# CVEs published 2014-04-15

69 CVEs were published on April 15, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-0642](https://cve.now/CVE-2014-0642.md): EMC Documentum Content Server before 6.7 SP1 P26, 6.7 SP2 before P13, 7.0 before P13, and 7.1 before P02 allows remote authenticated users t (no CVSS)
- [CVE-2014-0921](https://cve.now/CVE-2014-0921.md): The server in IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 allows remote attackers to cause a denial of service (daemon crash and mes (no CVSS)
- [CVE-2014-0922](https://cve.now/CVE-2014-0922.md): IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 allows remote attackers to cause a denial of service (resource consumption) via WebSocke (no CVSS)
- [CVE-2014-0923](https://cve.now/CVE-2014-0923.md): IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 allows remote attackers to cause a denial of service (daemon restart) via crafted MQ Tel (no CVSS)
- [CVE-2014-0924](https://cve.now/CVE-2014-0924.md): IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 does not verify that all of the characters of a password are correct, which makes it eas (no CVSS)
- [CVE-2014-2859](https://cve.now/CVE-2014-2859.md): PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to bypass intended access restrictions via a direct request. (no CVSS)
- [CVE-2014-2860](https://cve.now/CVE-2014-2860.md): Multiple cross-site scripting (XSS) vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to inje (no CVSS)
- [CVE-2014-2861](https://cve.now/CVE-2014-2861.md): Incomplete blacklist vulnerability in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to conduct cross-site s (no CVSS)
- [CVE-2014-2862](https://cve.now/CVE-2014-2862.md): PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 does not check authorization in unspecified situations, which allows remote authentic (no CVSS)
- [CVE-2014-2863](https://cve.now/CVE-2014-2863.md): Multiple absolute path traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an (no CVSS)
- [CVE-2014-2864](https://cve.now/CVE-2014-2864.md): Multiple directory traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an uns (no CVSS)
- [CVE-2014-2865](https://cve.now/CVE-2014-2865.md): PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to bypass intended access restrictions via a '\\0' character, (no CVSS)
- [CVE-2014-2866](https://cve.now/CVE-2014-2866.md): PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 relies on client JavaScript code for access restrictions, which allows remote attacke (no CVSS)
- [CVE-2014-2867](https://cve.now/CVE-2014-2867.md): Unrestricted file upload vulnerability in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2014-2868](https://cve.now/CVE-2014-2868.md): PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to modify the flow of execution of ColdFusion code by using a (no CVSS)
- [CVE-2014-2869](https://cve.now/CVE-2014-2869.md): PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to obtain sensitive information via requests to unspecified U (no CVSS)
- [CVE-2014-2870](https://cve.now/CVE-2014-2870.md): The default configuration of PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 uses cleartext for storage of credentials in a database, (no CVSS)
- [CVE-2014-2871](https://cve.now/CVE-2014-2871.md): PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 relies on an HTTP session for entering credentials on login pages, which allows remot (no CVSS)
- [CVE-2014-2872](https://cve.now/CVE-2014-2872.md): PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to obtain potentially sensitive information from a directory (no CVSS)
- [CVE-2014-2873](https://cve.now/CVE-2014-2873.md): PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 does not require authentication for access to log files, which allows remote attacker (no CVSS)
- [CVE-2014-2874](https://cve.now/CVE-2014-2874.md): PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to execute arbitrary code via shell metacharacters in an unsp (no CVSS)
