# CVEs published 2014-03-07

18 CVEs were published on March 7, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2013-1890](https://cve.now/CVE-2013-1890.md): Multiple cross-site scripting (XSS) vulnerabilities in ownCloud Server before 5.0.1 allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2013-1893](https://cve.now/CVE-2013-1893.md): SQL injection vulnerability in addressbookprovider.php in ownCloud Server before 5.0.1 allows remote authenticated users to execute arbitrar (no CVSS)
- [CVE-2013-2045](https://cve.now/CVE-2013-2045.md): SQL injection vulnerability in lib/db.php in ownCloud Server 5.0.x before 5.0.6 allows remote authenticated users to execute arbitrary SQL c (no CVSS)
- [CVE-2013-2046](https://cve.now/CVE-2013-2046.md): SQL injection vulnerability in lib/bookmarks.php in ownCloud Server 4.5.x before 4.5.11 and 5.x before 5.0.6 allows remote authenticated use (no CVSS)
- [CVE-2013-2270](https://cve.now/CVE-2013-2270.md): Cross-site scripting (XSS) vulnerability in the administration page in Airvana HubBub C1-600-RT and Sprint AIRAVE 2.5 allows remote attacker (no CVSS)
- [CVE-2013-4966](https://cve.now/CVE-2013-4966.md): The master external node classification script in Puppet Enterprise before 3.2.0 does not verify the identity of consoles, which allows remo (no CVSS)
- [CVE-2013-4971](https://cve.now/CVE-2013-4971.md): Puppet Enterprise before 3.2.0 does not properly restrict access to node endpoints in the console, which allows remote attackers to obtain s (no CVSS)
- [CVE-2013-6232](https://cve.now/CVE-2013-6232.md): Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2013-6233](https://cve.now/CVE-2013-6233.md): Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2013-7322](https://cve.now/CVE-2013-7322.md): usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password (OTP) type and a (no CVSS)
- [CVE-2014-1599](https://cve.now/CVE-2014-1599.md): Multiple cross-site scripting (XSS) vulnerabilities in the SFR Box router with firmware NB6-MAIN-R3.3.4 allow remote attackers to inject arb (no CVSS)
- [CVE-2014-1944](https://cve.now/CVE-2014-1944.md): Cross-site scripting (XSS) vulnerability in Ilch CMS 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2014-1945](https://cve.now/CVE-2014-1945.md): SQL injection vulnerability in ajax\_udf.php in OpenDocMan before 1.2.7.2 allows remote attackers to execute arbitrary SQL commands via the a (no CVSS)
- [CVE-2014-2313](https://cve.now/CVE-2014-2313.md): Directory traversal vulnerability in the Importers plugin in Atlassian JIRA before 6.0.5 allows remote attackers to create arbitrary files v (no CVSS)
- [CVE-2014-2314](https://cve.now/CVE-2014-2314.md): Directory traversal vulnerability in the Issue Collector plugin in Atlassian JIRA before 6.0.4 allows remote attackers to create arbitrary f (no CVSS)
- [CVE-2014-2315](https://cve.now/CVE-2014-2315.md): Multiple cross-site scripting (XSS) vulnerabilities in the Thank You Counter Button plugin 1.8.7 for WordPress allow remote attackers to inj (no CVSS)
- [CVE-2014-2316](https://cve.now/CVE-2014-2316.md): SQL injection vulnerability in se\_search\_default in the Search Everything plugin before 7.0.3 for WordPress allows remote attackers to execu (no CVSS)
- [CVE-2014-2317](https://cve.now/CVE-2014-2317.md): SQL injection vulnerability in ajax\_udf.php in OpenDocMan before 1.2.7.2 allows remote attackers to execute arbitrary SQL commands via the t (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-03-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.