# CVEs published 2014-03-03

25 CVEs were published on March 3, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-2040](https://cve.now/CVE-2014-2040.md): Multiple cross-site scripting (XSS) vulnerabilities in the (1) callback\_multicheck, (2) callback\_radio, and (3) callback\_wysiwygin functions (no CVSS)
- [CVE-2011-4696](https://cve.now/CVE-2011-4696.md): Directory traversal vulnerability in Eye-Fi Helper before 3.4.23 allows man-in-the-middle attackers to create arbitrary files via a .. (no CVSS)
- [CVE-2013-1409](https://cve.now/CVE-2013-1409.md): Cross-site scripting (XSS) vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2013-3259](https://cve.now/CVE-2013-3259.md): Stack-based buffer overflow in INMATRIX Zoom Player before 8.7 beta 11 allows remote attackers to execute arbitrary code via a large biClrUs (no CVSS)
- [CVE-2013-3260](https://cve.now/CVE-2013-3260.md): Heap-based buffer overflow in INMATRIX Zoom Player before 8.7 beta 11 allows remote attackers to execute arbitrary code via a large biClrUse (no CVSS)
- [CVE-2013-3487](https://cve.now/CVE-2013-3487.md): Multiple cross-site scripting (XSS) vulnerabilities in the security log in the BulletProof Security plugin before .49 for WordPress allow re (no CVSS)
- [CVE-2013-4977](https://cve.now/CVE-2013-4977.md): Buffer overflow in the RTSP Packet Handler in Hikvision DS-2CD7153-E IP camera with firmware 4.1.0 b130111 (Jan 2013), and possibly other de (no CVSS)
- [CVE-2013-4980](https://cve.now/CVE-2013-4980.md): Buffer overflow in the RTSP Packet Handler in AVTECH AVN801 DVR with firmware 1017-1003-1009-1003 and earlier, and possibly other devices, a (no CVSS)
- [CVE-2013-4981](https://cve.now/CVE-2013-4981.md): Buffer overflow in cgi-bin/user/Config.cgi in AVTECH AVN801 DVR with firmware 1017-1003-1009-1003 and earlier, and possibly other devices, a (no CVSS)
- [CVE-2013-6493](https://cve.now/CVE-2013-6493.md): The LiveConnect implementation in plugin/icedteanp/IcedTeaNPPlugin.cc in IcedTea-Web before 1.4.2 allows local users to read the messages be (no CVSS)
- [CVE-2014-1684](https://cve.now/CVE-2014-1684.md): The ASF\_ReadObject\_file\_properties function in modules/demux/asf/libasf.c in the ASF Demuxer in VideoLAN VLC Media Player before 2.1.3 allow (no CVSS)
- [CVE-2014-1840](https://cve.now/CVE-2014-1840.md): Cross-site scripting (XSS) vulnerability in Upload/search.php in MyBB 1.6.12 and earlier allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2014-2013](https://cve.now/CVE-2014-2013.md): Stack-based buffer overflow in the xps\_parse\_color function in xps/xps-common.c in MuPDF 1.3 and earlier allows remote attackers to execute (no CVSS)
- [CVE-2014-2211](https://cve.now/CVE-2014-2211.md): SQL injection vulnerability in portal/addtoapplication.php in POSH (aka Posh portal or Portaneo) 3.0 before 3.3.0 allows remote attackers to (no CVSS)
- [CVE-2012-6636](https://cve.now/CVE-2012-6636.md): The Android API before 17 does not properly restrict the WebView.addJavascriptInterface method, which allows remote attackers to execute arb (no CVSS)
- [CVE-2012-6637](https://cve.now/CVE-2012-6637.md): Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier do not anchor the end of domain-name regular expressions, which allows (no CVSS)
- [CVE-2013-4710](https://cve.now/CVE-2013-4710.md): Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView c (no CVSS)
- [CVE-2014-1881](https://cve.now/CVE-2014-1881.md): Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions (no CVSS)
- [CVE-2014-1882](https://cve.now/CVE-2014-1882.md): Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions (no CVSS)
- [CVE-2014-1883](https://cve.now/CVE-2014-1883.md): Adobe PhoneGap before 2.6.0 on Android uses the shouldOverrideUrlLoading callback instead of the proper shouldInterceptRequest callback, whi (no CVSS)
- [CVE-2014-1884](https://cve.now/CVE-2014-1884.md): Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, w (no CVSS)
- [CVE-2014-1885](https://cve.now/CVE-2014-1885.md): The ForzeArmate application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScri (no CVSS)
- [CVE-2014-1886](https://cve.now/CVE-2014-1886.md): The Edinburgh by Bus application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary Jav (no CVSS)
- [CVE-2014-1887](https://cve.now/CVE-2014-1887.md): The DrinkedIn BarFinder application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2014-1939](https://cve.now/CVE-2014-1939.md): java/android/webkit/BrowserFrame.java in Android before 4.4 uses the addJavascriptInterface API in conjunction with creating an object of th (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-03-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.