# Vulnerabilities published in 2014


- [CVE-2014-1261](https://insights.sbomify.com/CVE-2014-1261/): Integer overflow in apple:mac os x (high 7.5)
- [CVE-2014-1260](https://insights.sbomify.com/CVE-2014-1260/): Memory corruption in apple:mac os x (medium 6.8)
- [CVE-2014-1259](https://insights.sbomify.com/CVE-2014-1259/): Memory corruption in apple:mac os x (medium 6.8)
- [CVE-2014-1258](https://insights.sbomify.com/CVE-2014-1258/): Memory corruption in apple:mac os x (medium 6.8)
- [CVE-2014-1257](https://insights.sbomify.com/CVE-2014-1257/): Security feature bypass in apple:mac os x (low 3.6)
- [CVE-2014-1256](https://insights.sbomify.com/CVE-2014-1256/): Memory corruption in apple:mac os x (high 7.5)
- [CVE-2014-1255](https://insights.sbomify.com/CVE-2014-1255/): Security feature bypass in apple:mac os x (high 7.5)
- [CVE-2014-1254](https://insights.sbomify.com/CVE-2014-1254/): Memory corruption in apple:mac os x (medium 6.8)
- [CVE-2014-1253](https://insights.sbomify.com/CVE-2014-1253/): Memory corruption in apple:boot camp (medium 4.7)
- [CVE-2014-1252](https://insights.sbomify.com/CVE-2014-1252/): Memory corruption in apple:iphone os (high 7.5)
- [CVE-2014-125138](https://insights.sbomify.com/CVE-2014-125138/): File upload in Cart Engine (high 8.7)
- [CVE-2014-125137](https://insights.sbomify.com/CVE-2014-125137/): Path traversal in Cart Engine (high 7.1)
- [CVE-2014-125136](https://insights.sbomify.com/CVE-2014-125136/): Information disclosure in Cart Engine (high 8.2)
- [CVE-2014-125135](https://insights.sbomify.com/CVE-2014-125135/): OctoPrint Flask Secret Key hard-coded key (medium 6.9)
- [CVE-2014-125134](https://insights.sbomify.com/CVE-2014-125134/): ChurcHope WordPress Theme < 2.2 Path Traversal via downloadlink.php (high 8.7)
- [CVE-2014-125133](https://insights.sbomify.com/CVE-2014-125133/): NativeChurch WordPress Theme < 1.6.2 Arbitrary File Download via download.php (high 8.7)
- [CVE-2014-125132](https://insights.sbomify.com/CVE-2014-125132/): Blogroll Fun WordPress Plugin < 0.8.5 Reflected XSS via blogroll.php (medium 5.1)
- [CVE-2014-125131](https://insights.sbomify.com/CVE-2014-125131/): DedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in config.php (medium 5.1)
- [CVE-2014-125130](https://insights.sbomify.com/CVE-2014-125130/): CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read via direct_download.php (high 8.7)
- [CVE-2014-125128](https://insights.sbomify.com/CVE-2014-125128/): Cross-site scripting in apostrophecms:sanitize-html (medium 6.1)
- [CVE-2014-125127](https://insights.sbomify.com/CVE-2014-125127/): Denial of Service (DoS) vulnerability in mikecao/flight (high 7.5)
- [CVE-2014-125126](https://insights.sbomify.com/CVE-2014-125126/): Simple E-Document Arbitrary File Upload RCE (critical 9.2)
- [CVE-2014-125125](https://insights.sbomify.com/CVE-2014-125125/): A10 Networks AX Loadbalancer Path Traversal (high 8.8)
- [CVE-2014-125124](https://insights.sbomify.com/CVE-2014-125124/): Pandora FMS <= 5.0RC1 Anyterm Unauthenticated Command Injection (critical 10.0)
- [CVE-2014-125123](https://insights.sbomify.com/CVE-2014-125123/): Kloxo < 6.1.12 Unauthenticated SQL Injection RCE (critical 10.0)
- [CVE-2014-125122](https://insights.sbomify.com/CVE-2014-125122/): Linksys WRT120N tmUnblock.cgi Stack-Based Buffer Overflow Admin Password Reset (medium 5.3)
