# CVEs published 2014-04-25

18 CVEs were published on April 25, 2014: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2014-2579](https://cve.now/CVE-2014-2579.md): Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authen (no CVSS)
- [CVE-2014-2996](https://cve.now/CVE-2014-2996.md): XCloner Standalone 3.5 and earlier, when enable\_db\_backup and sql\_mem are enabled, allows remote authenticated administrators to execute arb (no CVSS)
- [CVE-2013-2025](https://cve.now/CVE-2013-2025.md): Cross-site scripting (XSS) vulnerability in Ushahidi Platform 2.5.x through 2.6.1 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2013-3069](https://cve.now/CVE-2013-3069.md): Multiple cross-site scripting (XSS) vulnerabilities in NETGEAR WNDR4700 with firmware 1.0.0.34 allow remote authenticated users to inject ar (no CVSS)
- [CVE-2013-4565](https://cve.now/CVE-2013-4565.md): Heap-based buffer overflow in the \_\_OLEdecode function in ppthtml 0.5.1 and earlier allows remote attackers to cause a denial of service (cr (no CVSS)
- [CVE-2013-4722](https://cve.now/CVE-2013-4722.md): Multiple cross-site scripting (XSS) vulnerabilities in Admin/login/default.asp in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/1 (no CVSS)
- [CVE-2013-4723](https://cve.now/CVE-2013-4723.md): Open redirect vulnerability in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions allows (no CVSS)
- [CVE-2013-4726](https://cve.now/CVE-2013-4726.md): Cross-site request forgery (CSRF) vulnerability in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly o (no CVSS)
- [CVE-2013-5660](https://cve.now/CVE-2013-5660.md): Buffer overflow in Power Software WinArchiver 3.2 allows remote attackers to execute arbitrary code via a crafted .zip file. (no CVSS)
- [CVE-2012-4230](https://cve.now/CVE-2012-4230.md): The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2) valid\_elemen (no CVSS)
- [CVE-2013-5954](https://cve.now/CVE-2013-5954.md): Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack the authentication o (no CVSS)
- [CVE-2013-5956](https://cve.now/CVE-2013-5956.md): Cross-site scripting (XSS) vulnerability in includes/flvthumbnail.php in the Youtube Gallery (com\_youtubegallery) component 3.4.0 for Joomla (no CVSS)
- [CVE-2014-2729](https://cve.now/CVE-2014-2729.md): Cross-site scripting (XSS) vulnerability in content.aspx in Ektron CMS 8.7 before 8.7.0.055 allows remote authenticated users to inject arbi (no CVSS)
- [CVE-2014-0760](https://cve.now/CVE-2014-0760.md): Festo CECX-X-(C1/M1) Controller Improper Authentication (no CVSS, Festo CECX-X-C1 Modular Master Controller with CoDeSys · Fe…)
- [CVE-2014-0769](https://cve.now/CVE-2014-0769.md): Festo CECX-X-(C1/M1) Controller Improper Authentication (no CVSS, Festo CECX-X-C1 Modular Master Controller with CoDeSys · Fe…)
- [CVE-2014-0780](https://cve.now/CVE-2014-0780.md): InduSoft Web Studio Path Traversal (CVSS 9.8, KEV, InduSoft Web Studio)
- [CVE-2014-2908](https://cve.now/CVE-2014-2908.md): Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attac (no CVSS)
- [CVE-2014-2909](https://cve.now/CVE-2014-2909.md): CRLF injection vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inje (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-04-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.