# CVEs published 2014-12-17

18 CVEs were published on December 17, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2013-7402](https://cve.now/CVE-2013-7402.md): Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted (no CVSS)
- [CVE-2014-7170](https://cve.now/CVE-2014-7170.md): Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or (no CVSS)
- [CVE-2014-8116](https://cve.now/CVE-2014-8116.md): The ELF parser (readelf.c) in file before 5.21 allows remote attackers to cause a denial of service (CPU consumption or crash) via a large n (no CVSS)
- [CVE-2014-8117](https://cve.now/CVE-2014-8117.md): softmagic.c in file before 5.21 does not properly limit recursion, which allows remote attackers to cause a denial of service (CPU consumpti (no CVSS)
- [CVE-2014-8553](https://cve.now/CVE-2014-8553.md): The mci\_account\_get\_array\_by\_id function in api/soap/mc\_account\_api.php in MantisBT before 1.2.18 allows remote attackers to obtain sensitiv (no CVSS)
- [CVE-2014-9387](https://cve.now/CVE-2014-9387.md): SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SI\_PLATFORM\_SEARCH\_SERVER\_LOGON\_TOKEN token and gain privileges via a cra (no CVSS)
- [CVE-2014-9388](https://cve.now/CVE-2014-9388.md): bug\_report.php in MantisBT before 1.2.18 allows remote attackers to assign arbitrary issues via the handler\_id parameter. (no CVSS)
- [CVE-2014-5437](https://cve.now/CVE-2014-5437.md): Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earl (no CVSS)
- [CVE-2014-5438](https://cve.now/CVE-2014-5438.md): Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote (no CVSS)
- [CVE-2014-9253](https://cve.now/CVE-2014-9253.md): The default file type whitelist configuration in conf/mime.conf in the Media Manager in DokuWiki before 2014-09-29b allows remote attackers (no CVSS)
- [CVE-2014-7285](https://cve.now/CVE-2014-7285.md): The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS co (no CVSS)
- [CVE-2014-7880](https://cve.now/CVE-2014-7880.md): Multiple unspecified vulnerabilities in the POP implementation in HP OpenVMS TCP/IP 5.7 before ECO5 allow remote attackers to cause a denial (no CVSS)
- [CVE-2014-8133](https://cve.now/CVE-2014-8133.md): arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the e (no CVSS)
- [CVE-2014-9322](https://cve.now/CVE-2014-9322.md): arch/x86/kernel/entry\_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment (no CVSS)
- [CVE-2014-4626](https://cve.now/CVE-2014-4626.md): EMC Documentum Content Server before 6.7 SP1 P29, 6.7 SP2 before P18, 7.0 before P16, and 7.1 before P09 allows remote authenticated users t (no CVSS)
- [CVE-2014-4844](https://cve.now/CVE-2014-4844.md): The import/export functionality in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5 (no CVSS)
- [CVE-2014-6182](https://cve.now/CVE-2014-6182.md): Directory traversal vulnerability in an export function in the Process Center in IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3 an (no CVSS)
- [CVE-2014-8006](https://cve.now/CVE-2014-8006.md): The Disaster Recovery (DRA) feature on the Cisco ISB8320-E High-Definition IP-Only DVR allows remote attackers to bypass authentication by e (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-12-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.