- [CVE-2014-125121](https://insights.sbomify.com/CVE-2014-125121/): Array Networks vAPV and vxAG Default Credential Privilege Escalation (critical 10.0)
- [CVE-2014-125119](https://insights.sbomify.com/CVE-2014-125119/): WinRAR < 5.00 Filename Spoofing RCE (high 8.4)
- [CVE-2014-125118](https://insights.sbomify.com/CVE-2014-125118/): eScan 5.5-2 Web Management Console Command Injection (critical 9.4)
- [CVE-2014-125117](https://insights.sbomify.com/CVE-2014-125117/): D-Link info.cgi POST Request Stack-Based Buffer Overflow RCE (critical 9.3)
- [CVE-2014-125116](https://insights.sbomify.com/CVE-2014-125116/): HybridAuth 2.0.9 - 2.2.2 Unauthenticated RCE via install.php Configuration Injection (critical 9.3)
- [CVE-2014-125115](https://insights.sbomify.com/CVE-2014-125115/): Pandora FMS ≤ 5.0 SP2 Default Credential SQL Injection RCE (critical 10.0)
- [CVE-2014-125114](https://insights.sbomify.com/CVE-2014-125114/): i-Ftp 2.20 Schedule.xml Stack-Based Buffer Overflow (high 8.4)
- [CVE-2014-125113](https://insights.sbomify.com/CVE-2014-125113/): Dell/Quest KACE K1000 Unauthenticated File Upload RCE (critical 9.3)
- [CVE-2014-125112](https://insights.sbomify.com/CVE-2014-125112/): Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution (critical 9.8)
- [CVE-2014-125111](https://insights.sbomify.com/CVE-2014-125111/): namithjawahar Wp-Insert cross site scripting (low 3.5)
- [CVE-2014-125110](https://insights.sbomify.com/CVE-2014-125110/): wp-file-upload Plugin wfu_ajaxactions.php wfu_ajax_action_callback cross site scripting (low 3.5)
- [CVE-2014-125109](https://insights.sbomify.com/CVE-2014-125109/): BestWebSoft Portfolio Plugin bws_menu.php bws_add_menu_render cross site scripting (low 3.5)
- [CVE-2014-125108](https://insights.sbomify.com/CVE-2014-125108/): w3c online-spellchecker-py spellchecker cross site scripting (low 3.1)
- [CVE-2014-125107](https://insights.sbomify.com/CVE-2014-125107/): Corveda PHPSandbox String protection mechanism (medium 4.3)
- [CVE-2014-125106](https://insights.sbomify.com/CVE-2014-125106/): Integer overflow in nanopb project:nanopb (critical 9.8)
- [CVE-2014-125105](https://insights.sbomify.com/CVE-2014-125105/): Broken Link Checker Plugin Settings Page core.php options_page cross site scripting (low 2.4)
- [CVE-2014-125104](https://insights.sbomify.com/CVE-2014-125104/): VaultPress Plugin MailPoet Plugin class.vaultpress-hotfixes.php protect_aioseo_ajax unrestricted upload (medium 6.3)
- [CVE-2014-125103](https://insights.sbomify.com/CVE-2014-125103/): BestWebSoft Twitter Plugin twitter.php twttr_settings_page cross site scripting (low 2.4)
- [CVE-2014-125102](https://insights.sbomify.com/CVE-2014-125102/): Bestwebsoft Relevant Plugin Thumbnail information disclosure (medium 4.3)
- [CVE-2014-125101](https://insights.sbomify.com/CVE-2014-125101/): Portfolio Gallery Plugin sql injection (medium 6.3)
- [CVE-2014-125100](https://insights.sbomify.com/CVE-2014-125100/): BestWebSoft Job Board Plugin cross site scripting (low 3.5)
- [CVE-2014-1251](https://insights.sbomify.com/CVE-2014-1251/): Memory corruption in apple:quicktime (critical 9.3)
- [CVE-2014-125099](https://insights.sbomify.com/CVE-2014-125099/): I Recommend This Plugin dot-irecommendthis.php sql injection (medium 6.3)
- [CVE-2014-125098](https://insights.sbomify.com/CVE-2014-125098/): Dart http_server Directory Listing virtual_directory.dart VirtualDirectory cross site scripting (medium 4.3)
