# Vulnerabilities published in 2014


- [CVE-2014-5088](https://insights.sbomify.com/CVE-2014-5088/): Cross-site scripting in status2k:status2k (medium 4.3)
- [CVE-2014-5087](https://insights.sbomify.com/CVE-2014-5087/): Code injection in sphider-plus:sphider-plus (critical 9.8)
- [CVE-2014-5086](https://insights.sbomify.com/CVE-2014-5086/): Code injection in sphider-plus:sphider-plus (high 8.8)
- [CVE-2014-5085](https://insights.sbomify.com/CVE-2014-5085/): Code injection in sphider-plus:sphider-plus (high 8.8)
- [CVE-2014-5084](https://insights.sbomify.com/CVE-2014-5084/): Code injection in sphiderpro:sphider pro (high 8.8)
- [CVE-2014-5083](https://insights.sbomify.com/CVE-2014-5083/): Code injection in sphider:sphider (high 8.8)
- [CVE-2014-5082](https://insights.sbomify.com/CVE-2014-5082/): SQL injection in sphider:sphider (high 7.5)
- [CVE-2014-5081](https://insights.sbomify.com/CVE-2014-5081/): Auth bypass in sphider-plus:sphider-plus (critical 9.8)
- [CVE-2014-5077](https://insights.sbomify.com/CVE-2014-5077/): Null dereference in canonical:ubuntu linux (high 7.1)
- [CVE-2014-5076](https://insights.sbomify.com/CVE-2014-5076/): Information disclosure in labanquepostale:labanquepostale (medium 4.3)
- [CVE-2014-5075](https://insights.sbomify.com/CVE-2014-5075/): Security feature bypass in igniterealtime:smack api (medium 6.8)
- [CVE-2014-5074](https://insights.sbomify.com/CVE-2014-5074/): Denial of service in siemens:simatic s7-1500 cpu firmware (high 7.1)
- [CVE-2014-5073](https://insights.sbomify.com/CVE-2014-5073/): Command injection in vmturbo:operations manager (high 7.5)
- [CVE-2014-5072](https://insights.sbomify.com/CVE-2014-5072/): Cross-site request forgery in wpsecurityauditlog:wp security audit log (high 8.8)
- [CVE-2014-5071](https://insights.sbomify.com/CVE-2014-5071/): SQL injection in microsemi:s350i firmware (critical 9.8)
- [CVE-2014-5070](https://insights.sbomify.com/CVE-2014-5070/): Privilege escalation in microsemi:s350i firmware (high 8.8)
- [CVE-2014-5069](https://insights.sbomify.com/CVE-2014-5069/): Cross-site scripting in microsemi:s350i firmware (medium 6.1)
- [CVE-2014-5068](https://insights.sbomify.com/CVE-2014-5068/): Path traversal in microsemi:s350i firmware (high 7.5)
- [CVE-2014-5045](https://insights.sbomify.com/CVE-2014-5045/): Use after free in linux:linux kernel (medium 6.2)
- [CVE-2014-5044](https://insights.sbomify.com/CVE-2014-5044/): Integer overflow in gnu:libgfortran (critical 9.8)
- [CVE-2014-5040](https://insights.sbomify.com/CVE-2014-5040/): Missing authorization in eucalyptus:eucalyptus (medium 6.8)
- [CVE-2014-5039](https://insights.sbomify.com/CVE-2014-5039/): Cross-site scripting in eucalyptus:eucalyptus management console (critical 9.6)
- [CVE-2014-5038](https://insights.sbomify.com/CVE-2014-5038/): Information disclosure in eucalyptus:eucalyptus (low 2.1)
- [CVE-2014-5037](https://insights.sbomify.com/CVE-2014-5037/): Information disclosure in eucalyptus:eucalyptus (low 2.1)
- [CVE-2014-5036](https://insights.sbomify.com/CVE-2014-5036/): Information disclosure in eucalyptus:eucalyptus (low 1.9)
