# CVEs published 2014-05-14

65 CVEs were published on May 14, 2014: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2011-5249](https://cve.now/CVE-2011-5249.md): Cross-site scripting (XSS) vulnerability in the events page in the System iNtrusion Analysis and Reporting Environment (SNARE) for Linux age (no CVSS)
- [CVE-2013-1765](https://cve.now/CVE-2013-1765.md): Multiple cross-site scripting (XSS) vulnerabilities in jwplayer.swf in the smart-flv plugin for WordPress allow remote attackers to inject a (no CVSS)
- [CVE-2013-2034](https://cve.now/CVE-2013-2034.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466. (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2013-2087](https://cve.now/CVE-2013-2087.md): Multiple cross-site scripting (XSS) vulnerabilities in Gallery 3 before 3.0.7 allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2013-2226](https://cve.now/CVE-2013-2226.md): Multiple SQL injection vulnerabilities in GLPI before 0.83.9 allow remote attackers to execute arbitrary SQL commands via the (1) users\_id\_a (no CVSS)
- [CVE-2013-2700](https://cve.now/CVE-2013-2700.md): Cross-site request forgery (CSRF) vulnerability in the Add/Edit page (adminmenus.php) in the WP125 plugin before 1.5.0 for WordPress allows (no CVSS)
- [CVE-2013-3514](https://cve.now/CVE-2013-3514.md): Multiple directory traversal vulnerabilities in OpenX before 2.8.10 revision 82710 allow remote administrators to read arbitrary files via a (no CVSS)
- [CVE-2013-4455](https://cve.now/CVE-2013-4455.md): Katello Installer before 0.0.18 uses world-readable permissions for /etc/pki/tls/private/katello-node.key when deploying a child Pulp node, (no CVSS)
- [CVE-2013-4468](https://cve.now/CVE-2013-4468.md): VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allows remote authenticated users to execute arbitrary commands (no CVSS)
- [CVE-2013-4471](https://cve.now/CVE-2013-4471.md): The Identity v3 API in OpenStack Dashboard (Horizon) before 2013.2 does not require the current password when changing passwords for user ac (no CVSS)
- [CVE-2013-5655](https://cve.now/CVE-2013-5655.md): Directory traversal vulnerability in the FTP server in YingZhi Python Programming Language for iOS 1.9 allows remote attackers to read and p (no CVSS)
- [CVE-2013-5939](https://cve.now/CVE-2013-5939.md): Multiple cross-site scripting (XSS) vulnerabilities in the Guestbook module for PHPCMS allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2013-7376](https://cve.now/CVE-2013-7376.md): Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.10, possibly before revision 82710, allow remote attackers to hijack (no CVSS)
- [CVE-2014-0078](https://cve.now/CVE-2014-0078.md): The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to delete arbitrary ca (no CVSS)
- [CVE-2014-0137](https://cve.now/CVE-2014-0137.md): SQL injection vulnerability in the saved\_report\_delete action in the ReportController in Red Hat CloudForms Management Engine (CFME) before (no CVSS)
- [CVE-2014-1603](https://cve.now/CVE-2014-1603.md): Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.3.1 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2014-3146](https://cve.now/CVE-2014-3146.md): Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scriptin (CVSS 6.1, lxml)
- [CVE-2014-3430](https://cve.now/CVE-2014-3430.md): Dovecot 1.1 before 2.2.13 and dovecot-ee before 2.1.7.7 and 2.2.x before 2.2.12.12 does not properly close old connections, which allows rem (no CVSS)
- [CVE-2014-3441](https://cve.now/CVE-2014-3441.md): codec\\libpng\_plugin.dll in VideoLAN VLC Media Player 2.1.3 allows remote attackers to cause a denial of service (crash) via a crafted .png f (no CVSS)
- [CVE-2014-3443](https://cve.now/CVE-2014-3443.md): JetMPAd.ax in JetAudio 8.1.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted .ogg file. (no CVSS)
