# CVEs published 2014-04-15

69 CVEs were published on April 15, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-0642](https://cve.now/CVE-2014-0642.md): EMC Documentum Content Server before 6.7 SP1 P26, 6.7 SP2 before P13, 7.0 before P13, and 7.1 before P02 allows remote authenticated users… (no CVSS)
- [CVE-2014-0921](https://cve.now/CVE-2014-0921.md): The server in IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 allows remote attackers to cause a denial of service (daemon crash and… (no CVSS)
- [CVE-2014-0922](https://cve.now/CVE-2014-0922.md): IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 allows remote attackers to cause a denial of service (resource consumption) via… (no CVSS)
- [CVE-2014-0923](https://cve.now/CVE-2014-0923.md): IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 allows remote attackers to cause a denial of service (daemon restart) via crafted MQ… (no CVSS)
- [CVE-2014-0924](https://cve.now/CVE-2014-0924.md): IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 does not verify that all of the characters of a password are correct, which makes it… (no CVSS)
- [CVE-2014-2859](https://cve.now/CVE-2014-2859.md): PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to bypass intended access restrictions via a direct request. (no CVSS)
- [CVE-2014-2860](https://cve.now/CVE-2014-2860.md): Multiple cross-site scripting (XSS) vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to… (no CVSS)
- [CVE-2014-2861](https://cve.now/CVE-2014-2861.md): Incomplete blacklist vulnerability in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to conduct cross-site… (no CVSS)
- [CVE-2014-2862](https://cve.now/CVE-2014-2862.md): PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 does not check authorization in unspecified situations, which allows remote… (no CVSS)
- [CVE-2014-2863](https://cve.now/CVE-2014-2863.md): Multiple absolute path traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have… (no CVSS)
- [CVE-2014-2864](https://cve.now/CVE-2014-2864.md): Multiple directory traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an… (no CVSS)
- [CVE-2014-2865](https://cve.now/CVE-2014-2865.md): PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to bypass intended access restrictions via a '\\0'… (no CVSS)
- [CVE-2014-2866](https://cve.now/CVE-2014-2866.md): PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 relies on client JavaScript code for access restrictions, which allows remote… (no CVSS)
- [CVE-2014-2867](https://cve.now/CVE-2014-2867.md): Unrestricted file upload vulnerability in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to execute… (no CVSS)
- [CVE-2014-2868](https://cve.now/CVE-2014-2868.md): PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to modify the flow of execution of ColdFusion code by using… (no CVSS)
- [CVE-2014-2869](https://cve.now/CVE-2014-2869.md): PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to obtain sensitive information via requests to unspecified… (no CVSS)
- [CVE-2014-2870](https://cve.now/CVE-2014-2870.md): The default configuration of PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 uses cleartext for storage of credentials in a… (no CVSS)
- [CVE-2014-2871](https://cve.now/CVE-2014-2871.md): PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 relies on an HTTP session for entering credentials on login pages, which allows… (no CVSS)
- [CVE-2014-2872](https://cve.now/CVE-2014-2872.md): PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to obtain potentially sensitive information from a… (no CVSS)
- [CVE-2014-2873](https://cve.now/CVE-2014-2873.md): PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 does not require authentication for access to log files, which allows remote… (no CVSS)
- [CVE-2014-2874](https://cve.now/CVE-2014-2874.md): PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to execute arbitrary code via shell metacharacters in an… (no CVSS)
