CVEs published April 17, 2014
20 CVEs were published on April 17, 2014: 0 critical, 0 high.
- Published
- 20
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 20
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- pillow
- 2
- org.apache.syncope:syncope
- 1
- org.jboss.fuse:jboss-fuse
- 1
- org.springframework:spring-webmvc
- 1
- rbovirt
- 1
Medium, low and unrated 20
- CVE-2014-2391The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an i
- CVE-2014-2392The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 pla
- CVE-2014-2393Cross-site scripting (XSS) vulnerability in Open-Xchange AppSuite 7.4.1 before 7.4.1-rev11 and 7.4.2 before 7.4.2-rev13 allows remote attack
- CVE-2011-3154DistUpgrade/DistUpgradeViewKDE.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.15
- CVE-2013-2143The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which
- CVE-2014-0036The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct manrbovirt
- CVE-2014-0054The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entorg.springframework:spring-webmvc
- CVE-2014-0071PackStack in Red Hat OpenStack 4.0 does not enforce the default security groups when deployed to Neutron, which allows remote attackers to b
- CVE-2014-0085JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper.org.jboss.fuse:jboss-fuse
- CVE-2014-0111Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to org.apache.syncope:syncope
- CVE-2014-0984The passwordCheck function in SAP Router 721 patch 117, 720 patch 411, 710 patch 029, and earlier terminates validation of a Route Permissio
- CVE-2014-1932The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, apillow
- CVE-2014-1933The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses thpillow
- CVE-2014-2310The AgentX subagent in Net-SNMP before 5.4.4 allows remote attackers to cause a denial of service (hang) by sending a multi-object request w
- CVE-2014-2469Unspecified vulnerability in lighttpd in Oracle Solaris 11.1 allows attackers to cause a denial of service via unknown vectors.
- CVE-2014-2707cups-browsed in cups-filters 1.0.41 before 1.0.51 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the (
- CVE-2014-2879Multiple cross-site scripting (XSS) vulnerabilities in Dell SonicWALL Email Security 7.4.5 and earlier allow remote authenticated administra
- CVE-2014-2880Open redirect vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2
- CVE-2014-0644EMC Cloud Tiering Appliance (CTA) 10 through SP1 allows remote attackers to read arbitrary files via an api/login request containing an XML
- CVE-2014-0645EMC Cloud Tiering Appliance (CTA) 9.x through 10 SP1 and File Management Appliance (FMA) 7.x store DES password hashes for the root, super,