# CVEs published 2014-05-16 21 CVEs were published on May 16, 2014: 0 critical, 0 high. Days are UTC. - [CVE-2013-7379](https://cve.now/CVE-2013-7379.md): The admin API in the tomato module before 0.0.6 for Node.js does not properly check the access key when it is set to a string, which allows (no CVSS, tomato) - [CVE-2014-1418](https://cve.now/CVE-2014-1418.md): Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cac (no CVSS, django) - [CVE-2014-1613](https://cve.now/CVE-2014-1613.md): Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dc\_passwd cookie to a password-pr (no CVSS) - [CVE-2014-3452](https://cve.now/CVE-2014-3452.md): Filters\\LAV\\avfilter-lav-4.dll in K-lite Codec 10.4.5 and earlier allows remote attackers to cause a denial of service (crash) via a crafted (no CVSS) - [CVE-2014-3730](https://cve.now/CVE-2014-3730.md): The django.util.http.is\_safe\_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not pro (no CVSS, django) - [CVE-2014-3742](https://cve.now/CVE-2014-3742.md): The hapi server framework 2.0.x and 2.1.x before 2.2.0 for Node.js allows remote attackers to cause a denial of service (file descriptor con (no CVSS, hapi) - [CVE-2014-0749](https://cve.now/CVE-2014-0749.md): Stack-based buffer overflow in lib/Libdis/disrsi\_.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x (no CVSS) - [CVE-2014-3758](https://cve.now/CVE-2014-3758.md): Cross-site scripting (XSS) vulnerability in the BibTex Publications (si\_bibtex) extension 0.2.3 for TYPO3 allows remote attackers to inject (no CVSS) - [CVE-2014-3759](https://cve.now/CVE-2014-3759.md): Multiple SQL injection vulnerabilities in the BibTex Publications (si\_bibtex) extension 0.2.3 for TYPO3 allow remote attackers to execute ar (no CVSS) - [CVE-2014-3760](https://cve.now/CVE-2014-3760.md): Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DAP 1150 with firmware 1.2.94 allow remote attackers to hijack the auth (no CVSS) - [CVE-2014-3761](https://cve.now/CVE-2014-3761.md): Cross-site scripting (XSS) vulnerability in D-Link DAP 1150 with firmware 1.2.94 allows remote attackers to inject arbitrary web script or H (no CVSS) - [CVE-2014-0643](https://cve.now/CVE-2014-0643.md): EMC RSA NetWitness before 9.8.5.19 and RSA Security Analytics before 10.2.4 and 10.3.x before 10.3.2, when Kerberos PAM is enabled, do not r (no CVSS) - [CVE-2014-0782](https://cve.now/CVE-2014-0782.md): Yokogawa CENTUM CS 3000 Stack-based Buffer Overflow (no CVSS, Yokogawa CENTUM CS) - [CVE-2014-0917](https://cve.now/CVE-2014-0917.md): Cross-site scripting (XSS) vulnerability in IBM Eclipse Help System (IEHS) in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through (no CVSS) - [CVE-2014-0918](https://cve.now/CVE-2014-0918.md): Directory traversal vulnerability in IBM Eclipse Help System (IEHS) in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5. (no CVSS) - [CVE-2014-0933](https://cve.now/CVE-2014-0933.md): Cross-site request forgery (CSRF) vulnerability in IBM InfoSphere Information Server Metadata Workbench 8.1 through 9.1 allows remote attack (no CVSS) - [CVE-2014-0964](https://cve.now/CVE-2014-0964.md): IBM WebSphere Application Server (WAS) 6.1.0.0 through 6.1.0.47 and 6.0.2.0 through 6.0.2.43 allows remote attackers to cause a denial of se (no CVSS) - [CVE-2014-1649](https://cve.now/CVE-2014-1649.md): The server in Symantec Workspace Streaming (SWS) before 7.5.0.749 allows remote attackers to access files and functionality by sending a cra (no CVSS) - [CVE-2014-3262](https://cve.now/CVE-2014-3262.md): The Locator/ID Separation Protocol (LISP) implementation in Cisco IOS 15.3(3)S and earlier and IOS XE does not properly validate parameters (no CVSS) - [CVE-2014-3263](https://cve.now/CVE-2014-3263.md): The ScanSafe module in Cisco IOS 15.3(3)M allows remote attackers to cause a denial of service (device reload) via HTTPS packets that requir (no CVSS) - [CVE-2014-3750](https://cve.now/CVE-2014-3750.md): The Bilyoner application before 2.3.1 for Android and before 4.6.2 for iOS does not verify X.509 certificates from SSL servers, which allows (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2014-05-16 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.