# CVEs published 2014-05-08

52 CVEs were published on May 8, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-2854](https://cve.now/CVE-2014-2854.md): Cross-site scripting (XSS) vulnerability in the SemanticTitle extension before 1.1.0 for MediaWiki allows remote attackers to inject arbitra (no CVSS)
- [CVE-2013-5916](https://cve.now/CVE-2013-5916.md): Cross-site scripting (XSS) vulnerability in falha.php in the Bradesco Gateway plugin 2.0 for Wordpress, as used in the WP e-Commerce plugin, (no CVSS)
- [CVE-2012-5477](https://cve.now/CVE-2012-5477.md): The smart proxy in Foreman before 1.1 uses a umask set to 0, which allows local users to modify files created by the daemon via unspecified (no CVSS)
- [CVE-2013-0171](https://cve.now/CVE-2013-0171.md): Foreman before 1.1 allows remote attackers to execute arbitrary code via a crafted YAML object to the (1) fact or (2) report import API. (no CVSS)
- [CVE-2013-0173](https://cve.now/CVE-2013-0173.md): Foreman before 1.1 uses a salt of "foreman" to hash root passwords, which makes it easier for attackers to guess the password via a brute fo (no CVSS)
- [CVE-2013-0174](https://cve.now/CVE-2013-0174.md): The external node classifier (ENC) API in Foreman before 1.1 allows remote attackers to obtain the hashed root password via an API request. (no CVSS)
- [CVE-2013-0187](https://cve.now/CVE-2013-0187.md): Foreman before 1.1 allows remote authenticated users to gain privileges via a (1) XMLHttpRequest or (2) AJAX request. (no CVSS)
- [CVE-2013-0210](https://cve.now/CVE-2013-0210.md): The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping (no CVSS)
- [CVE-2013-0345](https://cve.now/CVE-2013-0345.md): varnish 3.0.3 uses world-readable permissions for the /var/log/varnish/ directory and the log files in the directory, which allows local use (no CVSS)
- [CVE-2013-3571](https://cve.now/CVE-2013-3571.md): socat 1.2.0.0 before 1.7.2.2 and 2.0.0-b1 before 2.0.0-b6, when used for a listen type address and the fork option is enabled, allows remote (no CVSS)
- [CVE-2013-4544](https://cve.now/CVE-2013-4544.md): hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier allows local guest users to cause a denial of service or possibly execute arbitrary c (no CVSS)
- [CVE-2013-6372](https://cve.now/CVE-2013-6372.md): The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH (no CVSS, org.jenkins-ci.plugins:subversion)
- [CVE-2013-6889](https://cve.now/CVE-2013-6889.md): GNU Rush 1.7 does not properly drop privileges, which allows local users to read arbitrary files via the --lint option. (no CVSS)
- [CVE-2013-7041](https://cve.now/CVE-2013-7041.md): The pam\_userdb module for Pam uses a case-insensitive method to compare hashed passwords, which makes it easier for attackers to guess the p (no CVSS)
- [CVE-2014-0056](https://cve.now/CVE-2014-0056.md): The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated (no CVSS, neutron)
- [CVE-2014-0090](https://cve.now/CVE-2014-0090.md): Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie. (no CVSS)
- [CVE-2014-0109](https://cve.now/CVE-2014-0109.md): Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large reque (no CVSS, org.apache.cxf:cxf-core)
- [CVE-2014-0110](https://cve.now/CVE-2014-0110.md): Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) via a large in (no CVSS, org.apache.cxf:cxf-core)
- [CVE-2014-0134](https://cve.now/CVE-2014-0134.md): The instance rescue mode in OpenStack Compute (Nova) 2013.2 before 2013.2.3 and Icehouse before 2014.1, when using libvirt to spawn images a (no CVSS, nova)
- [CVE-2014-0135](https://cve.now/CVE-2014-0135.md): Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default\_values.yaml, which allows local u (no CVSS, kafo)
- [CVE-2014-0190](https://cve.now/CVE-2014-0190.md): The GIF decoder in QtGui in Qt before 5.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via invalid width (no CVSS)
- [CVE-2014-0192](https://cve.now/CVE-2014-0192.md): Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote attackers to obtain sens (no CVSS)
- [CVE-2014-1682](https://cve.now/CVE-2014-1682.md): The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows remote authenticated users to spoof arbitrary u (no CVSS)
- [CVE-2014-1685](https://cve.now/CVE-2014-1685.md): The Frontend in Zabbix before 1.8.20rc2, 2.0.x before 2.0.11rc2, and 2.2.x before 2.2.2rc1 allows remote "Zabbix Admin" users to modify the (no CVSS)
- [CVE-2014-1934](https://cve.now/CVE-2014-1934.md): tag.py in eyeD3 (aka python-eyed3) 7.0.3, 0.6.18, and earlier for Python allows local users to modify arbitrary files via a symlink attack o (no CVSS, eyed3)
