# CVEs published 2014-03-28

28 CVEs were published on March 28, 2014: 0 critical, 1 high. Days are UTC.

- [CVE-2014-0981](https://cve.now/CVE-2014-0981.md): VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3. (no CVSS)
- [CVE-2014-0983](https://cve.now/CVE-2014-0983.md): Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server\_dispatch.py in (no CVSS)
- [CVE-2014-1982](https://cve.now/CVE-2014-1982.md): The administrative interface in Allied Telesis AT-RG634A ADSL Broadband router 3.3+, iMG624A firmware 3.5, iMG616LH firmware 2.4, and iMG646 (no CVSS)
- [CVE-2013-0662](https://cve.now/CVE-2013-0662.md): Multiple stack-based buffer overflows in ModbusDrv.exe in Schneider Electric Modbus Serial Driver 1.10 through 3.2 allow remote attackers to (no CVSS)
- [CVE-2014-0050](https://cve.now/CVE-2014-0050.md): MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attac (CVSS 7.5, commons-fileupload:commons-fileupload · org.apache.tomcat:t…)
- [CVE-2014-0632](https://cve.now/CVE-2014-0632.md): Directory traversal vulnerability in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 allows remote authenticated users to execute arbitrary co (no CVSS)
- [CVE-2014-0633](https://cve.now/CVE-2014-0633.md): The GUI in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 does not properly validate session-timeout values, which might make it easier for r (no CVSS)
- [CVE-2014-0634](https://cve.now/CVE-2014-0634.md): EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified cookie, which mak (no CVSS)
- [CVE-2014-0635](https://cve.now/CVE-2014-0635.md): Session fixation vulnerability in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 allows remote attackers to hijack web sessions via unspecifi (no CVSS)
- [CVE-2014-2590](https://cve.now/CVE-2014-2590.md): The web management interface in Siemens RuggedCom ROS before 3.11, ROS 3.11 before 3.11.5 for RS950G, ROS 3.12, and ROS 4.0 for RSG2488 allo (no CVSS)
- [CVE-2014-0060](https://cve.now/CVE-2014-0060.md): PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the (no CVSS)
- [CVE-2014-0061](https://cve.now/CVE-2014-0061.md): The validator functions for the procedural languages (PLs) in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x befo (no CVSS)
- [CVE-2014-0062](https://cve.now/CVE-2014-0062.md): Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x befo (no CVSS)
- [CVE-2014-0063](https://cve.now/CVE-2014-0063.md): Multiple stack-based buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x b (no CVSS)
- [CVE-2014-0064](https://cve.now/CVE-2014-0064.md): Multiple integer overflows in the path\_in and other unspecified functions in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1 (no CVSS)
- [CVE-2014-0065](https://cve.now/CVE-2014-0065.md): Multiple buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 (no CVSS)
- [CVE-2014-0066](https://cve.now/CVE-2014-0066.md): The chkpass extension in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does (no CVSS)
- [CVE-2014-0067](https://cve.now/CVE-2014-0067.md): The "make check" command for the test suites in PostgreSQL 9.3.3 and earlier does not properly invoke initdb to specify the authentication r (no CVSS)
- [CVE-2014-0086](https://cve.now/CVE-2014-0086.md): The doFilter function in webapp/PushHandlerFilter.java in JBoss RichFaces 4.3.4, 4.3.5, and 5.x allows remote attackers to cause a denial of (no CVSS, org.richfaces:richfaces)
- [CVE-2014-2669](https://cve.now/CVE-2014-2669.md): Multiple integer overflows in contrib/hstore/hstore\_io.c in PostgreSQL 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3 (no CVSS)
- [CVE-2014-2668](https://cve.now/CVE-2014-2668.md): Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via the count parameter t (no CVSS)
- [CVE-2013-0734](https://cve.now/CVE-2013-0734.md): Multiple cross-site scripting (XSS) vulnerabilities in the Mingle Forum plugin before 1.0.34 for WordPress allow remote attackers to inject (no CVSS)
- [CVE-2013-0807](https://cve.now/CVE-2013-0807.md): Cross-site scripting (XSS) vulnerability in the NewSectionPrompt function in include/tool/editing\_page.php in gpEasy CMS 3.5.2 and earlier a (no CVSS)
- [CVE-2013-2694](https://cve.now/CVE-2013-2694.md): Open redirect vulnerability in invite.php in the WP Symposium plugin 13.04 for WordPress allows remote attackers to redirect users to arbitr (no CVSS)
- [CVE-2013-2695](https://cve.now/CVE-2013-2695.md): Cross-site scripting (XSS) vulnerability in invite.php in the WP Symposium plugin before 13.04 for WordPress allows remote attackers to inje (no CVSS)
- [CVE-2014-0133](https://cve.now/CVE-2014-0133.md): Heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execut (no CVSS)
- [CVE-2014-2525](https://cve.now/CVE-2014-2525.md): Heap-based buffer overflow in the yaml\_parser\_scan\_uri\_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execut (no CVSS)
- [CVE-2014-2599](https://cve.now/CVE-2014-2599.md): The HVMOP\_set\_mem\_access HVM control operations in Xen 4.1.x for 32-bit and 4.1.x through 4.4.x for 64-bit allow local guest administrators (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-03-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.