# CVEs published 2014-02-14

36 CVEs were published on February 14, 2014: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2013-4499](https://cve.now/CVE-2013-4499.md): Cross-site scripting (XSS) vulnerability in the Bean module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2013-5351](https://cve.now/CVE-2013-5351.md): Heap-based buffer overflow in IrfanView before 4.37 allows remote attackers to execute arbitrary code via the LZW code stream in a GIF file. (no CVSS)
- [CVE-2013-7032](https://cve.now/CVE-2013-7032.md): Multiple cross-site scripting (XSS) vulnerabilities in the web based operator client in LiveZilla before 5.1.2.1 allow remote attackers to i (no CVSS)
- [CVE-2013-7326](https://cve.now/CVE-2013-7326.md): Cross-site scripting (XSS) vulnerability in vTiger CRM 5.4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) retu (no CVSS)
- [CVE-2014-0322](https://cve.now/CVE-2014-0322.md): Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving (CVSS 8.8, KEV)
- [CVE-2014-0332](https://cve.now/CVE-2014-0332.md): Cross-site scripting (XSS) vulnerability in mainPage in Dell SonicWALL GMS before 7.1 SP2, SonicWALL Analyzer before 7.1 SP2, and SonicWALL (no CVSS)
- [CVE-2014-0813](https://cve.now/CVE-2014-0813.md): Cross-site request forgery (CSRF) vulnerability in phpMyFAQ before 2.8.6 allows remote attackers to hijack the authentication of arbitrary u (no CVSS)
- [CVE-2014-0814](https://cve.now/CVE-2014-0814.md): Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.8.6 allows remote attackers to inject arbitrary web script or HTML via unspeci (no CVSS)
- [CVE-2012-0052](https://cve.now/CVE-2012-0052.md): Red Hat JBoss Operations Network (JON) before 2.4.2 and 3.0.x before 3.0.1 does not check the JON agent key, which allows remote attackers t (no CVSS)
- [CVE-2012-0062](https://cve.now/CVE-2012-0062.md): Red Hat JBoss Operations Network (JON) before 2.4.2 and 3.0.x before 3.0.1 allows remote attackers to hijack agent sessions via an agent reg (no CVSS)
- [CVE-2012-1100](https://cve.now/CVE-2012-1100.md): Red Hat JBoss Operations Network (JON) 3.0.x before 3.0.1, 2.4.2, and earlier, when LDAP authentication is enabled and the LDAP bind account (no CVSS)
- [CVE-2012-6149](https://cve.now/CVE-2012-6149.md): Multiple cross-site scripting (XSS) vulnerabilities in systems/sdc/notes.jsp in Spacewalk and Red Hat Network (RHN) Satellite 5.6 allow remo (no CVSS)
- [CVE-2013-1871](https://cve.now/CVE-2013-1871.md): Cross-site scripting (XSS) vulnerability in account/EditAddress.do in Spacewalk and Red Hat Network (RHN) Satellite 5.6 allows remote attack (no CVSS)
- [CVE-2013-4415](https://cve.now/CVE-2013-4415.md): Multiple cross-site scripting (XSS) vulnerabilities in Spacewalk and Red Hat Network (RHN) Satellite 5.6 allow remote attackers to inject ar (no CVSS)
- [CVE-2013-6440](https://cve.now/CVE-2013-6440.md): The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set t (no CVSS, org.opensaml:opensaml)
- [CVE-2013-6441](https://cve.now/CVE-2013-6441.md): The lxc-sshd template (templates/lxc-sshd.in) in LXC before 1.0.0.beta2 uses read-write permissions when mounting /sbin/init, which allows l (no CVSS)
- [CVE-2013-6492](https://cve.now/CVE-2013-6492.md): The Piranha Configuration Tool in Piranha 0.8.6 does not properly restrict access to webpages, which allows remote attackers to bypass authe (no CVSS)
- [CVE-2014-0018](https://cve.now/CVE-2014-0018.md): Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.0 and JBoss WildFly Application Server, when run under a security manager, do not (no CVSS)
