# Vulnerabilities published in 2014


- [CVE-2014-5465](https://insights.sbomify.com/CVE-2014-5465/): Path traversal in werdswords:download shortcode (medium 5.0)
- [CVE-2014-5464](https://insights.sbomify.com/CVE-2014-5464/): Cross-site scripting in ntop:ntopng (medium 4.3)
- [CVE-2014-5462](https://insights.sbomify.com/CVE-2014-5462/): SQL injection in open-emr:openemr (medium 6.5)
- [CVE-2014-5461](https://insights.sbomify.com/CVE-2014-5461/): Memory corruption in canonical:ubuntu linux (medium 5.0)
- [CVE-2014-5460](https://insights.sbomify.com/CVE-2014-5460/): File upload in tribulant:tibulant slideshow gallery (medium 6.5)
- [CVE-2014-5459](https://insights.sbomify.com/CVE-2014-5459/): Race condition in opensuse:evergreen (low 3.6)
- [CVE-2014-5458](https://insights.sbomify.com/CVE-2014-5458/): SQL injection in php-sqrl project:php-sqrl (high 7.5)
- [CVE-2014-5457](https://insights.sbomify.com/CVE-2014-5457/): Misconfiguration in qnap:ss-839 (low 2.1)
- [CVE-2014-5456](https://insights.sbomify.com/CVE-2014-5456/): Cross-site scripting in social stats project:social stats (low 2.1)
- [CVE-2014-5455](https://insights.sbomify.com/CVE-2014-5455/): Privilege escalation in openvpn:openvpn (medium 5.3)
- [CVE-2014-5454](https://insights.sbomify.com/CVE-2014-5454/): File upload in sas:visual analytics (medium 6.0)
- [CVE-2014-5453](https://insights.sbomify.com/CVE-2014-5453/): Misconfiguration in ubi:uplay pc (high 7.2)
- [CVE-2014-5452](https://insights.sbomify.com/CVE-2014-5452/): Cross-site scripting in hl7:c-cda (medium 4.3)
- [CVE-2014-5451](https://insights.sbomify.com/CVE-2014-5451/): Cross-site scripting in modx:modx revolution (medium 4.3)
- [CVE-2014-5450](https://insights.sbomify.com/CVE-2014-5450/): Information disclosure in zarafa:zarafa collaboration platform (medium 5.5)
- [CVE-2014-5449](https://insights.sbomify.com/CVE-2014-5449/): Information disclosure in zarafa:webaccess (low 2.1)
- [CVE-2014-5448](https://insights.sbomify.com/CVE-2014-5448/): Information disclosure in zarafa:zarafa (low 2.1)
- [CVE-2014-5447](https://insights.sbomify.com/CVE-2014-5447/): Misconfiguration in zarafa:webapp (low 2.1)
- [CVE-2014-5446](https://insights.sbomify.com/CVE-2014-5446/): Path traversal in zohocorp:manageengine it360 (medium 5.0)
- [CVE-2014-5445](https://insights.sbomify.com/CVE-2014-5445/): Path traversal in zohocorp:manageengine it360 (medium 5.0)
- [CVE-2014-5444](https://insights.sbomify.com/CVE-2014-5444/): Security feature bypass in yorba:geary (medium 4.3)
- [CVE-2014-5443](https://insights.sbomify.com/CVE-2014-5443/): Privilege escalation in seafile:seafile server (high 7.8)
- [CVE-2014-5441](https://insights.sbomify.com/CVE-2014-5441/): Fat Free CRM subject to Cross-site Scripting (medium 4.3)
- [CVE-2014-5440](https://insights.sbomify.com/CVE-2014-5440/): SQL injection in mpexsolutions:mx-smartimer (high 7.5)
- [CVE-2014-5439](https://insights.sbomify.com/CVE-2014-5439/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2014-5438](https://insights.sbomify.com/CVE-2014-5438/): Cross-site scripting in arris:touchstone tg862g\/ct firmware (low 3.5)
