# CVEs published 2014-12-24 31 CVEs were published on December 24, 2014: 0 critical, 0 high. Days are UTC. - [CVE-2004-2771](https://cve.now/CVE-2004-2771.md): The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary (no CVSS) - [CVE-2014-8137](https://cve.now/CVE-2014-8137.md): Double free vulnerability in the jas\_iccattrval\_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of (no CVSS) - [CVE-2014-8138](https://cve.now/CVE-2014-8138.md): Heap-based buffer overflow in the jp2\_decode function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (cr (no CVSS) - [CVE-2014-8809](https://cve.now/CVE-2014-8809.md): Multiple cross-site scripting (XSS) vulnerabilities in the WP Symposium plugin before 14.11 for WordPress allow remote attackers to inject a (no CVSS) - [CVE-2014-8810](https://cve.now/CVE-2014-8810.md): SQL injection vulnerability in ajax/mail\_functions.php in the WP Symposium plugin before 14.11 for WordPress allows remote authenticated use (no CVSS) - [CVE-2014-9222](https://cve.now/CVE-2014-9222.md): AllegroSoft RomPager 4.34 and earlier, as used in Huawei Home Gateway products and other vendors and products, allows remote attackers to ga (no CVSS) - [CVE-2014-9223](https://cve.now/CVE-2014-9223.md): Multiple buffer overflows in AllegroSoft RomPager, as used in Huawei Home Gateway products and other vendors and products, allow remote atta (no CVSS) - [CVE-2014-9334](https://cve.now/CVE-2014-9334.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Bird Feeder plugin 1.2.3 for WordPress allow remote attackers to hijack th (no CVSS) - [CVE-2014-9413](https://cve.now/CVE-2014-9413.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the IP Ban (simple-ip-ban) plugin 1.2.3 for WordPress allow remote attackers t (no CVSS) - [CVE-2014-9414](https://cve.now/CVE-2014-9414.md): The W3 Total Cache plugin before 0.9.4.1 for WordPress does not properly handle empty nonces, which allows remote attackers to conduct cross (no CVSS) - [CVE-2014-9415](https://cve.now/CVE-2014-9415.md): Huawei eSpace Desktop before V100R001C03 allows local users to cause a denial of service (program exit) via a crafted QES file. (no CVSS) - [CVE-2014-9416](https://cve.now/CVE-2014-9416.md): Multiple untrusted search path vulnerabilities in Huawei eSpace Desktop before V200R003C00 allow local users to execute arbitrary code and c (no CVSS) - [CVE-2014-9417](https://cve.now/CVE-2014-9417.md): The Meeting component in Huawei eSpace Desktop before V100R001C03 allows local users to cause a denial of service (program exit) via a craft (no CVSS) - [CVE-2014-9418](https://cve.now/CVE-2014-9418.md): The eSpace Meeting ActiveX control (eSpaceStatusCtrl.dll) in Huawei eSpace Desktop before V200R001C03 allows local users to cause a denial o (no CVSS) - [CVE-2014-4322](https://cve.now/CVE-2014-4322.md): drivers/misc/qseecom.c in the QSEECOM driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions fo (no CVSS) - [CVE-2014-3569](https://cve.now/CVE-2014-3569.md): The ssl23\_get\_client\_hello function in s23\_srvr.c in OpenSSL 0.9.8zc, 1.0.0o, and 1.0.1j does not properly handle attempts to use unsupporte (no CVSS) - [CVE-2014-6132](https://cve.now/CVE-2014-6132.md): Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3 through 6.3.0.5, 7.0.x th (no CVSS) - [CVE-2014-6153](https://cve.now/CVE-2014-6153.md): The Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3.x through 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x through 7.5.0.4, 8.0. (no CVSS) - [CVE-2014-6155](https://cve.now/CVE-2014-6155.md): Multiple directory traversal vulnerabilities in the ServiceRegistry UI in IBM WebSphere Service Registry and Repository (WSRR) 7.5.x through (no CVSS) - [CVE-2014-6177](https://cve.now/CVE-2014-6177.md): IBM WebSphere Service Registry and Repository (WSRR) 7.0.x before 7.0.0.5 and 7.5.x before 7.5.0.3 does not perform access-control checks fo (no CVSS) - [CVE-2014-6178](https://cve.now/CVE-2014-6178.md): Cross-site scripting (XSS) vulnerability in the widgets in IBM WebSphere Service Registry and Repository (WSRR) 7.5.x before 7.5.0.4 and 8.0 (no CVSS) - [CVE-2014-6179](https://cve.now/CVE-2014-6179.md): Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Service Registry and Repository (WSRR) 7.5.x before 7.5.0.4 and 8.0. (no CVSS) - [CVE-2014-6180](https://cve.now/CVE-2014-6180.md): Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Service Registry and Repository (WSRR) 7.0.x before 7.0.0.5 and 7.5. (no CVSS) - [CVE-2014-6181](https://cve.now/CVE-2014-6181.md): IBM WebSphere Service Registry and Repository (WSRR) 7.0.x before 7.0.0.5 does not perform access-control checks for contained objects, whic (no CVSS) - [CVE-2014-6186](https://cve.now/CVE-2014-6186.md): IBM WebSphere Service Registry and Repository (WSRR) 6.3.x before 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x before 7.5.0.3, and 8.0.x before 8.0 (no CVSS) - [CVE-2014-6187](https://cve.now/CVE-2014-6187.md): Multiple cross-site request forgery (CSRF) vulnerabilities in IBM WebSphere Service Registry and Repository (WSRR) 6.3.x before 6.3.0.5, 7.0 (no CVSS) - [CVE-2014-6188](https://cve.now/CVE-2014-6188.md): Multiple cross-site scripting (XSS) vulnerabilities in IBM WebSphere Service Registry and Repository (WSRR) 6.3.x before 6.3.0.5, 7.0.x thro (no CVSS) - [CVE-2014-7993](https://cve.now/CVE-2014-7993.md): Cisco-Meraki MS, MR, and MX devices with firmware before 2014-09-24 allow remote attackers to obtain sensitive credential information by lev (no CVSS) - [CVE-2014-7994](https://cve.now/CVE-2014-7994.md): Cisco-Meraki MS, MR, and MX devices with firmware before 2014-09-24 allow remote attackers to execute arbitrary commands by leveraging knowl (no CVSS) - [CVE-2014-7995](https://cve.now/CVE-2014-7995.md): Cisco-Meraki MS, MR, and MX devices with firmware before 2014-09-24 allow physically proximate attackers to obtain shell access by opening a (no CVSS) - [CVE-2014-7999](https://cve.now/CVE-2014-7999.md): Cisco-Meraki MS, MR, and MX devices with firmware before 2014-09-24 allow remote authenticated users to install arbitrary firmware by levera (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2014-12-24 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.