# CVEs published 2014-05-13

17 CVEs were published on May 13, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2013-4490](https://cve.now/CVE-2013-4490.md): The SSH key upload feature (lib/gitlab\_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allow (no CVSS)
- [CVE-2013-4500](https://cve.now/CVE-2013-4500.md): The Quiz module 6.x-4.x before 6.x-4.5 for Drupal allows remote authenticated users with the "view any quiz results" or "view results for ow (no CVSS)
- [CVE-2013-4501](https://cve.now/CVE-2013-4501.md): The default views in the Quiz module 6.x-4.x before 6.x-4.5 for Drupal allows remote attackers to obtain sensitive quiz results via unspecif (no CVSS)
- [CVE-2013-4502](https://cve.now/CVE-2013-4502.md): The FileField Sources module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.9 for Drupal does not properly check file permissions, which al (no CVSS)
- [CVE-2013-4503](https://cve.now/CVE-2013-4503.md): Cross-site scripting (XSS) vulnerability in the Feed Element Mapper module for Drupal allows remote authenticated users with the "administer (no CVSS)
- [CVE-2013-4504](https://cve.now/CVE-2013-4504.md): The Monster Menus module 7.x-1.x before 7.x-1.15 allows remote attackers to read arbitrary node comments via a crafted URL. (no CVSS)
- [CVE-2013-4546](https://cve.now/CVE-2013-4546.md): The repository import feature in gitlab-shell before 1.7.4, as used in GitLab, allows remote authenticated users to execute arbitrary comman (no CVSS)
- [CVE-2013-4552](https://cve.now/CVE-2013-4552.md): lib/Auth/Source/External.php in the drupalauth module before 1.2.2 for simpleSAMLphp allows remote attackers to authenticate as an arbitrary (no CVSS)
- [CVE-2013-4562](https://cve.now/CVE-2013-4562.md): The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-s (no CVSS, omniauth-facebook)
- [CVE-2014-3456](https://cve.now/CVE-2014-3456.md): Cross-site scripting (XSS) vulnerability in GitLab Enterprise Edition (EE) 6.6.0 before 6.6.2 allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2011-4970](https://cve.now/CVE-2011-4970.md): Multiple SQL injection vulnerabilities in LCG Disk Pool Manager (DPM) before 1.8.6, as used in EGI UDM, allow remote attackers to execute ar (no CVSS)
- [CVE-2012-6342](https://cve.now/CVE-2012-6342.md): Cross-site request forgery (CSRF) vulnerability in logout.action in Atlassian Confluence 3.4.6 allows remote attackers to hijack the authent (no CVSS)
- [CVE-2013-1407](https://cve.now/CVE-2013-1407.md): Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for (no CVSS)
- [CVE-2013-2692](https://cve.now/CVE-2013-2692.md): Cross-site request forgery (CSRF) vulnerability in the Admin web interface in OpenVPN Access Server before 1.8.5 allows remote attackers to (no CVSS)
- [CVE-2013-2705](https://cve.now/CVE-2013-2705.md): Cross-site request forgery (CSRF) vulnerability in the WordPress Simple Paypal Shopping Cart plugin before 3.6 for WordPress allows remote a (no CVSS)
- [CVE-2014-2989](https://cve.now/CVE-2014-2989.md): Cross-site request forgery (CSRF) vulnerability in Open Assessment Technologies TAO 2.5.6 allows remote attackers to hijack the authenticati (no CVSS)
- [CVE-2014-3246](https://cve.now/CVE-2014-3246.md): SQL injection vulnerability in Collabtive 1.2 allows remote authenticated users to execute arbitrary SQL commands via the folder parameter i (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-05-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.