# CVEs published 2014-01-26

28 CVEs were published on January 26, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2013-4304](https://cve.now/CVE-2013-4304.md): The CentralAuth extension for MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 caches a valid CentralAuthUser (no CVSS)
- [CVE-2013-6466](https://cve.now/CVE-2013-6466.md): Openswan 2.6.39 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 (no CVSS)
- [CVE-2013-6467](https://cve.now/CVE-2013-6467.md): Libreswan 3.7 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 p (no CVSS)
- [CVE-2013-7140](https://cve.now/CVE-2013-7140.md): XML External Entity (XXE) vulnerability in the CalDAV interface in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote authenticated (no CVSS)
- [CVE-2013-7141](https://cve.now/CVE-2013-7141.md): Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2013-7142](https://cve.now/CVE-2013-7142.md): Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2013-7143](https://cve.now/CVE-2013-7143.md): Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.4.1 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2013-7298](https://cve.now/CVE-2013-7298.md): query\_params.cpp in cxxtools before 2.2.1 allows remote attackers to cause a denial of service (infinite recursion and crash) via an HTTP qu (no CVSS)
- [CVE-2013-7299](https://cve.now/CVE-2013-7299.md): framework/common/messageheaderparser.cpp in Tntnet before 2.2.1 allows remote attackers to obtain sensitive information via a header that en (no CVSS)
- [CVE-2014-0794](https://cve.now/CVE-2014-0794.md): SQL injection vulnerability in the JV Comment (com\_jvcomment) component before 3.0.3 for Joomla! allows remote authenticated users to execut (no CVSS)
- [CVE-2014-1607](https://cve.now/CVE-2014-1607.md): Cross-site scripting (XSS) vulnerability in the EventCalendar module for Drupal 7.14 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2014-1664](https://cve.now/CVE-2014-1664.md): The Citrix GoToMeeting application 5.0.799.1238 for Android logs HTTP requests containing sensitive information, which allows attackers to o (no CVSS)
- [CVE-2013-6429](https://cve.now/CVE-2013-6429.md): The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entit (no CVSS, org.springframework:spring-web)
- [CVE-2014-0022](https://cve.now/CVE-2014-0022.md): The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg fun (no CVSS)
- [CVE-2014-1642](https://cve.now/CVE-2014-1642.md): The IRQ setup in Xen 4.2.x and 4.3.x, when using device passthrough and configured to support a large number of CPUs, frees certain memory t (no CVSS)
- [CVE-2014-1666](https://cve.now/CVE-2014-1666.md): The do\_physdev\_op function in Xen 4.1.5, 4.1.6.1, 4.2.2 through 4.2.3, and 4.3.x does not properly restrict access to the (1) PHYSDEVOP\_prep (no CVSS)
- [CVE-2013-5364](https://cve.now/CVE-2013-5364.md): Secunia CSI Agent 6.0.0.15017 and earlier, 6.0.1.1007 and earlier, and 7.0.0.21 and earlier, when running on Red Hat Linux, uses world-reada (no CVSS)
- [CVE-2013-6853](https://cve.now/CVE-2013-6853.md): Cross-site scripting (XSS) vulnerability in clickstream.js in Y! Toolbar plugin for FireFox 3.1.0.20130813024103 for Mac, and 2.5.9.20134181 (no CVSS)
- [CVE-2013-6891](https://cve.now/CVE-2013-6891.md): lppasswd in CUPS before 1.7.1, when running with setuid privileges, allows local users to read portions of arbitrary files via a modified HO (no CVSS)
- [CVE-2013-7137](https://cve.now/CVE-2013-7137.md): The "remember me" functionality in login.php in Burden before 1.8.1 allows remote attackers to bypass authentication and gain privileges by (no CVSS)
- [CVE-2013-7247](https://cve.now/CVE-2013-7247.md): cgi-bin/tsaws.cgi in Franklin Fueling Systems TS-550 evo with firmware 2.0.0.6833 and other versions before 2.4.0 allows remote attackers to (no CVSS)
- [CVE-2013-7248](https://cve.now/CVE-2013-7248.md): Franklin Fueling Systems TS-550 evo with firmware 2.0.0.6833 and other versions before 2.4.0 has a hardcoded password for the roleDiag accou (no CVSS)
- [CVE-2013-7296](https://cve.now/CVE-2013-7296.md): The JBIG2Stream::readSegments method in JBIG2Stream.cc in Poppler before 0.24.5 does not use the correct specifier within a format string, w (no CVSS)
- [CVE-2014-0027](https://cve.now/CVE-2014-0027.md): The play\_wave\_from\_socket function in audio/auserver.c in Flite 1.4 allows local users to modify arbitrary files via a symlink attack on /tm (no CVSS)
- [CVE-2014-1626](https://cve.now/CVE-2014-1626.md): XML External Entity (XXE) vulnerability in MARC::File::XML module before 1.0.2 for Perl, as used in Evergreen, Koha, perl4lib, and possibly (no CVSS)
- [CVE-2014-1671](https://cve.now/CVE-2014-1671.md): Multiple SQL injection vulnerabilities in Dell KACE K1000 5.4.76847 and possibly earlier allow remote attackers or remote authenticated user (no CVSS)
- [CVE-2014-1672](https://cve.now/CVE-2014-1672.md): Check Point R75.47 Security Gateway and Management Server does not properly enforce Anti-Spoofing when the routing table is modified and the (no CVSS)
- [CVE-2014-1673](https://cve.now/CVE-2014-1673.md): Check Point Session Authentication Agent allows remote attackers to obtain sensitive information (user credentials) via unspecified vectors. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-01-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.