# CVEs published 2014-03-14

87 CVEs were published on March 14, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2013-0299](https://cve.now/CVE-2013-0299.md): Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote attackers to hijack (no CVSS)
- [CVE-2013-0300](https://cve.now/CVE-2013-0300.md): Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to hijack the authenticatio (no CVSS)
- [CVE-2013-0301](https://cve.now/CVE-2013-0301.md): Cross-site request forgery (CSRF) vulnerability in apps/calendar/ajax/settings/settimezone in ownCloud before 4.0.12 allows remote attackers (no CVSS)
- [CVE-2012-0891](https://cve.now/CVE-2012-0891.md): Multiple cross-site scripting (XSS) vulnerabilities in Puppet Dashboard 1.0 before 1.2.5 and Enterprise 1.0 before 1.2.5 and 2.x before 2.0. (no CVSS)
- [CVE-2012-5158](https://cve.now/CVE-2012-5158.md): Puppet Enterprise (PE) before 2.6.1 does not properly invalidate sessions when the session secret has changed, which allows remote authentic (no CVSS)
- [CVE-2013-1398](https://cve.now/CVE-2013-1398.md): The pe\_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which a (no CVSS)
- [CVE-2013-1399](https://cve.now/CVE-2013-1399.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2) live management, and (3) user administrat (no CVSS)
- [CVE-2013-1822](https://cve.now/CVE-2013-1822.md): Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.8 allow remote authenticated users with administrator privi (no CVSS)
- [CVE-2013-1850](https://cve.now/CVE-2013-1850.md): Multiple incomplete blacklist vulnerabilities in (1) import.php and (2) ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 an (no CVSS)
- [CVE-2013-1851](https://cve.now/CVE-2013-1851.md): Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.13 and 4.5.x before 4.5.8, when the user\_migrate application is (no CVSS)
- [CVE-2013-1939](https://cve.now/CVE-2013-1939.md): The HTML\\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, (no CVSS, sabre/dav)
- [CVE-2013-1963](https://cve.now/CVE-2013-1963.md): The contacts application in ownCloud before 4.5.10 and 5.x before 5.0.5 does not properly check the ownership of contacts, which allows remo (no CVSS)
- [CVE-2013-2039](https://cve.now/CVE-2013-2039.md): Directory traversal vulnerability in lib/files/view.php in ownCloud before 4.0.15, 4.5.x 4.5.11, and 5.x before 5.0.6 allows remote authenti (no CVSS)
- [CVE-2013-2040](https://cve.now/CVE-2013-2040.md): Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote auth (no CVSS)
- [CVE-2013-2041](https://cve.now/CVE-2013-2041.md): Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web (no CVSS)
- [CVE-2013-2042](https://cve.now/CVE-2013-2042.md): Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote auth (no CVSS)
- [CVE-2013-2043](https://cve.now/CVE-2013-2043.md): apps/calendar/ajax/events.php in ownCloud before 4.5.11 and 5.x before 5.0.6 does not properly check the ownership of a calendar, which allo (no CVSS)
- [CVE-2013-2044](https://cve.now/CVE-2013-2044.md): Open redirect vulnerability in the Login Page (index.php) in ownCloud before 5.0.6 allows remote attackers to redirect users to arbitrary we (no CVSS)
- [CVE-2013-2047](https://cve.now/CVE-2013-2047.md): The login page (aka index.php) in ownCloud before 5.0.6 does not disable the autocomplete setting for the password parameter, which makes it (no CVSS)
- [CVE-2013-2048](https://cve.now/CVE-2013-2048.md): ownCloud before 5.0.6 does not properly check permissions, which allows remote authenticated users to execute arbitrary API commands via uns (no CVSS)
- [CVE-2013-2085](https://cve.now/CVE-2013-2085.md): Directory traversal vulnerability in apps/files\_trashbin/index.php in ownCloud Server before 5.0.6 allows remote authenticated users to acce (no CVSS)
- [CVE-2013-2086](https://cve.now/CVE-2013-2086.md): The configuration loader in ownCloud 5.0.x before 5.0.6 allows remote attackers to obtain CSRF tokens and other sensitive information by rea (no CVSS)
