# CVEs published 2014-02-27

49 CVEs were published on February 27, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-0333](https://cve.now/CVE-2014-0333.md): The png\_push\_read\_chunk function in pngpread.c in the progressive decoder in libpng 1.6.x through 1.6.9 allows remote attackers to cause a d (no CVSS)
- [CVE-2014-0679](https://cve.now/CVE-2014-0679.md): Cisco Prime Infrastructure 1.2 and 1.3 before 1.3.0.20-2, 1.4 before 1.4.0.45-2, and 2.0 before 2.0.0.0.294-2 allows remote authenticated us (no CVSS)
- [CVE-2014-0858](https://cve.now/CVE-2014-0858.md): IBM Content Navigator 2.x before 2.0.2.2-ICN-FP002 allows remote authenticated users to bypass intended access restrictions and conduct dele (no CVSS)
- [CVE-2014-2103](https://cve.now/CVE-2014-2103.md): Cisco Intrusion Prevention System (IPS) Software allows remote attackers to cause a denial of service (MainApp process outage) via malformed (no CVSS)
- [CVE-2014-0046](https://cve.now/CVE-2014-0046.md): Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-be (no CVSS, ember-source)
- [CVE-2014-1223](https://cve.now/CVE-2014-1223.md): Cross-site scripting (XSS) vulnerability in controlpanel/loading.aspx in Telligent Evolution before 6.1.19.36103, 7.x before 7.1.12.36162, 7 (no CVSS)
- [CVE-2014-1597](https://cve.now/CVE-2014-1597.md): SQL injection vulnerability in the CMDB web application in synetics i-doit pro before 1.2.5 and i-doit open allows remote attackers to execu (no CVSS)
- [CVE-2014-1854](https://cve.now/CVE-2014-1854.md): SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3. (no CVSS)
- [CVE-2014-2035](https://cve.now/CVE-2014-2035.md): Cross-site scripting (XSS) vulnerability in xhr.php in InterWorx Web Control Panel (aka InterWorx Hosting Control Panel and InterWorx-CP) be (no CVSS)
- [CVE-2014-2231](https://cve.now/CVE-2014-2231.md): Cross-site scripting (XSS) vulnerability in the API in synetics i-doit pro before 1.2.5 allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2014-2075](https://cve.now/CVE-2014-2075.md): TIBCO Enterprise Administrator 1.0.0 and Enterprise Administrator SDK 1.0.0 do not properly enforce administrative authentication requiremen (no CVSS)
- [CVE-2014-0740](https://cve.now/CVE-2014-0740.md): Cross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (CAR) interface in the OS Administration c (no CVSS)
- [CVE-2014-0741](https://cve.now/CVE-2014-0741.md): The certificate-import feature in the Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications Manager (no CVSS)
- [CVE-2014-0742](https://cve.now/CVE-2014-0742.md): The Certificate Authority Proxy Function (CAPF) CLI implementation in the CSR management feature in Cisco Unified Communications Manager (Un (no CVSS)
- [CVE-2014-0743](https://cve.now/CVE-2014-0743.md): The Certificate Authority Proxy Function (CAPF) component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows re (no CVSS)
- [CVE-2014-0745](https://cve.now/CVE-2014-0745.md): Cross-site request forgery (CSRF) vulnerability in the Unified Serviceability subsystem in Cisco Unified Contact Center Express (Unified CCX (no CVSS)
- [CVE-2014-0746](https://cve.now/CVE-2014-0746.md): The disaster recovery system (DRS) in Cisco Unified Contact Center Express (Unified CCX) allows remote authenticated users to obtain sensiti (no CVSS)
- [CVE-2014-0747](https://cve.now/CVE-2014-0747.md): The Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier (no CVSS)
- [CVE-2014-0816](https://cve.now/CVE-2014-0816.md): Unspecified vulnerability in Norman Security Suite 10.1 and earlier allows local users to gain privileges via unknown vectors. (no CVSS)
- [CVE-2014-0817](https://cve.now/CVE-2014-0817.md): Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impers (no CVSS)
- [CVE-2014-0820](https://cve.now/CVE-2014-0820.md): Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authentic (no CVSS)
- [CVE-2014-0821](https://cve.now/CVE-2014-0821.md): SQL injection vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated u (no CVSS)
- [CVE-2014-1243](https://cve.now/CVE-2014-1243.md): Apple QuickTime before 7.7.5 does not initialize an unspecified pointer, which allows remote attackers to execute arbitrary code or cause a (no CVSS)
- [CVE-2014-1244](https://cve.now/CVE-2014-1244.md): Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application (no CVSS)