- [CVE-2013-4768](https://cve.now/CVE-2013-4768.md): The web services APIs in Eucalyptus 2.0 through 3.4.1 allow remote attackers to cause a denial of service via vectors related to the "networ (no CVSS)
- [CVE-2014-0384](https://cve.now/CVE-2014-0384.md): Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticate (no CVSS)
- [CVE-2014-0413](https://cve.now/CVE-2014-0413.md): Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect (no CVSS)
- [CVE-2014-0414](https://cve.now/CVE-2014-0414.md): Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect (no CVSS)
- [CVE-2014-0421](https://cve.now/CVE-2014-0421.md): Unspecified vulnerability in Oracle Solaris 10, when running on the SPARC64-X Platform, allows local users to affect confidentiality, integr (no CVSS)
- [CVE-2014-0426](https://cve.now/CVE-2014-0426.md): Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect (no CVSS)
- [CVE-2014-0429](https://cve.now/CVE-2014-0429.md): Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote (no CVSS)
- [CVE-2014-0432](https://cve.now/CVE-2014-0432.md): Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integr (no CVSS)
- [CVE-2014-0442](https://cve.now/CVE-2014-0442.md): Unspecified vulnerability in Oracle Solaris 9, 10, and 11.1 allows local users to affect confidentiality, integrity, and availability via un (no CVSS)
- [CVE-2014-0446](https://cve.now/CVE-2014-0446.md): Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confiden (no CVSS)
- [CVE-2014-0447](https://cve.now/CVE-2014-0447.md): Unspecified vulnerability in Oracle Solaris 10 and 11.1 allows local users to affect availability via unknown vectors related to Kernel, a d (no CVSS)
- [CVE-2014-0448](https://cve.now/CVE-2014-0448.md): Unspecified vulnerability in Oracle Java SE 7u51 and 8 allows remote attackers to affect confidentiality, integrity, and availability via un (no CVSS)
- [CVE-2014-0449](https://cve.now/CVE-2014-0449.md): Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality (no CVSS)
- [CVE-2014-0450](https://cve.now/CVE-2014-0450.md): Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.7 and 11.1.1.8 allows remote attackers (no CVSS)
- [CVE-2014-0514](https://cve.now/CVE-2014-0514.md): The Adobe Reader Mobile application before 11.2 for Android does not properly restrict use of JavaScript, which allows remote attackers to e (no CVSS)
- [CVE-2014-1986](https://cve.now/CVE-2014-1986.md): The Content Provider in the KOKUYO CamiApp application 1.21.1 and earlier for Android allows attackers to bypass intended access restriction (no CVSS)
- [CVE-2014-2384](https://cve.now/CVE-2014-2384.md): vmx86.sys in VMware Workstation 10.0.1 build 1379776 and VMware Player 6.0.1 build 1379776 on Windows might allow local users to cause a den (no CVSS)
- [CVE-2008-3277](https://cve.now/CVE-2008-3277.md): Untrusted search path vulnerability in a certain Red Hat build script for the ibmssh executable in ibutils packages before ibutils-1.5.7-2.e (no CVSS)
- [CVE-2010-2236](https://cve.now/CVE-2010-2236.md): The monitoring probe display in spacewalk-java before 2.1.148-1 and Red Hat Network (RHN) Satellite 4.0.0 through 4.2.0 and 5.1.0 through 5. (no CVSS)
- [CVE-2011-3628](https://cve.now/CVE-2011-3628.md): Untrusted search path vulnerability in pam\_motd (aka the MOTD module) in libpam-modules before 1.1.3-2ubuntu2.1 on Ubuntu 11.10, before 1.1. (no CVSS)
- [CVE-2012-0214](https://cve.now/CVE-2012-0214.md): The pkgAcqMetaClearSig::Failed method in apt-pkg/acquire-item.cc in Advanced Package Tool (APT) 0.8.11 through 0.8.15.10 and 0.8.16 before 0 (no CVSS)
- [CVE-2013-6456](https://cve.now/CVE-2013-6456.md): The LXC driver (lxc/lxc\_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDe (no CVSS)
- [CVE-2014-0053](https://cve.now/CVE-2014-0053.md): The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 before 2.3.6 does not properly restrict access (no CVSS)
- [CVE-2014-2857](https://cve.now/CVE-2014-2857.md): The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 does not properly restrict acces (no CVSS)
- [CVE-2014-2858](https://cve.now/CVE-2014-2858.md): Directory traversal vulnerability in the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 allows remote attackers (no CVSS)
