# CVEs published 2014-01-23

25 CVEs were published on January 23, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2013-4152](https://cve.now/CVE-2013-4152.md): The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution… (no CVSS, org.springframework:spring-oxm)
- [CVE-2013-6933](https://cve.now/CVE-2013-6933.md): The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media… (no CVSS)
- [CVE-2013-6934](https://cve.now/CVE-2013-6934.md): The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2013.11.26, as used in VideoLAN VLC Media Player, allows… (no CVSS)
- [CVE-2013-7048](https://cve.now/CVE-2013-7048.md): OpenStack Compute (Nova) Grizzly 2013.1.4, Havana 2013.2.1, and earlier uses world-writable and world-readable permissions for the… (no CVSS, nova)
- [CVE-2013-7315](https://cve.now/CVE-2013-7315.md): The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX… (no CVSS, org.springframework:spring-oxm)
- [CVE-2013-5371](https://cve.now/CVE-2013-5371.md): The client in IBM Tivoli Storage Manager (TSM) 6.3.1 and 6.4.0 on Windows does not preserve permissions of Resilient File System (ReFS)… (no CVSS)
- [CVE-2014-0494](https://cve.now/CVE-2014-0494.md): Adobe Digital Editions 2.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption and application… (no CVSS)
- [CVE-2014-1242](https://cve.now/CVE-2014-1242.md): Apple iTunes before 11.1.4 uses HTTP for the iTunes Tutorials window, which allows man-in-the-middle attackers to spoof content by gaining… (no CVSS)
- [CVE-2013-7306](https://cve.now/CVE-2013-7306.md): The OSPF implementation on Brocade routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement… (no CVSS)
- [CVE-2013-7307](https://cve.now/CVE-2013-7307.md): The OSPF implementation on the Brocade Vyatta vRouter with software before 6.6R1 does not consider the possibility of duplicate Link State… (no CVSS)
- [CVE-2013-7308](https://cve.now/CVE-2013-7308.md): The OSPF implementation on the D-Link DES-3810-28 switch with firmware R2.20.B017 does not consider the possibility of duplicate Link… (no CVSS)
- [CVE-2013-7309](https://cve.now/CVE-2013-7309.md): The OSPF implementation in Extreme Networks EXOS does not consider the possibility of duplicate Link State ID values in Link State… (no CVSS)
- [CVE-2013-7310](https://cve.now/CVE-2013-7310.md): The OSPF implementation on Yamaha routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement… (no CVSS)
- [CVE-2013-7311](https://cve.now/CVE-2013-7311.md): The OSPF implementation in Check Point Gaia OS R75.X and R76 and IPSO OS 6.2 R75.X and R76 does not consider the possibility of duplicate… (no CVSS)
- [CVE-2013-7312](https://cve.now/CVE-2013-7312.md): The OSPF implementation on Enterasys switches and routers does not consider the possibility of duplicate Link State ID values in Link… (no CVSS)
- [CVE-2013-7313](https://cve.now/CVE-2013-7313.md): The OSPF implementation in Juniper Junos through 13.x, JunosE, and ScreenOS through 6.3.x does not consider the possibility of duplicate… (no CVSS)
- [CVE-2013-7314](https://cve.now/CVE-2013-7314.md): The OSPF implementation on NEC IP38X, IX1000, IX2000, and IX3000 routers does not consider the possibility of duplicate Link State ID… (no CVSS)
- [CVE-2012-6447](https://cve.now/CVE-2012-6447.md): Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk 5.0.0 through 5.0.2 allows remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2014-0675](https://cve.now/CVE-2014-0675.md): The Expressway component in Cisco TelePresence Video Communication Server (VCS) uses the same default X.509 certificate across different… (no CVSS)
- [CVE-2013-6443](https://cve.now/CVE-2013-6443.md): CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protect\_from\_forgery mechanism and… (no CVSS)
- [CVE-2014-0006](https://cve.now/CVE-2014-0006.md): The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers… (no CVSS, swift)
- [CVE-2014-0979](https://cve.now/CVE-2014-0979.md): The start\_authentication function in lightdm-gtk-greeter.c in LightDM GTK+ Greeter before 1.7.1 does not properly handle the return value… (no CVSS)
- [CVE-2013-6412](https://cve.now/CVE-2013-6412.md): The transform\_save function in transform.c in Augeas 1.0.0 through 1.1.0 does not properly calculate the permission values when the umask… (no CVSS)
- [CVE-2013-6447](https://cve.now/CVE-2013-6447.md): Multiple XML External Entity (XXE) vulnerabilities in the (1) ExecutionHandler, (2) PollHandler, and (3) SubscriptionHandler classes in… (no CVSS)
- [CVE-2013-6448](https://cve.now/CVE-2013-6448.md): The InterfaceGenerator handler in JBoss Seam Remoting in JBoss Seam 2 framework 2.3.1 and earlier, as used in JBoss Web Framework Kit… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2014-01-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.