# Vulnerabilities published in 2014


- [CVE-2014-4000](https://insights.sbomify.com/CVE-2014-4000/): Deserialization in cacti:cacti (high 8.8)
- [CVE-2014-3999](https://insights.sbomify.com/CVE-2014-3999/): Auth bypass in horde:horde ldap (high 8.1)
- [CVE-2014-3997](https://insights.sbomify.com/CVE-2014-3997/): SQL injection in zohocorp:manageengine it360 (high 7.5)
- [CVE-2014-3996](https://insights.sbomify.com/CVE-2014-3996/): SQL injection in manageengine:desktop central (high 7.5)
- [CVE-2014-3995](https://insights.sbomify.com/CVE-2014-3995/): Djblets Cross-site scripting Vulnerability (medium 4.3)
- [CVE-2014-3994](https://insights.sbomify.com/CVE-2014-3994/): Djiblets Cross-site scripting Vulnerability via JSON Objects (medium 4.3)
- [CVE-2014-3992](https://insights.sbomify.com/CVE-2014-3992/): SQL injection in dolibarr:dolibarr erp\/crm (medium 6.5)
- [CVE-2014-3991](https://insights.sbomify.com/CVE-2014-3991/): Cross-site scripting in dolibarr:dolibarr erp\/crm (medium 4.3)
- [CVE-2014-3990](https://insights.sbomify.com/CVE-2014-3990/): Deserialization in opencart:opencart (critical 9.8)
- [CVE-2014-3988](https://insights.sbomify.com/CVE-2014-3988/): Cross-site scripting in sunhater:kcfinder (medium 4.3)
- [CVE-2014-3986](https://insights.sbomify.com/CVE-2014-3986/): Race condition in cisofy:lynis (low 3.3)
- [CVE-2014-3985](https://insights.sbomify.com/CVE-2014-3985/): Memory corruption in miniupnp project:miniupnp (medium 5.0)
- [CVE-2014-3984](https://insights.sbomify.com/CVE-2014-3984/): Other in libav:libav (critical 10.0)
- [CVE-2014-3982](https://insights.sbomify.com/CVE-2014-3982/): Race condition in cisofy:lynis (low 3.3)
- [CVE-2014-3981](https://insights.sbomify.com/CVE-2014-3981/): Race condition in php:php (low 3.3)
- [CVE-2014-3980](https://insights.sbomify.com/CVE-2014-3980/): Privilege escalation in daiki ueno:libfep (medium 4.6)
- [CVE-2014-3979](https://insights.sbomify.com/CVE-2014-3979/): Denial of service in bytemark:symbiosis (high 7.5)
- [CVE-2014-3978](https://insights.sbomify.com/CVE-2014-3978/): SQL injection in tomatocart:tomatocart (medium 6.5)
- [CVE-2014-3977](https://insights.sbomify.com/CVE-2014-3977/): Race condition in ibm:aix (medium 6.9)
- [CVE-2014-3976](https://insights.sbomify.com/CVE-2014-3976/): Memory corruption in a10networks:advanced core operating system (medium 5.0)
- [CVE-2014-3975](https://insights.sbomify.com/CVE-2014-3975/): Path traversal in auracms:auracms (medium 5.0)
- [CVE-2014-3974](https://insights.sbomify.com/CVE-2014-3974/): Cross-site scripting in auracms:auracms (medium 4.3)
- [CVE-2014-3973](https://insights.sbomify.com/CVE-2014-3973/): SQL injection in frontaccounting:frontaccounting (high 7.5)
- [CVE-2014-3972](https://insights.sbomify.com/CVE-2014-3972/): Path traversal in apexis:apm-j601-ws firmware (medium 5.3)
- [CVE-2014-3971](https://insights.sbomify.com/CVE-2014-3971/): Denial of service in mongodb:mongodb (medium 5.0)
- [CVE-2014-3970](https://insights.sbomify.com/CVE-2014-3970/): Denial of service in pulseaudio:pulseaudio (low 2.9)
