# CVEs published 2014-04-02 33 CVEs were published on April 2, 2014: 0 critical, 0 high. Days are UTC. - [CVE-2013-0735](https://cve.now/CVE-2013-0735.md): Multiple SQL injection vulnerabilities in wpf.class.php in the Mingle Forum plugin before 1.0.34 for WordPress allow remote attackers to exe (no CVSS) - [CVE-2013-7352](https://cve.now/CVE-2013-7352.md): Cross-site request forgery (CSRF) vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote attackers to hijack the authent (no CVSS) - [CVE-2013-0729](https://cve.now/CVE-2013-0729.md): Heap-based buffer overflow in Tracker Software PDF-XChange before 2.5.208 allows remote attackers to execute arbitrary code via a crafted De (no CVSS) - [CVE-2013-2945](https://cve.now/CVE-2013-2945.md): SQL injection vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote authenticated administrators to execute arbitrary S (no CVSS) - [CVE-2013-3484](https://cve.now/CVE-2013-3484.md): Multiple cross-site scripting (XSS) vulnerabilities in dotCMS before 2.3.2 allow remote attackers to inject arbitrary web script or HTML via (no CVSS) - [CVE-2014-1297](https://cve.now/CVE-2014-1297.md): WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, does not properly validate WebProcess IPC messages, which allows remote a (no CVSS) - [CVE-2014-1298](https://cve.now/CVE-2014-1298.md): WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS) - [CVE-2014-1299](https://cve.now/CVE-2014-1299.md): WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS) - [CVE-2014-1301](https://cve.now/CVE-2014-1301.md): WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS) - [CVE-2014-1302](https://cve.now/CVE-2014-1302.md): WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS) - [CVE-2014-1304](https://cve.now/CVE-2014-1304.md): WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS) - [CVE-2014-1305](https://cve.now/CVE-2014-1305.md): WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS) - [CVE-2014-1307](https://cve.now/CVE-2014-1307.md): WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS) - [CVE-2014-1308](https://cve.now/CVE-2014-1308.md): WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS) - [CVE-2014-1309](https://cve.now/CVE-2014-1309.md): WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS) - [CVE-2014-1310](https://cve.now/CVE-2014-1310.md): WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS) - [CVE-2014-1311](https://cve.now/CVE-2014-1311.md): WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS) - [CVE-2014-1312](https://cve.now/CVE-2014-1312.md): WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS) - [CVE-2014-1313](https://cve.now/CVE-2014-1313.md): WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS) - [CVE-2013-1770](https://cve.now/CVE-2013-1770.md): Cross-site scripting (XSS) vulnerability in views\_view.php in Ganglia Web 3.5.7 allows remote attackers to inject arbitrary web script or HT (no CVSS) - [CVE-2013-3213](https://cve.now/CVE-2013-3213.md): Multiple SQL injection vulnerabilities in vTiger CRM 5.0.0 through 5.4.0 allow remote attackers to execute arbitrary SQL commands via the (1 (no CVSS) - [CVE-2013-4240](https://cve.now/CVE-2013-4240.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers (no CVSS) - [CVE-2013-5365](https://cve.now/CVE-2013-5365.md): Heap-based buffer overflow in Autodesk SketchBook for Enterprise 2014, Pro, and Express before 6.25, and Copic Edition before 2.0.2 allows r (no CVSS) - [CVE-2014-2553](https://cve.now/CVE-2014-2553.md): Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3 (no CVSS) - [CVE-2014-2578](https://cve.now/CVE-2014-2578.md): Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk before 5.0.8 allows remote attackers to inject arbitrary web script or HTML (no CVSS) - [CVE-2014-2655](https://cve.now/CVE-2014-2655.md): SQL injection vulnerability in the gen\_show\_status function in functions.inc.php in Postfix Admin (aka postfixadmin) before 2.3.7 allows rem (no CVSS) - [CVE-2013-3588](https://cve.now/CVE-2013-3588.md): The web management interface on Zyxel P660 devices allows remote attackers to cause a denial of service (reboot) via a flood of TCP SYN pack (no CVSS) - [CVE-2014-0828](https://cve.now/CVE-2014-0828.md): Cross-site scripting (XSS) vulnerability in the WCM (Web Content Manager) UI in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x t (no CVSS) - [CVE-2014-0901](https://cve.now/CVE-2014-0901.md): Cross-site scripting (XSS) vulnerability in the Social Rendering implementation in the IBM Connections integration in IBM WebSphere Portal 8 (no CVSS) - [CVE-2014-1942](https://cve.now/CVE-2014-1942.md): Cross-site scripting (XSS) vulnerability in aal/loginverification.aspx in Pearson eSIS Enterprise Student Information System allows remote a (no CVSS) - [CVE-2014-2125](https://cve.now/CVE-2014-2125.md): Cross-site scripting (XSS) vulnerability in the Web Inbox in Cisco Unity Connection 8.6(2a)SU3 and earlier allows remote attackers to inject (no CVSS) - [CVE-2014-2137](https://cve.now/CVE-2014-2137.md): CRLF injection vulnerability in the web framework in Cisco Web Security Appliance (WSA) 7.7 and earlier allows remote attackers to inject ar (no CVSS) - [CVE-2014-2138](https://cve.now/CVE-2014-2138.md): CRLF injection vulnerability in the web framework in Cisco Security Manager 4.2 and earlier allows remote attackers to inject arbitrary HTTP (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2014-04-02 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.