CVEs published April 30, 2014
37 CVEs were published on April 30, 2014: 0 critical, 0 high.
- Published
- 37
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 37
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- ajenti
- 1
- commons-beanutils:commons-beanutils
- 1
Medium, low and unrated 37
- CVE-2013-1806Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary
- CVE-2013-1807PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which mig
- CVE-2014-2260Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows remote authenticatedajenti
- CVE-2013-6445Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, uses the DES-based crypt function to hash passwords, which makes
- CVE-2013-6990FortiGuard FortiAuthenticator before 3.0 allows remote administrators to gain privileges via the command line interface.
- CVE-2014-0470super.c in Super 3.30.0 does not check the return value of the setuid function when the -F flag is set, which allows local users to gain pri
- CVE-2014-0471Directory traversal vulnerability in the unpacking functionality in dpkg before 1.15.9, 1.16.x before 1.16.13, and 1.17.x before 1.17.8 allo
- CVE-2014-1955Cross-site scripting (XSS) vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary web script or HTML
- CVE-2014-1956CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP r
- CVE-2014-1957FortiGuard FortiWeb before 5.0.3 allows remote authenticated users to gain privileges via unspecified vectors.
- CVE-2014-2565The commandline interface in Blue Coat Content Analysis System (CAS) 1.1 before 1.1.4.2 allows remote administrators to execute arbitrary co
- CVE-2014-3129The Java Server Pages in the Software Lifecycle Manager (SLM) in SAP NetWeaver allows remote attackers to obtain sensitive information via a
- CVE-2014-3130The ABAP Help documentation and translation tools (BC-DOC-HLP) in Basis in SAP Netweaver ABAP Application Server does not properly restrict
- CVE-2014-3131SAP Profile Maintenance does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an un
- CVE-2014-3132SAP Background Processing does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an
- CVE-2014-3133SAP Netweaver Java Application Server does not properly restrict access, which allows remote attackers to obtain the list of SAP systems reg
- CVE-2014-3134Cross-site scripting (XSS) vulnerability in the InfoView application in SAP BusinessObjects allows remote attackers to inject arbitrary web
- CVE-2014-3135Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 5.1.1 Alpha 9 allow remote attackers to inject arbitrary web script or HTML
- CVE-2014-0114Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requircommons-beanutils:commons-beanutils
- CVE-2014-0363The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints
- CVE-2014-0364The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ sta
- CVE-2014-1518Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before
- CVE-2014-1519Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allow remote attackers t
- CVE-2014-1520maintenservice_installer.exe in the Maintenance Service Installer in Mozilla Firefox before 29.0 and Firefox ESR 24.x before 24.5 on Windows
- CVE-2014-1522The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 29.0 and SeaMonkey befor
- CVE-2014-1523Heap-based buffer overflow in the read_u32 function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, a
- CVE-2014-1524The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, an
- CVE-2014-1525The mozilla::dom::TextTrack::AddCue function in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 does not properly perform garbage coll
- CVE-2014-1526The XrayWrapper implementation in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows user-assisted remote attackers to bypass inte
- CVE-2014-1527Mozilla Firefox before 29.0 on Android allows remote attackers to spoof the address bar via crafted JavaScript code that uses DOM events to
- CVE-2014-1528The sse2_composite_src_x888_8888 function in Pixman, as used in Cairo in Mozilla Firefox 28.0 and SeaMonkey 2.25 on Windows, allows remote a
- CVE-2014-1529The Web Notification API in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 al
- CVE-2014-1530The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26
- CVE-2014-1531Use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox before 29.0, Firefox ESR 24.x b
- CVE-2014-1532Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox
- CVE-2014-2186Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco WebEx Meetings Server allows remote attackers to hijack the au
- CVE-2014-2545TIBCO Managed File Transfer Internet Server before 7.2.2, Managed File Transfer Command Center before 7.2.2, Slingshot before 1.9.1, and Vau