# CVEs published 2014-05-02 38 CVEs were published on May 2, 2014: 0 critical, 0 high. Days are UTC. - [CVE-2013-7060](https://cve.now/CVE-2013-7060.md): Products/CMFPlone/FactoryTool.py in Plone 3.3 through 4.3.2 allows remote attackers to obtain the installation path via vectors related to a (no CVSS, plone · products-cmfplone) - [CVE-2013-7061](https://cve.now/CVE-2013-7061.md): Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive informa (no CVSS, plone · products-cmfplone) - [CVE-2014-0189](https://cve.now/CVE-2014-0189.md): virt-who uses world-readable permissions for /etc/sysconfig/virt-who, which allows local users to obtain password for hypervisors by reading (no CVSS) - [CVE-2014-1899](https://cve.now/CVE-2014-1899.md): Cross-site scripting (XSS) vulnerability in Citrix NetScaler Gateway (formerly Citrix Access Gateway Enterprise Edition) 9.x before 9.3.66.5 (no CVSS) - [CVE-2014-2322](https://cve.now/CVE-2014-2322.md): lib/string\_utf\_support.rb in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharact (no CVSS, Arabic-Prawn) - [CVE-2014-2905](https://cve.now/CVE-2014-2905.md): fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credentials, which allows local users to gain privileges via the unive (no CVSS) - [CVE-2014-3000](https://cve.now/CVE-2014-3000.md): The TCP reassembly function in the inet module in FreeBSD 8.3 before p16, 8.4 before p9, 9.1 before p12, 9.2 before p5, and 10.0 before p2 a (no CVSS) - [CVE-2014-3001](https://cve.now/CVE-2014-3001.md): The device file system (aka devfs) in FreeBSD 10.0 before p2 does not load default rulesets when booting, which allows context-dependent att (no CVSS) - [CVE-2014-3006](https://cve.now/CVE-2014-3006.md): Sitepark Information Enterprise Server (IES) 2.9 before 2.9.6, when upgraded from an earlier version, does not properly restrict access, whi (no CVSS) - [CVE-2014-3125](https://cve.now/CVE-2014-3125.md): Xen 4.4.x, when running on an ARM system, does not properly context switch the CNTKCTL\_EL1 register, which allows local guest users to modif (no CVSS) - [CVE-2014-1988](https://cve.now/CVE-2014-1988.md): The Phone Messages feature in Cybozu Garoon 2.0.0 through 3.7 SP2 allows remote authenticated users to cause a denial of service (resource c (no CVSS) - [CVE-2014-1989](https://cve.now/CVE-2014-1989.md): Cybozu Garoon 3.0 through 3.7 SP3 allows remote authenticated users to bypass intended access restrictions and delete schedule information v (no CVSS) - [CVE-2014-2156](https://cve.now/CVE-2014-2156.md): Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted (no CVSS) - [CVE-2014-2157](https://cve.now/CVE-2014-2157.md): Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted (no CVSS) - [CVE-2014-2158](https://cve.now/CVE-2014-2158.md): Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted (no CVSS) - [CVE-2014-2159](https://cve.now/CVE-2014-2159.md): The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (dev (no CVSS) - [CVE-2014-2160](https://cve.now/CVE-2014-2160.md): The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (dev (no CVSS) - [CVE-2014-2161](https://cve.now/CVE-2014-2161.md): The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (dev (no CVSS) - [CVE-2014-2162](https://cve.now/CVE-2014-2162.md): The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial o (no CVSS) - [CVE-2014-2163](https://cve.now/CVE-2014-2163.md): The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x allows remote attackers to cause a denial of servic (no CVSS) - [CVE-2014-2164](https://cve.now/CVE-2014-2164.md): The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial o (no CVSS) - [CVE-2014-2165](https://cve.now/CVE-2014-2165.md): The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial o (no CVSS) - [CVE-2014-2166](https://cve.now/CVE-2014-2166.md): The SIP implementation in Cisco TelePresence TC Software 4.x and TE Software 4.x allows remote attackers to cause a denial of service (devic (no CVSS) - [CVE-2014-2167](https://cve.now/CVE-2014-2167.md): The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial o (no CVSS) - [CVE-2014-2168](https://cve.now/CVE-2014-2168.md): Buffer overflow in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to execute arbitrary code (no CVSS) - [CVE-2014-2169](https://cve.now/CVE-2014-2169.md): Cisco TelePresence TC Software 4.x through 6.x before 6.2.0 and TE Software 4.x and 6.0 allow remote authenticated users to execute arbitrar (no CVSS) - [CVE-2014-2170](https://cve.now/CVE-2014-2170.md): Cisco TelePresence TC Software 4.x and 5.x before 5.1.7 and 6.x before 6.0.1 and TE Software 4.x and 6.0 allow remote authenticated users to (no CVSS) - [CVE-2014-2171](https://cve.now/CVE-2014-2171.md): Heap-based buffer overflow in Cisco TelePresence TC Software 4.x through 6.x before 6.0.1 and TE Software 4.x and 6.0.x before 6.0.2 allows (no CVSS) - [CVE-2014-2172](https://cve.now/CVE-2014-2172.md): Buffer overflow in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows local users to gain privileges by leveragin (no CVSS) - [CVE-2014-2173](https://cve.now/CVE-2014-2173.md): Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 do not properly restrict access to the serial port, which allows loca (no CVSS) - [CVE-2014-2175](https://cve.now/CVE-2014-2175.md): Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allow remote attackers to cause a denial of service (memory consumpti (no CVSS) - [CVE-2014-3139](https://cve.now/CVE-2014-3139.md): recoveryconsole/bpl/snmpd.php in Unitrends Enterprise Backup 7.3.0 allows remote attackers to bypass authentication by setting the auth para (no CVSS) - [CVE-2013-2073](https://cve.now/CVE-2013-2073.md): Transifex command-line client before 0.9 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof a Transifex (no CVSS) - [CVE-2013-7110](https://cve.now/CVE-2013-7110.md): Transifex command-line client before 0.10 does not validate X.509 certificates for data transfer connections, which allows man-in-the-middle (no CVSS, transifex-client) - [CVE-2014-1441](https://cve.now/CVE-2014-1441.md): Core FTP Server 1.2 before build 515 allows remote attackers to cause a denial of service (reachable assertion and crash) via an AUTH SSL co (no CVSS) - [CVE-2014-1442](https://cve.now/CVE-2014-1442.md): Directory traversal vulnerability in Core FTP Server 1.2 before build 515 allows remote authenticated users to determine the existence of ar (no CVSS) - [CVE-2014-1443](https://cve.now/CVE-2014-1443.md): Core FTP Server 1.2 before build 515 allows remote authenticated users to obtain sensitive information (password for the previous user) via (no CVSS) - [CVE-2014-3138](https://cve.now/CVE-2014-3138.md): SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1 before Hotfix 24, and 6.6.1 Update 2 before Hotf (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2014-05-02 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.