- [CVE-2014-5437](https://insights.sbomify.com/CVE-2014-5437/): Cross-site request forgery in arris:touchstone tg862g\/ct firmware (medium 6.8)
- [CVE-2014-5436](https://insights.sbomify.com/CVE-2014-5436/): Path traversal in Experion PKS (high 7.5)
- [CVE-2014-5435](https://insights.sbomify.com/CVE-2014-5435/): Memory corruption in Experion PKS (critical 9.8)
- [CVE-2014-5434](https://insights.sbomify.com/CVE-2014-5434/): Hardcoded credentials in SIGMA Spectrum Infusion System (critical 9.8)
- [CVE-2014-5433](https://insights.sbomify.com/CVE-2014-5433/): Information disclosure in SIGMA Spectrum Infusion System (critical 9.8)
- [CVE-2014-5432](https://insights.sbomify.com/CVE-2014-5432/): Auth bypass in SIGMA Spectrum Infusion System (critical 9.8)
- [CVE-2014-5431](https://insights.sbomify.com/CVE-2014-5431/): Hardcoded credentials in SIGMA Spectrum Infusion System (medium 6.8)
- [CVE-2014-5430](https://insights.sbomify.com/CVE-2014-5430/): Privilege escalation in abb:robotstudio (medium 6.9)
- [CVE-2014-5429](https://insights.sbomify.com/CVE-2014-5429/): Denial of service in elipse:e3 (medium 5.0)
- [CVE-2014-5428](https://insights.sbomify.com/CVE-2014-5428/): File upload in johnsoncontrols:metsys (critical 10.0)
- [CVE-2014-5427](https://insights.sbomify.com/CVE-2014-5427/): Information disclosure in johnsoncontrols:metsys (medium 5.0)
- [CVE-2014-5426](https://insights.sbomify.com/CVE-2014-5426/): Denial of service in matrikonopc:dnp3 opc server (medium 5.0)
- [CVE-2014-5425](https://insights.sbomify.com/CVE-2014-5425/): Denial of service in ioserver:ioserver (medium 5.0)
- [CVE-2014-5424](https://insights.sbomify.com/CVE-2014-5424/): Memory corruption in rockwellautomation:connected components workbench (high 7.5)
- [CVE-2014-5423](https://insights.sbomify.com/CVE-2014-5423/): Information disclosure in carefusion:pyxis supplystation (low 1.9)
- [CVE-2014-5422](https://insights.sbomify.com/CVE-2014-5422/): Hardcoded credentials in carefusion:pyxis supplystation (critical 9.7)
- [CVE-2014-5421](https://insights.sbomify.com/CVE-2014-5421/): Hardcoded credentials in carefusion:pyxis supplystation (medium 6.8)
- [CVE-2014-5420](https://insights.sbomify.com/CVE-2014-5420/): Hardcoded credentials in carefusion:pyxis supplystation (low 3.5)
- [CVE-2014-5419](https://insights.sbomify.com/CVE-2014-5419/): GE Multilink Use of Hard-coded Cryptographic Key (critical 10.0)
- [CVE-2014-5418](https://insights.sbomify.com/CVE-2014-5418/): GE Multilink Uncontrolled Resource Consumption (medium 5.0)
- [CVE-2014-5417](https://insights.sbomify.com/CVE-2014-5417/): Meinberg Radio Clocks LANTIME M-Series (high 7.5)
- [CVE-2014-5415](https://insights.sbomify.com/CVE-2014-5415/): Beckhoff Embedded PC Images and TwinCAT Components Exposed Dangerous Method or Function (critical 9.1)
- [CVE-2014-5414](https://insights.sbomify.com/CVE-2014-5414/): Beckhoff Embedded PC Images and TwinCAT Components Improper Restriction of Excessive Authentication Attempts (critical 9.1)
- [CVE-2014-5413](https://insights.sbomify.com/CVE-2014-5413/): Schneider Electric SCADA Expert ClearSCADA Cryptographic Issues (medium 6.4)