- [CVE-2014-0251](https://cve.now/CVE-2014-0251.md): Microsoft Windows SharePoint Services 3.0 SP3; SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 Gold and SP1; SharePoint Foundation 20 (no CVSS)
- [CVE-2014-0255](https://cve.now/CVE-2014-0255.md): Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allow remote attackers to cause a denial of service (iSCSI service (no CVSS)
- [CVE-2014-0256](https://cve.now/CVE-2014-0256.md): Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold allow remote attackers to cause a denial of service (iSCSI service outage) (no CVSS)
- [CVE-2014-0310](https://cve.now/CVE-2014-0310.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2014-0513](https://cve.now/CVE-2014-0513.md): Stack-based buffer overflow in Adobe Illustrator CS6 before 16.0.5 and 16.2.x before 16.2.2 allows remote attackers to execute arbitrary cod (no CVSS)
- [CVE-2014-0516](https://cve.now/CVE-2014-0516.md): Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SD (no CVSS)
- [CVE-2014-0517](https://cve.now/CVE-2014-0517.md): Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SD (no CVSS)
- [CVE-2014-0518](https://cve.now/CVE-2014-0518.md): Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SD (no CVSS)
- [CVE-2014-0519](https://cve.now/CVE-2014-0519.md): Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SD (no CVSS)
- [CVE-2014-0520](https://cve.now/CVE-2014-0520.md): Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SD (no CVSS)
- [CVE-2014-0521](https://cve.now/CVE-2014-0521.md): Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X do not properly implement JavaScript APIs, which al (no CVSS)
- [CVE-2014-0522](https://cve.now/CVE-2014-0522.md): Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allow attackers to execute arbitrary code or cause (no CVSS)
- [CVE-2014-0523](https://cve.now/CVE-2014-0523.md): Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allow attackers to execute arbitrary code or cause (no CVSS)
- [CVE-2014-0524](https://cve.now/CVE-2014-0524.md): Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allow attackers to execute arbitrary code or cause (no CVSS)
- [CVE-2014-0525](https://cve.now/CVE-2014-0525.md): The API in Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X does not prevent access to unmapped memo (no CVSS)
- [CVE-2014-0526](https://cve.now/CVE-2014-0526.md): Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allow attackers to execute arbitrary code or cause (no CVSS)
- [CVE-2014-0527](https://cve.now/CVE-2014-0527.md): Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allows attackers to (no CVSS)
- [CVE-2014-0528](https://cve.now/CVE-2014-0528.md): Double free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allows attackers to ex (no CVSS)
- [CVE-2014-0529](https://cve.now/CVE-2014-0529.md): Buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allows attackers to execute arbi (no CVSS)
- [CVE-2014-1740](https://cve.now/CVE-2014-1740.md): Multiple use-after-free vulnerabilities in net/websockets/websocket\_job.cc in the WebSockets implementation in Google Chrome before 34.0.184 (no CVSS)
- [CVE-2014-1741](https://cve.now/CVE-2014-1741.md): Multiple integer overflows in the replace-data functionality in the CharacterData interface implementation in core/dom/CharacterData.cpp in (no CVSS)
- [CVE-2014-1742](https://cve.now/CVE-2014-1742.md): Use-after-free vulnerability in the FrameSelection::updateAppearance function in core/editing/FrameSelection.cpp in Blink, as used in Google (no CVSS)
- [CVE-2014-1754](https://cve.now/CVE-2014-1754.md): Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2013 Gold and SP1, SharePoint Foundation 2013 Gold and SP1, Office W (no CVSS)
- [CVE-2014-1756](https://cve.now/CVE-2014-1756.md): Untrusted search path vulnerability in Microsoft Office 2007 SP3, 2010 SP1 and SP2, and 2013 Gold, SP1, RT, and RT SP1, when the Simplified (no CVSS)