- [CVE-2014-5035](https://insights.sbomify.com/CVE-2014-5035/): XML external entity in opendaylight:opendaylight (medium 6.8)
- [CVE-2014-5034](https://insights.sbomify.com/CVE-2014-5034/): Cross-site request forgery in fresh-media:brute force login protection (high 8.8)
- [CVE-2014-5033](https://insights.sbomify.com/CVE-2014-5033/): Race condition in canonical:ubuntu linux (medium 6.9)
- [CVE-2014-5032](https://insights.sbomify.com/CVE-2014-5032/): Missing authorization in glpi-project:glpi (medium 5.0)
- [CVE-2014-5031](https://insights.sbomify.com/CVE-2014-5031/): Information disclosure in apple:cups (medium 5.0)
- [CVE-2014-5030](https://insights.sbomify.com/CVE-2014-5030/): Path traversal in apple:cups (low 1.9)
- [CVE-2014-5029](https://insights.sbomify.com/CVE-2014-5029/): Path traversal in apple:cups (low 1.5)
- [CVE-2014-5028](https://insights.sbomify.com/CVE-2014-5028/): Missing authorization in reviewboard:review board (medium 6.5)
- [CVE-2014-5027](https://insights.sbomify.com/CVE-2014-5027/): Cross-site scripting in reviewboard:review board (medium 4.3)
- [CVE-2014-5026](https://insights.sbomify.com/CVE-2014-5026/): Cross-site scripting in cacti:cacti (low 3.5)
- [CVE-2014-5025](https://insights.sbomify.com/CVE-2014-5025/): Cross-site scripting in cacti:cacti (low 3.5)
- [CVE-2014-5024](https://insights.sbomify.com/CVE-2014-5024/): Cross-site scripting in sonicwall:analyzer (medium 4.3)
- [CVE-2014-5023](https://insights.sbomify.com/CVE-2014-5023/): Command injection in gitlist:gitlist (medium 6.8)
- [CVE-2014-5022](https://insights.sbomify.com/CVE-2014-5022/): Cross-site scripting in drupal:drupal (medium 4.3)
- [CVE-2014-5021](https://insights.sbomify.com/CVE-2014-5021/): Cross-site scripting in drupal:drupal (low 2.1)
- [CVE-2014-5020](https://insights.sbomify.com/CVE-2014-5020/): Missing authorization in drupal:drupal (medium 4.9)
- [CVE-2014-5019](https://insights.sbomify.com/CVE-2014-5019/): Denial of service in drupal:drupal (medium 5.0)
- [CVE-2014-5018](https://insights.sbomify.com/CVE-2014-5018/): Cross-site scripting in limesurvey:limesurvey (medium 4.3)
- [CVE-2014-5017](https://insights.sbomify.com/CVE-2014-5017/): SQL injection in limesurvey:limesurvey (high 7.5)
- [CVE-2014-5016](https://insights.sbomify.com/CVE-2014-5016/): Cross-site scripting in limesurvey:limesurvey (medium 4.3)
- [CVE-2014-5015](https://insights.sbomify.com/CVE-2014-5015/): Auth bypass in eterna:bozohttpd (medium 5.0)
- [CVE-2014-5014](https://insights.sbomify.com/CVE-2014-5014/): Command injection in tinywebgallery:wordpress flash uploader (critical 9.8)
- [CVE-2014-5013](https://insights.sbomify.com/CVE-2014-5013/): DOMPDF Remote Code Execution (high 8.8)
- [CVE-2014-5012](https://insights.sbomify.com/CVE-2014-5012/): DOMPDF denial of service vulnerability (medium 6.5)
- [CVE-2014-5011](https://insights.sbomify.com/CVE-2014-5011/): DOMPDF Information Disclosure (medium 6.5)
- [CVE-2014-5009](https://insights.sbomify.com/CVE-2014-5009/): Command injection in nagios:nagios (critical 9.8)
- [CVE-2014-5008](https://insights.sbomify.com/CVE-2014-5008/): Command injection in debian:debian linux (critical 9.8)