- [CVE-2013-4768](https://cve.now/CVE-2013-4768.md): The web services APIs in Eucalyptus 2.0 through 3.4.1 allow remote attackers to cause a denial of service via vectors related to the… (no CVSS)
- [CVE-2014-0384](https://cve.now/CVE-2014-0384.md): Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.35 and earlier and 5.6.15 and earlier allows remote… (no CVSS)
- [CVE-2014-0413](https://cve.now/CVE-2014-0413.md): Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to… (no CVSS)
- [CVE-2014-0414](https://cve.now/CVE-2014-0414.md): Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to… (no CVSS)
- [CVE-2014-0421](https://cve.now/CVE-2014-0421.md): Unspecified vulnerability in Oracle Solaris 10, when running on the SPARC64-X Platform, allows local users to affect confidentiality… (no CVSS)
- [CVE-2014-0426](https://cve.now/CVE-2014-0426.md): Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to… (no CVSS)
- [CVE-2014-0429](https://cve.now/CVE-2014-0429.md): Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows… (no CVSS)
- [CVE-2014-0432](https://cve.now/CVE-2014-0432.md): Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality… (no CVSS)
- [CVE-2014-0442](https://cve.now/CVE-2014-0442.md): Unspecified vulnerability in Oracle Solaris 9, 10, and 11.1 allows local users to affect confidentiality, integrity, and availability via… (no CVSS)
- [CVE-2014-0446](https://cve.now/CVE-2014-0446.md): Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect… (no CVSS)
- [CVE-2014-0447](https://cve.now/CVE-2014-0447.md): Unspecified vulnerability in Oracle Solaris 10 and 11.1 allows local users to affect availability via unknown vectors related to Kernel, a… (no CVSS)
- [CVE-2014-0448](https://cve.now/CVE-2014-0448.md): Unspecified vulnerability in Oracle Java SE 7u51 and 8 allows remote attackers to affect confidentiality, integrity, and availability via… (no CVSS)
- [CVE-2014-0449](https://cve.now/CVE-2014-0449.md): Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect… (no CVSS)
- [CVE-2014-0450](https://cve.now/CVE-2014-0450.md): Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.7 and 11.1.1.8 allows remote… (no CVSS)
- [CVE-2014-0514](https://cve.now/CVE-2014-0514.md): The Adobe Reader Mobile application before 11.2 for Android does not properly restrict use of JavaScript, which allows remote attackers to… (no CVSS)
- [CVE-2014-1986](https://cve.now/CVE-2014-1986.md): The Content Provider in the KOKUYO CamiApp application 1.21.1 and earlier for Android allows attackers to bypass intended access… (no CVSS)
- [CVE-2014-2384](https://cve.now/CVE-2014-2384.md): vmx86.sys in VMware Workstation 10.0.1 build 1379776 and VMware Player 6.0.1 build 1379776 on Windows might allow local users to cause a… (no CVSS)
- [CVE-2008-3277](https://cve.now/CVE-2008-3277.md): Untrusted search path vulnerability in a certain Red Hat build script for the ibmssh executable in ibutils packages before… (no CVSS)
- [CVE-2010-2236](https://cve.now/CVE-2010-2236.md): The monitoring probe display in spacewalk-java before 2.1.148-1 and Red Hat Network (RHN) Satellite 4.0.0 through 4.2.0 and 5.1.0 through… (no CVSS)
- [CVE-2011-3628](https://cve.now/CVE-2011-3628.md): Untrusted search path vulnerability in pam\_motd (aka the MOTD module) in libpam-modules before 1.1.3-2ubuntu2.1 on Ubuntu 11.10, before… (no CVSS)
- [CVE-2012-0214](https://cve.now/CVE-2012-0214.md): The pkgAcqMetaClearSig::Failed method in apt-pkg/acquire-item.cc in Advanced Package Tool (APT) 0.8.11 through 0.8.15.10 and 0.8.16 before… (no CVSS)
- [CVE-2013-6456](https://cve.now/CVE-2013-6456.md): The LXC driver (lxc/lxc\_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the… (no CVSS)
- [CVE-2014-0053](https://cve.now/CVE-2014-0053.md): The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 before 2.3.6 does not properly restrict… (no CVSS)
- [CVE-2014-2857](https://cve.now/CVE-2014-2857.md): The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 does not properly restrict… (no CVSS)