- [CVE-2014-1245](https://cve.now/CVE-2014-1245.md): Integer signedness error in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (app (no CVSS)
- [CVE-2014-1246](https://cve.now/CVE-2014-1246.md): Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application (no CVSS)
- [CVE-2014-1247](https://cve.now/CVE-2014-1247.md): Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and applicati (no CVSS)
- [CVE-2014-1248](https://cve.now/CVE-2014-1248.md): Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application (no CVSS)
- [CVE-2014-1249](https://cve.now/CVE-2014-1249.md): Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application (no CVSS)
- [CVE-2014-1250](https://cve.now/CVE-2014-1250.md): Apple QuickTime before 7.7.5 does not properly perform a byte-swapping operation, which allows remote attackers to execute arbitrary code or (no CVSS)
- [CVE-2014-1251](https://cve.now/CVE-2014-1251.md): Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application (no CVSS)
- [CVE-2014-1254](https://cve.now/CVE-2014-1254.md): Apple Type Services (ATS) in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory (no CVSS)
- [CVE-2014-1255](https://cve.now/CVE-2014-1255.md): Apple Type Services (ATS) in Apple OS X before 10.9.2 does not properly validate calls to the free function, which allows attackers to bypas (no CVSS)
- [CVE-2014-1256](https://cve.now/CVE-2014-1256.md): Buffer overflow in Apple Type Services (ATS) in Apple OS X before 10.9.2 allows attackers to bypass the App Sandbox protection mechanism via (no CVSS)
- [CVE-2014-1257](https://cve.now/CVE-2014-1257.md): CFNetwork in Apple OS X through 10.8.5 does not remove session cookies upon a Safari reset action, which allows physically proximate attacke (no CVSS)
- [CVE-2014-1258](https://cve.now/CVE-2014-1258.md): Heap-based buffer overflow in CoreAnimation in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial (no CVSS)
- [CVE-2014-1259](https://cve.now/CVE-2014-1259.md): Buffer overflow in File Bookmark in Apple OS X before 10.9.2 allows attackers to execute arbitrary code or cause a denial of service (applic (no CVSS)
- [CVE-2014-1260](https://cve.now/CVE-2014-1260.md): QuickLook in Apple OS X through 10.8.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and (no CVSS)
- [CVE-2014-1261](https://cve.now/CVE-2014-1261.md): Integer signedness error in CoreText in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of serv (no CVSS)
- [CVE-2014-1262](https://cve.now/CVE-2014-1262.md): Apple Type Services (ATS) in Apple OS X before 10.9.2 allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messa (no CVSS)
- [CVE-2014-1263](https://cve.now/CVE-2014-1263.md): curl and libcurl 7.27.0 through 7.35.0, when using the SecureTransport/Darwinssl backend, as used in in Apple OS X 10.9.x before 10.9.2, doe (no CVSS)
- [CVE-2014-1264](https://cve.now/CVE-2014-1264.md): Finder in Apple OS X before 10.9.2 does not ensure ACL integrity after the viewing of file ACL information, which allows local users to bypa (no CVSS)
- [CVE-2014-1265](https://cve.now/CVE-2014-1265.md): The systemsetup program in the Date and Time subsystem in Apple OS X before 10.9.2 allows local users to bypass intended access restrictions (no CVSS)
- [CVE-2014-1268](https://cve.now/CVE-2014-1268.md): WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS)
- [CVE-2014-1269](https://cve.now/CVE-2014-1269.md): WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS)
- [CVE-2014-1270](https://cve.now/CVE-2014-1270.md): WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS)
- [CVE-2014-1967](https://cve.now/CVE-2014-1967.md): The Denny's application before 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attacke (no CVSS)
- [CVE-2014-1968](https://cve.now/CVE-2014-1968.md): Cross-site scripting (XSS) vulnerability in the XooNIps module 3.47 and earlier for XOOPS allows remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2014-2102](https://cve.now/CVE-2014-2102.md): Cisco Unified Contact Center Express (Unified CCX) does not properly restrict the content of the CCMConfig page, which allows remote authent (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-02-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.