- [CVE-2014-5412](https://insights.sbomify.com/CVE-2014-5412/): Schneider Electric SCADA Expert ClearSCADA Improper Authentication (medium 6.4)
- [CVE-2014-5411](https://insights.sbomify.com/CVE-2014-5411/): Schneider Electric SCADA Expert ClearSCADA Cross-site Scripting (medium 4.9)
- [CVE-2014-5410](https://insights.sbomify.com/CVE-2014-5410/): Rockwell Automation Micrologix 1400 Improper Input Validation (high 7.1)
- [CVE-2014-5409](https://insights.sbomify.com/CVE-2014-5409/): GE Hydran M2 Predictable Value Range from Previous Values (medium 6.4)
- [CVE-2014-5408](https://insights.sbomify.com/CVE-2014-5408/): Nordex NC2 Cross-site Scripting (high 7.5)
- [CVE-2014-5407](https://insights.sbomify.com/CVE-2014-5407/): Schneider Electric VAMPSET Stack-based Buffer Overflow (medium 4.1)
- [CVE-2014-5406](https://insights.sbomify.com/CVE-2014-5406/): Hospira LifeCare PCA Infusion System (high 7.6)
- [CVE-2014-5405](https://insights.sbomify.com/CVE-2014-5405/): Hospira MedNet Use of Hard-coded Password (critical 9.0)
- [CVE-2014-5403](https://insights.sbomify.com/CVE-2014-5403/): Hospira MedNet Use of Hard-coded Cryptographic Key (medium 6.8)
- [CVE-2014-5401](https://insights.sbomify.com/CVE-2014-5401/): Hospira MedNet Code Injection (critical 10.0)
- [CVE-2014-5400](https://insights.sbomify.com/CVE-2014-5400/): Hospira MedNet Password in Configuration File (medium 6.8)
- [CVE-2014-5399](https://insights.sbomify.com/CVE-2014-5399/): Schneider Electric Wonderware SQL Injection (high 7.5)
- [CVE-2014-5398](https://insights.sbomify.com/CVE-2014-5398/): Schneider Electric Wonderware Input Validation (low 2.1)
- [CVE-2014-5397](https://insights.sbomify.com/CVE-2014-5397/): Schneider Electric Wonderware Cross-site Scripting (high 7.5)
- [CVE-2014-5396](https://insights.sbomify.com/CVE-2014-5396/): Hardcoded credentials in schrack:technik microcontrol (high 7.5)
- [CVE-2014-5395](https://insights.sbomify.com/CVE-2014-5395/): Cross-site request forgery in huawei:e3236 firmware (medium 6.8)
- [CVE-2014-5394](https://insights.sbomify.com/CVE-2014-5394/): Information disclosure in huawei:s2300 firmware (medium 5.9)
- [CVE-2014-5393](https://insights.sbomify.com/CVE-2014-5393/): Path traversal in sos:jobscheduler (medium 4.0)
- [CVE-2014-5392](https://insights.sbomify.com/CVE-2014-5392/): XML external entity in sos:jobscheduler (medium 5.8)
- [CVE-2014-5391](https://insights.sbomify.com/CVE-2014-5391/): Cross-site scripting in sos:jobscheduler (medium 4.3)
- [CVE-2014-5389](https://insights.sbomify.com/CVE-2014-5389/): SQL injection in content audit project:content audit (high 7.5)
- [CVE-2014-5388](https://insights.sbomify.com/CVE-2014-5388/): Memory corruption in canonical:ubuntu linux (medium 4.6)
- [CVE-2014-5387](https://insights.sbomify.com/CVE-2014-5387/): SQL injection in ellislab:expressionengine (medium 6.5)
- [CVE-2014-5386](https://insights.sbomify.com/CVE-2014-5386/): Weak cryptography in facebook:hiphop virtual machine (medium 5.0)
- [CVE-2014-5385](https://insights.sbomify.com/CVE-2014-5385/): Auth bypass in shopizer:shopizer (medium 5.0)
- [CVE-2014-5384](https://insights.sbomify.com/CVE-2014-5384/): Memory corruption in freebsd:freebsd (medium 5.0)