- [CVE-2014-2858](https://cve.now/CVE-2014-2858.md): Directory traversal vulnerability in the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 allows remote… (no CVSS)
- [CVE-2013-7368](https://cve.now/CVE-2013-7368.md): Multiple cross-site scripting (XSS) vulnerabilities in Gnew 2013.1 allow remote attackers to inject arbitrary web script or HTML via the… (no CVSS)
- [CVE-2014-0107](https://cve.now/CVE-2014-0107.md): The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when… (no CVSS, xalan:xalan)
- [CVE-2014-2580](https://cve.now/CVE-2014-2580.md): The netback driver in Xen, when using certain Linux versions that do not allow sleeping in softirq context, allows local guest… (no CVSS)
- [CVE-2014-0105](https://cve.now/CVE-2014-0105.md): The auth\_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly… (no CVSS, python-keystoneclient)
- [CVE-2014-0138](https://cve.now/CVE-2014-0138.md): The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS… (no CVSS)
- [CVE-2014-0139](https://cve.now/CVE-2014-0139.md): cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in… (no CVSS)
- [CVE-2014-0157](https://cve.now/CVE-2014-0157.md): Cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard (aka Horizon) 2013.2 before… (no CVSS, horizon)
- [CVE-2014-0167](https://cve.now/CVE-2014-0167.md): The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does… (no CVSS, nova)
- [CVE-2014-2690](https://cve.now/CVE-2014-2690.md): Citrix VDI-in-a-Box 5.3.x before 5.3.6 and 5.4.x before 5.4.3 allows local users to obtain administrator credentials by reading the log. (no CVSS)
- [CVE-2014-2828](https://cve.now/CVE-2014-2828.md): The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a… (no CVSS, keystone)
- [CVE-2014-2842](https://cve.now/CVE-2014-2842.md): Juniper ScreenOS 6.3 and earlier allows remote attackers to cause a denial of service (crash and restart or failover) via a malformed… (no CVSS)
- [CVE-2013-5704](https://cve.now/CVE-2013-5704.md): The mod\_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a… (no CVSS)
- [CVE-2013-5705](https://cve.now/CVE-2013-5705.md): apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a… (no CVSS)
- [CVE-2014-0341](https://cve.now/CVE-2014-0341.md): Multiple cross-site scripting (XSS) vulnerabilities in PivotX before 2.3.9 allow remote authenticated users to inject arbitrary web script… (no CVSS)
- [CVE-2014-0342](https://cve.now/CVE-2014-0342.md): Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute… (no CVSS)
- [CVE-2014-0348](https://cve.now/CVE-2014-0348.md): The Artiva Agency Single Sign-On (SSO) implementation in Artiva Workstation 1.3.x before 1.3.9, Artiva Rm 3.1 MR7, Artiva Healthcare 5.2… (no CVSS)
- [CVE-2014-0353](https://cve.now/CVE-2014-0353.md): The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to bypass authentication by using %2F… (no CVSS)
- [CVE-2014-0354](https://cve.now/CVE-2014-0354.md): The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 has a hardcoded password of qweasdzxc for an unspecified… (no CVSS)
- [CVE-2014-0355](https://cve.now/CVE-2014-0355.md): Multiple stack-based buffer overflows on the ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allow… (no CVSS)
- [CVE-2014-0356](https://cve.now/CVE-2014-0356.md): The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to execute arbitrary code via shell… (no CVSS)
- [CVE-2014-0357](https://cve.now/CVE-2014-0357.md): Amtelco miSecureMessages allows remote attackers to read the messages of arbitrary users via an XML request containing a valid license key… (no CVSS)
- [CVE-2014-0358](https://cve.now/CVE-2014-0358.md): Multiple directory traversal vulnerabilities in Xangati XSR before 11 and XNR before 7 allow remote attackers to read arbitrary files via… (no CVSS)
- [CVE-2014-0359](https://cve.now/CVE-2014-0359.md): Xangati XSR before 11 and XNR before 7 allows remote attackers to execute arbitrary commands via shell metacharacters in a… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2014-04-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.