- [CVE-2014-3969](https://insights.sbomify.com/CVE-2014-3969/): Privilege escalation in xen:xen (high 7.4)
- [CVE-2014-3968](https://insights.sbomify.com/CVE-2014-3968/): Denial of service in opensuse:opensuse (medium 5.5)
- [CVE-2014-3967](https://insights.sbomify.com/CVE-2014-3967/): Null dereference in opensuse:opensuse (medium 5.5)
- [CVE-2014-3966](https://insights.sbomify.com/CVE-2014-3966/): Cross-site scripting in mediawiki:mediawiki (low 2.6)
- [CVE-2014-3963](https://insights.sbomify.com/CVE-2014-3963/): Missing authorization in owncloud:owncloud (medium 4.0)
- [CVE-2014-3962](https://insights.sbomify.com/CVE-2014-3962/): SQL injection in videos tube project:videos tube (high 7.5)
- [CVE-2014-3961](https://insights.sbomify.com/CVE-2014-3961/): SQL injection in xnau:participants database (high 7.5)
- [CVE-2014-3960](https://insights.sbomify.com/CVE-2014-3960/): Cross-site scripting in opennms:opennms (medium 4.3)
- [CVE-2014-3959](https://insights.sbomify.com/CVE-2014-3959/): Cross-site scripting in f5:big-ip access policy manager (medium 4.3)
- [CVE-2014-3956](https://insights.sbomify.com/CVE-2014-3956/): Security feature bypass in fedoraproject:fedora (low 1.9)
- [CVE-2014-3955](https://insights.sbomify.com/CVE-2014-3955/): Denial of service in freebsd:freebsd (medium 5.0)
- [CVE-2014-3954](https://insights.sbomify.com/CVE-2014-3954/): Memory corruption in freebsd:freebsd (critical 10.0)
- [CVE-2014-3953](https://insights.sbomify.com/CVE-2014-3953/): Information disclosure in freebsd:freebsd (medium 4.9)
- [CVE-2014-3952](https://insights.sbomify.com/CVE-2014-3952/): Information disclosure in freebsd:freebsd (medium 4.9)
- [CVE-2014-3951](https://insights.sbomify.com/CVE-2014-3951/): Null dereference in freebsd:freebsd (medium 5.0)
- [CVE-2014-3949](https://insights.sbomify.com/CVE-2014-3949/): Cross-site scripting in jo hasenau:gridelements (low 3.5)
- [CVE-2014-3948](https://insights.sbomify.com/CVE-2014-3948/): Cross-site scripting in alex kellner:powermail (medium 4.3)
- [CVE-2014-3947](https://insights.sbomify.com/CVE-2014-3947/): TYPO3 powermail extension has unrestricted file upload vulnerability (high 7.5)
- [CVE-2014-3946](https://insights.sbomify.com/CVE-2014-3946/): Typo3 Information Disclosure (medium 4.0)
- [CVE-2014-3945](https://insights.sbomify.com/CVE-2014-3945/): TYPO3 vulnerable to authentication bypass via leveraging knowledge of password hash (medium 4.0)
- [CVE-2014-3944](https://insights.sbomify.com/CVE-2014-3944/): TYPO3 Improper Session Invalidation (medium 5.8)
- [CVE-2014-3943](https://insights.sbomify.com/CVE-2014-3943/): Typo3 XSS Vulnerabilities (low 3.5)
- [CVE-2014-3942](https://insights.sbomify.com/CVE-2014-3942/): TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP code (medium 6.0)
- [CVE-2014-3941](https://insights.sbomify.com/CVE-2014-3941/): Typo3 Host Header Spoofing Vulnerability (medium 5.0)
- [CVE-2014-3940](https://insights.sbomify.com/CVE-2014-3940/): Race condition in linux:linux kernel (medium 4.0)
