# CVEs published 2014-03-20

26 CVEs were published on March 20, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-0708](https://cve.now/CVE-2014-0708.md): WebEx Meeting Center in Cisco WebEx Business Suite does not properly compose URLs for HTTP GET requests, which allows remote attackers to ob (no CVSS)
- [CVE-2014-2119](https://cve.now/CVE-2014-2119.md): The End User Safelist/Blocklist (aka SLBL) service in Cisco AsyncOS Software for Email Security Appliance (ESA) before 7.6.3-023 and 8.x bef (no CVSS)
- [CVE-2014-2124](https://cve.now/CVE-2014-2124.md): Cisco IOS 15.1(2)SY3 and earlier, when used with Supervisor Engine 2T (aka Sup2T) on Catalyst 6500 devices, allows remote attackers to cause (no CVSS)
- [CVE-2011-3195](https://cve.now/CVE-2011-3195.md): shared/inc/sql/lists.php in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary commands v (no CVSS)
- [CVE-2011-3196](https://cve.now/CVE-2011-3196.md): The setup script in Domain Technologie Control (DTC) before 0.34.1 uses world-readable permissions for /etc/apache2/apache2.conf, which allo (no CVSS)
- [CVE-2011-3197](https://cve.now/CVE-2011-3197.md): SQL injection vulnerability in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary SQL com (no CVSS)
- [CVE-2011-3198](https://cve.now/CVE-2011-3198.md): Domain Technologie Control (DTC) before 0.34.1 includes a password in the -b command line argument to htpasswd, which might allow local user (no CVSS)
- [CVE-2011-3199](https://cve.now/CVE-2011-3199.md): Multiple cross-site scripting (XSS) vulnerabilities in Domain Technologie Control (DTC) before 0.34.1 allow remote authenticated users to in (no CVSS)
- [CVE-2011-5272](https://cve.now/CVE-2011-5272.md): SQL injection vulnerability in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary SQL com (no CVSS)
- [CVE-2011-5273](https://cve.now/CVE-2011-5273.md): Directory traversal vulnerability in shared/package-installer in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated (no CVSS)
- [CVE-2011-5274](https://cve.now/CVE-2011-5274.md): The drawAdminTools\_PackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control (DTC) before 0.32.11 allows remo (no CVSS)
- [CVE-2011-5275](https://cve.now/CVE-2011-5275.md): The install script in Domain Technologie Control (DTC) before 0.34.1 gives sudo permissions for chrootuid to the dtc user, which makes it ea (no CVSS)
- [CVE-2011-5276](https://cve.now/CVE-2011-5276.md): SQL injection vulnerability in the drawAdminTools\_PackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control ( (no CVSS)
- [CVE-2013-7340](https://cve.now/CVE-2013-7340.md): VideoLAN VLC Media Player before 2.0.7 allows remote attackers to cause a denial of service (memory consumption) via a crafted playlist file (no CVSS)
- [CVE-2014-0002](https://cve.now/CVE-2014-0002.md): The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have (no CVSS, org.apache.camel:camel-core)
- [CVE-2014-0003](https://cve.now/CVE-2014-0003.md): The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to exec (no CVSS, org.apache.camel:camel-core)
- [CVE-2013-6401](https://cve.now/CVE-2013-6401.md): Jansson, possibly 2.4 and earlier, does not restrict the ability to trigger hash collisions predictably, which allows context-dependent atta (no CVSS)
- [CVE-2013-0805](https://cve.now/CVE-2013-0805.md): Multiple cross-site scripting (XSS) vulnerabilities in the search feature in iTop (aka IT Operations Portal) 2.0, 1.2.1, 1.2, and earlier al (no CVSS)
- [CVE-2013-3249](https://cve.now/CVE-2013-3249.md): Stack-based buffer overflow in the "Add from text file" feature in the DameWare Exporter tool (DWExporter.exe) in DameWare Remote Support 10 (no CVSS)
- [CVE-2014-1609](https://cve.now/CVE-2014-1609.md): Multiple SQL injection vulnerabilities in MantisBT before 1.2.16 allow remote attackers to execute arbitrary SQL commands via unspecified pa (no CVSS)
- [CVE-2014-1904](https://cve.now/CVE-2014-1904.md): Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0. (no CVSS, org.springframework:spring-webmvc)
- [CVE-2014-2077](https://cve.now/CVE-2014-2077.md): Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 7.4.1 before 7.4.1-rev10 and 7.4.2 before 7.4.2-rev8 (no CVSS)
- [CVE-2014-2219](https://cve.now/CVE-2014-2219.md): Cross-site scripting (XSS) vulnerability in whizzywig/wb.php in CMSimple Classic 3.54 and earlier, possibly as downloaded before February 26 (no CVSS)
- [CVE-2014-2280](https://cve.now/CVE-2014-2280.md): Cross-site scripting (XSS) vulnerability in the search feature in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows remote attackers (no CVSS)
- [CVE-2014-1970](https://cve.now/CVE-2014-1970.md): Directory traversal vulnerability in the ES File Explorer File Manager application before 3.0.4 for Android allows remote attackers to overw (no CVSS)
- [CVE-2014-1971](https://cve.now/CVE-2014-1971.md): Cross-site scripting (XSS) vulnerability in Silex before 2.0.0 allows remote attackers to inject arbitrary web script or HTML via unspecifie (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-03-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.