# CVEs published 2014-04-23

46 CVEs were published on April 23, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2011-5279](https://cve.now/CVE-2011-5279.md): CRLF injection vulnerability in the CGI implementation in Microsoft Internet Information Services (IIS) 4.x and 5.x on Windows NT and Window (no CVSS)
- [CVE-2014-0892](https://cve.now/CVE-2014-0892.md): IBM Notes and Domino 8.5.x before 8.5.3 FP6 IF3 and 9.x before 9.0.1 FP1 on 32-bit Linux platforms use incorrect gcc options, which makes it (no CVSS)
- [CVE-2014-1646](https://cve.now/CVE-2014-1646.md): Symantec PGP Desktop 10.0.x through 10.2.x and Encryption Desktop Professional 10.3.x before 10.3.2 MP1 do not properly perform memory copie (no CVSS)
- [CVE-2014-1647](https://cve.now/CVE-2014-1647.md): Symantec PGP Desktop 10.0.x through 10.2.x and Encryption Desktop Professional 10.3.x before 10.3.2 MP1 do not properly perform block-data m (no CVSS)
- [CVE-2014-0472](https://cve.now/CVE-2014-0472.md): The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 a (no CVSS, django)
- [CVE-2014-0473](https://cve.now/CVE-2014-0473.md): The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF toke (no CVSS, django)
- [CVE-2014-0474](https://cve.now/CVE-2014-0474.md): The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1. (no CVSS, django)
- [CVE-2014-2327](https://cve.now/CVE-2014-2327.md): Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of (no CVSS)
- [CVE-2014-2328](https://cve.now/CVE-2014-2328.md): lib/graph\_export.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote authenticated users to execute arbitrary commands via shell metachar (no CVSS)
- [CVE-2014-2554](https://cve.now/CVE-2014-2554.md): OTRS 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote attackers to conduct clickjacking attacks via an IFRAME (no CVSS)
- [CVE-2014-2709](https://cve.now/CVE-2014-2709.md): lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecifi (no CVSS)
- [CVE-2014-2855](https://cve.now/CVE-2014-2855.md): The check\_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of service (infinite loop a (no CVSS)
- [CVE-2014-2888](https://cve.now/CVE-2014-2888.md): lib/sfpagent/bsig.rb in the sfpagent gem before 0.4.15 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacte (no CVSS, sfpagent)
- [CVE-2014-2893](https://cve.now/CVE-2014-2893.md): The GetHTMLRunDir function in the scan-build utility in Clang 3.5 and earlier allows local users to obtain sensitive information or overwrit (no CVSS)
- [CVE-2014-2894](https://cve.now/CVE-2014-2894.md): Off-by-one error in the cmd\_smart function in the smart self test in hw/ide/core.c in QEMU before 2.0 allows local users to have unspecified (no CVSS)
- [CVE-2014-2976](https://cve.now/CVE-2014-2976.md): Directory traversal vulnerability in Sixnet SixView Manager 2.4.1 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2014-2983](https://cve.now/CVE-2014-2983.md): Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anony (no CVSS)
- [CVE-2012-0360](https://cve.now/CVE-2012-0360.md): Memory leak in Cisco IOS before 15.1(1)SY, when IKEv2 debugging is enabled, allows remote attackers to cause a denial of service (memory con (no CVSS)
- [CVE-2012-1317](https://cve.now/CVE-2012-1317.md): The multicast implementation in Cisco IOS before 15.1(1)SY allows remote attackers to cause a denial of service (Route Processor crash) by s (no CVSS)
- [CVE-2012-1366](https://cve.now/CVE-2012-1366.md): Cisco IOS before 15.1(1)SY on ASR 1000 devices, when Multicast Listener Discovery (MLD) tracking is enabled for IPv6, allows remote attacker (no CVSS)
- [CVE-2012-3062](https://cve.now/CVE-2012-3062.md): Cisco IOS before 15.1(1)SY, when Multicast Listener Discovery (MLD) snooping is enabled, allows remote attackers to cause a denial of servic (no CVSS)
- [CVE-2012-3918](https://cve.now/CVE-2012-3918.md): Cisco IOS before 15.3(1)T on Cisco 2900 devices, when a VWIC2-2MFT-T1/E1 card is configured for TDM/HDLC mode, allows remote attackers to ca (no CVSS)
- [CVE-2012-4638](https://cve.now/CVE-2012-4638.md): Cisco IOS before 15.1(1)SY allows local users to cause a denial of service (device reload) by establishing an outbound SSH session, aka Bug (no CVSS)
- [CVE-2012-4651](https://cve.now/CVE-2012-4651.md): Cisco IOS before 15.3(2)T, when scansafe is enabled, allows remote attackers to cause a denial of service (latency) via SYN packets that are (no CVSS)
