# CVEs published 2014-05-20

33 CVEs were published on May 20, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-3802](https://cve.now/CVE-2014-3802.md): msdia.dll in Microsoft Debug Interface Access (DIA) SDK, as distributed in Microsoft Visual Studio before 2013, does not properly validate a (no CVSS)
- [CVE-2012-6146](https://cve.now/CVE-2012-6146.md): The Backend History Module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 does not properly restrict access, whic (no CVSS, typo3/cms)
- [CVE-2013-4250](https://cve.now/CVE-2013-4250.md): The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check (no CVSS, typo3/cms)
- [CVE-2013-4320](https://cve.now/CVE-2013-4320.md): The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote (no CVSS, typo3/cms-core)
- [CVE-2013-4321](https://cve.now/CVE-2013-4321.md): The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary (no CVSS, typo3/cms)
- [CVE-2013-4346](https://cve.now/CVE-2013-4346.md): The Server.verify\_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay atta (no CVSS, oauth2)
- [CVE-2013-4347](https://cve.now/CVE-2013-4347.md): The (1) make\_nonce, (2) generate\_nonce, and (3) generate\_verifier functions in SimpleGeo python-oauth2 uses weak random numbers to generate (no CVSS, oauth2)
- [CVE-2013-4380](https://cve.now/CVE-2013-4380.md): Cross-site scripting (XSS) vulnerability in the MediaFront module 6.x-1.x before 6.x-1.6, 7.x-1.x before 7.x-1.6, and 7.x-2.x before 7.x-2.1 (no CVSS)
- [CVE-2013-7383](https://cve.now/CVE-2013-7383.md): x2gocleansessions in X2Go Server before 4.0.0.8 and 4.0.1.x before 4.0.1.10 allows remote authenticated users to gain privileges via unspeci (no CVSS)
- [CVE-2014-1855](https://cve.now/CVE-2014-1855.md): Multiple cross-site scripting (XSS) vulnerabilities in Seo Panel before 3.5.0 allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2014-3412](https://cve.now/CVE-2014-3412.md): Unspecified vulnerability in Juniper Junos Space before 13.3R1.8, when the firewall in disabled, allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2014-3738](https://cve.now/CVE-2014-3738.md): Cross-site scripting (XSS) vulnerability in Zenoss 4.2.5 allows remote attackers to inject arbitrary web script or HTML via the title of a d (no CVSS)
- [CVE-2014-3739](https://cve.now/CVE-2014-3739.md): Open redirect vulnerability in zport/acl\_users/cookieAuthHelper/login\_form in Zenoss 4.2.5 allows remote attackers to redirect users to arbi (no CVSS)
- [CVE-2014-3749](https://cve.now/CVE-2014-3749.md): SQL injection vulnerability in Construtiva CIS Manager allows remote attackers to execute arbitrary SQL commands via the email parameter to (no CVSS)
- [CVE-2014-3776](https://cve.now/CVE-2014-3776.md): Buffer overflow in the "read-u8vector!" procedure in the srfi-4 unit in CHICKEN stable 4.8.0.7 and development snapshots before 4.9.1 allows (no CVSS)
- [CVE-2014-3791](https://cve.now/CVE-2014-3791.md): Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 6.8 allows remote attackers to execute arbitrary code via a long string in (no CVSS)
- [CVE-2014-3792](https://cve.now/CVE-2014-3792.md): Cross-site request forgery (CSRF) vulnerability in Beetel 450TC2 Router with firmware TX6-0Q-005\_retail allows remote attackers to hijack th (no CVSS)
- [CVE-2013-6975](https://cve.now/CVE-2013-6975.md): Directory traversal vulnerability in the command-line interface in Cisco NX-OS 6.2(2a) and earlier allows local users to read arbitrary file (no CVSS)
- [CVE-2014-2192](https://cve.now/CVE-2014-2192.md): Cross-site scripting (XSS) vulnerability in Cisco Unified Web and E-mail Interaction Manager 9.0(2) allows remote attackers to inject arbitr (no CVSS)
- [CVE-2014-2193](https://cve.now/CVE-2014-2193.md): Cisco Unified Web and E-Mail Interaction Manager places session identifiers in GET requests, which allows remote attackers to inject convers (no CVSS)
- [CVE-2014-2194](https://cve.now/CVE-2014-2194.md): system/egain/chat/entrypoint in Cisco Unified Web and E-mail Interaction Manager 9.0(2) allows remote attackers to have an unspecified impac (no CVSS)
- [CVE-2014-2195](https://cve.now/CVE-2014-2195.md): Cisco AsyncOS on Email Security Appliance (ESA) and Content Security Management Appliance (SMA) devices, when Active Directory is enabled, d (no CVSS)
- [CVE-2014-2199](https://cve.now/CVE-2014-2199.md): meetinginfo.do in Cisco WebEx Event Center, WebEx Meeting Center, WebEx Sales Center, WebEx Training Center, WebEx Meetings Server 1.5(.1.13 (no CVSS)
- [CVE-2014-2351](https://cve.now/CVE-2014-2351.md): CSWorks SQL Injection (no CVSS, CSWorks)
- [CVE-2014-3264](https://cve.now/CVE-2014-3264.md): Cisco Adaptive Security Appliance (ASA) Software 9.1(.5) and earlier allows remote authenticated users to cause a denial of service (device (no CVSS)
- [CVE-2014-3265](https://cve.now/CVE-2014-3265.md): Cross-site scripting (XSS) vulnerability in the Auto Update Server (AUS) web framework in Cisco Security Manager 4.2 and earlier allows remo (no CVSS)
- [CVE-2014-3268](https://cve.now/CVE-2014-3268.md): Cisco IOS 15.2(4)M4 on Cisco Unified Border Element (CUBE) devices allows remote attackers to cause a denial of service (input-queue consump (no CVSS)
- [CVE-2014-3269](https://cve.now/CVE-2014-3269.md): The SNMP module in Cisco IOS XE 3.5E allows remote authenticated users to cause a denial of service (device reload) by polling frequently, a (no CVSS)
- [CVE-2014-3270](https://cve.now/CVE-2014-3270.md): The DHCPv6 implementation in Cisco IOS XR allows remote attackers to cause a denial of service (process hang) via a malformed packet, aka Bu (no CVSS)
- [CVE-2014-3271](https://cve.now/CVE-2014-3271.md): The DHCPv6 implementation in Cisco IOS XR allows remote attackers to cause a denial of service (device crash) via a malformed packet, aka Bu (no CVSS)
- [CVE-2014-3273](https://cve.now/CVE-2014-3273.md): The LLDP implementation in Cisco IOS allows remote attackers to cause a denial of service (device reload) via a malformed packet, aka Bug ID (no CVSS)
- [CVE-2014-3444](https://cve.now/CVE-2014-3444.md): The GetGUID function in codecs/dmp4.dll in RealNetworks RealPlayer 16.0.3.51 and earlier allows remote attackers to execute arbitrary code o (no CVSS)
- [CVE-2014-3460](https://cve.now/CVE-2014-3460.md): Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in Agent Manager in NetIQ Sentinel allows remo (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-05-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.