# CVEs published 2014-12-16

22 CVEs were published on December 16, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-5353](https://cve.now/CVE-2014-5353.md): The krb5\_ldap\_get\_password\_policy\_from\_dn function in plugins/kdb/ldap/libkdb\_ldap/ldap\_pwd\_policy.c in MIT Kerberos 5 (aka krb5) before 1.1 (no CVSS)
- [CVE-2014-5354](https://cve.now/CVE-2014-5354.md): plugins/kdb/ldap/libkdb\_ldap/ldap\_principal2.c in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when the KDC uses LDAP, allows (no CVSS)
- [CVE-2014-6176](https://cve.now/CVE-2014-6176.md): IBM WebSphere Process Server 7.0, WebSphere Enterprise Service Bus 7.0, and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x t (no CVSS)
- [CVE-2014-8246](https://cve.now/CVE-2014-8246.md): Cross-site request forgery (CSRF) vulnerability in CA Release Automation (formerly iTKO LISA Release Automation) before 4.7.1 b448 allows re (no CVSS)
- [CVE-2014-8247](https://cve.now/CVE-2014-8247.md): Cross-site scripting (XSS) vulnerability in CA Release Automation (formerly iTKO LISA Release Automation) before 4.7.1 b448 allows remote at (no CVSS)
- [CVE-2014-8248](https://cve.now/CVE-2014-8248.md): SQL injection vulnerability in CA Release Automation (formerly iTKO LISA Release Automation) before 4.7.1 b448 allows remote authenticated u (no CVSS)
- [CVE-2013-6435](https://cve.now/CVE-2013-6435.md): Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extract (no CVSS)
- [CVE-2014-4936](https://cve.now/CVE-2014-4936.md): The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.101 (no CVSS)
- [CVE-2014-5359](https://cve.now/CVE-2014-5359.md): Directory traversal vulnerability in SafeNet Authentication Service (SAS) Outlook Web Access Agent (formerly CRYPTOCard) before 1.03.30109 a (no CVSS)
- [CVE-2014-5466](https://cve.now/CVE-2014-5466.md): Cross-site scripting (XSS) vulnerability in the Dashboard in Splunk Web in Splunk Enterprise 6.1.x before 6.1.4, 6.0.x before 6.0.7, and 5.0 (no CVSS)
- [CVE-2014-8118](https://cve.now/CVE-2014-8118.md): Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in the payload section (no CVSS)
- [CVE-2014-8340](https://cve.now/CVE-2014-8340.md): SQL injection vulnerability in Php/Functions/log\_function.php in phpTrafficA 2.3 and earlier allows remote attackers to execute arbitrary SQ (no CVSS)
- [CVE-2014-8583](https://cve.now/CVE-2014-8583.md): mod\_wsgi before 4.2.4 for Apache, when creating a daemon process group, does not properly handle when group privileges cannot be dropped, wh (no CVSS)
- [CVE-2014-8751](https://cve.now/CVE-2014-8751.md): Multiple cross-site scripting (XSS) vulnerabilities in goYWP WebPress 13.00.06 allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2014-8964](https://cve.now/CVE-2014-8964.md): Heap-based buffer overflow in PCRE 8.36 and earlier allows remote attackers to cause a denial of service (crash) or have other unspecified i (no CVSS)
- [CVE-2014-9057](https://cve.now/CVE-2014-9057.md): SQL injection vulnerability in the XML-RPC interface in Movable Type before 5.18, 5.2.x before 5.2.11, and 6.x before 6.0.6 allows remote at (no CVSS)
- [CVE-2014-9323](https://cve.now/CVE-2014-9323.md): The xdr\_status\_vector function in Firebird before 2.1.7 and 2.5.x before 2.5.3 SU1 allows remote attackers to cause a denial of service (NUL (no CVSS)
- [CVE-2014-9357](https://cve.now/CVE-2014-9357.md): Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in (no CVSS, github.com/docker/docker)
- [CVE-2014-9358](https://cve.now/CVE-2014-9358.md): Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof reposito (no CVSS, github.com/docker/docker)
- [CVE-2014-9371](https://cve.now/CVE-2014-9371.md): The NativeAppServlet in ManageEngine Desktop Central MSP before 90075 allows remote attackers to execute arbitrary code via a crafted JSON o (no CVSS)
- [CVE-2014-9372](https://cve.now/CVE-2014-9372.md): Directory traversal vulnerability in the UploadAccountActivities servlet in ManageEngine Password Manager Pro (PMP) before 7103 allows remot (no CVSS)
- [CVE-2014-9373](https://cve.now/CVE-2014-9373.md): Directory traversal vulnerability in the CollectorConfInfoServlet servlet in ManageEngine NetFlow Analyzer allows remote attackers to execut (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-12-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.