- [CVE-2014-2689](https://cve.now/CVE-2014-2689.md): Cross-site scripting (XSS) vulnerability in Offiria 2.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2014-3115](https://cve.now/CVE-2014-3115.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Fortinet FortiWeb before 5.2.0 allow remote (no CVSS)
- [CVE-2014-3123](https://cve.now/CVE-2014-3123.md): Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows re (no CVSS)
- [CVE-2014-3207](https://cve.now/CVE-2014-3207.md): Cross-site scripting (XSS) vulnerability in wserver.ml in SKS Keyserver before 1.1.5 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2013-5016](https://cve.now/CVE-2013-5016.md): Symantec Critical System Protection (SCSP) before 5.2.9, when installed on an unpatched Windows Server 2003 R2 platform, allows remote attac (no CVSS)
- [CVE-2014-0116](https://cve.now/CVE-2014-0116.md): CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the ge (no CVSS, org.apache.struts:struts2-core)
- [CVE-2014-0362](https://cve.now/CVE-2014-0362.md): Cross-site scripting (XSS) vulnerability on Google Search Appliance (GSA) devices before 7.0.14.G.216 and 7.2 before 7.2.0.G.114, when dynam (no CVSS)
- [CVE-2014-0595](https://cve.now/CVE-2014-0595.md): /opt/novell/ncl/bin/nwrights in Novell Client for Linux in Novell Open Enterprise Server (OES) 11 Linux SP2 does not properly manage a certa (no CVSS)
- [CVE-2014-0930](https://cve.now/CVE-2014-0930.md): The ptrace system call in IBM AIX 5.3, 6.1, and 7.1, and VIOS 2.2.x, allows local users to cause a denial of service (system crash) or obtai (no CVSS)
- [CVE-2014-0963](https://cve.now/CVE-2014-0963.md): The Reverse Proxy feature in IBM Global Security Kit (aka GSKit) in IBM Security Access Manager (ISAM) for Web 7.0 before 7.0.0-ISS-SAM-IF00 (no CVSS)
- [CVE-2014-2132](https://cve.now/CVE-2014-2132.md): Cisco WebEx Recording Format (WRF) player and Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 bef (no CVSS)
- [CVE-2014-2133](https://cve.now/CVE-2014-2133.md): Buffer overflow in Cisco Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remo (no CVSS)
- [CVE-2014-2134](https://cve.now/CVE-2014-2134.md): Heap-based buffer overflow in Cisco WebEx Recording Format (WRF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 all (no CVSS)
- [CVE-2014-2135](https://cve.now/CVE-2014-2135.md): Buffer overflow in Cisco Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remo (no CVSS)
- [CVE-2014-2136](https://cve.now/CVE-2014-2136.md): Buffer overflow in Cisco Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remo (no CVSS)
- [CVE-2014-2602](https://cve.now/CVE-2014-2602.md): Unspecified vulnerability in HP OneView 1.0 and 1.01 allows remote authenticated users to gain privileges via unknown vectors. (no CVSS)
- [CVE-2014-2933](https://cve.now/CVE-2014-2933.md): Directory traversal vulnerability in dirmng/index.php in Caldera 9.20 allows remote attackers to access arbitrary directories via a crafted (no CVSS)
- [CVE-2014-2934](https://cve.now/CVE-2014-2934.md): Multiple SQL injection vulnerabilities in Caldera 9.20 allow remote attackers to execute arbitrary SQL commands via the tr parameter to (1) (no CVSS)
- [CVE-2014-2935](https://cve.now/CVE-2014-2935.md): costview3/xmlrpc\_server/xmlrpc.php in CostView in Caldera 9.20 allows remote attackers to execute arbitrary commands via shell metacharacter (no CVSS)
- [CVE-2014-2936](https://cve.now/CVE-2014-2936.md): The directory manager in Caldera 9.20 allows remote attackers to conduct variable-injection attacks in the global scope via (1) the maindir\_ (no CVSS)
- [CVE-2014-3215](https://cve.now/CVE-2014-3215.md): seunshare in policycoreutils 2.2.5 is owned by root with 4755 permissions, and executes programs in a way that changes the relationship betw (no CVSS)
- [CVE-2014-3421](https://cve.now/CVE-2014-3421.md): lisp/gnus/gnus-fun.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on the /tmp/gnus.fa (no CVSS)
- [CVE-2014-3422](https://cve.now/CVE-2014-3422.md): lisp/emacs-lisp/find-gc.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary (no CVSS)
- [CVE-2014-3423](https://cve.now/CVE-2014-3423.md): lisp/net/browse-url.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/Mosaic.# (no CVSS)
- [CVE-2014-3424](https://cve.now/CVE-2014-3424.md): lisp/net/tramp-sh.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/tramp.#### (no CVSS)
- [CVE-2014-3425](https://cve.now/CVE-2014-3425.md): NCSA Mosaic 2.0 and earlier allows local users to cause a denial of service ("remote control" outage) by creating a /tmp/xmosaic.pid file fo (no CVSS)
- [CVE-2014-3426](https://cve.now/CVE-2014-3426.md): NCSA Mosaic 2.1 through 2.7b5 allows local users to cause a denial of service ("remote control" outage) by creating a /tmp/Mosaic.pid file f (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-05-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.