# CVEs published 2014-12-19

48 CVEs were published on December 19, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2013-7401](https://cve.now/CVE-2013-7401.md): The parse\_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " (no CVSS)
- [CVE-2014-5212](https://cve.now/CVE-2014-5212.md): Cross-site scripting (XSS) vulnerability in nds/search/data in iMonitor in Novell eDirectory before 8.8 SP8 Patch 4 allows remote attackers (no CVSS)
- [CVE-2014-5213](https://cve.now/CVE-2014-5213.md): nds/files/opt/novell/eDirectory/lib64/ndsimon/public/images in iMonitor in Novell eDirectory before 8.8 SP8 Patch 4 allows remote authentica (no CVSS)
- [CVE-2013-4440](https://cve.now/CVE-2013-4440.md): Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess (no CVSS)
- [CVE-2013-4442](https://cve.now/CVE-2013-4442.md): Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for co (no CVSS)
- [CVE-2014-2026](https://cve.now/CVE-2014-2026.md): Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and (no CVSS)
- [CVE-2014-2716](https://cve.now/CVE-2014-2716.md): Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 reuses the RC4 (no CVSS)
- [CVE-2014-6395](https://cve.now/CVE-2014-6395.md): Heap-based buffer overflow in the dissector\_postgresql function in dissectors/ec\_postgresql.c in Ettercap before 0.8.1 allows remote attacke (no CVSS)
- [CVE-2014-6396](https://cve.now/CVE-2014-6396.md): The dissector\_postgresql function in dissectors/ec\_postgresql.c in Ettercap before 0.8.1 allows remote attackers to cause a denial of servic (no CVSS)
- [CVE-2014-7208](https://cve.now/CVE-2014-7208.md): GParted before 0.15.0 allows local users to execute arbitrary commands with root privileges via shell metacharacters in a crafted filesystem (no CVSS)
- [CVE-2014-8135](https://cve.now/CVE-2014-8135.md): The storageVolUpload function in storage/storage\_driver.c in libvirt before 1.2.11 does not check a certain return value, which allows local (no CVSS)
- [CVE-2014-8136](https://cve.now/CVE-2014-8136.md): The (1) qemuDomainMigratePerform and (2) qemuDomainMigrateFinish2 functions in qemu/qemu\_driver.c in libvirt do not unlock the domain when a (no CVSS)
- [CVE-2014-8724](https://cve.now/CVE-2014-8724.md): Cross-site scripting (XSS) vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remot (no CVSS)
- [CVE-2014-8793](https://cve.now/CVE-2014-8793.md): Cross-site scripting (XSS) vulnerability in lib/max/Admin/UI/Field/PublisherIdField.php in Revive Adserver before 3.0.6 allows remote attack (no CVSS)
- [CVE-2014-8875](https://cve.now/CVE-2014-8875.md): The XML\_RPC\_cd function in lib/pear/XML/RPC.php in Revive Adserver before 3.0.6 allows remote attackers to cause a denial of service (CPU an (no CVSS)
- [CVE-2014-9135](https://cve.now/CVE-2014-9135.md): The PackageInstaller module in Huawei P7-L10 smartphones before V100R001C00B136 allows remote attackers to spoof the origin website and bypa (no CVSS)
- [CVE-2014-9185](https://cve.now/CVE-2014-9185.md): Static code injection vulnerability in install.php in Morfy CMS 1.05 allows remote authenticated users to inject arbitrary PHP code into con (no CVSS)
- [CVE-2014-9258](https://cve.now/CVE-2014-9258.md): SQL injection vulnerability in ajax/getDropdownValue.php in GLPI before 0.85.1 allows remote authenticated users to execute arbitrary SQL co (no CVSS)
- [CVE-2014-9324](https://cve.now/CVE-2014-9324.md): The GenericInterface in OTRS Help Desk 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before 4.0.3 allows remote authenticated users to (no CVSS)
- [CVE-2014-9335](https://cve.now/CVE-2014-9335.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the DandyID Services plugin 1.5.9 and earlier for WordPress allow remote attac (no CVSS)
- [CVE-2014-9336](https://cve.now/CVE-2014-9336.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the iTwitter plugin 0.04 and earlier for WordPress allow remote attackers to h (no CVSS)
- [CVE-2014-9337](https://cve.now/CVE-2014-9337.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Mikiurl Wordpress Eklentisi plugin 2.0 and earlier for WordPress allow rem (no CVSS)
- [CVE-2014-9338](https://cve.now/CVE-2014-9338.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the O2Tweet plugin 0.0.4 and earlier for WordPress allow remote attackers to h (no CVSS)
- [CVE-2014-9339](https://cve.now/CVE-2014-9339.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the SPNbabble plugin 1.4.1 and earlier for WordPress allow remote attackers to (no CVSS)