- [CVE-2014-5383](https://insights.sbomify.com/CVE-2014-5383/): SQL injection in alienvault:open source security information management (medium 6.5)
- [CVE-2014-5382](https://insights.sbomify.com/CVE-2014-5382/): Cross-site scripting in schrack:technik microcontrol (medium 4.3)
- [CVE-2014-5381](https://insights.sbomify.com/CVE-2014-5381/): Auth bypass in granding:grand ma300 firmware (critical 9.8)
- [CVE-2014-5380](https://insights.sbomify.com/CVE-2014-5380/): Information disclosure in granding:grand ma300 firmware (high 7.5)
- [CVE-2014-5377](https://insights.sbomify.com/CVE-2014-5377/): Information disclosure in manageengine:device expert (medium 5.0)
- [CVE-2014-5376](https://insights.sbomify.com/CVE-2014-5376/): Auth bypass in adaptivecomputing:moab (medium 4.0)
- [CVE-2014-5375](https://insights.sbomify.com/CVE-2014-5375/): Auth bypass in adaptivecomputing:moab (medium 4.0)
- [CVE-2014-5370](https://insights.sbomify.com/CVE-2014-5370/): Path traversal in new atlanta:bluedragon (high 7.5)
- [CVE-2014-5369](https://insights.sbomify.com/CVE-2014-5369/): Information disclosure in enigmail:enigmail (medium 4.3)
- [CVE-2014-5368](https://insights.sbomify.com/CVE-2014-5368/): Path traversal in wp content source control project:wp content source control (medium 5.0)
- [CVE-2014-5362](https://insights.sbomify.com/CVE-2014-5362/): Code injection in landesk:landesk management suite (high 7.2)
- [CVE-2014-5361](https://insights.sbomify.com/CVE-2014-5361/): Cross-site request forgery in landesk:landesk management suite (medium 6.8)
- [CVE-2014-5360](https://insights.sbomify.com/CVE-2014-5360/): Cross-site scripting in landesk:landesk management suite (medium 4.3)
- [CVE-2014-5359](https://insights.sbomify.com/CVE-2014-5359/): Path traversal in safenet-inc:safenet authentication service outlook web access agent (high 7.8)
- [CVE-2014-5356](https://insights.sbomify.com/CVE-2014-5356/): OpenStack Glance improper validation of the image_size_cap configuration option (medium 4.0)
- [CVE-2014-5355](https://insights.sbomify.com/CVE-2014-5355/): Null dereference in mit:kerberos 5 (medium 5.0)
- [CVE-2014-5354](https://insights.sbomify.com/CVE-2014-5354/): Null dereference in mit:kerberos (low 3.5)
- [CVE-2014-5353](https://insights.sbomify.com/CVE-2014-5353/): Null dereference in canonical:ubuntu linux (low 3.5)
- [CVE-2014-5352](https://insights.sbomify.com/CVE-2014-5352/): Use after free in mit:kerberos 5 (critical 9.0)
- [CVE-2014-5351](https://insights.sbomify.com/CVE-2014-5351/): Information disclosure in mit:kerberos 5 (low 2.1)
- [CVE-2014-5350](https://insights.sbomify.com/CVE-2014-5350/): Path traversal in bitdefender:gravityzone (medium 5.0)
- [CVE-2014-5349](https://insights.sbomify.com/CVE-2014-5349/): Memory corruption in baidu:spark browser (medium 5.0)
- [CVE-2014-5348](https://insights.sbomify.com/CVE-2014-5348/): Cross-site scripting in riverbed:steelapp traffic manager (medium 4.3)
- [CVE-2014-5347](https://insights.sbomify.com/CVE-2014-5347/): Cross-site request forgery in disqus:disqus comment system (medium 6.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2014/page/38/