# CVEs published 2014-05-27

26 CVEs were published on May 27, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2012-5662](https://cve.now/CVE-2012-5662.md): x3270 before 3.3.12ga12 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName f (no CVSS)
- [CVE-2012-6452](https://cve.now/CVE-2012-6452.md): Axway Secure Messenger before 6.5 Updated Release 7, as used in Axway Email Firewall, provides different responses to authentication request (no CVSS)
- [CVE-2013-0724](https://cve.now/CVE-2013-0724.md): PHP remote file inclusion vulnerability in includes/generate-pdf.php in the WP ecommerce Shop Styling plugin for WordPress before 1.8 allows (no CVSS)
- [CVE-2013-1883](https://cve.now/CVE-2013-1883.md): Mantis Bug Tracker (aka MantisBT) 1.2.12 before 1.2.15 allows remote attackers to cause a denial of service (resource consumption) via a fil (no CVSS)
- [CVE-2013-2090](https://cve.now/CVE-2013-2090.md): The set\_meta\_data function in lib/cremefraiche.rb in the Creme Fraiche gem before 0.6.1 for Ruby allows remote attackers to execute arbitrar (no CVSS, cremefraiche)
- [CVE-2013-2111](https://cve.now/CVE-2013-2111.md): The IMAP functionality in Dovecot before 2.2.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via (no CVSS)
- [CVE-2013-2124](https://cve.now/CVE-2013-2124.md): Double free vulnerability in inspect-fs.c in LibguestFS 1.20.x before 1.20.7, 1.21.x, 1.22.0, and 1.23.0 allows remote attackers to cause a (no CVSS)
- [CVE-2013-2125](https://cve.now/CVE-2013-2125.md): OpenSMTPD before 5.3.2 does not properly handle SSL sessions, which allows remote attackers to cause a denial of service (connection blockin (no CVSS)
- [CVE-2013-2225](https://cve.now/CVE-2013-2225.md): inc/ticket.class.php in GLPI 0.83.9 and earlier allows remote attackers to unserialize arbitrary PHP objects via the \_predefined\_fields para (no CVSS)
- [CVE-2013-2698](https://cve.now/CVE-2013-2698.md): Cross-site request forgery (CSRF) vulnerability in the Calendar plugin before 1.3.3 for WordPress allows remote attackers to hijack the auth (no CVSS)
- [CVE-2013-3477](https://cve.now/CVE-2013-3477.md): Cross-site request forgery (CSRF) vulnerability in the Related Posts by Zemanta plugin before 1.3.2 for WordPress allows remote attackers to (no CVSS)
- [CVE-2013-4598](https://cve.now/CVE-2013-4598.md): The Groups, Communities and Co (GCC) module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permission, which allows remote attack (no CVSS)
- [CVE-2013-5036](https://cve.now/CVE-2013-5036.md): The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the (1) namespace parameter to the deobfuscation (no CVSS)
- [CVE-2014-0177](https://cve.now/CVE-2014-0177.md): The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a tempor (no CVSS, github.com/github/hub · hub)
- [CVE-2014-0240](https://cve.now/CVE-2014-0240.md): The mod\_wsgi module before 3.5 for Apache, when daemon mode is enabled, does not properly handle error codes returned by setuid when run on (no CVSS)
- [CVE-2014-3840](https://cve.now/CVE-2014-3840.md): Multiple cross-site scripting (XSS) vulnerabilities in apps/common/templates/calculate\_form\_title.html in Mayan EDMS 0.13 allow remote authe (no CVSS, mayan-edms)
- [CVE-2014-3870](https://cve.now/CVE-2014-3870.md): Cross-site scripting (XSS) vulnerability in the bib2html plugin 0.9.3 for WordPress allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2014-3871](https://cve.now/CVE-2014-3871.md): Multiple SQL injection vulnerabilities in register.php in Geodesic Solutions GeoCore MAX 7.3.3 (formerly GeoClassifieds and GeoAuctions) all (no CVSS)
- [CVE-2014-3872](https://cve.now/CVE-2014-3872.md): Multiple SQL injection vulnerabilities in the administration login page in D-Link DAP-1350 (Rev. (no CVSS)
- [CVE-2014-2720](https://cve.now/CVE-2014-2720.md): IZArc 4.1.8 displays a file's name on the basis of a ZIP archive's Central Directory entry, but launches this file on the basis of a ZIP arc (no CVSS)
- [CVE-2014-0213](https://cve.now/CVE-2014-0213.md): Multiple cross-site request forgery (CSRF) vulnerabilities in mod/assign/locallib.php in the Assignment subsystem in Moodle through 2.3.11, (no CVSS, moodle/moodle)
- [CVE-2014-0214](https://cve.now/CVE-2014-0214.md): login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service (no CVSS, moodle/moodle)
- [CVE-2014-0215](https://cve.now/CVE-2014-0215.md): The blind-marking implementation in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows remote aut (no CVSS, moodle/moodle)
- [CVE-2014-0216](https://cve.now/CVE-2014-0216.md): The My Home implementation in the block\_html\_pluginfile function in blocks/html/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x (no CVSS, moodle/moodle)
- [CVE-2014-0217](https://cve.now/CVE-2014-0217.md): enrol/index.php in Moodle 2.6.x before 2.6.3 does not check for the moodle/course:viewhiddencourses capability before listing hidden courses (no CVSS, moodle/moodle)
- [CVE-2014-0218](https://cve.now/CVE-2014-0218.md): Cross-site scripting (XSS) vulnerability in the URL downloader repository in repository/url/lib.php in Moodle through 2.3.11, 2.4.x before 2 (no CVSS, moodle/moodle)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-05-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.