# CVEs published 2014-12-12

31 CVEs were published on December 12, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-2516](https://cve.now/CVE-2014-2516.md): Open redirect vulnerability in EMC RSA Authentication Manager 8.x before 8.1 Patch 6 allows remote attackers to redirect users to arbitrary (no CVSS)
- [CVE-2014-4628](https://cve.now/CVE-2014-4628.md): Cross-site scripting (XSS) vulnerability in EMC Isilon InsightIQ 2.x and 3.x before 3.1 allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2014-4633](https://cve.now/CVE-2014-4633.md): Cross-site scripting (XSS) vulnerability in EMC RSA Archer GRC Platform 5.x before 5.5.1.1 allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2014-8134](https://cve.now/CVE-2014-8134.md): The paravirt\_ops\_setup function in arch/x86/kernel/kvm.c in the Linux kernel through 3.18 uses an improper paravirt\_enabled setting for KVM (no CVSS)
- [CVE-2014-6209](https://cve.now/CVE-2014-6209.md): IBM DB2 9.5 through FP10, 9.7 through FP10, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP5 on Linux, UNIX, and Windows allows remote (no CVSS)
- [CVE-2014-6210](https://cve.now/CVE-2014-6210.md): IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP5 on Linux, UNIX, and Windows allows remote authenticated use (no CVSS)
- [CVE-2013-4399](https://cve.now/CVE-2013-4399.md): The remoteClientFreeFunc function in daemon/remote.c in libvirt before 1.1.3, when ACLs are used, does not set an identity, which causes eve (no CVSS)
- [CVE-2014-6381](https://cve.now/CVE-2014-6381.md): Juniper WLC devices with WLAN Software releases 8.0.x before 8.0.4, 9.0.x before 9.0.2.11, 9.0.3.x before 9.0.3.5, and 9.1.x before 9.1.1, w (no CVSS)
- [CVE-2014-6407](https://cve.now/CVE-2014-6407.md): Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack (no CVSS, github.com/docker/docker)
- [CVE-2014-6408](https://cve.now/CVE-2014-6408.md): Docker 1.3.0 through 1.3.1 allows remote attackers to modify the default run profile of image containers and possibly bypass the container b (no CVSS, github.com/docker/docker)
- [CVE-2014-7136](https://cve.now/CVE-2014-7136.md): Heap-based buffer overflow in the K7FWFilt.sys kernel mode driver (aka K7Firewall Packet Driver) before 14.0.1.16, as used in multiple K7 Co (no CVSS)
- [CVE-2014-7840](https://cve.now/CVE-2014-7840.md): The host\_from\_stream\_offset function in arch\_init.c in QEMU, when loading RAM during migration, allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2014-8124](https://cve.now/CVE-2014-8124.md): OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memca (no CVSS)
- [CVE-2014-8489](https://cve.now/CVE-2014-8489.md): Open redirect vulnerability in startSSO.ping in the SP Endpoints in Ping Identity PingFederate 6.10.1 allows remote attackers to redirect us (no CVSS)
- [CVE-2014-8515](https://cve.now/CVE-2014-8515.md): The web interface in BitTorrent allows remote attackers to execute arbitrary commands by leveraging knowledge of the pairing values and a cr (no CVSS)
- [CVE-2014-8608](https://cve.now/CVE-2014-8608.md): The K7Sentry.sys kernel mode driver (aka K7AV Sentry Device Driver) before 12.8.0.119, as used in multiple K7 Computing products, allows loc (no CVSS)
- [CVE-2014-8956](https://cve.now/CVE-2014-8956.md): Stack-based buffer overflow in the K7Sentry.sys kernel mode driver (aka K7AV Sentry Device Driver) before 12.8.0.119, as used in multiple K7 (no CVSS)
- [CVE-2014-9374](https://cve.now/CVE-2014-9374.md): Double free vulnerability in the WebSocket Server (res\_http\_websocket module) in Asterisk Open Source 11.x before 11.14.2, 12.x before 12.7. (no CVSS)
- [CVE-2014-4323](https://cve.now/CVE-2014-4323.md): The mdp\_lut\_hw\_update function in drivers/video/msm/mdp.c in the MDP display driver for the Linux kernel 3.x, as used in Qualcomm Innovation (no CVSS)
- [CVE-2014-6138](https://cve.now/CVE-2014-6138.md): The IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to bypass intended grid-data access rest (no CVSS)
- [CVE-2014-6145](https://cve.now/CVE-2014-6145.md): Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence 10.1 before IF10, 10.1.1 before IF9, 10.2 before (no CVSS)
- [CVE-2014-6316](https://cve.now/CVE-2014-6316.md): core/string\_api.php in MantisBT before 1.2.18 does not properly categorize URLs when running under the web root, which allows remote attacke (no CVSS)
- [CVE-2014-7265](https://cve.now/CVE-2014-7265.md): Cross-site scripting (XSS) vulnerability in LinPHA allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. (no CVSS)
- [CVE-2014-8270](https://cve.now/CVE-2014-8270.md): BMC Track-It! 11.3 allows remote attackers to gain privileges and execute arbitrary code by creating an account whose name matches that of a (no CVSS)
- [CVE-2014-9365](https://cve.now/CVE-2014-9365.md): The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x b (no CVSS)
- [CVE-2014-4815](https://cve.now/CVE-2014-4815.md): Session fixation vulnerability in IBM Rational Lifecycle Integration Adapter for Windchill 1.x before 1.0.1 allows remote attackers to hijac (no CVSS)
- [CVE-2014-7250](https://cve.now/CVE-2014-7250.md): The TCP stack in 4.3BSD Net/2, as used in FreeBSD 5.4, NetBSD possibly 2.0, and OpenBSD possibly 3.6, does not properly implement the sessio (no CVSS)
- [CVE-2014-7260](https://cve.now/CVE-2014-7260.md): The Server Side Includes (SSI) implementation in the File Upload BBS component in ULTRAPOP.JP i-HTTPD allows remote attackers to execute arb (no CVSS)
- [CVE-2014-7261](https://cve.now/CVE-2014-7261.md): Cross-site scripting (XSS) vulnerability in ULTRAPOP.JP i-HTTPD allows remote attackers to inject arbitrary web script or HTML via a crafted (no CVSS)
- [CVE-2014-7262](https://cve.now/CVE-2014-7262.md): Cross-site scripting (XSS) vulnerability in the Omake BBS component in ULTRAPOP.JP i-HTTPD allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2014-7263](https://cve.now/CVE-2014-7263.md): Cross-site scripting (XSS) vulnerability in ULTRAPOP.JP i-HTTPD allows remote attackers to inject arbitrary web script or HTML via a crafted (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-12-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.