# CVEs published 2014-03-18

23 CVEs were published on March 18, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2012-5641](https://cve.now/CVE-2012-5641.md): Directory traversal vulnerability in the partition2 function in mochiweb\_util.erl in MochiWeb before 2.4.0, as used in Apache CouchDB before (no CVSS)
- [CVE-2012-5650](https://cve.now/CVE-2012-5650.md): Cross-site scripting (XSS) vulnerability in the Futon UI in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1 allows r (no CVSS)
- [CVE-2013-0201](https://cve.now/CVE-2013-0201.md): Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2013-2619](https://cve.now/CVE-2013-2619.md): Directory traversal vulnerability in Aspen before 0.22 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2013-2641](https://cve.now/CVE-2013-2641.md): Directory traversal vulnerability in patience.cgi in Sophos Web Appliance before 3.7.8.2 allows remote attackers to read arbitrary files via (no CVSS)
- [CVE-2013-2642](https://cve.now/CVE-2013-2642.md): Sophos Web Appliance before 3.7.8.2 allows (1) remote attackers to execute arbitrary commands via shell metacharacters in the client-ip para (no CVSS)
- [CVE-2013-2643](https://cve.now/CVE-2013-2643.md): Multiple cross-site scripting (XSS) vulnerabilities in Sophos Web Appliance before 3.7.8.2 allow remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2013-3938](https://cve.now/CVE-2013-3938.md): Integer overflow in xnview.exe in XnView 2.13 allows remote attackers to execute arbitrary code via a large NUM\_ELEMENTS field in an IFD\_ENT (no CVSS)
- [CVE-2014-0057](https://cve.now/CVE-2014-0057.md): The x\_button method in the ServiceController (vmdb/app/controllers/service\_controller.rb) in Red Hat CloudForms 3.0 Management Engine 5.2 al (no CVSS)
- [CVE-2014-0132](https://cve.now/CVE-2014-0132.md): The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary (no CVSS)
- [CVE-2014-1608](https://cve.now/CVE-2014-1608.md): SQL injection vulnerability in the mci\_file\_get function in api/soap/mc\_file\_api.php in MantisBT before 1.2.16 allows remote attackers to ex (no CVSS)
- [CVE-2014-2087](https://cve.now/CVE-2014-2087.md): Stack-based buffer overflow in the CDownloads\_Deleted::UpdateDownload function in Downloads\_Deleted.cpp in Free Download Manager 3.9.3 build (no CVSS)
- [CVE-2014-2241](https://cve.now/CVE-2014-2241.md): The (1) cf2\_initLocalRegionBuffer and (2) cf2\_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check (no CVSS)
- [CVE-2014-2535](https://cve.now/CVE-2014-2535.md): Directory traversal vulnerability in McAfee Web Gateway (MWG) 7.4.x before 7.4.1, 7.3.x before 7.3.2.6, and 7.2.0.9 and earlier allows remot (no CVSS)
- [CVE-2014-2536](https://cve.now/CVE-2014-2536.md): Directory traversal vulnerability in McAfee Cloud Identity Manager 3.0, 3.1, and 3.5.1, McAfee Cloud Single Sign On (MCSSO) before 4.0.1, an (no CVSS)
- [CVE-2014-2537](https://cve.now/CVE-2014-2537.md): Memory leak in the TCP stack in the kernel in Sophos UTM before 9.109 allows remote attackers to cause a denial of service (memory consumpti (no CVSS)
- [CVE-2013-6438](https://cve.now/CVE-2013-6438.md): The dav\_xml\_get\_cdata function in main/util.c in the mod\_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespa (no CVSS)
- [CVE-2014-0098](https://cve.now/CVE-2014-0098.md): The log\_cookie function in mod\_log\_config.c in the mod\_log\_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to c (no CVSS)
- [CVE-2014-1975](https://cve.now/CVE-2014-1975.md): Directory traversal vulnerability in the R-Company Unzipper application 1.0.1 and earlier for Android allows remote attackers to overwrite o (no CVSS)
- [CVE-2014-1976](https://cve.now/CVE-2014-1976.md): The Demaecan application 2.1.0 and earlier for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle a (no CVSS)
- [CVE-2014-2532](https://cve.now/CVE-2014-2532.md): sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd\_config, which allows remote attackers to bypass in (CVSS 4.2)
- [CVE-2014-2533](https://cve.now/CVE-2014-2533.md): /sbin/ifwatchd in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to gain privileges by providing an arbitrary program name (no CVSS)
- [CVE-2014-2534](https://cve.now/CVE-2014-2534.md): /sbin/pppoectl in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to obtain sensitive information by reading "bad parameter" (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-03-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.