# CVEs published 2014-02-05

23 CVEs were published on February 5, 2014: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2011-3377](https://cve.now/CVE-2011-3377.md): The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (S (no CVSS)
- [CVE-2011-4613](https://cve.now/CVE-2011-4613.md): The X.Org X wrapper (xserver-wrapper.c) in Debian GNU/Linux and Ubuntu Linux does not properly verify the TTY of a user who is starting X, w (no CVSS)
- [CVE-2013-2074](https://cve.now/CVE-2013-2074.md): kioslave/http/http.cpp in KIO in kdelibs 4.10.3 and earlier allows attackers to discover credentials via a crafted request that triggers an (no CVSS)
- [CVE-2014-1439](https://cve.now/CVE-2014-1439.md): The libxml\_disable\_entity\_loader function in runtime/ext/ext\_simplexml.cpp in HipHop Virtual Machine for PHP (HHVM) before 2.4.0 and 2.3.x b (no CVSS)
- [CVE-2011-1594](https://cve.now/CVE-2011-1594.md): Spacewalk: spacewalk: open redirect vulnerability enables phishing attacks via url parameter (CVSS 6.5, Red Hat Network Satellite Server v · Red Hat Enterprise Lin…)
- [CVE-2011-2919](https://cve.now/CVE-2011-2919.md): Cross-site scripting (XSS) vulnerability in Spacewalk 1.6, as used in Red Hat Network (RHN) Satellite, allows remote attackers to inject arb (no CVSS)
- [CVE-2011-2920](https://cve.now/CVE-2011-2920.md): Spacewalk: spacewalk: cross-site scripting vulnerability allows arbitrary web script execution. (CVSS 5.5, Red Hat Network Satellite Server v · Red Hat Enterprise Lin…)
- [CVE-2011-2927](https://cve.now/CVE-2011-2927.md): Spacewalk: spacewalk and red hat network satellite: cross-site scripting vulnerability via search forms (CVSS 5.4, Red Hat Network Satellite Server v · Red Hat Enterprise Lin…)
- [CVE-2011-3344](https://cve.now/CVE-2011-3344.md): Spacewalk: spacewalk: cross-site scripting via uri in lookup login/password form (CVSS 5.4, Red Hat Network Satellite Server v · Red Hat Enterprise Lin…)
- [CVE-2012-0059](https://cve.now/CVE-2012-0059.md): Spacewalk-backend: spacewalk-backend: information disclosure via cleartext passwords in error messages (CVSS 4.9, Red Hat Network Proxy v · Red Hat Network Satellite Serv… +1)
- [CVE-2013-1880](https://cve.now/CVE-2013-1880.md): Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allo (no CVSS, org.apache.activemq:activemq-core)
- [CVE-2013-4449](https://cve.now/CVE-2013-4449.md): The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial (no CVSS)
- [CVE-2014-1833](https://cve.now/CVE-2014-1833.md): Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar (no CVSS)
- [CVE-2013-1466](https://cve.now/CVE-2013-1466.md): Multiple cross-site scripting (XSS) vulnerabilities in glFusion before 1.2.2.pl4 allow remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2013-1470](https://cve.now/CVE-2013-1470.md): Cross-site scripting (XSS) vulnerability in calendar/index.php in the Calendar plugin in Geeklog before 1.8.2sr1 and 2.0.0 before 2.0.0rc2 a (no CVSS)
- [CVE-2013-1852](https://cve.now/CVE-2013-1852.md): SQL injection vulnerability in leaguemanager.php in the LeagueManager plugin before 3.8.1 for WordPress allows remote attackers to execute a (no CVSS)
- [CVE-2013-1967](https://cve.now/CVE-2013-1967.md): Cross-site scripting (XSS) vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2, as used in ownCloud Server 5.0.x before (no CVSS)
- [CVE-2013-2691](https://cve.now/CVE-2013-2691.md): Stack-based buffer overflow in the JetMPG.ax module in jetAudio 8.0.17 allows remote attackers to execute arbitrary code via a crafted MPEG2 (no CVSS)
- [CVE-2013-3639](https://cve.now/CVE-2013-3639.md): Multiple cross-site scripting (XSS) vulnerabilities in Xaraya 2.4.0-b1 and earlier allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2013-4978](https://cve.now/CVE-2013-4978.md): Stack-based buffer overflow in AloahaPDFViewer 5.0.0.7 and earlier in Aloaha PDF Suite FREE allows remote attackers to execute arbitrary cod (no CVSS)
- [CVE-2014-1403](https://cve.now/CVE-2014-1403.md): Cross-site scripting (XSS) vulnerability in name.html in easyXDM before 2.4.19 allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2014-0497](https://cve.now/CVE-2014-0497.md): Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 1 (CVSS 8.8, KEV)
- [CVE-2014-0755](https://cve.now/CVE-2014-0755.md): Rockwell RSLogix 5000 Insufficiently Protected Credentials (no CVSS, Rockwell Automation RSLogix 5000 software)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-02-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.