# CVEs published 2014-05-19 27 CVEs were published on May 19, 2014: 0 critical, 0 high. Days are UTC. - [CVE-2013-4406](https://cve.now/CVE-2013-4406.md): The Quick Tabs module 6.x-2.x before 6.x-2.2, 6.x-3.x before 6.x-3.2, and 7.x-3.x before 7.x-3.6 for Drupal does not properly check block pe (no CVSS) - [CVE-2013-4426](https://cve.now/CVE-2013-4426.md): pyxtrlock before 0.1 uses an incorrect variable name, which allows physically proximate attackers to bypass the lock screen via multiple fai (no CVSS) - [CVE-2013-4427](https://cve.now/CVE-2013-4427.md): pyxtrlock before 0.2 does not properly check the return values of the (1) xcb\_grab\_pointer and (2) xcb\_grab\_keyboard XCB library functions, (no CVSS) - [CVE-2013-4429](https://cve.now/CVE-2013-4429.md): Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 does not properly restrict access to artefacts, which allows remote authent (no CVSS) - [CVE-2013-4430](https://cve.now/CVE-2013-4430.md): Cross-site scripting (XSS) vulnerability in Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 allows remote attackers to inje (no CVSS) - [CVE-2013-4431](https://cve.now/CVE-2013-4431.md): Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 does not properly prevent access to blocks, which allows remote authenticat (no CVSS) - [CVE-2013-4432](https://cve.now/CVE-2013-4432.md): Mahara before 1.5.13, 1.6.x before 1.6.8, and 1.7.x before 1.7.4 does not properly restrict access to folders, which allows remote authentic (no CVSS) - [CVE-2013-6413](https://cve.now/CVE-2013-6413.md): Use-after-free vulnerability in UnrealIRCd 3.2.10 before 3.2.10.2 allows remote attackers to cause a denial of service (crash) via unspecifi (no CVSS) - [CVE-2013-6765](https://cve.now/CVE-2013-6765.md): OpenVAS Manager 3.0 before 3.0.7 and 4.0 before 4.0.4 allows remote attackers to bypass the OMP authentication restrictions and execute OMP (no CVSS) - [CVE-2013-6766](https://cve.now/CVE-2013-6766.md): OpenVAS Administrator 1.2 before 1.2.2 and 1.3 before 1.3.2 allows remote attackers to bypass the OAP authentication restrictions and execut (no CVSS) - [CVE-2013-6805](https://cve.now/CVE-2013-6805.md): OpenText Exceed OnDemand (EoD) 8 uses weak encryption for passwords, which makes it easier for (1) remote attackers to discover credentials (no CVSS) - [CVE-2013-6806](https://cve.now/CVE-2013-6806.md): OpenText Exceed OnDemand (EoD) 8 allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information (no CVSS) - [CVE-2013-6807](https://cve.now/CVE-2013-6807.md): The client in OpenText Exceed OnDemand (EoD) 8 supports anonymous ciphers by default, which allows man-in-the-middle attackers to bypass ser (no CVSS) - [CVE-2013-6994](https://cve.now/CVE-2013-6994.md): OpenText Exceed OnDemand (EoD) 8 transmits the session ID in cleartext, which allows remote attackers to perform session fixation attacks by (no CVSS) - [CVE-2013-7033](https://cve.now/CVE-2013-7033.md): LiveZilla before 5.1.2.1 includes the operator password in plaintext in Javascript code that is generated by lz/mobile/chat.php, which might (no CVSS) - [CVE-2013-7040](https://cve.now/CVE-2013-7040.md): Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without r (no CVSS) - [CVE-2013-7384](https://cve.now/CVE-2013-7384.md): UnrealIRCd 3.2.10 before 3.2.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via unspecified (no CVSS) - [CVE-2013-7385](https://cve.now/CVE-2013-7385.md): LiveZilla 5.1.2.1 and earlier includes the MD5 hash of the operator password in plaintext in Javascript code that is generated by lz/mobile/ (no CVSS) - [CVE-2014-0012](https://cve.now/CVE-2014-0012.md): FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-c (no CVSS, jinja2) - [CVE-2014-1402](https://cve.now/CVE-2014-1402.md): The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows (no CVSS, jinja2) - [CVE-2014-3411](https://cve.now/CVE-2014-3411.md): Unspecified vulnerability in the NSM XDB service in Juniper NSM before 2012.2R8 allows remote attackers to execute arbitrary code via unspec (no CVSS) - [CVE-2014-3714](https://cve.now/CVE-2014-3714.md): The ARM image loading functionality in Xen 4.4.x does not properly validate kernel length, which allows local users to read system memory or (no CVSS) - [CVE-2014-3715](https://cve.now/CVE-2014-3715.md): Buffer overflow in Xen 4.4.x allows local users to read system memory or cause a denial of service (crash) via a crafted 32-bit guest kernel (no CVSS) - [CVE-2014-3716](https://cve.now/CVE-2014-3716.md): Xen 4.4.x does not properly check alignment, which allows local users to cause a denial of service (crash) via an unspecified field in a DTB (no CVSS) - [CVE-2014-3717](https://cve.now/CVE-2014-3717.md): Xen 4.4.x does not properly validate the load address for 64-bit ARM guest kernels, which allows local users to read system memory or cause (no CVSS) - [CVE-2014-3735](https://cve.now/CVE-2014-3735.md): ir41\_32.ax 4.51.16.3 for Intel Indeo Video 4.5 allows remote attackers to cause a denial of service (crash) via a crafted .avi file. (no CVSS) - [CVE-2014-3787](https://cve.now/CVE-2014-3787.md): SAP NetWeaver 7.20 and earlier allows remote attackers to read arbitrary SAP Central User Administration (SAP CUA) tables via unspecified ve (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2014-05-19 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.