- [CVE-2014-3939](https://insights.sbomify.com/CVE-2014-3939/): Memory corruption in autodesk:sketchbook pro (critical 9.3)
- [CVE-2014-3938](https://insights.sbomify.com/CVE-2014-3938/): Integer overflow in autodesk:sketchbook pro (critical 9.3)
- [CVE-2014-3937](https://insights.sbomify.com/CVE-2014-3937/): SQL injection in ajaydsouza:contextual related posts (high 7.5)
- [CVE-2014-3936](https://insights.sbomify.com/CVE-2014-3936/): Memory corruption in dlink:dir-505l shareport mobile companion (critical 10.0)
- [CVE-2014-3935](https://insights.sbomify.com/CVE-2014-3935/): SQL injection in xoops:glossaire module (high 7.5)
- [CVE-2014-3934](https://insights.sbomify.com/CVE-2014-3934/): SQL injection in phpnuke:php-nuke (high 7.5)
- [CVE-2014-3933](https://insights.sbomify.com/CVE-2014-3933/): Cross-site scripting in newsignature:addressfield tokens (low 3.5)
- [CVE-2014-3932](https://insights.sbomify.com/CVE-2014-3932/): SQL injection in cososys:endpoint protector (high 7.5)
- [CVE-2014-3931](https://insights.sbomify.com/CVE-2014-3931/): Multi-Router Looking Glass (MRLG) Buffer Overflow (critical 9.8, exploited in the wild)
- [CVE-2014-3930](https://insights.sbomify.com/CVE-2014-3930/): Information disclosure in lg project:lg (high 7.5)
- [CVE-2014-3929](https://insights.sbomify.com/CVE-2014-3929/): Information disclosure in lg project:lg (high 7.5)
- [CVE-2014-3928](https://insights.sbomify.com/CVE-2014-3928/): Information disclosure in lg project:lg (critical 9.8)
- [CVE-2014-3927](https://insights.sbomify.com/CVE-2014-3927/): Code injection in mrlg4php project:mrlg4php (critical 9.8)
- [CVE-2014-3926](https://insights.sbomify.com/CVE-2014-3926/): Cross-site scripting in lg project:lg (medium 6.1)
- [CVE-2014-3925](https://insights.sbomify.com/CVE-2014-3925/): Information disclosure in canonical:ubuntu linux (medium 5.0)
- [CVE-2014-3924](https://insights.sbomify.com/CVE-2014-3924/): Cross-site scripting in webmin:userwin (medium 4.3)
- [CVE-2014-3923](https://insights.sbomify.com/CVE-2014-3923/): Cross-site scripting in digitalzoomstudio:video gallery (medium 4.3)
- [CVE-2014-3922](https://insights.sbomify.com/CVE-2014-3922/): Cross-site scripting in trendmicro:interscan messaging security virtual appliance (medium 4.3)
- [CVE-2014-3921](https://insights.sbomify.com/CVE-2014-3921/): Cross-site scripting in simple popup project:simple popup (medium 4.3)
- [CVE-2014-3920](https://insights.sbomify.com/CVE-2014-3920/): Cross-site request forgery in kanboard:kanboard (medium 6.8)
- [CVE-2014-3919](https://insights.sbomify.com/CVE-2014-3919/): Cross-site scripting in netgear:cg3100 firmware (critical 9.3)
- [CVE-2014-3917](https://insights.sbomify.com/CVE-2014-3917/): Information disclosure in linux:linux kernel (low 3.3)
- [CVE-2014-3916](https://insights.sbomify.com/CVE-2014-3916/): Denial of service in rubyonrails:rails (medium 5.0)
- [CVE-2014-3915](https://insights.sbomify.com/CVE-2014-3915/): Command injection in rocketsoftware:rocket servergraph (critical 10.0)
- [CVE-2014-3914](https://insights.sbomify.com/CVE-2014-3914/): Path traversal in rocketsoftware:rocket servergraph (critical 10.0)
