# CVEs published 2014-01-02

22 CVEs were published on January 2, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2009-5137](https://cve.now/CVE-2009-5137.md): Stack-based buffer overflow in Mini-stream CastRipper 2.50.70 allows remote attackers to execute arbitrary code via a long URL in the \[playl (no CVSS)
- [CVE-2013-2119](https://cve.now/CVE-2013-2119.md): Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application sta (no CVSS, passenger)
- [CVE-2013-6953](https://cve.now/CVE-2013-6953.md): BlogEngine.NET 2.8.0.0 and earlier allows remote attackers to read usernames and password hashes via a request for the sioc.axd file. (no CVSS)
- [CVE-2013-6991](https://cve.now/CVE-2013-6991.md): Cross-site scripting (XSS) vulnerability in the WP-Cron Dashboard plugin 1.1.5 and earlier for WordPress allows remote attackers to inject a (no CVSS)
- [CVE-2013-6992](https://cve.now/CVE-2013-6992.md): Cross-site request forgery (CSRF) vulnerability in askapache-firefox-adsense.php in the AskApache Firefox Adsense plugin 3.0 and earlier for (no CVSS)
- [CVE-2013-6993](https://cve.now/CVE-2013-6993.md): Cross-site scripting (XSS) vulnerability in the Ad-minister plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2013-7240](https://cve.now/CVE-2013-7240.md): Directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read ar (no CVSS)
- [CVE-2013-7254](https://cve.now/CVE-2013-7254.md): Cross-site scripting (XSS) vulnerability in Opsview before 4.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecif (no CVSS)
- [CVE-2013-7255](https://cve.now/CVE-2013-7255.md): Open redirect vulnerability in Opsview before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing at (no CVSS)
- [CVE-2013-7256](https://cve.now/CVE-2013-7256.md): Cross-site request forgery (CSRF) vulnerability in Opsview before 4.4.2 allows remote attackers to hijack the authentication of unspecified (no CVSS)
- [CVE-2013-7257](https://cve.now/CVE-2013-7257.md): Cross-site scripting (XSS) vulnerability in Codiad 2.0.7 allows remote attackers to inject arbitrary web script or HTML via the Project Name (no CVSS)
- [CVE-2013-7258](https://cve.now/CVE-2013-7258.md): Cross-site scripting (XSS) vulnerability in web2ldap 1.1.x before 1.1.49 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2011-5269](https://cve.now/CVE-2011-5269.md): Cross-site scripting (XSS) vulnerability in ProjectForge before 3.5.3 allows remote authenticated users to inject arbitrary web script or HT (no CVSS)
- [CVE-2013-5211](https://cve.now/CVE-2013-5211.md): The monlist feature in ntp\_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplificat (no CVSS)
- [CVE-2013-5385](https://cve.now/CVE-2013-5385.md): The OSPF implementation in IBM i 6.1 and 7.1, in z/OS on zSeries servers, and in Networking Operating System (aka NOS, formerly BLADE Operat (no CVSS)
- [CVE-2013-7222](https://cve.now/CVE-2013-7222.md): config/initializers/secret\_token.rb in Fat Free CRM before 0.12.1 has a fixed FatFreeCRM::Application.config.secret\_token value, which makes (no CVSS, fat\_free\_crm)
- [CVE-2013-7223](https://cve.now/CVE-2013-7223.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the authentication (no CVSS, fat\_free\_crm)
- [CVE-2013-7224](https://cve.now/CVE-2013-7224.md): Fat Free CRM before 0.12.1 does not restrict JSON serialization, which allows remote attackers to obtain sensitive information via a direct (no CVSS, fat\_free\_crm)
- [CVE-2013-7225](https://cve.now/CVE-2013-7225.md): Multiple SQL injection vulnerabilities in app/controllers/home\_controller.rb in Fat Free CRM before 0.12.1 allow remote authenticated users (no CVSS, fat\_free\_crm)
- [CVE-2013-7249](https://cve.now/CVE-2013-7249.md): Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct r (no CVSS, fat\_free\_crm)
- [CVE-2013-7250](https://cve.now/CVE-2013-7250.md): Cross-site scripting (XSS) vulnerability in the JsonBuilder implementation in ProjectForge before 5.3 allows remote authenticated users to i (no CVSS)
- [CVE-2013-7251](https://cve.now/CVE-2013-7251.md): Multiple cross-site request forgery (CSRF) vulnerabilities in ProjectForge before 5.3 allow remote attackers to hijack the authentication of (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-01-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.