# CVEs published 2014-12-31

27 CVEs were published on December 31, 2014: 0 critical, 1 high. Days are UTC.

- [CVE-2011-5283](https://cve.now/CVE-2011-5283.md): Cross-site scripting (XSS) vulnerability in the web management interface in httpd/cgi-bin/ipinfo.cgi in Smoothwall Express 3.1 and 3.0 SP3 a (no CVSS)
- [CVE-2011-5284](https://cve.now/CVE-2011-5284.md): Cross-site request forgery (CSRF) vulnerability in the web management interface in httpd/cgi-bin/shutdown.cgi in Smoothwall Express 3.1 and (no CVSS)
- [CVE-2014-8144](https://cve.now/CVE-2014-8144.md): Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of unspecifi (no CVSS, doorkeeper)
- [CVE-2014-8145](https://cve.now/CVE-2014-8145.md): Multiple heap-based buffer overflows in Sound eXchange (SoX) 14.4.1 and earlier allow remote attackers to have unspecified impact via a craf (no CVSS)
- [CVE-2014-9119](https://cve.now/CVE-2014-9119.md): Directory traversal vulnerability in download.php in the DB Backup plugin 4.5 and earlier for Wordpress allows remote attackers to read arbi (no CVSS)
- [CVE-2014-9429](https://cve.now/CVE-2014-9429.md): Multiple cross-site scripting (XSS) vulnerabilities in Smoothwall Express 3.1 and 3.0 SP3 allow remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2014-9430](https://cve.now/CVE-2014-9430.md): Cross-site scripting (XSS) vulnerability in httpd/cgi-bin/vpn.cgi/vpnconfig.dat in Smoothwall Express 3.0 SP3 allows remote attackers to inj (no CVSS)
- [CVE-2014-9431](https://cve.now/CVE-2014-9431.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Smoothwall Express 3.1 and 3.0 SP3 allow remote attackers to hijack the authen (no CVSS)
- [CVE-2014-9432](https://cve.now/CVE-2014-9432.md): Multiple cross-site scripting (XSS) vulnerabilities in templates/2k11/admin/overview.inc.tpl in Serendipity before 2.0-rc2 allow remote atta (no CVSS)
- [CVE-2014-9433](https://cve.now/CVE-2014-9433.md): Multiple cross-site scripting (XSS) vulnerabilities in cms/front\_content.php in Contenido before 4.9.6, when advanced mod rewrite (AMR) is d (no CVSS)
- [CVE-2014-8752](https://cve.now/CVE-2014-8752.md): Multiple cross-site scripting (XSS) vulnerabilities in view.php in JCE-Tech PHP Video Script (aka Video Niche Script) 4.0 allow remote attac (no CVSS)
- [CVE-2014-9254](https://cve.now/CVE-2014-9254.md): bb\_func\_unsub.php in MiniBB 3.1 before 20141127 uses an incorrect regular expression, which allows remote attackers to conduct SQl injection (no CVSS)
- [CVE-2014-9325](https://cve.now/CVE-2014-9325.md): Multiple cross-site scripting (XSS) vulnerabilities in TWiki 6.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) (no CVSS)
- [CVE-2014-9367](https://cve.now/CVE-2014-9367.md): Incomplete blacklist vulnerability in the urlEncode function in lib/TWiki.pm in TWiki 6.0.0 and 6.0.1 allows remote attackers to conduct cro (no CVSS)
- [CVE-2014-9391](https://cve.now/CVE-2014-9391.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the gSlideShow plugin 0.1 and earlier for WordPress allow remote attackers to (no CVSS)
- [CVE-2014-9392](https://cve.now/CVE-2014-9392.md): Cross-site request forgery (CSRF) vulnerability in the PictoBrowser (pictobrowser-gallery) plugin 0.3.1 and earlier for WordPress allows rem (no CVSS)
- [CVE-2014-9393](https://cve.now/CVE-2014-9393.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Post to Twitter plugin 0.7 and earlier for WordPress allow remote attacker (no CVSS)
- [CVE-2014-9394](https://cve.now/CVE-2014-9394.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the PWGRandom plugin 1.11 and earlier for WordPress allow remote attackers to (no CVSS)
- [CVE-2014-9395](https://cve.now/CVE-2014-9395.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Simplelife plugin 1.2 and earlier for WordPress allow remote attackers to (no CVSS)
- [CVE-2014-9396](https://cve.now/CVE-2014-9396.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the SimpleFlickr plugin 3.0.3 and earlier for WordPress allow remote attackers (no CVSS)
- [CVE-2014-9397](https://cve.now/CVE-2014-9397.md): Cross-site request forgery (CSRF) vulnerability in the twimp-wp plugin for WordPress allows remote attackers to hijack the authentication of (no CVSS)
- [CVE-2014-9398](https://cve.now/CVE-2014-9398.md): Cross-site request forgery (CSRF) vulnerability in the Twitter LiveBlog plugin 1.1.2 and earlier for WordPress allows remote attackers to hi (no CVSS)
- [CVE-2014-9399](https://cve.now/CVE-2014-9399.md): Cross-site request forgery (CSRF) vulnerability in the TweetScribe plugin 1.1 and earlier for WordPress allows remote attackers to hijack th (no CVSS)
- [CVE-2014-9400](https://cve.now/CVE-2014-9400.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Wp Unique Article Header Image plugin 1.0 and earlier for WordPress allow (no CVSS)
- [CVE-2014-9401](https://cve.now/CVE-2014-9401.md): Cross-site request forgery (CSRF) vulnerability in the WP Limit Posts Automatically plugin 0.7 and earlier for WordPress allows remote attac (no CVSS)
- [CVE-2014-9425](https://cve.now/CVE-2014-9425.md): Double free vulnerability in the zend\_ts\_hash\_graceful\_destroy function in zend\_ts\_hash.c in the Zend Engine in PHP through 5.5.20 and 5.6.x (no CVSS)
- [CVE-2014-9426](https://cve.now/CVE-2014-9426.md): The apprentice\_load function in libmagic/apprentice.c in the Fileinfo component in PHP through 5.6.4 attempts to perform a free operation on (CVSS 7.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-12-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.