# CVEs published 2014-04-29

32 CVEs were published on April 29, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2013-1804](https://cve.now/CVE-2013-1804.md): Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2013-7372](https://cve.now/CVE-2013-7372.md): The engineNextBytes function in classlib/modules/security/src/main/java/common/org/apache/harmony/security/provider/crypto/SHA1PRNG\_SecureRa (no CVSS)
- [CVE-2013-7373](https://cve.now/CVE-2013-7373.md): Android before 4.4 does not properly arrange for seeding of the OpenSSL PRNG, which makes it easier for attackers to defeat cryptographic pr (no CVSS)
- [CVE-2014-2853](https://cve.now/CVE-2014-2853.md): Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remot (no CVSS, mediawiki/core)
- [CVE-2013-7063](https://cve.now/CVE-2013-7063.md): The Invitation module 7.x-2.x for Drupal does not properly check permissions, which allows remote attackers to obtain sensitive information (no CVSS)
- [CVE-2013-7064](https://cve.now/CVE-2013-7064.md): Cross-site scripting (XSS) vulnerability in the EU Cookie Compliance module 7.x-1.x before 7.x-1.12 for Drupal allows remote authenticated a (no CVSS)
- [CVE-2013-7065](https://cve.now/CVE-2013-7065.md): The Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal allows remote attackers to bypass access restrictions and post to arbitrary (no CVSS)
- [CVE-2013-7066](https://cve.now/CVE-2013-7066.md): The Entity reference module 7.x-1.x before 7.x-1.1-rc1 for Drupal allows remote attackers to read private nodes titles by leveraging edit pe (no CVSS)
- [CVE-2013-7068](https://cve.now/CVE-2013-7068.md): The Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users to bypass group restrictions on nodes wit (no CVSS)
- [CVE-2013-7111](https://cve.now/CVE-2013-7111.md): The put\_call function in the API client (api/api\_client.rb) in the BaseSpace Ruby SDK (aka bio-basespace-sdk) gem 0.1.7 for Ruby uses the AP (no CVSS, bio-basespace-sdk)
- [CVE-2013-7134](https://cve.now/CVE-2013-7134.md): Juvia uses the same secret key for all installations, which allows remote attackers to have unspecified impact by leveraging the secret key (no CVSS)
- [CVE-2013-7220](https://cve.now/CVE-2013-7220.md): js/ui/screenShield.js in GNOME Shell (aka gnome-shell) before 3.8 allows physically proximate attackers to execute arbitrary commands by lev (no CVSS)
- [CVE-2013-7221](https://cve.now/CVE-2013-7221.md): The automatic screen lock functionality in GNOME Shell (aka gnome-shell) before 3.10 does not prevent access to the "Enter a Command" dialog (no CVSS)
- [CVE-2013-7234](https://cve.now/CVE-2013-7234.md): Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to conduct clickjacking attacks via an X-Frame-Option (no CVSS)
- [CVE-2013-7235](https://cve.now/CVE-2013-7235.md): Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to impersonate arbitrary users via multiple space cha (no CVSS)
- [CVE-2013-7236](https://cve.now/CVE-2013-7236.md): Simple Machines Forum (SMF) 2.0.6, 1.1.19, and earlier allows remote attackers to impersonate arbitrary users via a Unicode homoglyph charac (no CVSS)
- [CVE-2013-7259](https://cve.now/CVE-2013-7259.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrat (no CVSS, org.neo4j:neo4j)
- [CVE-2013-7273](https://cve.now/CVE-2013-7273.md): GNOME Display Manager (gdm) 3.4.1 and earlier, when disable-user-list is set to true, allows local users to cause a denial of service (unabl (no CVSS)
- [CVE-2013-7284](https://cve.now/CVE-2013-7284.md): The PlRPC module, possibly 0.2020 and earlier, for Perl uses the Storable module, which allows remote attackers to execute arbitrary code vi (no CVSS)
- [CVE-2013-7302](https://cve.now/CVE-2013-7302.md): Session fixation vulnerability in the Ubercart module 6.x-2.x before 6.x-2.13 and 7.x-3.x before 7.x-3.6 for Drupal, when the "Log in new cu (no CVSS)
- [CVE-2014-0088](https://cve.now/CVE-2014-0088.md): The SPDY implementation in the ngx\_http\_spdy\_module module in nginx 1.5.10 before 1.5.11, when running on a 32-bit platform, allows remote a (no CVSS)
- [CVE-2014-0112](https://cve.now/CVE-2014-0112.md): ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers (no CVSS, org.apache.struts:struts2-core)
- [CVE-2014-0113](https://cve.now/CVE-2014-0113.md): CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getCla (no CVSS, org.apache.struts:struts2-core)
- [CVE-2014-0515](https://cve.now/CVE-2014-0515.md): Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and before 11.2.2 (no CVSS)
- [CVE-2014-1841](https://cve.now/CVE-2014-1841.md): Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to copy an arbitr (no CVSS)
- [CVE-2014-1842](https://cve.now/CVE-2014-1842.md): Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to list all usern (no CVSS)
- [CVE-2014-1843](https://cve.now/CVE-2014-1843.md): Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to obtain the pro (no CVSS)
- [CVE-2014-2180](https://cve.now/CVE-2014-2180.md): The Document Management component in Cisco Unified Contact Center Express does not properly validate a parameter, which allows remote authen (no CVSS)
- [CVE-2014-2182](https://cve.now/CVE-2014-2182.md): Cisco Adaptive Security Appliance (ASA) Software, when DHCPv6 replay is configured, allows remote attackers to cause a denial of service (de (no CVSS)
- [CVE-2014-2183](https://cve.now/CVE-2014-2183.md): The L2TP module in Cisco IOS XE 3.10S(.2) and earlier on ASR 1000 routers allows remote authenticated users to cause a denial of service (ES (no CVSS)
- [CVE-2014-2184](https://cve.now/CVE-2014-2184.md): The IP Manager Assistant (IPMA) component in Cisco Unified Communications Manager (Unified CM) allows remote attackers to obtain sensitive i (no CVSS)
- [CVE-2014-2185](https://cve.now/CVE-2014-2185.md): The Call Detail Records (CDR) Management component in Cisco Unified Communications Manager (Unified CM) allows remote authenticated users to (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-04-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.