# CVEs published 2014-05-29

18 CVEs were published on May 29, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-3277](https://cve.now/CVE-2014-3277.md): The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not proper (no CVSS)
- [CVE-2014-3279](https://cve.now/CVE-2014-3279.md): The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not proper (no CVSS)
- [CVE-2014-3282](https://cve.now/CVE-2014-3282.md): The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not proper (no CVSS)
- [CVE-2014-3283](https://cve.now/CVE-2014-3283.md): Open redirect vulnerability in Self-Care Client Portal applications in the web framework in VOSS in Cisco Unified Communications Domain Mana (no CVSS)
- [CVE-2014-3285](https://cve.now/CVE-2014-3285.md): Cisco Wide Area Application Services (WAAS) 5.3(.5a) and earlier, when SharePoint acceleration is enabled, does not properly parse SharePoin (no CVSS)
- [CVE-2012-4915](https://cve.now/CVE-2012-4915.md): Directory traversal vulnerability in the Google Doc Embedder plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary fil (no CVSS)
- [CVE-2013-0199](https://cve.now/CVE-2013-0199.md): The default LDAP ACIs in FreeIPA 3.0 before 3.1.2 do not restrict access to the (1) ipaNTTrustAuthIncoming and (2) ipaNTTrustAuthOutgoing at (no CVSS)
- [CVE-2013-2193](https://cve.now/CVE-2013-2193.md): Apache HBase 0.92.x before 0.92.3 and 0.94.x before 0.94.9, when the Kerberos features are enabled, allows man-in-the-middle attackers to di (no CVSS)
- [CVE-2013-4177](https://cve.now/CVE-2013-4177.md): The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal does not properly identify user account n (no CVSS)
- [CVE-2013-4178](https://cve.now/CVE-2013-4178.md): The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to obtain access (no CVSS)
- [CVE-2014-0199](https://cve.now/CVE-2014-0199.md): The setup script in ovirt-engine-reports, as used in the Red Hat Enterprise Virtualization reports (rhevm-reports) package before 3.3.3, sto (no CVSS)
- [CVE-2014-0200](https://cve.now/CVE-2014-0200.md): The Red Hat Enterprise Virtualization Manager reports (rhevm-reports) package before 3.3.3-1 uses world-readable permissions on the datasour (no CVSS)
- [CVE-2014-0201](https://cve.now/CVE-2014-0201.md): ovirt-engine-reports, as used in the Red Hat Enterprise Virtualization reports package (rhevm-reports) before 3.3.3, uses world-readable per (no CVSS)
- [CVE-2014-0246](https://cve.now/CVE-2014-0246.md): SOSreport stores the md5 hash of the GRUB bootloader password in an archive, which allows local users to obtain sensitive information by rea (no CVSS)
- [CVE-2014-3414](https://cve.now/CVE-2014-3414.md): Cross-site request forgery (CSRF) vulnerability in Sharetronix before 3.4 allows remote attackers to hijack the authentication of administra (no CVSS)
- [CVE-2014-3415](https://cve.now/CVE-2014-3415.md): SQL injection vulnerability in Sharetronix before 3.4 allows remote authenticated users to execute arbitrary SQL commands via the invite\_use (no CVSS)
- [CVE-2014-3416](https://cve.now/CVE-2014-3416.md): uPortal before 4.0.13.1 does not properly check the MANAGE permissions, which allows remote authenticated users to manage arbitrary portlets (no CVSS)
- [CVE-2014-3417](https://cve.now/CVE-2014-3417.md): uPortal before 4.0.13.1 does not properly check the CONFIG permission, which allows remote authenticated users to configure portlets by leve (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-05-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.