# CVEs published 2014-03-11

42 CVEs were published on March 11, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2013-7334](https://cve.now/CVE-2013-7334.md): Cross-site request forgery (CSRF) vulnerability in ImageCMS before 4.2 allows remote attackers to hijack the authentication of administrator (no CVSS)
- [CVE-2012-6290](https://cve.now/CVE-2012-6290.md): SQL injection vulnerability in ImageCMS before 4.2 allows remote authenticated administrators to execute arbitrary SQL commands via the q pa (no CVSS)
- [CVE-2013-2289](https://cve.now/CVE-2013-2289.md): Cross-site scripting (XSS) vulnerability in admin/templates/default.php in Batavi 1.2.2 allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2013-2754](https://cve.now/CVE-2013-2754.md): Cross-site request forgery (CSRF) vulnerability in Umisoft UMI.CMS before 2.9 build 21905 allows remote attackers to hijack the authenticati (no CVSS)
- [CVE-2013-3928](https://cve.now/CVE-2013-3928.md): Stack-based buffer overflow in the ReadFile function in flt\_BMP.dll in Chasys Draw IES before 4.11.02 allows remote attackers to execute arb (no CVSS)
- [CVE-2013-3961](https://cve.now/CVE-2013-3961.md): SQL injection vulnerability in edit\_event.php in Simple PHP Agenda before 2.2.9 allows remote authenticated users to execute arbitrary SQL c (no CVSS)
- [CVE-2013-4188](https://cve.now/CVE-2013-4188.md): traverser.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers with administrator privileges to (no CVSS, plone)
- [CVE-2013-4189](https://cve.now/CVE-2013-4189.md): Multiple unspecified vulnerabilities in (1) dataitems.py, (2) get.py, and (3) traverseName.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, (no CVSS, plone)
- [CVE-2013-4190](https://cve.now/CVE-2013-4190.md): Multiple cross-site scripting (XSS) vulnerabilities in (1) spamProtect.py, (2) pts.py, and (3) request.py in Plone 2.1 through 4.1, 4.2.x th (no CVSS, plone)
- [CVE-2013-4191](https://cve.now/CVE-2013-4191.md): zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including c (no CVSS, plone)
- [CVE-2013-4192](https://cve.now/CVE-2013-4192.md): sendto.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to spoof emails via unspe (no CVSS, plone)
- [CVE-2013-4193](https://cve.now/CVE-2013-4193.md): typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting on uns (no CVSS, plone)
- [CVE-2013-4194](https://cve.now/CVE-2013-4194.md): The WYSIWYG component (wysiwyg.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers to obtain (no CVSS, plone)
- [CVE-2013-4195](https://cve.now/CVE-2013-4195.md): Multiple open redirect vulnerabilities in (1) marmoset\_patch.py, (2) publish.py, and (3) principiaredirect.py in Plone 2.1 through 4.1, 4.2. (no CVSS, plone)
- [CVE-2013-4196](https://cve.now/CVE-2013-4196.md): The object manager implementation (objectmanager.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properl (no CVSS, plone)
- [CVE-2013-4197](https://cve.now/CVE-2013-4197.md): member\_portrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or del (no CVSS, plone)
- [CVE-2013-4198](https://cve.now/CVE-2013-4198.md): mail\_password.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the proh (no CVSS, plone)
- [CVE-2013-4199](https://cve.now/CVE-2013-4199.md): (1) cb\_decode.py and (2) linkintegrity.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated (no CVSS, plone)
- [CVE-2013-4413](https://cve.now/CVE-2013-4413.md): Directory traversal vulnerability in controller/concerns/render\_redirect.rb in the Wicked gem before 1.0.1 for Ruby allows remote attackers (no CVSS, wicked)
- [CVE-2013-4433](https://cve.now/CVE-2013-4433.md): Cross-site scripting (XSS) vulnerability in XHProf before 0.9.4 allows remote attackers to inject arbitrary web script or HTML via the run p (no CVSS)
- [CVE-2013-4467](https://cve.now/CVE-2013-4467.md): Multiple SQL injection vulnerabilities in the agent interface (agc/) in VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and (no CVSS)
