# CVEs published 2014-04-01

23 CVEs were published on April 1, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-2212](https://cve.now/CVE-2014-2212.md): The remember me feature in portal/scr\_authentif.php in POSH (aka Posh portal or Portaneo) 3.0, 3.2.1, 3.3.0, and earlier stores the username (no CVSS)
- [CVE-2014-1691](https://cve.now/CVE-2014-1691.md): The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object inject (no CVSS)
- [CVE-2011-3346](https://cve.now/CVE-2011-3346.md): Buffer overflow in hw/scsi-disk.c in the SCSI subsystem in QEMU before 0.15.2, as used by Xen, might allow local guest users with permission (no CVSS)
- [CVE-2011-4573](https://cve.now/CVE-2011-4573.md): Red Hat JBoss Operations Network (JON) before 2.4.2 does not properly enforce "modify resource" permissions for remote authenticated users w (no CVSS)
- [CVE-2012-0032](https://cve.now/CVE-2012-0032.md): Red Hat JBoss Operations Network (JON) before 3.0.1 uses 0777 permissions for the root directory when installing a remote client, which allo (no CVSS)
- [CVE-2013-1869](https://cve.now/CVE-2013-1869.md): CRLF injection vulnerability in spacewalk-java before 2.1.148-1 and Red Hat Network (RHN) Satellite 5.6 allows remote attackers to inject ar (no CVSS)
- [CVE-2013-7348](https://cve.now/CVE-2013-7348.md): Double free vulnerability in the ioctx\_alloc function in fs/aio.c in the Linux kernel before 3.12.4 allows local users to cause a denial of (no CVSS)
- [CVE-2013-7350](https://cve.now/CVE-2013-7350.md): Multiple unspecified vulnerabilities in Check Point Security Gateway 80 R71.x before R71.45 (730159141) and R75.20.x before R75.20.4 and 600 (no CVSS)
- [CVE-2014-1891](https://cve.now/CVE-2014-1891.md): Multiple integer overflows in the (1) FLASK\_GETBOOL, (2) FLASK\_SETBOOL, (3) FLASK\_USER, and (4) FLASK\_CONTEXT\_TO\_SID suboperations in the fl (no CVSS)
- [CVE-2014-1892](https://cve.now/CVE-2014-1892.md): Xen 3.3 through 4.1, when XSM is enabled, allows local users to cause a denial of service via vectors related to a "large memory allocation, (no CVSS)
- [CVE-2014-1893](https://cve.now/CVE-2014-1893.md): Multiple integer overflows in the (1) FLASK\_GETBOOL and (2) FLASK\_SETBOOL suboperations in the flask hypercall in Xen 4.1.x, 3.3.x, 3.2.x, a (no CVSS)
- [CVE-2014-1894](https://cve.now/CVE-2014-1894.md): Multiple integer overflows in unspecified suboperations in the flask hypercall in Xen 3.2.x and earlier, when XSM is enabled, allow local us (no CVSS)
- [CVE-2014-1895](https://cve.now/CVE-2014-1895.md): Off-by-one error in the flask\_security\_avc\_cachestats function in xsm/flask/flask\_op.c in Xen 4.2.x and 4.3.x, when the maximum number of ph (no CVSS)
- [CVE-2014-1896](https://cve.now/CVE-2014-1896.md): The (1) do\_send and (2) do\_recv functions in io.c in libvchan in Xen 4.2.x, 4.3.x, and 4.4-RC series allows local guests to cause a denial o (no CVSS)
- [CVE-2014-2237](https://cve.now/CVE-2014-2237.md): The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse- (no CVSS, keystone)
- [CVE-2014-2672](https://cve.now/CVE-2014-2672.md): Race condition in the ath\_tx\_aggr\_sleep function in drivers/net/wireless/ath/ath9k/xmit.c in the Linux kernel before 3.13.7 allows remote at (no CVSS)
- [CVE-2014-2673](https://cve.now/CVE-2014-2673.md): The arch\_dup\_task\_struct function in the Transactional Memory (TM) implementation in arch/powerpc/kernel/process.c in the Linux kernel befor (no CVSS)
- [CVE-2014-2678](https://cve.now/CVE-2014-2678.md): The rds\_iw\_laddr\_check function in net/rds/iw.c in the Linux kernel through 3.14 allows local users to cause a denial of service (NULL point (no CVSS)
- [CVE-2009-5141](https://cve.now/CVE-2009-5141.md): Format string vulnerability in War FTP Daemon (warftpd) 1.82 RC 12 allows remote authenticated users to cause a denial of service (crash) vi (no CVSS)
- [CVE-2013-2278](https://cve.now/CVE-2013-2278.md): Unspecified vulnerability in War FTP Daemon (warftpd) 1.82, when running as a Windows service, allows remote attackers to cause a denial of (no CVSS)
- [CVE-2013-5640](https://cve.now/CVE-2013-5640.md): Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the (1) answer\_id or (2) (no CVSS)
- [CVE-2013-7349](https://cve.now/CVE-2013-7349.md): Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the (1) news\_id parameter (no CVSS)
- [CVE-2014-2034](https://cve.now/CVE-2014-2034.md): Unspecified vulnerability in Sonatype Nexus OSS and Pro 2.4.0 through 2.7.1 allows attackers to create arbitrary user accounts via unknown v (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-04-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.