- [CVE-2014-125097](https://insights.sbomify.com/CVE-2014-125097/): BestWebSoft Facebook Like Button facebook-button-plugin.php fcbkbttn_settings_page cross site scripting (low 3.5)
- [CVE-2014-125096](https://insights.sbomify.com/CVE-2014-125096/): Fancy Gallery Plugin Options Page class.options.php cross site scripting (low 3.5)
- [CVE-2014-125095](https://insights.sbomify.com/CVE-2014-125095/): BestWebSoft Contact Form Plugin bws_menu.php bws_add_menu_render cross site scripting (low 3.5)
- [CVE-2014-125094](https://insights.sbomify.com/CVE-2014-125094/): phpMiniAdmin cross site scripting (low 3.5)
- [CVE-2014-125093](https://insights.sbomify.com/CVE-2014-125093/): Ad Blocking Detector Plugin ad-blocking-detector.php information disclosure (medium 4.3)
- [CVE-2014-125092](https://insights.sbomify.com/CVE-2014-125092/): MaxButtons Plugin maxbuttons-button.php maxbuttons_strip_px cross site scripting (low 3.5)
- [CVE-2014-125091](https://insights.sbomify.com/CVE-2014-125091/): codepeople cp-polls Plugin cp-admin-int-message-list.inc.php sql injection (medium 4.7)
- [CVE-2014-125090](https://insights.sbomify.com/CVE-2014-125090/): Media Downloader Plugin getfile.php dl_file_resumable cross site scripting (low 3.5)
- [CVE-2014-125089](https://insights.sbomify.com/CVE-2014-125089/): cention-chatserver InternalChatProtocol.fe _formatBody cross site scripting (low 3.5)
- [CVE-2014-125088](https://insights.sbomify.com/CVE-2014-125088/): qt-users-jp silk header.qml cross site scripting (low 3.5)
- [CVE-2014-125087](https://insights.sbomify.com/CVE-2014-125087/): java-xmlbuilder xml external entity reference (medium 5.5)
- [CVE-2014-125086](https://insights.sbomify.com/CVE-2014-125086/): Gimmie Plugin trigger_login.php sql injection (medium 5.5)
- [CVE-2014-125085](https://insights.sbomify.com/CVE-2014-125085/): Gimmie Plugin trigger_ratethread.php sql injection (medium 5.5)
- [CVE-2014-125084](https://insights.sbomify.com/CVE-2014-125084/): Gimmie Plugin trigger_referral.php sql injection (medium 5.5)
- [CVE-2014-125083](https://insights.sbomify.com/CVE-2014-125083/): Anant Labs google-enterprise-connector-dctm sql injection (medium 5.5)
- [CVE-2014-125082](https://insights.sbomify.com/CVE-2014-125082/): nivit redports model.py sql injection (medium 5.5)
- [CVE-2014-125081](https://insights.sbomify.com/CVE-2014-125081/): risheesh debutsav sql injection (medium 5.5)
- [CVE-2014-125080](https://insights.sbomify.com/CVE-2014-125080/): frontaccounting faplanet path traversal (medium 5.5)
- [CVE-2014-125079](https://insights.sbomify.com/CVE-2014-125079/): agy pontifex.http Http.coffee sql injection (medium 5.5)
- [CVE-2014-125078](https://insights.sbomify.com/CVE-2014-125078/): yanheven console horizon.instances.js cross site scripting (low 3.5)
- [CVE-2014-125077](https://insights.sbomify.com/CVE-2014-125077/): pointhi searx_stats cron.php sql injection (medium 5.5)
- [CVE-2014-125076](https://insights.sbomify.com/CVE-2014-125076/): NoxxieNl Criminals roulette.php sql injection (medium 5.5)
- [CVE-2014-125075](https://insights.sbomify.com/CVE-2014-125075/): gmail-servlet Model.java search sql injection (medium 5.5)
- [CVE-2014-125074](https://insights.sbomify.com/CVE-2014-125074/): Nayshlok Voyager DatabaseAccess.java sql injection (medium 5.5)
- [CVE-2014-125073](https://insights.sbomify.com/CVE-2014-125073/): mapoor voteapp app.py show_refresh sql injection (medium 5.5)