- [CVE-2014-9340](https://cve.now/CVE-2014-9340.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the wpCommentTwit plugin 0.5 and earlier for WordPress allow remote attackers (no CVSS)
- [CVE-2014-9341](https://cve.now/CVE-2014-9341.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the yURL ReTwitt plugin 1.4 and earlier for WordPress allow remote attackers t (no CVSS)
- [CVE-2014-9355](https://cve.now/CVE-2014-9355.md): Puppet Enterprise before 3.7.1 allows remote authenticated users to obtain licensing and certificate signing request information by leveragi (no CVSS)
- [CVE-2014-9368](https://cve.now/CVE-2014-9368.md): Cross-site request forgery (CSRF) vulnerability in the twitterDash plugin 2.1 and earlier for WordPress allows remote attackers to hijack th (no CVSS)
- [CVE-2014-9376](https://cve.now/CVE-2014-9376.md): Integer underflow in Ettercap 0.8.1 allows remote attackers to cause a denial of service (out-of-bounds write) and possibly execute arbitrar (no CVSS)
- [CVE-2014-9377](https://cve.now/CVE-2014-9377.md): Heap-based buffer overflow in the nbns\_spoof function in plug-ins/nbns\_spoof/nbns\_spoof.c in Ettercap 0.8.1 allows remote attackers to cause (no CVSS)
- [CVE-2014-9378](https://cve.now/CVE-2014-9378.md): Ettercap 0.8.1 does not validate certain return values, which allows remote attackers to cause a denial of service (crash) or possibly execu (no CVSS)
- [CVE-2014-9379](https://cve.now/CVE-2014-9379.md): The radius\_get\_attribute function in dissectors/ec\_radius.c in Ettercap 0.8.1 performs an incorrect cast, which allows remote attackers to c (no CVSS)
- [CVE-2014-9380](https://cve.now/CVE-2014-9380.md): The dissector\_cvs function in dissectors/ec\_cvs.c in Ettercap 0.8.1 allows remote attackers to cause a denial of service (out-of-bounds read (no CVSS)
- [CVE-2014-9381](https://cve.now/CVE-2014-9381.md): Integer signedness error in the dissector\_cvs function in dissectors/ec\_cvs.c in Ettercap 0.8.1 allows remote attackers to cause a denial of (no CVSS)
- [CVE-2014-9403](https://cve.now/CVE-2014-9403.md): The CWebAdminMod::ChanPage function in modules/webadmin.cpp in ZNC before 1.4 allows remote authenticated users to cause a denial of service (no CVSS)
- [CVE-2014-9407](https://cve.now/CVE-2014-9407.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Revive Adserver before 3.0.5 allow remote attackers to hijack the authenticati (no CVSS)
- [CVE-2014-9408](https://cve.now/CVE-2014-9408.md): Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 uses part of th (no CVSS)
- [CVE-2014-7241](https://cve.now/CVE-2014-7241.md): The TSUTAYA application 5.3 and earlier for Android allows remote attackers to execute arbitrary Java methods via a crafted HTML document. (no CVSS)
- [CVE-2014-7249](https://cve.now/CVE-2014-7249.md): Buffer overflow on the Allied Telesis AR440S, AR441S, AR442S, AR745, AR750S, AR750S-DP, AT-8624POE, AT-8624T/2M, AT-8648T/2SP, AT-8748XL, AT (no CVSS)
- [CVE-2014-7267](https://cve.now/CVE-2014-7267.md): Cross-site scripting (XSS) vulnerability in the output-page generator in the Ricksoft WBS Gantt-Chart add-on 7.8.1 and earlier for JIRA allo (no CVSS)
- [CVE-2014-7268](https://cve.now/CVE-2014-7268.md): Cross-site scripting (XSS) vulnerability in the data-export feature in the Ricksoft WBS Gantt-Chart add-on 7.8.1 and earlier for JIRA allows (no CVSS)
- [CVE-2014-8272](https://cve.now/CVE-2014-8272.md): The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57 does not properly se (no CVSS)
- [CVE-2014-4801](https://cve.now/CVE-2014-4801.md): Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager 2.x through 2.0.1.1, 3.x before 3.0.1.6 iFix 4, 4.x before 4.0.7 iF (no CVSS)
- [CVE-2014-6171](https://cve.now/CVE-2014-6171.md): Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0 (no CVSS)
- [CVE-2014-6173](https://cve.now/CVE-2014-6173.md): Cross-site scripting (XSS) vulnerability in the Process Inspector in IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3 and 8.5.x thro (no CVSS)
- [CVE-2014-6193](https://cve.now/CVE-2014-6193.md): IBM WebSphere Portal 8.0.0 through 8.0.0.1 CF14 and 8.5.0 before CF04, when the Managed Pages setting is enabled, allows remote authenticate (no CVSS)
- [CVE-2014-8016](https://cve.now/CVE-2014-8016.md): The Cisco IronPort Email Security Appliance (ESA) allows remote attackers to cause a denial of service (CPU consumption) via long Subject he (no CVSS)
- [CVE-2014-8902](https://cve.now/CVE-2014-8902.md): Cross-site scripting (XSS) vulnerability in the Blog Portlet in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-12-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.