# CVEs published 2014-05-12

21 CVEs were published on May 12, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2013-4570](https://cve.now/CVE-2013-4570.md): The zend\_inline\_hash\_func function in php-luasandbox in the Scribuntu extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and… (no CVSS)
- [CVE-2013-4571](https://cve.now/CVE-2013-4571.md): Buffer overflow in php-luasandbox in the Scribuntu extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1… (no CVSS)
- [CVE-2013-4574](https://cve.now/CVE-2013-4574.md): Cross-site scripting (XSS) vulnerability in the TimeMediaHandler extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x… (no CVSS)
- [CVE-2013-4577](https://cve.now/CVE-2013-4577.md): A certain Debian patch for GNU GRUB uses world-readable permissions for grub.cfg, which allows local users to obtain password hashes, as… (no CVSS)
- [CVE-2013-4580](https://cve.now/CVE-2013-4580.md): GitLab before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1, when using a MySQL backend, allows remote… (no CVSS)
- [CVE-2013-4581](https://cve.now/CVE-2013-4581.md): GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote… (no CVSS)
- [CVE-2013-4772](https://cve.now/CVE-2013-4772.md): D-Link DIR-505L SharePort Mobile Companion 1.01 and DIR-826L Wireless N600 Cloud Router 1.02 allows remote attackers to bypass… (no CVSS)
- [CVE-2013-5671](https://cve.now/CVE-2013-5671.md): lib/dragonfly/imagemagickutils.rb in the fog-dragonfly gem 0.8.2 for Ruby allows remote attackers to execute arbitrary commands via… (no CVSS, dragonfly · fog-dragonfly)
- [CVE-2013-5748](https://cve.now/CVE-2013-5748.md): Cross-site request forgery (CSRF) vulnerability in management/prioritize\_planning.php in SimpleRisk before 20130916-001 allows remote… (no CVSS)
- [CVE-2013-5749](https://cve.now/CVE-2013-5749.md): Cross-site scripting (XSS) vulnerability in management/prioritize\_planning.php in SimpleRisk before 20130916-001 allows remote attackers… (no CVSS)
- [CVE-2013-5984](https://cve.now/CVE-2013-5984.md): Directory traversal vulnerability in userfiles/modules/admin/backup/delete.php in Microweber before 0.830 allows remote attackers to… (no CVSS)
- [CVE-2013-6452](https://cve.now/CVE-2013-6452.md): Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers… (no CVSS)
- [CVE-2013-6453](https://cve.now/CVE-2013-6453.md): MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 does not properly sanitize SVG files, which allows remote attackers… (no CVSS)
- [CVE-2013-6454](https://cve.now/CVE-2013-6454.md): Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers… (no CVSS)
- [CVE-2013-6472](https://cve.now/CVE-2013-6472.md): MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain information about deleted page… (no CVSS)
- [CVE-2014-2301](https://cve.now/CVE-2014-2301.md): OrbiTeam BSCW before 5.0.8 allows remote attackers to obtain sensitive metadata via the inf operations (op=inf) to an object in… (no CVSS)
- [CVE-2014-2928](https://cve.now/CVE-2014-2928.md): The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM… (no CVSS)
- [CVE-2014-3242](https://cve.now/CVE-2014-3242.md): SOAPpy 0.12.5 allows remote attackers to read arbitrary files via a SOAP request containing an external entity declaration in conjunction… (no CVSS, soappy)
- [CVE-2014-3243](https://cve.now/CVE-2014-3243.md): SOAPpy 0.12.5 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service… (no CVSS, soappy)
- [CVE-2014-3454](https://cve.now/CVE-2014-3454.md): Cross-site request forgery (CSRF) vulnerability in Special:CreateCategory in the SemanticForms extension for MediaWiki before 1.19.10… (no CVSS)
- [CVE-2014-3455](https://cve.now/CVE-2014-3455.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) CreateProperty, (2) CreateTemplate, (3) CreateForm, and (4)… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2014-05-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.