- [CVE-2014-3913](https://insights.sbomify.com/CVE-2014-3913/): Memory corruption in ericom:accessnow server (critical 10.0)
- [CVE-2014-3912](https://insights.sbomify.com/CVE-2014-3912/): Memory corruption in samsung:ipolis device manager (critical 9.3)
- [CVE-2014-3911](https://insights.sbomify.com/CVE-2014-3911/): Code injection in samsung:ipolis device manager (critical 9.3)
- [CVE-2014-3910](https://insights.sbomify.com/CVE-2014-3910/): Code injection in emurasoft:emftp (medium 4.4)
- [CVE-2014-3909](https://insights.sbomify.com/CVE-2014-3909/): Auth bypass in falconsc:wisepoint (medium 6.8)
- [CVE-2014-3908](https://insights.sbomify.com/CVE-2014-3908/): Weak cryptography in amazon:kindle (medium 5.8)
- [CVE-2014-3907](https://insights.sbomify.com/CVE-2014-3907/): Cross-site request forgery in mailpoet:mailpoet newsletters (medium 6.8)
- [CVE-2014-3906](https://insights.sbomify.com/CVE-2014-3906/): SQL injection in kk-osk:advance-flow (high 7.5)
- [CVE-2014-3905](https://insights.sbomify.com/CVE-2014-3905/): Cross-site scripting in tenfourzero:shutter (medium 4.3)
- [CVE-2014-3904](https://insights.sbomify.com/CVE-2014-3904/): SQL injection in tenfourzero:shutter (high 7.5)
- [CVE-2014-3903](https://insights.sbomify.com/CVE-2014-3903/): Cross-site scripting in jayj:cakifo (low 3.5)
- [CVE-2014-3902](https://insights.sbomify.com/CVE-2014-3902/): Weak cryptography in cyberagent:ameba (medium 5.8)
- [CVE-2014-3901](https://insights.sbomify.com/CVE-2014-3901/): Denial of service in raritan:dominion kx ii-101 firmware (high 7.8)
- [CVE-2014-3900](https://insights.sbomify.com/CVE-2014-3900/): Cross-site scripting in piwigo:piwigo (medium 4.3)
- [CVE-2014-3899](https://insights.sbomify.com/CVE-2014-3899/): Denial of service in gomlab:gom player (medium 4.3)
- [CVE-2014-3898](https://insights.sbomify.com/CVE-2014-3898/): Cross-site scripting in fujitsu:serverview operations manager (medium 4.3)
- [CVE-2014-3897](https://insights.sbomify.com/CVE-2014-3897/): Cross-site scripting in homepage decorator perlmailer project:homepage decorator perlmailer (medium 4.3)
- [CVE-2014-3896](https://insights.sbomify.com/CVE-2014-3896/): Cross-site request forgery in seeds:acmailer (medium 6.8)
- [CVE-2014-3895](https://insights.sbomify.com/CVE-2014-3895/): Auth bypass in iodata:ts-ptcam\/poe camera (medium 6.4)
- [CVE-2014-3894](https://insights.sbomify.com/CVE-2014-3894/): Cross-site scripting in php kobo:multifunctional mailform free (medium 4.3)
- [CVE-2014-3892](https://insights.sbomify.com/CVE-2014-3892/): Cross-site scripting in nexatechnologies:meridian (medium 4.3)
- [CVE-2014-3891](https://insights.sbomify.com/CVE-2014-3891/): Memory corruption in rimarts:becky\! internet mail (medium 6.8)
- [CVE-2014-3890](https://insights.sbomify.com/CVE-2014-3890/): Denial of service in silex:sx-2000wg firmware (medium 5.0)
- [CVE-2014-3889](https://insights.sbomify.com/CVE-2014-3889/): Denial of service in silex:sx-2000wg firmware (medium 5.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2014/page/50/