# CVEs published 2014-12-15

27 CVEs were published on December 15, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-1569](https://cve.now/CVE-2014-1569.md): The definite\_length\_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.1 (no CVSS)
- [CVE-2014-3583](https://cve.now/CVE-2014-3583.md): The handle\_headers function in mod\_proxy\_fcgi.c in the mod\_proxy\_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers (no CVSS)
- [CVE-2014-6052](https://cve.now/CVE-2014-6052.md): The HandleRFBServerMessage function in libvncclient/rfbproto.c in LibVNCServer 0.9.9 and earlier does not check certain malloc return values (no CVSS)
- [CVE-2014-6053](https://cve.now/CVE-2014-6053.md): The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier does not properly handle attempts t (no CVSS)
- [CVE-2014-6253](https://cve.now/CVE-2014-6253.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Zenoss Core through 5 Beta 3 allow remote attackers to hijack the authenticati (no CVSS)
- [CVE-2014-6254](https://cve.now/CVE-2014-6254.md): Multiple cross-site scripting (XSS) vulnerabilities in Zenoss Core through 5 Beta 3 allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2014-6255](https://cve.now/CVE-2014-6255.md): Open redirect vulnerability in the login form in Zenoss Core before 4.2.5 SP161 allows remote attackers to redirect users to arbitrary web s (no CVSS)
- [CVE-2014-6256](https://cve.now/CVE-2014-6256.md): Zenoss Core through 5 Beta 3 allows remote attackers to bypass intended access restrictions and place files in a directory with public (1) r (no CVSS)
- [CVE-2014-6257](https://cve.now/CVE-2014-6257.md): Zenoss Core through 5 Beta 3 allows remote attackers to bypass intended access restrictions by using a web-endpoint URL to invoke an object (no CVSS)
- [CVE-2014-6258](https://cve.now/CVE-2014-6258.md): An unspecified endpoint in Zenoss Core through 5 Beta 3 allows remote attackers to cause a denial of service (CPU consumption) by triggering (no CVSS)
- [CVE-2014-6259](https://cve.now/CVE-2014-6259.md): Zenoss Core through 5 Beta 3 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of (no CVSS)
- [CVE-2014-6260](https://cve.now/CVE-2014-6260.md): Zenoss Core through 5 Beta 3 does not require a password for modifying the pager command string, which allows remote attackers to execute ar (no CVSS)
- [CVE-2014-6261](https://cve.now/CVE-2014-6261.md): Zenoss Core through 5 Beta 3 does not properly implement the Check For Updates feature, which allows remote attackers to execute arbitrary c (no CVSS)
- [CVE-2014-7911](https://cve.now/CVE-2014-7911.md): luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.0 does not verify th (no CVSS)
- [CVE-2014-8507](https://cve.now/CVE-2014-8507.md): Multiple SQL injection vulnerabilities in the queryLastApp method in packages/WAPPushManager/src/com/android/smspush/WapPushManager.java in (no CVSS)
- [CVE-2014-8609](https://cve.now/CVE-2014-8609.md): The addAccount method in src/com/android/settings/accounts/AddAccountSettings.java in the Settings application in Android before 5.0.0 does (no CVSS)
- [CVE-2014-8610](https://cve.now/CVE-2014-8610.md): AndroidManifest.xml in Android before 5.0.0 does not require the SEND\_SMS permission for the SmsReceiver receiver, which allows attackers to (no CVSS)
- [CVE-2014-8967](https://cve.now/CVE-2014-8967.md): Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute arbitrary code via a crafted HTML document in (no CVSS)
- [CVE-2014-9245](https://cve.now/CVE-2014-9245.md): Zenoss Core through 5 Beta 3 allows remote attackers to obtain sensitive information by attempting a product-rename action with an invalid n (no CVSS)
- [CVE-2014-9247](https://cve.now/CVE-2014-9247.md): Zenoss Core through 5 Beta 3 allows remote authenticated users to obtain sensitive (1) user account, (2) e-mail address, and (3) role inform (no CVSS)
- [CVE-2014-9248](https://cve.now/CVE-2014-9248.md): Zenoss Core through 5 Beta 3 does not require complex passwords, which makes it easier for remote attackers to obtain access via a brute-for (no CVSS)
- [CVE-2014-9249](https://cve.now/CVE-2014-9249.md): The default configuration of Zenoss Core before 5 allows remote attackers to read or modify database information by connecting to unspecifie (no CVSS)
- [CVE-2014-9250](https://cve.now/CVE-2014-9250.md): Zenoss Core through 5 Beta 3 does not include the HTTPOnly flag in a Set-Cookie header for the authentication cookie, which makes it easier (no CVSS)
- [CVE-2014-9251](https://cve.now/CVE-2014-9251.md): Zenoss Core through 5 Beta 3 uses a weak algorithm to hash passwords, which makes it easier for context-dependent attackers to obtain cleart (no CVSS)
- [CVE-2014-9252](https://cve.now/CVE-2014-9252.md): Zenoss Core through 5 Beta 3 stores cleartext passwords in the session database, which might allow local users to obtain sensitive informati (no CVSS)
- [CVE-2014-9385](https://cve.now/CVE-2014-9385.md): Cross-site request forgery (CSRF) vulnerability in Zenoss Core through 5 Beta 3 allows remote attackers to hijack the authentication of arbi (no CVSS)
- [CVE-2014-9386](https://cve.now/CVE-2014-9386.md): Zenoss Core before 4.2.5 SP161 sets an infinite lifetime for the session ID cookie, which makes it easier for remote attackers to hijack ses (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-12-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.