# CVEs published 2014-04-25

18 CVEs were published on April 25, 2014: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2014-2579](https://cve.now/CVE-2014-2579.md): Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the… (no CVSS)
- [CVE-2014-2996](https://cve.now/CVE-2014-2996.md): XCloner Standalone 3.5 and earlier, when enable\_db\_backup and sql\_mem are enabled, allows remote authenticated administrators to execute… (no CVSS)
- [CVE-2013-2025](https://cve.now/CVE-2013-2025.md): Cross-site scripting (XSS) vulnerability in Ushahidi Platform 2.5.x through 2.6.1 allows remote attackers to inject arbitrary web script… (no CVSS)
- [CVE-2013-3069](https://cve.now/CVE-2013-3069.md): Multiple cross-site scripting (XSS) vulnerabilities in NETGEAR WNDR4700 with firmware 1.0.0.34 allow remote authenticated users to inject… (no CVSS)
- [CVE-2013-4565](https://cve.now/CVE-2013-4565.md): Heap-based buffer overflow in the \_\_OLEdecode function in ppthtml 0.5.1 and earlier allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2013-4722](https://cve.now/CVE-2013-4722.md): Multiple cross-site scripting (XSS) vulnerabilities in Admin/login/default.asp in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a… (no CVSS)
- [CVE-2013-4723](https://cve.now/CVE-2013-4723.md): Open redirect vulnerability in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions… (no CVSS)
- [CVE-2013-4726](https://cve.now/CVE-2013-4726.md): Cross-site request forgery (CSRF) vulnerability in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly… (no CVSS)
- [CVE-2013-5660](https://cve.now/CVE-2013-5660.md): Buffer overflow in Power Software WinArchiver 3.2 allows remote attackers to execute arbitrary code via a crafted .zip file. (no CVSS)
- [CVE-2012-4230](https://cve.now/CVE-2012-4230.md): The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2)… (no CVSS)
- [CVE-2013-5954](https://cve.now/CVE-2013-5954.md): Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack the authentication… (no CVSS)
- [CVE-2013-5956](https://cve.now/CVE-2013-5956.md): Cross-site scripting (XSS) vulnerability in includes/flvthumbnail.php in the Youtube Gallery (com\_youtubegallery) component 3.4.0 for… (no CVSS)
- [CVE-2014-2729](https://cve.now/CVE-2014-2729.md): Cross-site scripting (XSS) vulnerability in content.aspx in Ektron CMS 8.7 before 8.7.0.055 allows remote authenticated users to inject… (no CVSS)
- [CVE-2014-0760](https://cve.now/CVE-2014-0760.md): Festo CECX-X-(C1/M1) Controller Improper Authentication (no CVSS, Festo CECX-X-C1 Modular Master Controller with CoDeSys · Fe…)
- [CVE-2014-0769](https://cve.now/CVE-2014-0769.md): Festo CECX-X-(C1/M1) Controller Improper Authentication (no CVSS, Festo CECX-X-C1 Modular Master Controller with CoDeSys · Fe…)
- [CVE-2014-0780](https://cve.now/CVE-2014-0780.md): InduSoft Web Studio Path Traversal (CVSS 9.8, KEV, InduSoft Web Studio)
- [CVE-2014-2908](https://cve.now/CVE-2014-2908.md): Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote… (no CVSS)
- [CVE-2014-2909](https://cve.now/CVE-2014-2909.md): CRLF injection vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2014-04-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.