- [CVE-2013-7368](https://cve.now/CVE-2013-7368.md): Multiple cross-site scripting (XSS) vulnerabilities in Gnew 2013.1 allow remote attackers to inject arbitrary web script or HTML via the gne (no CVSS)
- [CVE-2014-0107](https://cve.now/CVE-2014-0107.md): The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE\_SECURE\_PROCESS (no CVSS, xalan:xalan)
- [CVE-2014-2580](https://cve.now/CVE-2014-2580.md): The netback driver in Xen, when using certain Linux versions that do not allow sleeping in softirq context, allows local guest administrator (no CVSS)
- [CVE-2014-0105](https://cve.now/CVE-2014-0105.md): The auth\_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly ret (no CVSS, python-keystoneclient)
- [CVE-2014-0138](https://cve.now/CVE-2014-0138.md): The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) (no CVSS)
- [CVE-2014-0139](https://cve.now/CVE-2014-0139.md): cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the (no CVSS)
- [CVE-2014-0157](https://cve.now/CVE-2014-0157.md): Cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard (aka Horizon) 2013.2 before 2013.2.4 (no CVSS, horizon)
- [CVE-2014-0167](https://cve.now/CVE-2014-0167.md): The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not (no CVSS, nova)
- [CVE-2014-2690](https://cve.now/CVE-2014-2690.md): Citrix VDI-in-a-Box 5.3.x before 5.3.6 and 5.4.x before 5.4.3 allows local users to obtain administrator credentials by reading the log. (no CVSS)
- [CVE-2014-2828](https://cve.now/CVE-2014-2828.md): The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a denia (no CVSS, keystone)
- [CVE-2014-2842](https://cve.now/CVE-2014-2842.md): Juniper ScreenOS 6.3 and earlier allows remote attackers to cause a denial of service (crash and restart or failover) via a malformed SSL/TL (no CVSS)
- [CVE-2013-5704](https://cve.now/CVE-2013-5704.md): The mod\_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a head (no CVSS)
- [CVE-2013-5705](https://cve.now/CVE-2013-5705.md): apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalize (no CVSS)
- [CVE-2014-0341](https://cve.now/CVE-2014-0341.md): Multiple cross-site scripting (XSS) vulnerabilities in PivotX before 2.3.9 allow remote authenticated users to inject arbitrary web script o (no CVSS)
- [CVE-2014-0342](https://cve.now/CVE-2014-0342.md): Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute arbit (no CVSS)
- [CVE-2014-0348](https://cve.now/CVE-2014-0348.md): The Artiva Agency Single Sign-On (SSO) implementation in Artiva Workstation 1.3.x before 1.3.9, Artiva Rm 3.1 MR7, Artiva Healthcare 5.2 MR5 (no CVSS)
- [CVE-2014-0353](https://cve.now/CVE-2014-0353.md): The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to bypass authentication by using %2F seq (no CVSS)
- [CVE-2014-0354](https://cve.now/CVE-2014-0354.md): The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 has a hardcoded password of qweasdzxc for an unspecified account, (no CVSS)
- [CVE-2014-0355](https://cve.now/CVE-2014-0355.md): Multiple stack-based buffer overflows on the ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allow man-in-the-middle (no CVSS)
- [CVE-2014-0356](https://cve.now/CVE-2014-0356.md): The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to execute arbitrary code via shell metac (no CVSS)
- [CVE-2014-0357](https://cve.now/CVE-2014-0357.md): Amtelco miSecureMessages allows remote attackers to read the messages of arbitrary users via an XML request containing a valid license key a (no CVSS)
- [CVE-2014-0358](https://cve.now/CVE-2014-0358.md): Multiple directory traversal vulnerabilities in Xangati XSR before 11 and XNR before 7 allow remote attackers to read arbitrary files via a (no CVSS)
- [CVE-2014-0359](https://cve.now/CVE-2014-0359.md): Xangati XSR before 11 and XNR before 7 allows remote attackers to execute arbitrary commands via shell metacharacters in a gui\_input\_test.pl (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-04-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.