# CVEs published 2014-04-22

14 CVEs were published on April 22, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2013-1421](https://cve.now/CVE-2013-1421.md): Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote att (no CVSS)
- [CVE-2013-2105](https://cve.now/CVE-2013-2105.md): The Show In Browser (show\_in\_browser) gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on / (no CVSS, show\_in\_browser)
- [CVE-2013-2187](https://cve.now/CVE-2013-2187.md): Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3 before 1.3.8 allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2013-4116](https://cve.now/CVE-2013-4116.md): lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary fil (no CVSS, npm)
- [CVE-2013-4472](https://cve.now/CVE-2013-4472.md): The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local use (no CVSS)
- [CVE-2013-7338](https://cve.now/CVE-2013-7338.md): Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value large (no CVSS)
- [CVE-2014-1615](https://cve.now/CVE-2014-1615.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Carbon Black before 4.1.0 allow remote attackers to hijack the authentication (no CVSS)
- [CVE-2014-2654](https://cve.now/CVE-2014-2654.md): Multiple SQL injection vulnerabilities in MobFox mAdserve 2.0 and earlier allow remote authenticated users to execute arbitrary SQL commands (no CVSS)
- [CVE-2014-2659](https://cve.now/CVE-2014-2659.md): Cross-site request forgery (CSRF) vulnerability in the admin UI in Papercut MF and NG before 14.1 (Build 26983) allows remote attackers to h (no CVSS)
- [CVE-2014-2737](https://cve.now/CVE-2014-2737.md): SQL injection vulnerability in the get\_active\_session function in the KTAPI\_UserSession class in webservice/clienttools/services/mdownload.p (no CVSS)
- [CVE-2014-2890](https://cve.now/CVE-2014-2890.md): Cross-site scripting (XSS) vulnerability in the wrap\_html function in MyID.php in phpMyID 0.9 allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2014-2892](https://cve.now/CVE-2014-2892.md): Heap-based buffer overflow in the get\_answer function in mmsh.c in libmms before 0.6.4 allows remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2014-2899](https://cve.now/CVE-2014-2899.md): wolfSSL CyaSSL before 2.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via (1) a request for the peer c (no CVSS)
- [CVE-2014-2900](https://cve.now/CVE-2014-2900.md): wolfSSL CyaSSL before 2.9.4 does not properly validate X.509 certificates with unknown critical extensions, which allows man-in-the-middle a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-04-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.