- [CVE-2014-5007](https://insights.sbomify.com/CVE-2014-5007/): Path traversal in zohocorp:manageengine desktop central (critical 9.8)
- [CVE-2014-5006](https://insights.sbomify.com/CVE-2014-5006/): Path traversal in zohocorp:manageengine desktop central (high 7.5)
- [CVE-2014-5005](https://insights.sbomify.com/CVE-2014-5005/): Path traversal in zohocorp:manageengine desktop central (high 7.5)
- [CVE-2014-5004](https://insights.sbomify.com/CVE-2014-5004/): brbackup exposes database password to unauthorized users (high 7.8)
- [CVE-2014-5003](https://insights.sbomify.com/CVE-2014-5003/): Ciborg gem for Ruby allows local users to write files and gain privileges via Symlink (medium 5.5)
- [CVE-2014-5002](https://insights.sbomify.com/CVE-2014-5002/): lynx doesn't properly sanitize user input and exposes database password to unauthorized users (high 7.8)
- [CVE-2014-5001](https://insights.sbomify.com/CVE-2014-5001/): Kcapifony gem for Ruby places database user passwords on the command line (high 7.8)
- [CVE-2014-5000](https://insights.sbomify.com/CVE-2014-5000/): lawn-login exposes database password to unauthorized users (high 7.8)
- [CVE-2014-4999](https://insights.sbomify.com/CVE-2014-4999/): kajam allows local users to obtain sensitive information by listing the process (high 7.8)
- [CVE-2014-4998](https://insights.sbomify.com/CVE-2014-4998/): lean-ruport allows local users to obtain sensitive information by listing the process (high 7.8)
- [CVE-2014-4997](https://insights.sbomify.com/CVE-2014-4997/): point-cli allows local users to obtain sensitive information by listing the process (high 7.8)
- [CVE-2014-4996](https://insights.sbomify.com/CVE-2014-4996/): VladTheEnterprising allows local users to write to arbitrary files via a symlink attack (medium 5.5)
- [CVE-2014-4995](https://insights.sbomify.com/CVE-2014-4995/): VladTheEnterprising allows local users to obtain sensitive information by reading MySQL root password from temporary file (high 7.0)
- [CVE-2014-4994](https://insights.sbomify.com/CVE-2014-4994/): Gyazo allows local users to write arbitrary files (medium 5.5)
- [CVE-2014-4993](https://insights.sbomify.com/CVE-2014-4993/): backup-agoddard and backup_checksum have Information Exposure vulnerability (high 7.8)
- [CVE-2014-4992](https://insights.sbomify.com/CVE-2014-4992/): Cap-Strap gem for Ruby places credentials on the useradd command line (high 7.8)
- [CVE-2014-4991](https://insights.sbomify.com/CVE-2014-4991/): codders-dataset Process Table Local Plaintext Credential Disclosure (high 7.8)
- [CVE-2014-4987](https://insights.sbomify.com/CVE-2014-4987/): Missing authorization in opensuse:opensuse (medium 4.0)
- [CVE-2014-4986](https://insights.sbomify.com/CVE-2014-4986/): phpMyAdmin cross-site scripting Vulnerability in Table or Column Names (low 3.5)
- [CVE-2014-4984](https://insights.sbomify.com/CVE-2014-4984/): SQL injection in dejavuprotech:crescendo - sales crm (critical 9.8)
- [CVE-2014-4982](https://insights.sbomify.com/CVE-2014-4982/): Command injection in xorux:lpar2rrd (critical 9.8)
- [CVE-2014-4981](https://insights.sbomify.com/CVE-2014-4981/): Command injection in xorux:lpar2rrd (critical 9.8)
