# CVEs published 2014-03-25 20 CVEs were published on March 25, 2014: 0 critical, 0 high. Days are UTC. - [CVE-2013-5443](https://cve.now/CVE-2013-5443.md): Cross-site request forgery (CSRF) vulnerability in IBM Cognos Express 9.0 before IFIX 2, 9.5 before IFIX 2, 10.1 before IFIX 2, and 10.2.1 b (no CVSS) - [CVE-2013-5444](https://cve.now/CVE-2013-5444.md): The server in IBM Cognos Express 9.0 before IFIX 2, 9.5 before IFIX 2, 10.1 before IFIX 2, and 10.2.1 before FP1 allows remote attackers to (no CVSS) - [CVE-2013-5445](https://cve.now/CVE-2013-5445.md): IBM Cognos Express 9.0 before IFIX 2, 9.5 before IFIX 2, 10.1 before IFIX 2, and 10.2.1 before FP1 allows local users to obtain sensitive cl (no CVSS) - [CVE-2014-0343](https://cve.now/CVE-2014-0343.md): The web interface on Virtual Access GW6110A routers with software 9.00 before 9.09.27, 9.50 before 9.50.21, and 10.00 before 10.00.21 allows (no CVSS) - [CVE-2014-0884](https://cve.now/CVE-2014-0884.md): Cross-site scripting (XSS) vulnerability in the Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote (no CVSS) - [CVE-2014-0885](https://cve.now/CVE-2014-0885.md): Cross-site request forgery (CSRF) vulnerability in the Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows (no CVSS) - [CVE-2014-0886](https://cve.now/CVE-2014-0886.md): The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to bypass intended acce (no CVSS) - [CVE-2014-0887](https://cve.now/CVE-2014-0887.md): The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to execute arbitrary co (no CVSS) - [CVE-2013-5951](https://cve.now/CVE-2013-5951.md): Multiple cross-site scripting (XSS) vulnerabilities in eXtplorer 2.1.3, when used as a component for Joomla!, allow remote attackers to inje (no CVSS) - [CVE-2014-2386](https://cve.now/CVE-2014-2386.md): Multiple off-by-one errors in Icinga, possibly 1.10.2 and earlier, allow remote attackers to cause a denial of service (crash) via unspecifi (no CVSS) - [CVE-2014-2573](https://cve.now/CVE-2014-2573.md): The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote auth (no CVSS, nova) - [CVE-2013-1604](https://cve.now/CVE-2013-1604.md): Directory traversal vulnerability in MayGion IP Cameras with firmware before 2013.04.22 (05.53) allows remote attackers to read arbitrary fi (no CVSS) - [CVE-2013-1605](https://cve.now/CVE-2013-1605.md): Buffer overflow in MayGion IP Cameras with firmware before 2013.04.22 (05.53) allows remote attackers to execute arbitrary code via a long f (no CVSS) - [CVE-2014-2016](https://cve.now/CVE-2014-2016.md): Multiple cross-site scripting (XSS) vulnerabilities in OXID eShop Professional and Community Edition 4.6.8 and earlier, 4.7.x before 4.7.11, (no CVSS) - [CVE-2014-2526](https://cve.now/CVE-2014-2526.md): Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7 allow remote attackers to inject arbitrary web script or HT (no CVSS) - [CVE-2014-2538](https://cve.now/CVE-2014-2538.md): Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbi (no CVSS, rack-ssl) - [CVE-2014-0076](https://cve.now/CVE-2014-0076.md): The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, w (no CVSS) - [CVE-2014-0628](https://cve.now/CVE-2014-0628.md): The server in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.5 does not properly process certificate chains, which allows remote a (no CVSS) - [CVE-2014-1492](https://cve.now/CVE-2014-1492.md): The cert\_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) (no CVSS) - [CVE-2014-1515](https://cve.now/CVE-2014-1515.md): Mozilla Firefox before 28.0.1 on Android processes a file: URL by copying a local file onto the SD card, which allows attackers to obtain se (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2014-03-25 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.