- [CVE-2013-2089](https://cve.now/CVE-2013-2089.md): Incomplete blacklist vulnerability in ownCloud before 5.0.6 allows remote authenticated users to execute arbitrary PHP code by uploading a c (no CVSS)
- [CVE-2013-2149](https://cve.now/CVE-2013-2149.md): Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.16 and 5.x before 5.0.7 allow remote authenticated users to injec (no CVSS)
- [CVE-2013-2150](https://cve.now/CVE-2013-2150.md): Multiple cross-site scripting (XSS) vulnerabilities in js/viewer.js in ownCloud before 4.5.12 and 5.x before 5.0.7 allow remote attackers to (no CVSS)
- [CVE-2013-4963](https://cve.now/CVE-2013-4963.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Puppet Enterprise (PE) before 3.0.1 allow remote attackers to hijack the authe (no CVSS)
- [CVE-2014-2047](https://cve.now/CVE-2014-2047.md): Session fixation vulnerability in ownCloud before 6.0.2, when PHP is configured to accept session parameters through a GET request, allows r (no CVSS)
- [CVE-2014-2049](https://cve.now/CVE-2014-2049.md): The default Flash Cross Domain policies in ownCloud before 5.0.15 and 6.x before 6.0.2 allows remote attackers to access user files via unsp (no CVSS)
- [CVE-2013-0297](https://cve.now/CVE-2013-0297.md): Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote authenticated administrato (no CVSS)
- [CVE-2013-0298](https://cve.now/CVE-2013-0298.md): Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2013-0307](https://cve.now/CVE-2013-0307.md): Cross-site scripting (XSS) vulnerability in settings.php in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allows remote administrators to in (no CVSS)
- [CVE-2013-6473](https://cve.now/CVE-2013-6473.md): Multiple heap-based buffer overflows in the urftopdf filter in cups-filters 1.0.25 before 1.0.47 allow remote attackers to execute arbitrary (no CVSS)
- [CVE-2013-6474](https://cve.now/CVE-2013-6474.md): Heap-based buffer overflow in the pdftoopvp filter in CUPS and cups-filters before 1.0.47 allows remote attackers to execute arbitrary code (no CVSS)
- [CVE-2013-6475](https://cve.now/CVE-2013-6475.md): Multiple integer overflows in (1) OPVPOutputDev.cxx and (2) oprs/OPVPSplash.cxx in the pdftoopvp filter in CUPS and cups-filters before 1.0. (no CVSS)
- [CVE-2013-6476](https://cve.now/CVE-2013-6476.md): The OPVPWrapper::loadDriver function in oprs/OPVPWrapper.cxx in the pdftoopvp filter in CUPS and cups-filters before 1.0.47 allows local use (no CVSS)
- [CVE-2014-0017](https://cve.now/CVE-2014-0017.md): The RAND\_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random numb (no CVSS)
- [CVE-2014-0467](https://cve.now/CVE-2014-0467.md): Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header li (no CVSS)
- [CVE-2014-2270](https://cve.now/CVE-2014-2270.md): softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of service (out-of-bounds memory access an (no CVSS)
- [CVE-2014-2291](https://cve.now/CVE-2014-2291.md): Cross-site scripting (XSS) vulnerability in the Pulse Collaboration (Secure Meeting) user pages in Juniper Junos Pulse Secure Access Service (no CVSS)
- [CVE-2014-2292](https://cve.now/CVE-2014-2292.md): Unspecified vulnerability in the Linux Network Connect client in Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS before (no CVSS)
- [CVE-2014-2323](https://cve.now/CVE-2014-2323.md): SQL injection vulnerability in mod\_mysql\_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2014-2324](https://cve.now/CVE-2014-2324.md): Multiple directory traversal vulnerabilities in (1) mod\_evhost and (2) mod\_simple\_vhost in lighttpd before 1.4.35 allow remote attackers to (no CVSS)
- [CVE-2013-1758](https://cve.now/CVE-2013-1758.md): Cross-site scripting (XSS) vulnerability in the Marekkis Watermark plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2013-1759](https://cve.now/CVE-2013-1759.md): Cross-site scripting (XSS) vulnerability in the Responsive Logo Slideshow plugin for WordPress allows remote attackers to inject arbitrary w (no CVSS)
