# CVEs published 2014-01-23 25 CVEs were published on January 23, 2014: 0 critical, 0 high. Days are UTC. - [CVE-2013-4152](https://cve.now/CVE-2013-4152.md): The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, wh (no CVSS, org.springframework:spring-oxm) - [CVE-2013-6933](https://cve.now/CVE-2013-6933.md): The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Pl (no CVSS) - [CVE-2013-6934](https://cve.now/CVE-2013-6934.md): The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2013.11.26, as used in VideoLAN VLC Media Player, allows remote (no CVSS) - [CVE-2013-7048](https://cve.now/CVE-2013-7048.md): OpenStack Compute (Nova) Grizzly 2013.1.4, Havana 2013.2.1, and earlier uses world-writable and world-readable permissions for the temporary (no CVSS, nova) - [CVE-2013-7315](https://cve.now/CVE-2013-7315.md): The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLIn (no CVSS, org.springframework:spring-oxm) - [CVE-2013-5371](https://cve.now/CVE-2013-5371.md): The client in IBM Tivoli Storage Manager (TSM) 6.3.1 and 6.4.0 on Windows does not preserve permissions of Resilient File System (ReFS) file (no CVSS) - [CVE-2014-0494](https://cve.now/CVE-2014-0494.md): Adobe Digital Editions 2.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption and application cras (no CVSS) - [CVE-2014-1242](https://cve.now/CVE-2014-1242.md): Apple iTunes before 11.1.4 uses HTTP for the iTunes Tutorials window, which allows man-in-the-middle attackers to spoof content by gaining c (no CVSS) - [CVE-2013-7306](https://cve.now/CVE-2013-7306.md): The OSPF implementation on Brocade routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement ( (no CVSS) - [CVE-2013-7307](https://cve.now/CVE-2013-7307.md): The OSPF implementation on the Brocade Vyatta vRouter with software before 6.6R1 does not consider the possibility of duplicate Link State I (no CVSS) - [CVE-2013-7308](https://cve.now/CVE-2013-7308.md): The OSPF implementation on the D-Link DES-3810-28 switch with firmware R2.20.B017 does not consider the possibility of duplicate Link State (no CVSS) - [CVE-2013-7309](https://cve.now/CVE-2013-7309.md): The OSPF implementation in Extreme Networks EXOS does not consider the possibility of duplicate Link State ID values in Link State Advertise (no CVSS) - [CVE-2013-7310](https://cve.now/CVE-2013-7310.md): The OSPF implementation on Yamaha routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (L (no CVSS) - [CVE-2013-7311](https://cve.now/CVE-2013-7311.md): The OSPF implementation in Check Point Gaia OS R75.X and R76 and IPSO OS 6.2 R75.X and R76 does not consider the possibility of duplicate Li (no CVSS) - [CVE-2013-7312](https://cve.now/CVE-2013-7312.md): The OSPF implementation on Enterasys switches and routers does not consider the possibility of duplicate Link State ID values in Link State (no CVSS) - [CVE-2013-7313](https://cve.now/CVE-2013-7313.md): The OSPF implementation in Juniper Junos through 13.x, JunosE, and ScreenOS through 6.3.x does not consider the possibility of duplicate Lin (no CVSS) - [CVE-2013-7314](https://cve.now/CVE-2013-7314.md): The OSPF implementation on NEC IP38X, IX1000, IX2000, and IX3000 routers does not consider the possibility of duplicate Link State ID values (no CVSS) - [CVE-2012-6447](https://cve.now/CVE-2012-6447.md): Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk 5.0.0 through 5.0.2 allows remote attackers to inject arbitrary web script (no CVSS) - [CVE-2014-0675](https://cve.now/CVE-2014-0675.md): The Expressway component in Cisco TelePresence Video Communication Server (VCS) uses the same default X.509 certificate across different cus (no CVSS) - [CVE-2013-6443](https://cve.now/CVE-2013-6443.md): CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protect\_from\_forgery mechanism and condu (no CVSS) - [CVE-2014-0006](https://cve.now/CVE-2014-0006.md): The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to (no CVSS, swift) - [CVE-2014-0979](https://cve.now/CVE-2014-0979.md): The start\_authentication function in lightdm-gtk-greeter.c in LightDM GTK+ Greeter before 1.7.1 does not properly handle the return value fr (no CVSS) - [CVE-2013-6412](https://cve.now/CVE-2013-6412.md): The transform\_save function in transform.c in Augeas 1.0.0 through 1.1.0 does not properly calculate the permission values when the umask co (no CVSS) - [CVE-2013-6447](https://cve.now/CVE-2013-6447.md): Multiple XML External Entity (XXE) vulnerabilities in the (1) ExecutionHandler, (2) PollHandler, and (3) SubscriptionHandler classes in JBos (no CVSS) - [CVE-2013-6448](https://cve.now/CVE-2013-6448.md): The InterfaceGenerator handler in JBoss Seam Remoting in JBoss Seam 2 framework 2.3.1 and earlier, as used in JBoss Web Framework Kit, allow (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2014-01-23 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.