# CVEs published 2014-01-21

38 CVEs were published on January 21, 2014: 0 critical, 1 high. Days are UTC.

- [CVE-2012-2997](https://cve.now/CVE-2012-2997.md): XML External Entity (XXE) vulnerability in sam/admin/vpe2/public/php/server.php in F5 BIG-IP 10.0.0 through 10.2.4 and 11.0.0 through 11.2.1 (no CVSS)
- [CVE-2013-0157](https://cve.now/CVE-2013-0157.md): (a) mount and (b) umount in util-linux 2.14.1, 2.17.2, and probably other versions allow local users to determine the existence of restricte (no CVSS)
- [CVE-2013-0339](https://cve.now/CVE-2013-0339.md): libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or (no CVSS)
- [CVE-2013-0340](https://cve.now/CVE-2013-0340.md): expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML\_SetEntityDeclHandler fun (no CVSS, libexpat)
- [CVE-2013-0485](https://cve.now/CVE-2013-0485.md): Unspecified vulnerability in IBM Java SDK 7 before SR4-FP1, 6 before SR13-FP1, 5.0 before SR16-FP1, and 1.4.2 before SR13-FP16 has unknown i (no CVSS)
- [CVE-2013-1361](https://cve.now/CVE-2013-1361.md): Untrusted search path vulnerability in Lenovo Thinkpad Bluetooth with Enhanced Data Rate Software 6.4.0.2900 and earlier allows local users, (no CVSS)
- [CVE-2013-1769](https://cve.now/CVE-2013-1769.md): A certain hashing algorithm in Telepathy Gabble 0.16.x before 0.16.5 and 0.17.x before 0.17.3 allows remote attackers to cause a denial of s (no CVSS)
- [CVE-2013-1923](https://cve.now/CVE-2013-1923.md): rpc-gssd in nfs-utils before 1.2.8 performs reverse DNS resolution for server names during GSSAPI authentication, which might allow remote a (no CVSS)
- [CVE-2013-2104](https://cve.now/CVE-2013-2104.md): python-keystoneclient before 0.2.4, as used in OpenStack Keystone (Folsom), does not properly check expiry for PKI tokens, which allows remo (no CVSS, python-keystoneclient)
- [CVE-2013-2151](https://cve.now/CVE-2013-2151.md): Unquoted Windows search path vulnerability in Red Hat Enterprise Virtualization (RHEV) 3 and 3.2 allows local users to gain privileges via a (no CVSS)
- [CVE-2013-2152](https://cve.now/CVE-2013-2152.md): Unquoted Windows search path vulnerability in the SPICE service, as used in Red Hat Enterprise Virtualization (RHEV) 3.2, allows local users (no CVSS)
- [CVE-2013-4160](https://cve.now/CVE-2013-4160.md): Little CMS (lcms2) before 2.5, as used in OpenJDK 7 and possibly other products, allows remote attackers to cause a denial of service (NULL (no CVSS)
- [CVE-2013-4884](https://cve.now/CVE-2013-4884.md): Cross-site scripting (XSS) vulnerability in McAfee SuperScan 4.0 allows remote attackers to inject arbitrary web script or HTML via UTF-7 en (no CVSS)
- [CVE-2013-5986](https://cve.now/CVE-2013-5986.md): Unspecified vulnerability in NVIDIA graphics driver Release 331, 325, 319, 310, and 304 has unknown impact and attack vectors, a different v (no CVSS)
- [CVE-2013-5987](https://cve.now/CVE-2013-5987.md): Unspecified vulnerability in NVIDIA graphics driver Release 331, 325, 319, 310, and 304 allows local users to bypass intended access restric (no CVSS)
- [CVE-2013-2594](https://cve.now/CVE-2013-2594.md): SQL injection vulnerability in reports/calldiary.php in Hornbill Supportworks ITSM 1.0.0 through 3.4.14 allows remote attackers to execute a (no CVSS)
- [CVE-2013-4200](https://cve.now/CVE-2013-4200.md): The isURLInPortal method in the URLTool class in in\_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats (no CVSS, plone)
- [CVE-2013-6922](https://cve.now/CVE-2013-6922.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Seagate BlackArmor NAS 220 devices with firmware sg2000-2000.1331 allow re (no CVSS)