- [CVE-2013-2507](https://cve.now/CVE-2013-2507.md): Multiple cross-site scripting (XSS) vulnerabilities in the Brother MFC-9970CDW printer with firmware G (1.03) allow remote attackers to inje (no CVSS)
- [CVE-2013-2670](https://cve.now/CVE-2013-2670.md): Cross-site scripting (XSS) vulnerability in the Brother MFC-9970CDW printer with firmware G (1.03) and L (1.10) allows remote attackers to i (no CVSS)
- [CVE-2013-2671](https://cve.now/CVE-2013-2671.md): Multiple cross-site scripting (XSS) vulnerabilities in the Brother MFC-9970CDW printer with firmware L (1.10) allow remote attackers to inje (no CVSS)
- [CVE-2014-2024](https://cve.now/CVE-2014-2024.md): Cross-site scripting (XSS) vulnerability in classes/controller/error.php in Open Classifieds 2 before 2.1.3 allows remote attackers to injec (no CVSS)
- [CVE-2014-2325](https://cve.now/CVE-2014-2325.md): Multiple cross-site scripting (XSS) vulnerabilities in Proxmox Mail Gateway before 3.1-5829 allow remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2013-4496](https://cve.now/CVE-2013-4496.md): Samba 3.x before 3.6.23, 4.0.x before 4.0.16, and 4.1.x before 4.1.6 does not enforce the password-guessing protection mechanism for all int (no CVSS)
- [CVE-2013-4846](https://cve.now/CVE-2013-4846.md): Unspecified vulnerability in HP System Management Homepage (SMH) before 7.3 allows remote attackers to obtain sensitive information via unkn (no CVSS)
- [CVE-2013-5133](https://cve.now/CVE-2013-5133.md): Backup in Apple iOS before 7.1 does not properly restrict symlinks, which allows remote attackers to overwrite files during a restore operat (no CVSS)
- [CVE-2013-6188](https://cve.now/CVE-2013-6188.md): Cross-site request forgery (CSRF) vulnerability in HP System Management Homepage (SMH) 7.1 through 7.2.2 allows remote attackers to hijack t (no CVSS)
- [CVE-2013-6205](https://cve.now/CVE-2013-6205.md): Unspecified vulnerability in HP Rapid Deployment Pack (RDP) and Insight Control Server Deployment allows local users to obtain sensitive inf (no CVSS)
- [CVE-2013-6206](https://cve.now/CVE-2013-6206.md): Unspecified vulnerability in HP Rapid Deployment Pack (RDP) and Insight Control Server Deployment allows remote attackers to obtain sensitiv (no CVSS)
- [CVE-2013-6209](https://cve.now/CVE-2013-6209.md): Unspecified vulnerability in rpc.lockd in the NFS subsystem in HP HP-UX B.11.11 and B.11.23 allows remote attackers to cause a denial of ser (no CVSS)
- [CVE-2013-6442](https://cve.now/CVE-2013-6442.md): The owner\_set function in smbcacls.c in smbcacls in Samba 4.0.x before 4.0.16 and 4.1.x before 4.1.6 removes an ACL during use of a --chown (no CVSS)
- [CVE-2013-6835](https://cve.now/CVE-2013-6835.md): TelephonyUI Framework in Apple iOS 7 before 7.1, when Safari is used, does not require user confirmation for FaceTime audio calls, which all (no CVSS)
- [CVE-2014-0505](https://cve.now/CVE-2014-0505.md): Adobe Shockwave Player before 12.1.0.150 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2014-0694](https://cve.now/CVE-2014-0694.md): Intelligent Automation for Cloud (IAC) in Cisco Cloud Portal 9.4.1 and earlier includes a cryptographic key in binary files, which makes it (no CVSS)
- [CVE-2014-0779](https://cve.now/CVE-2014-0779.md): Schneider Electric StruxureWare SCADA Expert ClearSCADA Improper Restriction of Operations within the Bounds of a Memory Buffer (no CVSS, Schneider Electric ClearSCADA · Schneider Electric SCADA Ex…)
- [CVE-2014-0781](https://cve.now/CVE-2014-0781.md): Yokogawa CENTUM CS 3000 Heap-based Buffer Overflow (no CVSS, Yokogawa CENTUM CS)
- [CVE-2014-0783](https://cve.now/CVE-2014-0783.md): Yokogawa CENTUM CS 3000 Stack-based Buffer Overflow (no CVSS, Yokogawa CENTUM CS)
- [CVE-2014-0784](https://cve.now/CVE-2014-0784.md): Yokogawa CENTUM CS 3000 Stack-based Buffer Overflow (no CVSS, Yokogawa CENTUM CS)
- [CVE-2014-1267](https://cve.now/CVE-2014-1267.md): The Configuration Profiles component in Apple iOS before 7.1 and Apple TV before 6.1 does not properly evaluate the expiration date of a mob (no CVSS)