- [CVE-2013-5639](https://cve.now/CVE-2013-5639.md): Directory traversal vulnerability in users/login.php in Gnew 2013.1 and earlier allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2014-0004](https://cve.now/CVE-2014-0004.md): Stack-based buffer overflow in udisks before 1.0.5 and 2.x before 2.1.3 allows local users to cause a denial of service (crash) and possibly (no CVSS)
- [CVE-2014-0106](https://cve.now/CVE-2014-0106.md): Sudo 1.6.9 before 1.8.5, when env\_reset is disabled, does not properly check environment variables for the env\_delete restriction, which all (no CVSS)
- [CVE-2014-1838](https://cve.now/CVE-2014-1838.md): The (1) extract\_keys\_from\_pdf and (2) fill\_pdf functions in pdf\_ext.py in logilab-commons before 0.61.0 allows local users to overwrite arbi (no CVSS, logilab-common)
- [CVE-2014-1839](https://cve.now/CVE-2014-1839.md): The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impac (no CVSS, logilab-common)
- [CVE-2014-2311](https://cve.now/CVE-2014-2311.md): SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2014-2321](https://cve.now/CVE-2014-2321.md): web\_shell\_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests, as demonst (no CVSS)
- [CVE-2013-6031](https://cve.now/CVE-2013-6031.md): The Huawei E355 adapter with firmware 21.157.37.01.910 does not require authentication for API pages, which allows remote attackers to chang (no CVSS)
- [CVE-2013-6037](https://cve.now/CVE-2013-6037.md): Cross-site scripting (XSS) vulnerability in index.php in Aker Secure Mail Gateway 2.5.2 and earlier allows remote attackers to inject arbitr (no CVSS)
- [CVE-2013-6200](https://cve.now/CVE-2013-6200.md): Unspecified vulnerability in m4 in HP HP-UX B.11.23 and B.11.31 allows local users to obtain sensitive information or modify data via unknow (no CVSS)
- [CVE-2013-6207](https://cve.now/CVE-2013-6207.md): Unspecified vulnerability in the loadFileContents function in the SOAP implementation in HP SiteScope 10.1x, 11.1x, and 11.21 allows remote (no CVSS)
- [CVE-2014-0049](https://cve.now/CVE-2014-0049.md): Buffer overflow in the complete\_emulated\_mmio function in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6 allows guest OS users to exec (no CVSS)
- [CVE-2014-0100](https://cve.now/CVE-2014-0100.md): Race condition in the inet\_frag\_intern function in net/ipv4/inet\_fragment.c in the Linux kernel through 3.13.6 allows remote attackers to ca (no CVSS)
- [CVE-2014-0101](https://cve.now/CVE-2014-0101.md): The sctp\_sf\_do\_5\_1D\_ce function in net/sctp/sm\_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth\_enable and auth (no CVSS)
- [CVE-2014-0102](https://cve.now/CVE-2014-0102.md): The keyring\_detect\_cycle\_iterator function in security/keys/keyring.c in the Linux kernel through 3.13.6 does not properly determine whether (no CVSS)
- [CVE-2014-0899](https://cve.now/CVE-2014-0899.md): ftpd in IBM AIX 7.1.1 before SP10 and 7.1.2 before SP5, when a Workload Partition (aka WPAR) for AIX 5.2 or 5.3 is used, allows remote authe (no CVSS)
- [CVE-2014-2281](https://cve.now/CVE-2014-2281.md): The nfs\_name\_snoop\_add\_name function in epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before (no CVSS)
- [CVE-2014-2282](https://cve.now/CVE-2014-2282.md): The dissect\_protocol\_data\_parameter function in epan/dissectors/packet-m3ua.c in the M3UA dissector in Wireshark 1.10.x before 1.10.6 does n (no CVSS)
- [CVE-2014-2283](https://cve.now/CVE-2014-2283.md): epan/dissectors/packet-rlc in the RLC dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 uses inconsistent memory-managemen (no CVSS)
- [CVE-2014-2299](https://cve.now/CVE-2014-2299.md): Buffer overflow in the mpeg\_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 all (no CVSS)
- [CVE-2014-2309](https://cve.now/CVE-2014-2309.md): The ip6\_route\_add function in net/ipv6/route.c in the Linux kernel through 3.13.6 does not properly count the addition of routes, which allo (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-03-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.