CVEs published April 25, 2014
18 CVEs were published on April 25, 2014: 1 critical, 0 high. 1 is now in CISA KEV.
- Published
- 18
- Critical
- 1
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 17
- Now in CISA KEV
- 1
- Fix available
- 0
Most affected products
- Festo CECX-X-C1 Modular Master Controller with CoDeSys · Fe…
- 2
- InduSoft Web Studio
- 1
Critical 1
Medium, low and unrated 17
- CVE-2014-2579Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authen
- CVE-2014-2996XCloner Standalone 3.5 and earlier, when enable_db_backup and sql_mem are enabled, allows remote authenticated administrators to execute arb
- CVE-2013-2025Cross-site scripting (XSS) vulnerability in Ushahidi Platform 2.5.x through 2.6.1 allows remote attackers to inject arbitrary web script or
- CVE-2013-3069Multiple cross-site scripting (XSS) vulnerabilities in NETGEAR WNDR4700 with firmware 1.0.0.34 allow remote authenticated users to inject ar
- CVE-2013-4565Heap-based buffer overflow in the __OLEdecode function in ppthtml 0.5.1 and earlier allows remote attackers to cause a denial of service (cr
- CVE-2013-4722Multiple cross-site scripting (XSS) vulnerabilities in Admin/login/default.asp in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/1
- CVE-2013-4723Open redirect vulnerability in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions allows
- CVE-2013-4726Cross-site request forgery (CSRF) vulnerability in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly o
- CVE-2013-5660Buffer overflow in Power Software WinArchiver 3.2 allows remote attackers to execute arbitrary code via a crafted .zip file.
- CVE-2012-4230The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2) valid_elemen
- CVE-2013-5954Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack the authentication o
- CVE-2013-5956Cross-site scripting (XSS) vulnerability in includes/flvthumbnail.php in the Youtube Gallery (com_youtubegallery) component 3.4.0 for Joomla
- CVE-2014-2729Cross-site scripting (XSS) vulnerability in content.aspx in Ektron CMS 8.7 before 8.7.0.055 allows remote authenticated users to inject arbi
- CVE-2014-0760Festo CECX-X-(C1/M1) Controller Improper AuthenticationFesto CECX-X-C1 Modular Master Controller with CoDeSys · Fe…
- CVE-2014-0769Festo CECX-X-(C1/M1) Controller Improper AuthenticationFesto CECX-X-C1 Modular Master Controller with CoDeSys · Fe…
- CVE-2014-2908Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attac
- CVE-2014-2909CRLF injection vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inje