# CVEs published 2014-04-10

37 CVEs were published on April 10, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-0908](https://cve.now/CVE-2014-0908.md): The User Attribute implementation in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.2, and 8.5.x through 8.5. (no CVSS)
- [CVE-2014-0920](https://cve.now/CVE-2014-0920.md): IBM SPSS Analytic Server 1.0 before IF002 and 1.0.1 before IF004 logs cleartext passwords, which allows remote authenticated users to obtain (no CVSS)
- [CVE-2012-6132](https://cve.now/CVE-2012-6132.md): Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the otk (no CVSS, roundup)
- [CVE-2013-0740](https://cve.now/CVE-2013-0740.md): Open redirect vulnerability in Dell OpenManage Server Administrator (OMSA) before 7.3.0 allows remote attackers to redirect users to arbitra (no CVSS)
- [CVE-2013-7355](https://cve.now/CVE-2013-7355.md): SQL injection vulnerability in SAP BI Universal Data Integration allows remote attackers to execute arbitrary SQL commands via unspecified v (no CVSS)
- [CVE-2013-7356](https://cve.now/CVE-2013-7356.md): Unspecified vulnerability in the SAP CCMS / Database Monitors for Oracle allows attackers to obtain the database password via unknown vector (no CVSS)
- [CVE-2013-7357](https://cve.now/CVE-2013-7357.md): Unspecified vulnerability in the configuration service in SAP J2EE Engine allows remote attackers to obtain credential information via unkno (no CVSS)
- [CVE-2013-7358](https://cve.now/CVE-2013-7358.md): Unspecified vulnerability in SAP Guided Procedures Archive Monitor allows remote attackers to obtain usernames, roles, profiles, and possibl (no CVSS)
- [CVE-2013-7359](https://cve.now/CVE-2013-7359.md): Unspecified vulnerability in SAP Mobile Infrastructure allows remote attackers to obtain sensitive port information via unknown vectors, rel (no CVSS)
- [CVE-2013-7360](https://cve.now/CVE-2013-7360.md): Unspecified vulnerability in SAP adminadapter allows remote attackers to read or write to arbitrary files via unknown vectors. (no CVSS)
- [CVE-2013-7361](https://cve.now/CVE-2013-7361.md): Directory traversal vulnerability in SAP CMS and CM Services allows attackers to upload arbitrary files via unspecified vectors. (no CVSS)
- [CVE-2013-7362](https://cve.now/CVE-2013-7362.md): An unspecified RFC function in SAP CCMS Agent allows remote attackers to execute arbitrary commands via unknown vectors. (no CVSS)
- [CVE-2013-7363](https://cve.now/CVE-2013-7363.md): Unspecified vulnerability in the Diagnostics (SMD) agent in SAP Solution Manager allows remote attackers to obtain sensitive information, mo (no CVSS)
- [CVE-2013-7364](https://cve.now/CVE-2013-7364.md): An unspecified J2EE core service in the J2EE Engine in SAP NetWeaver does not properly restrict access, which allows remote attackers to rea (no CVSS)
- [CVE-2013-7365](https://cve.now/CVE-2013-7365.md): Cross-site scripting (XSS) vulnerability in SAP Enterprise Portal allows remote attackers to inject arbitrary web script or HTML via unspeci (no CVSS)
- [CVE-2013-7366](https://cve.now/CVE-2013-7366.md): The SAP Software Deployment Manager (SDM), in certain unspecified conditions, allows remote attackers to cause a denial of service via vecto (no CVSS)
- [CVE-2013-7367](https://cve.now/CVE-2013-7367.md): SAP Enterprise Portal does not properly restrict access to the Federation configuration pages, which allows remote attackers to gain privile (no CVSS)
- [CVE-2014-2748](https://cve.now/CVE-2014-2748.md): The Security Audit Log facility in SAP Enhancement Package (EHP) 6 for SAP ERP 6.0 allows remote attackers to modify or delete arbitrary log (no CVSS)