- [CVE-2013-7219](https://cve.now/CVE-2013-7219.md): SQL injection vulnerability in vote.php in the 2Glux Sexy Polling (com\_sexypolling) component before 1.0.9 for Joomla! allows remote attacke (no CVSS)
- [CVE-2013-6305](https://cve.now/CVE-2013-6305.md): IBM Platform Symphony 5.2 before build 229037 and 6.1.0.1 before build 229073 uses the same credentials encryption key across different cust (no CVSS)
- [CVE-2013-6872](https://cve.now/CVE-2013-6872.md): SQL injection vulnerability in managetimetracker.php in Collabtive before 1.2 allows remote authenticated users to execute arbitrary SQL com (no CVSS)
- [CVE-2014-1452](https://cve.now/CVE-2014-1452.md): Stack-based buffer overflow in lib/snmpagent.c in bsnmpd, as used in FreeBSD 8.3 through 10.0, allows remote attackers to cause a denial of (no CVSS)
- [CVE-2014-1618](https://cve.now/CVE-2014-1618.md): Multiple SQL injection vulnerabilities in UAEPD Shopping Cart Script allow remote attackers to execute arbitrary SQL commands via the (1) ca (no CVSS)
- [CVE-2014-1619](https://cve.now/CVE-2014-1619.md): Multiple SQL injection vulnerabilities in Cubic CMS 5.1.1, 5.1.2, and 5.2 allow remote attackers to execute arbitrary SQL commands via the ( (no CVSS)
- [CVE-2014-1620](https://cve.now/CVE-2014-1620.md): Multiple cross-site scripting (XSS) vulnerabilities in add.php in HIOX Guest Book (HGB) 5.0 allow remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2010-5293](https://cve.now/CVE-2010-5293.md): wp-includes/comment.php in WordPress before 3.0.2 does not properly whitelist trackbacks and pingbacks in the blogroll, which allows remote (no CVSS)
- [CVE-2010-5294](https://cve.now/CVE-2010-5294.md): Multiple cross-site scripting (XSS) vulnerabilities in the request\_filesystem\_credentials function in wp-admin/includes/file.php in WordPres (no CVSS)
- [CVE-2010-5295](https://cve.now/CVE-2010-5295.md): Cross-site scripting (XSS) vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary (no CVSS)
- [CVE-2010-5296](https://cve.now/CVE-2010-5296.md): wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for th (no CVSS)
- [CVE-2010-5297](https://cve.now/CVE-2010-5297.md): WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once chang (no CVSS)
- [CVE-2011-5270](https://cve.now/CVE-2011-5270.md): wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publish\_posts capability requirement, which allows remote authenticat (no CVSS)
- [CVE-2012-6633](https://cve.now/CVE-2012-6633.md): Cross-site scripting (XSS) vulnerability in wp-includes/default-filters.php in WordPress before 3.3.3 allows remote attackers to inject arbi (no CVSS)
- [CVE-2012-6634](https://cve.now/CVE-2012-6634.md): wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachm (no CVSS)
- [CVE-2012-6635](https://cve.now/CVE-2012-6635.md): wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remot (no CVSS)
- [CVE-2013-4030](https://cve.now/CVE-2013-4030.md): Integrated Management Module (IMM) 2 1.00 through 2.00 on IBM System X and Flex System servers supports SSL cipher suites with short keys, w (no CVSS)
- [CVE-2013-5429](https://cve.now/CVE-2013-5429.md): The Risk Based Access functionality in IBM Tivoli Federated Identity Manager (TFIM) 6.2.2 before FP9 and Tivoli Federated Identity Manager B (no CVSS)
- [CVE-2013-6040](https://cve.now/CVE-2013-6040.md): MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls versions before 4.0 are vulnerable to arbitrary code via crafted HTML document. (CVSS 8.1, MW6 Tech MW6 Aztec ActiveX Controls · MW6 Tech MW6 DataM… +1)
- [CVE-2014-0753](https://cve.now/CVE-2014-0753.md): Ecava IntegraXor Stack-based Buffer Overflow (no CVSS, Ecava IntegraXor)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-01-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.