVE-2014-8631](https://cve.now/CVE-2014-8631.md): The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 34.0 and SeaMonkey before 2.31 supports native-interface passing, w (no CVSS)
- [CVE-2014-8632](https://cve.now/CVE-2014-8632.md): The structured-clone implementation in Mozilla Firefox before 34.0 and SeaMonkey before 2.31 does not properly interact with XrayWrapper pro (no CVSS)
- [CVE-2014-8500](https://cve.now/CVE-2014-8500.md): ISC BIND 9.0.x through 9.8.x, 9.9.0 through 9.9.6, and 9.10.0 through 9.10.1 does not limit delegation chaining, which allows remote attacke (no CVSS)
- [CVE-2014-8602](https://cve.now/CVE-2014-8602.md): iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2014-8680](https://cve.now/CVE-2014-8680.md): The GeoIP functionality in ISC BIND 9.10.0 through 9.10.1 allows remote attackers to cause a denial of service (assertion failure and named (no CVSS)
- [CVE-2014-6319](https://cve.now/CVE-2014-6319.md): Outlook Web App (OWA) in Microsoft Exchange Server 2007 SP3, 2010 SP3, and 2013 SP1 and Cumulative Update 6 does not properly validate token (no CVSS)
- [CVE-2014-6325](https://cve.now/CVE-2014-6325.md): Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 allows remote attackers to inject arb (no CVSS)
- [CVE-2014-6326](https://cve.now/CVE-2014-6326.md): Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 allows remote attackers to inject arb (no CVSS)
- [CVE-2014-6327](https://cve.now/CVE-2014-6327.md): Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS)
- [CVE-2014-6328](https://cve.now/CVE-2014-6328.md): Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the XSS filter via a crafted attribute of an element in an HTML d (no CVSS)
- [CVE-2014-6329](https://cve.now/CVE-2014-6329.md): Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS)
- [CVE-2014-6330](https://cve.now/CVE-2014-6330.md): Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft (no CVSS)
- [CVE-2014-6336](https://cve.now/CVE-2014-6336.md): Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 does not properly validate redirection tokens, which all (no CVSS)
- [CVE-2014-6355](https://cve.now/CVE-2014-6355.md): The Graphics Component in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8 (no CVSS)
- [CVE-2014-6356](https://cve.now/CVE-2014-6356.md): Array index error in Microsoft Word 2007 SP3, Word 2010 SP2, and Office Compatibility Pack SP3 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2014-6357](https://cve.now/CVE-2014-6357.md): Use-after-free vulnerability in Microsoft Office 2010 SP2, Office 2013 Gold and SP1, Office 2013 RT Gold and SP1, Office for Mac 2011, Word (no CVSS)
- [CVE-2014-6360](https://cve.now/CVE-2014-6360.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, and Office Compatibility Pack allow remote attackers to execute arbitrary code via a crafted Offic (no CVSS)
- [CVE-2014-6361](https://cve.now/CVE-2014-6361.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 Gold and SP1, Excel 2013 RT Gold and SP1, and Office Compatibility Pack allow remote at (no CVSS)
- [CVE-2014-6363](https://cve.now/CVE-2014-6363.md): vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 6 through 11 and other products, allows remote attackers (no CVSS)
- [CVE-2014-6364](https://cve.now/CVE-2014-6364.md): Use-after-free vulnerability in Microsoft Office 2007 SP3; 2010 SP2; 2013 Gold, SP1, and SP2; and 2013 RT Gold and SP1 allows remote attacke (no CVSS)
- [CVE-2014-6365](https://cve.now/CVE-2014-6365.md): Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the XSS filter via a crafted attribute of an element in an HTML d (no CVSS)
- [CVE-2014-6366](https://cve.now/CVE-2014-6366.md): Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a (no CVSS)
- [CVE-2014-6368](https://cve.now/CVE-2014-6368.md): Microsoft Internet Explorer 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explore (no CVSS)
- [CVE-2014-6369](https://cve.now/CVE-2014-6369.md): Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2014-6373](https://cve.now/CVE-2014-6373.md): Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS)
- [CVE-2014-6374](https://cve.now/CVE-2014-6374.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2014-6375](https://cve.now/CVE-2014-6375.md): Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft (no CVSS)
- [CVE-2014-6376](https://cve.now/CVE-2014-6376.md): Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS)
- [CVE-2014-8966](https://cve.now/CVE-2014-8966.md): Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-12-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.