CVEs published April 29, 2014
32 CVEs were published on April 29, 2014: 0 critical, 0 high.
- Published
- 32
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 32
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- org.apache.struts:struts2-core
- 2
- bio-basespace-sdk
- 1
- mediawiki/core
- 1
- org.neo4j:neo4j
- 1
Medium, low and unrated 32
- CVE-2013-1804Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitrary web script or HT
- CVE-2013-7372The engineNextBytes function in classlib/modules/security/src/main/java/common/org/apache/harmony/security/provider/crypto/SHA1PRNG_SecureRa
- CVE-2013-7373Android before 4.4 does not properly arrange for seeding of the OpenSSL PRNG, which makes it easier for attackers to defeat cryptographic pr
- CVE-2014-2853Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remotmediawiki/core
- CVE-2013-7063The Invitation module 7.x-2.x for Drupal does not properly check permissions, which allows remote attackers to obtain sensitive information
- CVE-2013-7064Cross-site scripting (XSS) vulnerability in the EU Cookie Compliance module 7.x-1.x before 7.x-1.12 for Drupal allows remote authenticated a
- CVE-2013-7065The Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal allows remote attackers to bypass access restrictions and post to arbitrary
- CVE-2013-7066The Entity reference module 7.x-1.x before 7.x-1.1-rc1 for Drupal allows remote attackers to read private nodes titles by leveraging edit pe
- CVE-2013-7068The Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users to bypass group restrictions on nodes wit
- CVE-2013-7111The put_call function in the API client (api/api_client.rb) in the BaseSpace Ruby SDK (aka bio-basespace-sdk) gem 0.1.7 for Ruby uses the APbio-basespace-sdk
- CVE-2013-7134Juvia uses the same secret key for all installations, which allows remote attackers to have unspecified impact by leveraging the secret key
- CVE-2013-7220js/ui/screenShield.js in GNOME Shell (aka gnome-shell) before 3.8 allows physically proximate attackers to execute arbitrary commands by lev
- CVE-2013-7221The automatic screen lock functionality in GNOME Shell (aka gnome-shell) before 3.10 does not prevent access to the "Enter a Command" dialog
- CVE-2013-7234Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to conduct clickjacking attacks via an X-Frame-Option
- CVE-2013-7235Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to impersonate arbitrary users via multiple space cha
- CVE-2013-7236Simple Machines Forum (SMF) 2.0.6, 1.1.19, and earlier allows remote attackers to impersonate arbitrary users via a Unicode homoglyph charac
- CVE-2013-7259Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administratorg.neo4j:neo4j
- CVE-2013-7273GNOME Display Manager (gdm) 3.4.1 and earlier, when disable-user-list is set to true, allows local users to cause a denial of service (unabl
- CVE-2013-7284The PlRPC module, possibly 0.2020 and earlier, for Perl uses the Storable module, which allows remote attackers to execute arbitrary code vi
- CVE-2013-7302Session fixation vulnerability in the Ubercart module 6.x-2.x before 6.x-2.13 and 7.x-3.x before 7.x-3.6 for Drupal, when the "Log in new cu
- CVE-2014-0088The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11, when running on a 32-bit platform, allows remote a
- CVE-2014-0112ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackersorg.apache.struts:struts2-core
- CVE-2014-0113CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClaorg.apache.struts:struts2-core
- CVE-2014-0515Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and before 11.2.2
- CVE-2014-1841Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to copy an arbitr
- CVE-2014-1842Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to list all usern
- CVE-2014-1843Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to obtain the pro
- CVE-2014-2180The Document Management component in Cisco Unified Contact Center Express does not properly validate a parameter, which allows remote authen
- CVE-2014-2182Cisco Adaptive Security Appliance (ASA) Software, when DHCPv6 replay is configured, allows remote attackers to cause a denial of service (de
- CVE-2014-2183The L2TP module in Cisco IOS XE 3.10S(.2) and earlier on ASR 1000 routers allows remote authenticated users to cause a denial of service (ES
- CVE-2014-2184The IP Manager Assistant (IPMA) component in Cisco Unified Communications Manager (Unified CM) allows remote attackers to obtain sensitive i
- CVE-2014-2185The Call Detail Records (CDR) Management component in Cisco Unified Communications Manager (Unified CM) allows remote authenticated users to