# CVEs published 2014-04-21

16 CVEs were published on April 21, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2013-5459](https://cve.now/CVE-2013-5459.md): Unspecified vulnerability in IBM Rational Software Architect (RSA) Design Manager and Rational Rhapsody Design Manager 3.x through 3.0.1 and (no CVSS)
- [CVE-2014-0361](https://cve.now/CVE-2014-0361.md): The default configuration of IBM 4690 OS, as used in Toshiba Global Commerce Solutions 4690 POS and other products, hashes passwords with th (no CVSS)
- [CVE-2014-0932](https://cve.now/CVE-2014-0932.md): Cross-site scripting (XSS) vulnerability in IBM Sterling Order Management 8.5 before HF105 and Sterling Selling and Fulfillment Foundation 9 (no CVSS)
- [CVE-2014-2921](https://cve.now/CVE-2014-2921.md): The getObjectByToken function in Newsletter.php in the Pimcore\_Tool\_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handl (no CVSS, pimcore/pimcore)
- [CVE-2014-2922](https://cve.now/CVE-2014-2922.md): The getObjectByToken function in Newsletter.php in the Pimcore\_Tool\_Newsletter module in pimcore 1.4.9 through 2.1.0 does not properly handl (no CVSS)
- [CVE-2013-5948](https://cve.now/CVE-2013-5948.md): The Network Analysis tab (Main\_Analysis\_Content.asp) in the ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 (no CVSS)
- [CVE-2013-6370](https://cve.now/CVE-2013-6370.md): Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a denial of service via unspecified vectors. (no CVSS)
- [CVE-2013-6371](https://cve.now/CVE-2013-6371.md): The hash functionality in json-c before 0.12 allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted J (no CVSS)
- [CVE-2013-6469](https://cve.now/CVE-2013-6469.md): JBoss Overlord Run Time Governance (RTGov) 1.0 for JBossAS allows remote authenticated users to execute arbitrary Java code via an MVFLEX Ex (no CVSS)
- [CVE-2014-0173](https://cve.now/CVE-2014-0173.md): The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4 (no CVSS)
- [CVE-2014-1216](https://cve.now/CVE-2014-1216.md): FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND\_PATTERN and TEST\_R (no CVSS, org.fitnesse:fitnesse)
- [CVE-2014-2269](https://cve.now/CVE-2014-2269.md): modules/Users/ForgotPassword.php in vTiger 6.0 before Security Patch 2 allows remote attackers to reset the password for arbitrary users via (no CVSS)
- [CVE-2014-2341](https://cve.now/CVE-2014-2341.md): Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web sessions via the PHPSESSID parameter. (no CVSS)
- [CVE-2014-2719](https://cve.now/CVE-2014-2719.md): Advanced\_System\_Content.asp in the ASUS RT series routers with firmware before 3.0.0.4.374.5517, when an administrator session is active, al (no CVSS)
- [CVE-2014-2735](https://cve.now/CVE-2014-2735.md): WinSCP before 5.5.3, when FTP with TLS is used, does not verify that the server hostname matches a domain name in the subject's Common Name (no CVSS)
- [CVE-2014-2925](https://cve.now/CVE-2014-2925.md): Cross-site scripting (XSS) vulnerability in Advanced\_Wireless\_Content.asp in ASUS RT-AC68U and other RT series routers with firmware before (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-04-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.