# CVEs published 2014-05-05

15 CVEs were published on May 5, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2010-5109](https://cve.now/CVE-2010-5109.md): Off-by-one error in the DecompressRTF function in ytnef.c in Yerase's TNEF Stream Reader allows remote attackers to cause a denial of servic (no CVSS)
- [CVE-2013-0350](https://cve.now/CVE-2013-0350.md): tmp\_smtp.c in pktstat 1.8.5 allows local users to overwrite arbitrary files via a symlink attack on /tmp/smtp.log. (no CVSS)
- [CVE-2013-1803](https://cve.now/CVE-2013-1803.md): Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) ord (no CVSS)
- [CVE-2013-3736](https://cve.now/CVE-2013-3736.md): Cross-site scripting (XSS) vulnerability in the MobileUI (aka RT-Extension-MobileUI) extension before 1.04 in Request Tracker (RT) 4.0.0 bef (no CVSS)
- [CVE-2013-4215](https://cve.now/CVE-2013-4215.md): The IPXPING\_COMMAND in contrib/check\_ipxping.c in Nagios Plugins 1.4.16 allows local users to gain privileges via a symlink attack on /tmp/i (no CVSS)
- [CVE-2013-6418](https://cve.now/CVE-2013-6418.md): PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer v (no CVSS, pywbem)
- [CVE-2013-6444](https://cve.now/CVE-2013-6444.md): PyWBEM 0.7 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName fi (no CVSS, pywbem)
- [CVE-2013-7003](https://cve.now/CVE-2013-7003.md): Multiple cross-site scripting (XSS) vulnerabilities in LiveZilla before 5.1.2.0 allow remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2013-7034](https://cve.now/CVE-2013-7034.md): The setCookieValue function in \_lib/functions.global.inc.php in LiveZilla before 5.1.2.1 allows remote attackers to execute arbitrary PHP co (no CVSS)
- [CVE-2013-7375](https://cve.now/CVE-2013-7375.md): SQL injection vulnerability in includes/classes/Authenticate.class.php in PHP-Fusion 7.02.01 through 7.02.05 allows remote attackers to exec (no CVSS)
- [CVE-2014-0149](https://cve.now/CVE-2014-0149.md): Multiple cross-site scripting (XSS) vulnerabilities in Red Hat JBoss Web Framework Kit 2.5.0 allow remote attackers to inject arbitrary web (no CVSS)
- [CVE-2014-0164](https://cve.now/CVE-2014-0164.md): openshift-origin-broker-util, as used in Red Hat OpenShift Enterprise 1.2.7 and 2.0.5, uses world-readable permissions for the mcollective c (no CVSS)
- [CVE-2014-3220](https://cve.now/CVE-2014-3220.md): F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary users via the name pa (no CVSS)
- [CVE-2014-0469](https://cve.now/CVE-2014-0469.md): Stack-based buffer overflow in a certain Debian patch for xbuffy before 3.3.bl.3.dfsg-9 allows remote attackers to execute arbitrary code vi (no CVSS)
- [CVE-2014-2916](https://cve.now/CVE-2014-2916.md): Cross-site request forgery (CSRF) vulnerability in the subscription page editor (spageedit) in phpList before 3.0.6 allows remote attackers (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-05-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.