- [CVE-2014-125072](https://insights.sbomify.com/CVE-2014-125072/): CherishSin klattr sql injection (medium 5.5)
- [CVE-2014-125071](https://insights.sbomify.com/CVE-2014-125071/): lukehutch Gribbit HttpRequestHandler.java messageReceived missing origin validation in websockets (medium 5.5)
- [CVE-2014-125070](https://insights.sbomify.com/CVE-2014-125070/): yanheven console tables.py AvailabilityZonesTable cross site scripting (low 3.5)
- [CVE-2014-125069](https://insights.sbomify.com/CVE-2014-125069/): saxman maps-js-icoads exposure of information through directory listing (medium 4.3)
- [CVE-2014-125068](https://insights.sbomify.com/CVE-2014-125068/): saxman maps-js-icoads http-server.js path traversal (medium 5.5)
- [CVE-2014-125067](https://insights.sbomify.com/CVE-2014-125067/): corincerami curiosity image_controller.rb sql injection (medium 5.5)
- [CVE-2014-125066](https://insights.sbomify.com/CVE-2014-125066/): emmflo yuko-bot denial of service (medium 4.3)
- [CVE-2014-125065](https://insights.sbomify.com/CVE-2014-125065/): john5223 bottle-auth sql injection (medium 5.5)
- [CVE-2014-125063](https://insights.sbomify.com/CVE-2014-125063/): ada-l0velace Bid sql injection (medium 5.5)
- [CVE-2014-125062](https://insights.sbomify.com/CVE-2014-125062/): ananich bitstorm announce.php sql injection (medium 5.5)
- [CVE-2014-125061](https://insights.sbomify.com/CVE-2014-125061/): peel filebroker common.rb select_transfer_status_desc sql injection (medium 5.5)
- [CVE-2014-125060](https://insights.sbomify.com/CVE-2014-125060/): holdennb CollabCal calenderServer.cpp handleGet improper authentication (high 7.3)
- [CVE-2014-125059](https://insights.sbomify.com/CVE-2014-125059/): sternenseemann sternenblog main.c blog_index file inclusion (medium 5.0)
- [CVE-2014-125058](https://insights.sbomify.com/CVE-2014-125058/): LearnMeSomeCodes project3 search.rb search_first_name sql injection (medium 5.5)
- [CVE-2014-125057](https://insights.sbomify.com/CVE-2014-125057/): mrobit robitailletheknot CSRF Token filters.php comparison (low 3.1)
- [CVE-2014-125056](https://insights.sbomify.com/CVE-2014-125056/): Pylons horus services.py timing discrepancy (low 2.6)
- [CVE-2014-125055](https://insights.sbomify.com/CVE-2014-125055/): agnivade easy-scrypt scrypt.go VerifyPassphrase timing discrepancy (low 2.6)
- [CVE-2014-125054](https://insights.sbomify.com/CVE-2014-125054/): koroket RedditOnRails Vote access control (medium 4.3)
- [CVE-2014-125053](https://insights.sbomify.com/CVE-2014-125053/): Piwigo-Guest-Book Navigation Bar guestbook.inc.php sql injection (medium 5.5)
- [CVE-2014-125052](https://insights.sbomify.com/CVE-2014-125052/): JervenBolleman sparql-identifiers RegistryDao.java sql injection (medium 5.5)
- [CVE-2014-125051](https://insights.sbomify.com/CVE-2014-125051/): himiklab yii2-jqgrid-widget JqGridAction.php addSearchOptionsRecursively sql injection (medium 5.5)
- [CVE-2014-125050](https://insights.sbomify.com/CVE-2014-125050/): ScottTZhang voter-js main.js sql injection (medium 5.5)
- [CVE-2014-125049](https://insights.sbomify.com/CVE-2014-125049/): typcn Blogile server.js getNav sql injection (medium 5.5)
- [CVE-2014-125048](https://insights.sbomify.com/CVE-2014-125048/): kassi xingwall oauth.js session fixiation (medium 6.3)
- [CVE-2014-125047](https://insights.sbomify.com/CVE-2014-125047/): tbezman school-store sql injection (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2014/page/73/