# CVEs published 2014-12-28

13 CVEs were published on December 28, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-2208](https://cve.now/CVE-2014-2208.md): CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine ( (no CVSS)
- [CVE-2014-2209](https://cve.now/CVE-2014-2209.md): Facebook HipHop Virtual Machine (HHVM) before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and hphp/ut (no CVSS)
- [CVE-2014-5386](https://cve.now/CVE-2014-5386.md): The mcrypt\_create\_iv function in hphp/runtime/ext/mcrypt/ext\_mcrypt.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 does not seed (no CVSS)
- [CVE-2014-6228](https://cve.now/CVE-2014-6228.md): Integer overflow in the string\_chunk\_split function in hphp/runtime/base/zend-string.cpp in Facebook HipHop Virtual Machine (HHVM) before 3. (no CVSS)
- [CVE-2014-6229](https://cve.now/CVE-2014-6229.md): The HashContext class in hphp/runtime/ext/ext\_hash.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 incorrectly expects that a cer (no CVSS)
- [CVE-2011-4722](https://cve.now/CVE-2011-4722.md): Directory traversal vulnerability in the TFTP Server 1.0.0.24 in Ipswitch WhatsUp Gold allows remote attackers to read arbitrary files via a (no CVSS)
- [CVE-2012-1302](https://cve.now/CVE-2012-1302.md): Multiple cross-site scripting (XSS) vulnerabilities in amMap 2.6.3 allow remote attackers to inject arbitrary web script or HTML via the (1) (no CVSS)
- [CVE-2012-1303](https://cve.now/CVE-2012-1303.md): Multiple cross-site scripting (XSS) vulnerabilities in amCharts Flash 1 allow remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2012-1415](https://cve.now/CVE-2012-1415.md): Cross-site request forgery (CSRF) vulnerability in lib/logout.php in DFLabs PTK 1.0.5 and earlier allows remote attackers to hijack the auth (no CVSS)
- [CVE-2010-5075](https://cve.now/CVE-2010-5075.md): Integer overflow in aswFW.sys 5.0.594.0 in Avast! Internet Security 5.0 Korean Trial allows local users to cause a denial of service (memory (no CVSS)
- [CVE-2011-4720](https://cve.now/CVE-2011-4720.md): Hillstone HS TFTP Server 1.3.2 allows remote attackers to cause a denial of service (daemon crash) via a long filename in a (1) RRQ or (2) W (no CVSS)
- [CVE-2012-1203](https://cve.now/CVE-2012-1203.md): Cross-site request forgery (CSRF) vulnerability in starnet/index.php in SyndeoCMS 3.0 and earlier allows remote attackers to hijack the auth (no CVSS)
- [CVE-2013-4663](https://cve.now/CVE-2013-4663.md): git\_http\_controller.rb in the redmine\_git\_hosting plugin for Redmine allows remote attackers to execute arbitrary commands via shell metacha (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-12-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.