- [CVE-2014-2749](https://cve.now/CVE-2014-2749.md): The HANA ICM process in SAP HANA allows remote attackers to obtain the platform version, host name, instance number, and possibly other sens (no CVSS)
- [CVE-2014-2751](https://cve.now/CVE-2014-2751.md): SAP Print and Output Management has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vecto (no CVSS)
- [CVE-2014-2752](https://cve.now/CVE-2014-2752.md): SAP Business Object Processing Framework (BOPF) for ABAP has hardcoded credentials, which makes it easier for remote attackers to obtain acc (no CVSS)
- [CVE-2012-4921](https://cve.now/CVE-2012-4921.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the DVS Custom Notification plugin 1.0.1 and earlier for WordPress allow remot (no CVSS)
- [CVE-2013-2033](https://cve.now/CVE-2013-2033.md): Cross-site scripting (XSS) vulnerability in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x b (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2013-2693](https://cve.now/CVE-2013-2693.md): Cross-site request forgery (CSRF) vulnerability in the Options in the WP-Print plugin before 2.52 for WordPress allows remote attackers to h (no CVSS)
- [CVE-2013-2699](https://cve.now/CVE-2013-2699.md): Cross-site request forgery (CSRF) vulnerability in the underConstruction plugin before 1.09 for WordPress allows remote attackers to hijack (no CVSS)
- [CVE-2013-3251](https://cve.now/CVE-2013-3251.md): Cross-site request forgery (CSRF) vulnerability in the qTranslate plugin 2.5.34 and earlier for WordPress allows remote attackers to hijack (no CVSS)
- [CVE-2013-3252](https://cve.now/CVE-2013-3252.md): Cross-site request forgery (CSRF) vulnerability in the options admin page in the WP-PostViews plugin before 1.63 for WordPress allows remote (no CVSS)
- [CVE-2013-6468](https://cve.now/CVE-2013-6468.md): JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitra (no CVSS)
- [CVE-2014-0331](https://cve.now/CVE-2014-0331.md): Cross-site scripting (XSS) vulnerability in the web administration interface in FortiADC with firmware before 3.2.1 allows remote attackers (no CVSS)
- [CVE-2014-1455](https://cve.now/CVE-2014-1455.md): SQL injection vulnerability in the password reset functionality in Pearson eSIS Enterprise Student Information System, possibly 3.3.0.13 and (no CVSS)
- [CVE-2014-2583](https://cve.now/CVE-2014-2583.md): Multiple directory traversal vulnerabilities in pam\_timestamp.c in the pam\_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users (no CVSS)
- [CVE-2014-2708](https://cve.now/CVE-2014-2708.md): Multiple SQL injection vulnerabilities in graph\_xport.php in Cacti 0.8.7g, 0.8.8b, and earlier allow remote attackers to execute arbitrary S (no CVSS)
- [CVE-2014-2126](https://cve.now/CVE-2014-2126.md): Cisco Adaptive Security Appliance (ASA) Software 8.2 before 8.2(5.47), 8.4 before 8.4(7.5), 8.7 before 8.7(1.11), 9.0 before 9.0(3.10), and (no CVSS)
- [CVE-2014-2127](https://cve.now/CVE-2014-2127.md): Cisco Adaptive Security Appliance (ASA) Software 8.x before 8.2(5.48), 8.3 before 8.3(2.40), 8.4 before 8.4(7.9), 8.6 before 8.6(1.13), 9.0 (no CVSS)
- [CVE-2014-2128](https://cve.now/CVE-2014-2128.md): The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 8.2 before 8.2(5.47, 8.3 before 8.3(2.40), 8.4 before 8.4(7.3 (no CVSS)
- [CVE-2014-2129](https://cve.now/CVE-2014-2129.md): The SIP inspection engine in Cisco Adaptive Security Appliance (ASA) Software 8.2 before 8.2(5.48), 8.4 before 8.4(6.5), 9.0 before 9.0(3.1) (no CVSS)
- [CVE-2014-2141](https://cve.now/CVE-2014-2141.md): The session-termination functionality on Cisco ONS 15454 controller cards with software 9.6 and earlier does not initialize an unspecified p (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-04-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.