- [CVE-2014-1806](https://cve.now/CVE-2014-1806.md): The .NET Remoting implementation in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly restrict memo (no CVSS)
- [CVE-2014-1807](https://cve.now/CVE-2014-1807.md): The ShellExecute API in Windows Shell in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 (no CVSS)
- [CVE-2014-1808](https://cve.now/CVE-2014-1808.md): Microsoft Office 2013 Gold, SP1, RT, and RT SP1 allows remote attackers to obtain sensitive token information via a web site that sends a cr (no CVSS)
- [CVE-2014-1809](https://cve.now/CVE-2014-1809.md): The MSCOMCTL library in Microsoft Office 2007 SP3, 2010 SP1 and SP2, and 2013 Gold, SP1, RT, and RT SP1 makes it easier for remote attackers (no CVSS)
- [CVE-2014-1812](https://cve.now/CVE-2014-1812.md): The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, a (CVSS 8.8, KEV)
- [CVE-2014-1813](https://cve.now/CVE-2014-1813.md): Microsoft Web Applications 2010 SP1 and SP2 allows remote authenticated users to execute arbitrary code via crafted page content, aka "Web A (no CVSS)
- [CVE-2014-1815](https://cve.now/CVE-2014-1815.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2010-4832](https://cve.now/CVE-2010-4832.md): Android OS before 2.2 does not display the correct SSL certificate in certain cases, which might allow remote attackers to spoof trusted web (no CVSS)
- [CVE-2011-2513](https://cve.now/CVE-2011-2513.md): The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1. (no CVSS)
- [CVE-2011-2514](https://cve.now/CVE-2011-2514.md): The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1. (no CVSS)
- [CVE-2011-4407](https://cve.now/CVE-2011-4407.md): ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which all (no CVSS)
- [CVE-2012-1600](https://cve.now/CVE-2012-1600.md): Multiple cross-site scripting (XSS) vulnerabilities in functions.php in phpPgAdmin before 5.0.4 allow remote attackers to inject arbitrary w (no CVSS)
- [CVE-2014-0462](https://cve.now/CVE-2014-0462.md): Unspecified vulnerability in OpenJDK 6 before 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS has unknown impact and attack vect (no CVSS)
- [CVE-2014-1849](https://cve.now/CVE-2014-1849.md): Foscam IP camera 11.37.2.49 and other versions, when using the Foscam DynDNS option, generates credentials based on predictable camera subdo (no CVSS)
- [CVE-2014-1909](https://cve.now/CVE-2014-1909.md): Integer signedness error in system/core/adb/adb\_client.c in Android Debug Bridge (ADB) for Android 4.4 in the Android SDK Platform Tools 18. (no CVSS)
- [CVE-2014-2046](https://cve.now/CVE-2014-2046.md): cgi-bin/rpcBridge in the web interface 1.1 on Broadcom Ltd PIPA C211 rev2 does not properly restrict access, which allows remote attackers t (no CVSS)
- [CVE-2014-2405](https://cve.now/CVE-2014-2405.md): Unspecified vulnerability in OpenJDK 6 before 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS has unknown impact and attack vect (no CVSS)
- [CVE-2014-2591](https://cve.now/CVE-2014-2591.md): Untrusted search path vulnerability in BMC Patrol for AIX 3.9.00 allows local users to gain privileges via a crafted library, related to an (no CVSS)
- [CVE-2014-3121](https://cve.now/CVE-2014-3121.md): rxvt-unicode before 9.20 does not properly handle OSC escape sequences, which allows user-assisted remote attackers to manipulate arbitrary (no CVSS)
- [CVE-2014-3127](https://cve.now/CVE-2014-3127.md): dpkg 1.15.9 on Debian squeeze introduces support for the "C-style encoded filenames" feature without recognizing that the squeeze patch prog (no CVSS)
- [CVE-2014-3225](https://cve.now/CVE-2014-3225.md): Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrar (no CVSS, cobbler)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-05-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.