# CVEs published 2014-05-07

13 CVEs were published on May 7, 2014: 0 critical, 1 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2013-6726](https://cve.now/CVE-2013-6726.md): Multiple cross-site scripting (XSS) vulnerabilities in WebProcess.srv in IBM TRIRIGA Application Platform 3.2.x and 3.3.x before 3.3.1.2 all (no CVSS)
- [CVE-2013-7336](https://cve.now/CVE-2013-7336.md): The qemuMigrationWaitForSpice function in qemu/qemu\_migration.c in libvirt before 1.1.3 does not properly enter a monitor when performing se (no CVSS)
- [CVE-2014-0130](https://cve.now/CVE-2014-0130.md): Directory traversal vulnerability in actionpack/lib/abstract\_controller/base.rb in the implicit-render implementation in Ruby on Rails befor (CVSS 7.5, KEV, actionpack)
- [CVE-2014-0196](https://cve.now/CVE-2014-0196.md): The n\_tty\_write function in drivers/tty/n\_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO (CVSS 5.5, KEV)
- [CVE-2014-0684](https://cve.now/CVE-2014-0684.md): Cisco NX-OS 6.2(2) on Nexus 7000 switches allows local users to cause a denial of service via crafted sed input, aka Bug ID CSCui56136. (no CVSS)
- [CVE-2014-0685](https://cve.now/CVE-2014-0685.md): Cisco Nexus 1000V InterCloud 5.2(1)IC1(1.2) and earlier for VMware allows remote attackers to bypass ACL deny statements via crafted (1) IGM (no CVSS)
- [CVE-2014-0911](https://cve.now/CVE-2014-0911.md): inetd in IBM WebSphere MQ 7.1.x before 7.1.0.5 and 7.5.x before 7.5.0.4 allows remote attackers to cause a denial of service (disk or CPU co (no CVSS)
- [CVE-2014-2181](https://cve.now/CVE-2014-2181.md): Cisco Adaptive Security Appliance (ASA) Software allows remote authenticated users to read files by sending a crafted URL to the HTTP server (no CVSS)
- [CVE-2014-2190](https://cve.now/CVE-2014-2190.md): Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Broadcast Access Center for Telco and Wireless (aka BAC-TW) al (no CVSS)
- [CVE-2014-2191](https://cve.now/CVE-2014-2191.md): Cross-site scripting (XSS) vulnerability in the web framework in Cisco Broadcast Access Center for Telco and Wireless (aka BAC-TW) allows re (no CVSS)
- [CVE-2014-2891](https://cve.now/CVE-2014-2891.md): strongSwan before 5.1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a crafted I (no CVSS)
- [CVE-2014-2913](https://cve.now/CVE-2014-2913.md): Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arb (no CVSS)
- [CVE-2014-3124](https://cve.now/CVE-2014-3124.md): The HVMOP\_set\_mem\_type control in Xen 4.1 through 4.4.x allows local guest HVM administrators to cause a denial of service (hypervisor crash (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-05-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.