- [CVE-2014-0032](https://cve.now/CVE-2014-0032.md): The get\_resource function in repos.c in the mod\_dav\_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParent (no CVSS)
- [CVE-2014-1921](https://cve.now/CVE-2014-1921.md): parcimonie before 0.8.1, when using a large keyring, sleeps for the same amount of time between fetches, which allows attackers to correlate (no CVSS)
- [CVE-2014-1948](https://cve.now/CVE-2014-1948.md): OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swif (no CVSS, glance)
- [CVE-2014-1950](https://cve.now/CVE-2014-1950.md): Use-after-free vulnerability in the xc\_cpupool\_getinfo function in Xen 4.1.x through 4.3.x, when using a multithreaded toolstack, does not p (no CVSS)
- [CVE-2014-1960](https://cve.now/CVE-2014-1960.md): The Solution Manager in SAP NetWeaver does not properly restrict access, which allows remote attackers to obtain sensitive information via u (no CVSS)
- [CVE-2014-1961](https://cve.now/CVE-2014-1961.md): Unspecified vulnerability in the Portal WebDynPro in SAP NetWeaver allows remote attackers to obtain sensitive path information via unknown (no CVSS)
- [CVE-2014-1962](https://cve.now/CVE-2014-1962.md): Gwsync in SAP CRM 7.02 EHP 2 allows remote attackers to obtain sensitive information via unspecified vectors, related to an XML External Ent (no CVSS)
- [CVE-2014-1963](https://cve.now/CVE-2014-1963.md): Unspecified vulnerability in Message Server in SAP NetWeaver 7.20 allows remote attackers to cause a denial of service via unknown attack ve (no CVSS)
- [CVE-2014-1964](https://cve.now/CVE-2014-1964.md): Cross-site scripting (XSS) vulnerability in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component in SAP NetWeaver (no CVSS)
- [CVE-2014-1965](https://cve.now/CVE-2014-1965.md): Cross-site scripting (XSS) vulnerability in ISpeakAdapter in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component (no CVSS)
- [CVE-2013-5014](https://cve.now/CVE-2013-5014.md): The management console in Symantec Endpoint Protection Manager (SEPM) 11.0 before 11.0.7405.1424 and 12.1 before 12.1.4023.4080, and Symante (no CVSS)
- [CVE-2013-5015](https://cve.now/CVE-2013-5015.md): SQL injection vulnerability in the management console in Symantec Endpoint Protection Manager (SEPM) 11.0 before 11.0.7405.1424 and 12.1 bef (no CVSS)
- [CVE-2013-5400](https://cve.now/CVE-2013-5400.md): An unspecified servlet in IBM Platform Symphony Developer Edition (DE) 5.2 and 6.1.x through 6.1.1 has hardcoded credentials, which allows r (no CVSS)
- [CVE-2013-6722](https://cve.now/CVE-2013-6722.md): Unrestricted file upload vulnerability in the Registration/Edit My Profile portlet in IBM WebSphere Portal 7.x before 7.0.0.2 CF27 and 8.x t (no CVSS)
- [CVE-2013-6728](https://cve.now/CVE-2013-6728.md): The charting component in IBM WebSphere Dashboard Framework (WDF) 6.1.5 and 7.0.1 allows remote attackers to view or delete image files by l (no CVSS)
- [CVE-2014-0855](https://cve.now/CVE-2014-0855.md): Multiple cross-site scripting (XSS) vulnerabilities in IBM Connections Portlets 4.x before 4.5.1 FP1 for IBM WebSphere Portal 7.0.0.2 and 8. (no CVSS)
- [CVE-2014-1467](https://cve.now/CVE-2014-1467.md): BlackBerry Enterprise Service 10 before 10.2.1, Universal Device Service 6, Enterprise Server Express for Domino through 5.0.4, Enterprise S (no CVSS)
- [CVE-2014-1680](https://cve.now/CVE-2014-1680.md): Untrusted search path vulnerability in Bandisoft Bandizip before 3.10 allows local users to gain privileges via a Trojan horse dwmapi.dll fi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-02-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.