# CVEs published 2014-04-17 20 CVEs were published on April 17, 2014: 0 critical, 0 high. Days are UTC. - [CVE-2014-2391](https://cve.now/CVE-2014-2391.md): The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an i (no CVSS) - [CVE-2014-2392](https://cve.now/CVE-2014-2392.md): The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 pla (no CVSS) - [CVE-2014-2393](https://cve.now/CVE-2014-2393.md): Cross-site scripting (XSS) vulnerability in Open-Xchange AppSuite 7.4.1 before 7.4.1-rev11 and 7.4.2 before 7.4.2-rev13 allows remote attack (no CVSS) - [CVE-2011-3154](https://cve.now/CVE-2011-3154.md): DistUpgrade/DistUpgradeViewKDE.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.15 (no CVSS) - [CVE-2013-2143](https://cve.now/CVE-2013-2143.md): The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update\_roles action, which (no CVSS) - [CVE-2014-0036](https://cve.now/CVE-2014-0036.md): The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man (no CVSS, rbovirt) - [CVE-2014-0054](https://cve.now/CVE-2014-0054.md): The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external ent (no CVSS, org.springframework:spring-webmvc) - [CVE-2014-0071](https://cve.now/CVE-2014-0071.md): PackStack in Red Hat OpenStack 4.0 does not enforce the default security groups when deployed to Neutron, which allows remote attackers to b (no CVSS) - [CVE-2014-0085](https://cve.now/CVE-2014-0085.md): JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. (no CVSS, org.jboss.fuse:jboss-fuse) - [CVE-2014-0111](https://cve.now/CVE-2014-0111.md): Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to (no CVSS, org.apache.syncope:syncope) - [CVE-2014-0984](https://cve.now/CVE-2014-0984.md): The passwordCheck function in SAP Router 721 patch 117, 720 patch 411, 710 patch 029, and earlier terminates validation of a Route Permissio (no CVSS) - [CVE-2014-1932](https://cve.now/CVE-2014-1932.md): The (1) load\_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, a (no CVSS, pillow) - [CVE-2014-1933](https://cve.now/CVE-2014-1933.md): The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses th (no CVSS, pillow) - [CVE-2014-2310](https://cve.now/CVE-2014-2310.md): The AgentX subagent in Net-SNMP before 5.4.4 allows remote attackers to cause a denial of service (hang) by sending a multi-object request w (no CVSS) - [CVE-2014-2469](https://cve.now/CVE-2014-2469.md): Unspecified vulnerability in lighttpd in Oracle Solaris 11.1 allows attackers to cause a denial of service via unknown vectors. (no CVSS) - [CVE-2014-2707](https://cve.now/CVE-2014-2707.md): cups-browsed in cups-filters 1.0.41 before 1.0.51 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the ( (no CVSS) - [CVE-2014-2879](https://cve.now/CVE-2014-2879.md): Multiple cross-site scripting (XSS) vulnerabilities in Dell SonicWALL Email Security 7.4.5 and earlier allow remote authenticated administra (no CVSS) - [CVE-2014-2880](https://cve.now/CVE-2014-2880.md): Open redirect vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2 (no CVSS) - [CVE-2014-0644](https://cve.now/CVE-2014-0644.md): EMC Cloud Tiering Appliance (CTA) 10 through SP1 allows remote attackers to read arbitrary files via an api/login request containing an XML (no CVSS) - [CVE-2014-0645](https://cve.now/CVE-2014-0645.md): EMC Cloud Tiering Appliance (CTA) 9.x through 10 SP1 and File Management Appliance (FMA) 7.x store DES password hashes for the root, super, (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2014-04-17 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.