# CVEs published 2014-01-24

23 CVEs were published on January 24, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2013-1853](https://cve.now/CVE-2013-1853.md): Almanah Diary 0.9.0 and 0.10.0 does not encrypt the database when closed, which allows local users to obtain sensitive information by readin (no CVSS)
- [CVE-2013-2192](https://cve.now/CVE-2013-2192.md): The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos secur (no CVSS, org.apache.hadoop:hadoop-common)
- [CVE-2013-6434](https://cve.now/CVE-2013-6434.md): The remote-viewer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.3, when using a native SPICE client invocation method, init (no CVSS)
- [CVE-2013-6457](https://cve.now/CVE-2013-6457.md): The libxlDomainGetNumaParameters function in the libxl driver (libxl/libxl\_driver.c) in libvirt before 1.2.1 does not properly initialize th (no CVSS)
- [CVE-2013-6458](https://cve.now/CVE-2013-6458.md): Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3) qemuDomainBlockJobImpl, and (4) virDomainGetBlockIoTu (no CVSS)
- [CVE-2014-0028](https://cve.now/CVE-2014-0028.md): libvirt 1.1.1 through 1.2.0 allows context-dependent attackers to bypass the domain:getattr and connect:search\_domains restrictions in ACLs (no CVSS)
- [CVE-2014-1447](https://cve.now/CVE-2014-1447.md): Race condition in the virNetServerClientStartKeepAlive function in libvirt before 1.2.1 allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2014-1475](https://cve.now/CVE-2014-1475.md): The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified ve (no CVSS)
- [CVE-2014-1476](https://cve.now/CVE-2014-1476.md): The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal, does not properly restrict access to unpubli (no CVSS)
- [CVE-2013-1885](https://cve.now/CVE-2013-1885.md): Multiple cross-site scripting (XSS) vulnerabilities in the token processing system (pki-tps) in Red Hat Certificate System (RHCS) 8.1 and po (no CVSS)
- [CVE-2013-1886](https://cve.now/CVE-2013-1886.md): Format string vulnerability in the token processing system (pki-tps) in Red Hat Certificate System (RHCS) 8.1 and possibly Dogtag Certificat (no CVSS)
- [CVE-2013-5350](https://cve.now/CVE-2013-5350.md): The "Remember me" feature in the opSecurityUser::getRememberLoginCookie function in lib/user/opSecurityUser.class.php in OpenPNE 3.6.13 befo (no CVSS)
- [CVE-2013-7184](https://cve.now/CVE-2013-7184.md): Gretech GOM Media Player 2.2.56.5158 and earlier allows remote attackers to cause a denial of service (memory corruption) via a crafted AVI (no CVSS)
- [CVE-2013-7316](https://cve.now/CVE-2013-7316.md): Cross-site scripting (XSS) vulnerability in GitLab 6.0 and other versions before 6.5.0 allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2013-7317](https://cve.now/CVE-2013-7317.md): Multiple cross-site scripting (XSS) vulnerabilities in CS-Cart before 4.1.1 allow remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2014-0809](https://cve.now/CVE-2014-0809.md): Directory traversal vulnerability in the Gapless Player SimZip (aka Simple Zip Viewer) application before 1.2.1 for Android allows remote at (no CVSS)
- [CVE-2014-1252](https://cve.now/CVE-2014-1252.md): Double free vulnerability in Apple Pages 2.x before 2.1 and 5.x before 5.1 allows remote attackers to execute arbitrary code or cause a deni (no CVSS)
- [CVE-2013-5667](https://cve.now/CVE-2013-5667.md): The Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to execute arbitrary commands via a get\_userid action with shell m (no CVSS)
- [CVE-2013-5668](https://cve.now/CVE-2013-5668.md): The ADS/NT Support page on the Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to discover the administrator credentia (no CVSS)
- [CVE-2013-5669](https://cve.now/CVE-2013-5669.md): The Thecus NAS server N8800 with firmware 5.03.01 uses cleartext credentials for administrative authentication, which allows remote attacker (no CVSS)
- [CVE-2013-6030](https://cve.now/CVE-2013-6030.md): Directory traversal vulnerability on the Emerson Network Power Avocent MergePoint Unity 2016 (aka MPU2016) KVM switch with firmware 1.9.1647 (no CVSS)
- [CVE-2013-7175](https://cve.now/CVE-2013-7175.md): Multiple SQL injection vulnerabilities in Avanset Visual CertExam Manager 3.3 and earlier allow remote authenticated users to execute arbitr (no CVSS)
- [CVE-2014-0674](https://cve.now/CVE-2014-0674.md): Cisco Video Surveillance Operations Manager (VSOM) does not require authentication for MySQL database connections, which allows remote attac (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-01-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.