# CVEs published 2014-12-25

5 CVEs were published on December 25, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-1449](https://cve.now/CVE-2014-1449.md): The Maxthon Cloud Browser application before 4.1.6.2000 for Android allows remote attackers to spoof the address bar via crafted JavaScript (no CVSS)
- [CVE-2014-2217](https://cve.now/CVE-2014-2217.md): Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX before Q3 2012 SP2 all (no CVSS)
- [CVE-2014-7300](https://cve.now/CVE-2014-7300.md): GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption of all active PrtSc (no CVSS)
- [CVE-2014-3971](https://cve.now/CVE-2014-3971.md): The CmdAuthenticate::\_authenticateX509 function in db/commands/authentication\_commands.cpp in mongod in MongoDB 2.6.x before 2.6.2 allows re (no CVSS)
- [CVE-2014-7193](https://cve.now/CVE-2014-7193.md): The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS enabled, (no CVSS, crumb)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-12-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.