- [CVE-2014-4980](https://insights.sbomify.com/CVE-2014-4980/): Information disclosure in tenable:nessus (medium 5.0)
- [CVE-2014-4979](https://insights.sbomify.com/CVE-2014-4979/): Memory corruption in apple:quicktime (critical 9.3)
- [CVE-2014-4978](https://insights.sbomify.com/CVE-2014-4978/): Other in fedoraproject:fedora (medium 5.5)
- [CVE-2014-4977](https://insights.sbomify.com/CVE-2014-4977/): SQL injection in sonicwall:scrutinizer (medium 6.5)
- [CVE-2014-4976](https://insights.sbomify.com/CVE-2014-4976/): Missing authorization in sonicwall:scrutinizer (medium 5.5)
- [CVE-2014-4975](https://insights.sbomify.com/CVE-2014-4975/): Memory corruption in canonical:ubuntu linux (medium 5.0)
- [CVE-2014-4974](https://insights.sbomify.com/CVE-2014-4974/): Information disclosure in eset:personal firewall ndis filter (low 2.1)
- [CVE-2014-4973](https://insights.sbomify.com/CVE-2014-4973/): Privilege escalation in eset:endpoint security (medium 6.9)
- [CVE-2014-4972](https://insights.sbomify.com/CVE-2014-4972/): File upload in ajax upload for gravity forms project:ajax upload for gravity forms (critical 9.8)
- [CVE-2014-4971](https://insights.sbomify.com/CVE-2014-4971/): Memory corruption in microsoft:windows xp (high 7.2)
- [CVE-2014-4968](https://insights.sbomify.com/CVE-2014-4968/): Code injection in boatmob:boat browser (high 8.8)
- [CVE-2014-4967](https://insights.sbomify.com/CVE-2014-4967/): Ansible Arbitrary Code Execution (critical 9.8)
- [CVE-2014-4966](https://insights.sbomify.com/CVE-2014-4966/): Ansible Arbitrary Code Execution (critical 9.8)
- [CVE-2014-4965](https://insights.sbomify.com/CVE-2014-4965/): Cross-site scripting in shopizer:shopizer (medium 4.3)
- [CVE-2014-4964](https://insights.sbomify.com/CVE-2014-4964/): Cross-site request forgery in shopizer:shopizer (medium 6.8)
- [CVE-2014-4963](https://insights.sbomify.com/CVE-2014-4963/): Missing authorization in shopizer:shopizer (medium 6.8)
- [CVE-2014-4962](https://insights.sbomify.com/CVE-2014-4962/): Business logic in shopizer:shopizer (medium 6.4)
- [CVE-2014-4960](https://insights.sbomify.com/CVE-2014-4960/): SQL injection in joomlaboat:com youtubegallery (high 7.5)
- [CVE-2014-4959](https://insights.sbomify.com/CVE-2014-4959/): SQL injection in google:android (critical 9.8)
- [CVE-2014-4958](https://insights.sbomify.com/CVE-2014-4958/): Cross-site scripting in telerik:asp.net ajax radeditor control (medium 4.3)
- [CVE-2014-4955](https://insights.sbomify.com/CVE-2014-4955/): Cross-site scripting in phpmyadmin:phpmyadmin (low 3.5)
- [CVE-2014-4954](https://insights.sbomify.com/CVE-2014-4954/): Cross-site scripting in phpmyadmin:phpmyadmin (low 3.5)
- [CVE-2014-4948](https://insights.sbomify.com/CVE-2014-4948/): Other in citrix:xenserver (medium 6.4)
- [CVE-2014-4947](https://insights.sbomify.com/CVE-2014-4947/): Memory corruption in citrix:xenserver (critical 10.0)
- [CVE-2014-4946](https://insights.sbomify.com/CVE-2014-4946/): Cross-site scripting in horde:groupware (medium 4.3)
- [CVE-2014-4945](https://insights.sbomify.com/CVE-2014-4945/): Cross-site scripting in horde:groupware (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2014/page/41/