# CVEs published 2014-04-11 26 CVEs were published on April 11, 2014: 0 critical, 0 high. Days are UTC. - [CVE-2014-0636](https://cve.now/CVE-2014-0636.md): EMC RSA BSAFE Micro Edition Suite (MES) 3.2.x before 3.2.6 and 4.0.x before 4.0.5 does not properly validate X.509 certificate chains, which (no CVSS) - [CVE-2014-1209](https://cve.now/CVE-2014-1209.md): VMware vSphere Client 4.0, 4.1, 5.0 before Update 3, and 5.1 before Update 2 does not properly validate updates to Client files, which allow (no CVSS) - [CVE-2014-1210](https://cve.now/CVE-2014-1210.md): VMware vSphere Client 5.0 before Update 3 and 5.1 before Update 2 does not properly validate X.509 certificates, which allows man-in-the-mid (no CVSS) - [CVE-2014-0777](https://cve.now/CVE-2014-0777.md): OServer Out of Bounds Read (no CVSS, IOServer OPC Drivers) - [CVE-2014-1969](https://cve.now/CVE-2014-1969.md): Directory traversal vulnerability in the apps4u@android SD Card Manager application before 20140224 for Android allows attackers to overwrit (no CVSS) - [CVE-2012-6130](https://cve.now/CVE-2012-6130.md): Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web scr (no CVSS, roundup) - [CVE-2012-6131](https://cve.now/CVE-2012-6131.md): Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or (no CVSS, roundup) - [CVE-2014-0172](https://cve.now/CVE-2014-0172.md): Integer overflow in the check\_section function in dwarf\_begin\_elf.c in the libdw library, as used in elfutils 0.153 and possibly through 0.1 (no CVSS) - [CVE-2014-2847](https://cve.now/CVE-2014-2847.md): SQL injection vulnerability in default.asp in CIS Manager CMS allows remote attackers to execute arbitrary SQL commands via the TroncoID par (no CVSS) - [CVE-2014-2848](https://cve.now/CVE-2014-2848.md): A race condition in the wmi\_malware\_scan.nbin plugin before 201402262215 for Nessus 5.2.1 allows local users to gain privileges by replacing (no CVSS) - [CVE-2014-2849](https://cve.now/CVE-2014-2849.md): The Change Password dialog box (change\_password) in Sophos Web Appliance before 3.8.2 allows remote authenticated users to change the admin (no CVSS) - [CVE-2014-2850](https://cve.now/CVE-2014-2850.md): The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitra (no CVSS) - [CVE-2013-2706](https://cve.now/CVE-2013-2706.md): Cross-site request forgery (CSRF) vulnerability in the Stream Video Player plugin 1.4.0 for WordPress allows remote attackers to hijack the (no CVSS) - [CVE-2013-2708](https://cve.now/CVE-2013-2708.md): Cross-site request forgery (CSRF) vulnerability in the Content Slide plugin 1.4.2 for WordPress allows remote attackers to hijack the authen (no CVSS) - [CVE-2013-4795](https://cve.now/CVE-2013-4795.md): Cross-site scripting (XSS) vulnerability in the Submitters list in Review Board 1.6.x before 1.6.18 and 1.7.x before 1.7.12 allows remote at (no CVSS) - [CVE-2013-6369](https://cve.now/CVE-2013-6369.md): Stack-based buffer overflow in the jbg\_dec\_in function in libjbig/jbig.c in JBIG-KIT before 2.1 allows remote attackers to cause a denial of (no CVSS) - [CVE-2014-1985](https://cve.now/CVE-2014-1985.md): Open redirect vulnerability in the redirect\_back\_or\_default function in app/controllers/application\_controller.rb in Redmine before 2.4.5 an (no CVSS) - [CVE-2014-2333](https://cve.now/CVE-2014-2333.md): Cross-site scripting (XSS) vulnerability in the Lazyest Gallery plugin before 1.1.21 for WordPress allows remote attackers to inject arbitra (no CVSS) - [CVE-2014-2540](https://cve.now/CVE-2014-2540.md): SQL injection vulnerability in OrbitScripts Orbit Open Ad Server before 1.1.1 allows remote attackers to execute arbitrary SQL commands via (no CVSS) - [CVE-2014-2741](https://cve.now/CVE-2014-2741.md): nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, (no CVSS, org.igniterealtime.openfire:parent) - [CVE-2014-2742](https://cve.now/CVE-2014-2742.md): Isode M-Link before 16.0v7 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a de (no CVSS) - [CVE-2014-2743](https://cve.now/CVE-2014-2743.md): plugins/mod\_compression.lua in Lightwitch Metronome through 3.4 does not properly restrict the processing of compressed XML elements, which (no CVSS) - [CVE-2014-2744](https://cve.now/CVE-2014-2744.md): plugins/mod\_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a sessi (no CVSS) - [CVE-2014-2745](https://cve.now/CVE-2014-2745.md): Prosody before 0.9.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial o (no CVSS) - [CVE-2014-2746](https://cve.now/CVE-2014-2746.md): net/IOService.java in Tigase before 5.2.1 does not properly restrict the processing of compressed XML elements, which allows remote attacker (no CVSS) - [CVE-2014-2829](https://cve.now/CVE-2014-2829.md): Erlang Solutions MongooseIM through 1.3.1 rev. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2014-04-11 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.