# CVEs published 2014-04-30

37 CVEs were published on April 30, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2013-1806](https://cve.now/CVE-2013-1806.md): Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary (no CVSS)
- [CVE-2013-1807](https://cve.now/CVE-2013-1807.md): PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which mig (no CVSS)
- [CVE-2014-2260](https://cve.now/CVE-2014-2260.md): Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows remote authenticated (no CVSS, ajenti)
- [CVE-2013-6445](https://cve.now/CVE-2013-6445.md): Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, uses the DES-based crypt function to hash passwords, which makes (no CVSS)
- [CVE-2013-6990](https://cve.now/CVE-2013-6990.md): FortiGuard FortiAuthenticator before 3.0 allows remote administrators to gain privileges via the command line interface. (no CVSS)
- [CVE-2014-0470](https://cve.now/CVE-2014-0470.md): super.c in Super 3.30.0 does not check the return value of the setuid function when the -F flag is set, which allows local users to gain pri (no CVSS)
- [CVE-2014-0471](https://cve.now/CVE-2014-0471.md): Directory traversal vulnerability in the unpacking functionality in dpkg before 1.15.9, 1.16.x before 1.16.13, and 1.17.x before 1.17.8 allo (no CVSS)
- [CVE-2014-1955](https://cve.now/CVE-2014-1955.md): Cross-site scripting (XSS) vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2014-1956](https://cve.now/CVE-2014-1956.md): CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP r (no CVSS)
- [CVE-2014-1957](https://cve.now/CVE-2014-1957.md): FortiGuard FortiWeb before 5.0.3 allows remote authenticated users to gain privileges via unspecified vectors. (no CVSS)
- [CVE-2014-2565](https://cve.now/CVE-2014-2565.md): The commandline interface in Blue Coat Content Analysis System (CAS) 1.1 before 1.1.4.2 allows remote administrators to execute arbitrary co (no CVSS)
- [CVE-2014-3129](https://cve.now/CVE-2014-3129.md): The Java Server Pages in the Software Lifecycle Manager (SLM) in SAP NetWeaver allows remote attackers to obtain sensitive information via a (no CVSS)
- [CVE-2014-3130](https://cve.now/CVE-2014-3130.md): The ABAP Help documentation and translation tools (BC-DOC-HLP) in Basis in SAP Netweaver ABAP Application Server does not properly restrict (no CVSS)
- [CVE-2014-3131](https://cve.now/CVE-2014-3131.md): SAP Profile Maintenance does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an un (no CVSS)
- [CVE-2014-3132](https://cve.now/CVE-2014-3132.md): SAP Background Processing does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an (no CVSS)
- [CVE-2014-3133](https://cve.now/CVE-2014-3133.md): SAP Netweaver Java Application Server does not properly restrict access, which allows remote attackers to obtain the list of SAP systems reg (no CVSS)
- [CVE-2014-3134](https://cve.now/CVE-2014-3134.md): Cross-site scripting (XSS) vulnerability in the InfoView application in SAP BusinessObjects allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2014-3135](https://cve.now/CVE-2014-3135.md): Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 5.1.1 Alpha 9 allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2014-0114](https://cve.now/CVE-2014-0114.md): Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requir (no CVSS, commons-beanutils:commons-beanutils)
- [CVE-2014-0363](https://cve.now/CVE-2014-0363.md): The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints (no CVSS)
- [CVE-2014-0364](https://cve.now/CVE-2014-0364.md): The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ sta (no CVSS)
- [CVE-2014-1518](https://cve.now/CVE-2014-1518.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before (no CVSS)
- [CVE-2014-1519](https://cve.now/CVE-2014-1519.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allow remote attackers t (no CVSS)
- [CVE-2014-1520](https://cve.now/CVE-2014-1520.md): maintenservice\_installer.exe in the Maintenance Service Installer in Mozilla Firefox before 29.0 and Firefox ESR 24.x before 24.5 on Windows (no CVSS)
- [CVE-2014-1522](https://cve.now/CVE-2014-1522.md): The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 29.0 and SeaMonkey befor (no CVSS)
- [CVE-2014-1523](https://cve.now/CVE-2014-1523.md): Heap-based buffer overflow in the read\_u32 function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, a (no CVSS)
- [CVE-2014-1524](https://cve.now/CVE-2014-1524.md): The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, an (no CVSS)
- [CVE-2014-1525](https://cve.now/CVE-2014-1525.md): The mozilla::dom::TextTrack::AddCue function in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 does not properly perform garbage coll (no CVSS)
- [CVE-2014-1526](https://cve.now/CVE-2014-1526.md): The XrayWrapper implementation in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows user-assisted remote attackers to bypass inte (no CVSS)
- [CVE-2014-1527](https://cve.now/CVE-2014-1527.md): Mozilla Firefox before 29.0 on Android allows remote attackers to spoof the address bar via crafted JavaScript code that uses DOM events to (no CVSS)
- [CVE-2014-1528](https://cve.now/CVE-2014-1528.md): The sse2\_composite\_src\_x888\_8888 function in Pixman, as used in Cairo in Mozilla Firefox 28.0 and SeaMonkey 2.25 on Windows, allows remote a (no CVSS)
- [CVE-2014-1529](https://cve.now/CVE-2014-1529.md): The Web Notification API in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 al (no CVSS)
- [CVE-2014-1530](https://cve.now/CVE-2014-1530.md): The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 (no CVSS)
- [CVE-2014-1531](https://cve.now/CVE-2014-1531.md): Use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox before 29.0, Firefox ESR 24.x b (no CVSS)
- [CVE-2014-1532](https://cve.now/CVE-2014-1532.md): Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox (no CVSS)
- [CVE-2014-2186](https://cve.now/CVE-2014-2186.md): Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco WebEx Meetings Server allows remote attackers to hijack the au (no CVSS)
- [CVE-2014-2545](https://cve.now/CVE-2014-2545.md): TIBCO Managed File Transfer Internet Server before 7.2.2, Managed File Transfer Command Center before 7.2.2, Slingshot before 1.9.1, and Vau (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-04-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.