- [CVE-2012-4658](https://cve.now/CVE-2012-4658.md): The ios-authproxy implementation in Cisco IOS before 15.1(1)SY3 allows remote attackers to cause a denial of service (webauth and HTTP servi (no CVSS)
- [CVE-2012-5014](https://cve.now/CVE-2012-5014.md): Cisco IOS before 15.1(2)SY allows remote authenticated users to cause a denial of service (device crash) by establishing an SSH session from (no CVSS)
- [CVE-2012-5017](https://cve.now/CVE-2012-5017.md): Cisco IOS before 15.1(1)SY1 allows remote authenticated users to cause a denial of service (device reload) by establishing a VPN session and (no CVSS)
- [CVE-2012-5032](https://cve.now/CVE-2012-5032.md): The Flex-VPN load-balancing feature in the ipsec-ikev2 implementation in Cisco IOS before 15.1(1)SY3 does not require authentication, which (no CVSS)
- [CVE-2012-5036](https://cve.now/CVE-2012-5036.md): Cisco IOS before 12.2(50)SY1 allows remote authenticated users to cause a denial of service (memory consumption) via a sequence of VTY manag (no CVSS)
- [CVE-2012-5037](https://cve.now/CVE-2012-5037.md): The ACL implementation in Cisco IOS before 15.1(1)SY on Catalyst 6500 and 7600 devices allows local users to cause a denial of service (devi (no CVSS)
- [CVE-2012-5039](https://cve.now/CVE-2012-5039.md): The BGP Router process in Cisco IOS before 12.2(50)SY1 allows remote attackers to cause a denial of service (memory consumption) via vectors (no CVSS)
- [CVE-2012-5044](https://cve.now/CVE-2012-5044.md): Cisco IOS before 15.3(1)T, when media flow-around is not used, allows remote attackers to cause a denial of service (media loops and stack m (no CVSS)
- [CVE-2012-5422](https://cve.now/CVE-2012-5422.md): Unspecified vulnerability in Cisco IOS before 15.3(2)T on AS5400 devices allows remote authenticated users to cause a denial of service (spu (no CVSS)
- [CVE-2012-5427](https://cve.now/CVE-2012-5427.md): Cisco IOS Unified Border Element (CUBE) in Cisco IOS before 15.3(2)T allows remote authenticated users to cause a denial of service (input q (no CVSS)
- [CVE-2014-1295](https://cve.now/CVE-2014-1295.md): Secure Transport in Apple iOS before 7.1.1, Apple OS X 10.8.x and 10.9.x through 10.9.2, and Apple TV before 6.1.1 does not ensure that a se (no CVSS)
- [CVE-2014-1296](https://cve.now/CVE-2014-1296.md): CFNetwork in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 does not ensure that a Set-Cookie HTTP header is c (no CVSS)
- [CVE-2014-1314](https://cve.now/CVE-2014-1314.md): WindowServer in Apple OS X through 10.9.2 does not prevent session creation by a sandboxed application, which allows attackers to bypass the (no CVSS)
- [CVE-2014-1315](https://cve.now/CVE-2014-1315.md): Format string vulnerability in CoreServicesUIAgent in Apple OS X 10.9.x through 10.9.2 allows remote attackers to execute arbitrary code or (no CVSS)
- [CVE-2014-1316](https://cve.now/CVE-2014-1316.md): Heimdal, as used in Apple OS X through 10.9.2, allows remote attackers to cause a denial of service (abort and daemon exit) via ASN.1 data e (no CVSS)
- [CVE-2014-1318](https://cve.now/CVE-2014-1318.md): The Intel Graphics Driver in Apple OS X through 10.9.2 does not properly validate a certain pointer, which allows attackers to execute arbit (no CVSS)
- [CVE-2014-1319](https://cve.now/CVE-2014-1319.md): Buffer overflow in ImageIO in Apple OS X 10.9.x through 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of servic (no CVSS)
- [CVE-2014-1320](https://cve.now/CVE-2014-1320.md): IOKit in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 places kernel pointers into an object data structure, (no CVSS)
- [CVE-2014-1321](https://cve.now/CVE-2014-1321.md): Power Management in Apple OS X 10.9.x through 10.9.2 allows physically proximate attackers to bypass an intended transition into the locked- (no CVSS)
- [CVE-2014-1322](https://cve.now/CVE-2014-1322.md): The kernel in Apple OS X through 10.9.2 places a kernel pointer into an XNU object data structure accessible from user space, which makes it (no CVSS)
- [CVE-2014-1648](https://cve.now/CVE-2014-1648.md): Cross-site scripting (XSS) vulnerability in brightmail/setting/compliance/DlpConnectFlow$view.flo in the management console in Symantec Mess (no CVSS)
- [CVE-2014-2154](https://cve.now/CVE-2014-2154.md): Memory leak in the SIP inspection engine in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to cause a denial of se (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-04-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.