# CVEs published 2014-01-29

23 CVEs were published on January 29, 2014: 0 critical, 1 high. Days are UTC.

- [CVE-2012-6086](https://cve.now/CVE-2012-6086.md): libs/zbxmedia/eztexting.c in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.8rc1, and 2.1.x before 2.1.2 does not properly set the CURLOPT\_ (no CVSS)
- [CVE-2013-2747](https://cve.now/CVE-2013-2747.md): The password reset feature in Courion Access Risk Management Suite Version 8 Update 9 allows remote authenticated users to bypass intended I (no CVSS)
- [CVE-2013-4661](https://cve.now/CVE-2013-4661.md): CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control (RBAC) restrictions for default cust (no CVSS)
- [CVE-2013-4662](https://cve.now/CVE-2013-4662.md): The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer (no CVSS, civicrm/civicrm-core)
- [CVE-2013-4887](https://cve.now/CVE-2013-4887.md): SQL injection vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to execute arbitrary SQL commands via the dis (no CVSS)
- [CVE-2013-4888](https://cve.now/CVE-2013-4888.md): Cross-site scripting (XSS) vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2013-4889](https://cve.now/CVE-2013-4889.md): Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in Digital Signage Xibo 1.4.2 allow remote attackers to hijack the a (no CVSS)
- [CVE-2013-4898](https://cve.now/CVE-2013-4898.md): Unrestricted file upload vulnerability in the user profile page feature in the Timeline Plugin 4.2.5p9 for SocialEngine allows remote authen (no CVSS)
- [CVE-2013-5005](https://cve.now/CVE-2013-5005.md): Multiple cross-site scripting (XSS) vulnerabilities in ajaxRequest/methodCall.do in Tripwire Enterprise 8.2 and earlier allow remote attacke (no CVSS)
- [CVE-2013-5092](https://cve.now/CVE-2013-5092.md): Cross-site scripting (XSS) vulnerability in afa/php/Login.php in AlgoSec Firewall Analyzer 6.1-b86 allows remote attackers to inject arbitra (no CVSS)
- [CVE-2013-6141](https://cve.now/CVE-2013-6141.md): Unspecified vulnerability in op5 Monitor before 6.1.3 allows attackers to read arbitrary files via unknown vectors related to lack of author (no CVSS)
- [CVE-2013-7318](https://cve.now/CVE-2013-7318.md): Cross-site scripting (XSS) vulnerability in BusinessFlow/login in AlgoSec Firewall Analyzer 6.4 allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2014-1683](https://cve.now/CVE-2014-1683.md): The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid pa (no CVSS)
- [CVE-2014-0680](https://cve.now/CVE-2014-0680.md): Cross-site scripting (XSS) vulnerability in the HTTP control interface in the NAC Web Agent component in Cisco Identity Services Engine (ISE (no CVSS)
- [CVE-2014-0681](https://cve.now/CVE-2014-0681.md): Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine (ISE) 1.2 patch 2 and earlier allows remote attackers to inject a (no CVSS)
- [CVE-2014-0682](https://cve.now/CVE-2014-0682.md): Cisco WebEx Meetings Server allows remote authenticated users to bypass authorization checks and (1) join arbitrary meetings, or (2) termina (no CVSS)
- [CVE-2014-1692](https://cve.now/CVE-2014-1692.md): The hash\_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initiali (CVSS 7.3)
- [CVE-2013-2974](https://cve.now/CVE-2013-2974.md): The BIRT viewer in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.2.1.x before 7.2.1.5 allows remote authenticated users to b (no CVSS)
- [CVE-2013-6748](https://cve.now/CVE-2013-6748.md): Buffer overflow in the ActiveX control in qp2.cab in IBM Lotus Quickr for Domino 8.5.1 before 8.5.1.42-001b allows remote attackers to execu (no CVSS)
- [CVE-2013-6749](https://cve.now/CVE-2013-6749.md): Buffer overflow in the ActiveX control in qp2.cab in IBM Lotus Quickr for Domino 8.5.1 before 8.5.1.42-001b allows remote attackers to execu (no CVSS)
- [CVE-2013-6930](https://cve.now/CVE-2013-6930.md): SQL injection vulnerability in the page-navigation implementation in Cybozu Garoon 2.0.0 through 2.0.6, 2.1.0 through 2.1.3, 2.5.0 through 2 (no CVSS)
- [CVE-2013-6931](https://cve.now/CVE-2013-6931.md): SQL injection vulnerability in the API in Cybozu Garoon 3.7.x before 3.7.3 allows remote authenticated users to execute arbitrary SQL comman (no CVSS)
- [CVE-2014-0810](https://cve.now/CVE-2014-0810.md): Unspecified vulnerability in JustSystems Sanshiro 2007 before update 3, 2008 before update 5, 2009 before update 6, and 2010 before update 6 (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-01-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.