# CVEs published 2014-01-10

24 CVEs were published on January 10, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-0977](https://cve.now/CVE-2014-0977.md): Cross-site scripting (XSS) vulnerability in the Rich Text Editor in Movable Type 5.0x, 5.1x before 5.161, 5.2.x before 5.2.9, and 6.0.x befo (no CVSS)
- [CVE-2014-0978](https://cve.now/CVE-2014-0978.md): Stack-based buffer overflow in the yyerror function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impa (no CVSS)
- [CVE-2010-5291](https://cve.now/CVE-2010-5291.md): Amberdms Billing System (ABS) before 1.4.1 does not properly implement blacklisting after detection of invalid login attempts, which makes i (no CVSS)
- [CVE-2010-5292](https://cve.now/CVE-2010-5292.md): Amberdms Billing System (ABS) before 1.4.1, when a multi-instance installation is configured, might allow local users to obtain sensitive in (no CVSS)
- [CVE-2013-5009](https://cve.now/CVE-2013-5009.md): The Management Console in Symantec Endpoint Protection (SEP) 11.x before 11.0.7.4 and 12.x before 12.1.2 RU2 and Endpoint Protection Small B (no CVSS)
- [CVE-2013-5010](https://cve.now/CVE-2013-5010.md): The Application/Device Control (ADC) component in the client in Symantec Endpoint Protection (SEP) 11.x before 11.0.7.4 and 12.x before 12.1 (no CVSS)
- [CVE-2013-5011](https://cve.now/CVE-2013-5011.md): Unquoted Windows search path vulnerability in the client in Symantec Endpoint Protection (SEP) 11.x before 11.0.7.4 and 12.x before 12.1.2 R (no CVSS)
- [CVE-2013-7288](https://cve.now/CVE-2013-7288.md): Cross-site scripting (XSS) vulnerability in the mycode\_parse\_video function in inc/class\_parser.php in MyBB (aka MyBulletinBoard) before 1.6 (no CVSS)
- [CVE-2013-7289](https://cve.now/CVE-2013-7289.md): Multiple cross-site scripting (XSS) vulnerabilities in register.php in Andy's PHP Knowledgebase (Aphpkb) before 0.95.8 allow remote attacker (no CVSS)
- [CVE-2014-0658](https://cve.now/CVE-2014-0658.md): Cisco 9900 Unified IP phones allow remote attackers to cause a denial of service (unregistration) via a crafted SIP header, aka Bug ID CSCul (no CVSS)
- [CVE-2014-0663](https://cve.now/CVE-2014-0663.md): Cross-site scripting (XSS) vulnerability in the web framework in Cisco Secure Access Control System (ACS) allows remote attackers to inject (no CVSS)
- [CVE-2014-0664](https://cve.now/CVE-2014-0664.md): The server in Cisco Unity Connection allows remote authenticated users to cause a denial of service (CPU consumption) via unspecified IMAP c (no CVSS)
- [CVE-2014-1405](https://cve.now/CVE-2014-1405.md): Multiple open redirect vulnerabilities on the Conceptronic C54APM access point with runtime code 1.26 allow remote attackers to redirect use (no CVSS)
- [CVE-2014-1406](https://cve.now/CVE-2014-1406.md): CRLF injection vulnerability in goform/formWlSiteSurvey on the Conceptronic C54APM access point with runtime code 1.26 allows remote attacke (no CVSS)
- [CVE-2014-1407](https://cve.now/CVE-2014-1407.md): Multiple cross-site scripting (XSS) vulnerabilities on the Conceptronic C54APM access point with runtime code 1.26 allow remote attackers to (no CVSS)
- [CVE-2014-1408](https://cve.now/CVE-2014-1408.md): The Conceptronic C54APM access point with runtime code 1.26 has a default password of admin for the admin account, which makes it easier for (no CVSS)
- [CVE-2013-4460](https://cve.now/CVE-2013-4460.md): Cross-site scripting (XSS) vulnerability in account\_sponsor\_page.php in MantisBT 1.0.0 through 1.2.15 allows remote authenticated users to i (no CVSS)
- [CVE-2014-1236](https://cve.now/CVE-2014-1236.md): Stack-based buffer overflow in the chkNum function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impac (no CVSS)
- [CVE-2013-6321](https://cve.now/CVE-2013-6321.md): SQL injection vulnerability in IBM Atlas eDiscovery Process Management 6.0.1.5 and earlier and 6.0.2, Disposal and Governance Management for (no CVSS)
- [CVE-2013-6334](https://cve.now/CVE-2013-6334.md): IBM Atlas eDiscovery Process Management 6.0.1.5 and earlier and 6.0.2, Disposal and Governance Management for IT 6.0.1.5 and earlier and 6.0 (no CVSS)
- [CVE-2013-6974](https://cve.now/CVE-2013-6974.md): Cross-site scripting (XSS) vulnerability in the web interface in Cisco Secure Access Control System (ACS) allows remote attackers to inject (no CVSS)
- [CVE-2013-7282](https://cve.now/CVE-2013-7282.md): The management web interface on the Nisuta NS-WIR150NE router with firmware 5.07.41 and Nisuta NS-WIR300N router with firmware 5.07.36\_NIS01 (no CVSS)
- [CVE-2014-1233](https://cve.now/CVE-2014-1233.md): The paratrooper-pingdom gem 1.0.0 for Ruby allows local users to obtain the App-Key, username, and password values by listing the curl proce (no CVSS, paratrooper-pingdom)
- [CVE-2014-1234](https://cve.now/CVE-2014-1234.md): The paratrooper-newrelic gem 1.0.1 for Ruby allows local users to obtain the X-Api-Key value by listing the curl process. (no CVSS, paratrooper-newrelic)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-01-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.