- [CVE-2014-1271](https://cve.now/CVE-2014-1271.md): CoreCapture in Apple iOS before 7.1 and Apple TV before 6.1 does not properly validate IOKit API calls, which allows attackers to cause a de (no CVSS)
- [CVE-2014-1272](https://cve.now/CVE-2014-1272.md): CrashHouseKeeping in Crash Reporting in Apple iOS before 7.1 and Apple TV before 6.1 allows local users to change arbitrary file permissions (no CVSS)
- [CVE-2014-1273](https://cve.now/CVE-2014-1273.md): dyld in Apple iOS before 7.1 and Apple TV before 6.1 allows attackers to bypass code-signing requirements by leveraging use of text-relocati (no CVSS)
- [CVE-2014-1274](https://cve.now/CVE-2014-1274.md): FaceTime in Apple iOS before 7.1 allows physically proximate attackers to obtain sensitive FaceTime contact information by using the lock sc (no CVSS)
- [CVE-2014-1275](https://cve.now/CVE-2014-1275.md): Buffer overflow in ImageIO in Apple iOS before 7.1 and Apple TV before 6.1 allows remote attackers to execute arbitrary code or cause a deni (no CVSS)
- [CVE-2014-1276](https://cve.now/CVE-2014-1276.md): IOKit HID Event in Apple iOS before 7.1 allows attackers to conduct user-action monitoring attacks against arbitrary apps via a crafted app (no CVSS)
- [CVE-2014-1278](https://cve.now/CVE-2014-1278.md): The ptmx\_get\_ioctl function in the ARM kernel in Apple iOS before 7.1 and Apple TV before 6.1 allows local users to gain privileges or cause (no CVSS)
- [CVE-2014-1279](https://cve.now/CVE-2014-1279.md): Apple TV before 6.1 does not properly restrict logging, which allows local users to obtain sensitive information by reading log data. (no CVSS)
- [CVE-2014-1280](https://cve.now/CVE-2014-1280.md): Video Driver in Apple iOS before 7.1 and Apple TV before 6.1 allows remote attackers to cause a denial of service (NULL pointer dereference (no CVSS)
- [CVE-2014-1281](https://cve.now/CVE-2014-1281.md): Photos Backend in Apple iOS before 7.1 does not properly manage the asset-library cache during deletions, which allows physically proximate (no CVSS)
- [CVE-2014-1282](https://cve.now/CVE-2014-1282.md): The Profiles component in Apple iOS before 7.1 and Apple TV before 6.1 allows attackers to bypass intended configuration-profile visibility (no CVSS)
- [CVE-2014-1285](https://cve.now/CVE-2014-1285.md): Springboard in Apple iOS before 7.1 allows physically proximate attackers to bypass intended access restrictions and read the home screen by (no CVSS)
- [CVE-2014-1286](https://cve.now/CVE-2014-1286.md): SpringBoard Lock Screen in Apple iOS before 7.1 allows remote attackers to cause a denial of service (lock-screen hang) by leveraging a stat (no CVSS)
- [CVE-2014-1287](https://cve.now/CVE-2014-1287.md): USB Host in Apple iOS before 7.1 and Apple TV before 6.1 allows physically proximate attackers to execute arbitrary code or cause a denial o (no CVSS)
- [CVE-2014-1289](https://cve.now/CVE-2014-1289.md): WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of serv (no CVSS)
- [CVE-2014-1290](https://cve.now/CVE-2014-1290.md): WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of serv (no CVSS)
- [CVE-2014-1291](https://cve.now/CVE-2014-1291.md): WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of serv (no CVSS)
- [CVE-2014-1292](https://cve.now/CVE-2014-1292.md): WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of serv (no CVSS)
- [CVE-2014-1293](https://cve.now/CVE-2014-1293.md): WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of serv (no CVSS)
- [CVE-2014-1294](https://cve.now/CVE-2014-1294.md): WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of serv (no CVSS)
- [CVE-2014-2265](https://cve.now/CVE-2014-2265.md): Rock Lobster Contact Form 7 before 3.7.2 allows remote attackers to bypass the CAPTCHA protection mechanism and submit arbitrary form data b (no CVSS)
- [CVE-2014-2319](https://cve.now/CVE-2014-2319.md): The Encrypt Files feature in ConeXware PowerArchiver before 14.02.05 uses legacy ZIP encryption even if the AES 256-bit selection is chosen, (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-03-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.