# CVEs published 2014-05-23

25 CVEs were published on May 23, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-2196](https://cve.now/CVE-2014-2196.md): Cisco Wide Area Application Services (WAAS) 5.1.1 before 5.1.1e, when SharePoint prefetch optimization is enabled, allows remote SharePoint (no CVSS)
- [CVE-2014-2504](https://cve.now/CVE-2014-2504.md): EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allows remote authenticated users t (no CVSS)
- [CVE-2014-3266](https://cve.now/CVE-2014-3266.md): Cross-site scripting (XSS) vulnerability in the web framework in Cisco Security Manager 4.6 and earlier allows remote attackers to inject ar (no CVSS)
- [CVE-2014-3267](https://cve.now/CVE-2014-3267.md): Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Security Manager 4.6 and earlier allows remote attackers to hi (no CVSS)
- [CVE-2014-3272](https://cve.now/CVE-2014-3272.md): The Agent in Cisco Tidal Enterprise Scheduler (TES) 6.1 and earlier allows local users to gain privileges via crafted Tidal Job Buffers (TJB (no CVSS)
- [CVE-2014-3274](https://cve.now/CVE-2014-3274.md): Cisco TelePresence System (CTS) 6.0(.5)(5) and earlier falls back to HTTP when certain HTTPS sessions cannot be established, which allows ma (no CVSS)
- [CVE-2014-3275](https://cve.now/CVE-2014-3275.md): SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) and earlier allows remote authentic (no CVSS)
- [CVE-2014-3276](https://cve.now/CVE-2014-3276.md): Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) and earlier does not properly handle deadlock conditions during reception of crafted RA (no CVSS)
- [CVE-2012-5649](https://cve.now/CVE-2012-5649.md): Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1 allows remote attackers to execute arbitrary code via a JSONP callba (no CVSS)
- [CVE-2013-0289](https://cve.now/CVE-2013-0289.md): Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName f (no CVSS)
- [CVE-2013-1668](https://cve.now/CVE-2013-1668.md): The uploadFile function in upload/index.php in CosCMS before 1.822 allows remote administrators to execute arbitrary commands via shell meta (no CVSS)
- [CVE-2013-1864](https://cve.now/CVE-2013-1864.md): The Portable Tool Library (aka PTLib) before 2.10.10, as used in Ekiga before 4.0.1, does not properly detect recursion during entity expans (no CVSS)
- [CVE-2013-2712](https://cve.now/CVE-2013-2712.md): Cross-site scripting (XSS) vulnerability in services/get\_article.php in KrisonAV CMS before 3.0.2 allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2013-2713](https://cve.now/CVE-2013-2713.md): Cross-site request forgery (CSRF) vulnerability in users\_maint.html in KrisonAV CMS before 3.0.2 allows remote attackers to hijack the authe (no CVSS)
- [CVE-2013-2756](https://cve.now/CVE-2013-2756.md): Apache CloudStack 4.0.0 before 4.0.2 and Citrix CloudPlatform (formerly Citrix CloudStack) 3.0.x before 3.0.6 Patch C allows remote attacker (no CVSS)
- [CVE-2013-2757](https://cve.now/CVE-2013-2757.md): Citrix CloudPlatform (formerly Citrix CloudStack) 3.0.x before 3.0.6 Patch C does not properly restrict access to VNC ports on the managemen (no CVSS)
- [CVE-2013-2758](https://cve.now/CVE-2013-2758.md): Apache CloudStack 4.0.0 before 4.0.2 and Citrix CloudPlatform (formerly Citrix CloudStack) 3.0.x before 3.0.6 Patch C uses a hash of a predi (no CVSS)
- [CVE-2013-4223](https://cve.now/CVE-2013-4223.md): The Gentoo Nullmailer package before 1.11-r2 uses world-readable permissions for /etc/nullmailer/remotes, which allows local users to obtain (no CVSS)
- [CVE-2014-3442](https://cve.now/CVE-2014-3442.md): Winamp 5.666 and earlier allows remote attackers to cause a denial of service (memory corruption and crash) via a malformed .FLV file, relat (no CVSS)
- [CVE-2014-3450](https://cve.now/CVE-2014-3450.md): Unspecified vulnerability in Panda Gold Protection and Global Protection 2014 7.01.01 and earlier, Internet Security 2014 19.01.01 and earli (no CVSS)
- [CVE-2014-3801](https://cve.now/CVE-2014-3801.md): OpenStack Orchestration API (Heat) 2013.2 through 2013.2.3 and 2014.1, when creating the stack for a template using a provider template, all (no CVSS, openstack-heat)
- [CVE-2014-3848](https://cve.now/CVE-2014-3848.md): The iMember360 plugin before 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to obtain database crede (no CVSS)
- [CVE-2014-3849](https://cve.now/CVE-2014-3849.md): The iMember360 plugin 3.8.012 through 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to delete arbit (no CVSS)
- [CVE-2010-5299](https://cve.now/CVE-2010-5299.md): Stack-based buffer overflow in MicroP 0.1.1.1600 allows remote attackers to execute arbitrary code via a crafted .mppl file. (no CVSS)
- [CVE-2013-2107](https://cve.now/CVE-2013-2107.md): Cross-site request forgery (CSRF) vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack th (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-05-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.