# CVEs published 2014-06-02

31 CVEs were published on June 2, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-2939](https://cve.now/CVE-2014-2939.md): Multiple cross-site scripting (XSS) vulnerabilities in Alfresco Enterprise before 4.1.6.13 allow remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2014-2946](https://cve.now/CVE-2014-2946.md): Cross-site request forgery (CSRF) vulnerability in api/sms/send-sms in the Web UI 11.010.06.01.858 on Huawei E303 modems with software 22.15 (no CVSS)
- [CVE-2014-2959](https://cve.now/CVE-2014-2959.md): logViewer.htm on the Dell ML6000 tape backup system with firmware before i8.2.0.2 (641G.GS103) and the Quantum Scalar i500 tape backup syste (no CVSS)
- [CVE-2011-5280](https://cve.now/CVE-2011-5280.md): Multiple stack-based buffer overflows in BOINC 6.13.x allow remote attackers to cause a denial of service (crash) via a long trickle-up to ( (no CVSS)
- [CVE-2012-5391](https://cve.now/CVE-2012-5391.md): Session fixation vulnerability in Special:UserLogin in MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote (no CVSS)
- [CVE-2012-5395](https://cve.now/CVE-2012-5395.md): Session fixation vulnerability in the CentralAuth extension for MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allo (no CVSS)
- [CVE-2013-1348](https://cve.now/CVE-2013-1348.md): The Yaml::parse function in Symfony 2.0.x before 2.0.22 remote attackers to execute arbitrary PHP code via a PHP file, a different vulnerabi (no CVSS, symfony/symfony · symfony/yaml)
- [CVE-2013-1397](https://cve.now/CVE-2013-1397.md): Symfony 2.0.x before 2.0.22, 2.1.x before 2.1.7, and 2.2.x remote attackers to execute arbitrary PHP code via a serialized PHP object to the (no CVSS, symfony/symfony · symfony/yaml)
- [CVE-2013-1412](https://cve.now/CVE-2013-1412.md): DataLife Engine (DLE) 9.7 allows remote attackers to execute arbitrary PHP code via the catlist\[\] parameter to engine/preview.php, which is (no CVSS)
- [CVE-2013-1818](https://cve.now/CVE-2013-1818.md): maintenance/mwdoc-filter.php in MediaWiki before 1.20.3 allows remote attackers to read arbitrary files via unspecified vectors. (no CVSS)
- [CVE-2013-2014](https://cve.now/CVE-2013-2014.md): OpenStack Identity (Keystone) before 2013.1 allows remote attackers to cause a denial of service (memory consumption and crash) via multiple (no CVSS, keystone)
- [CVE-2013-2019](https://cve.now/CVE-2013-2019.md): Stack-based buffer overflow in BOINC 6.10.58 and 6.12.34 allows remote attackers to have unspecified impact via multiple file\_signature elem (no CVSS)
- [CVE-2013-2298](https://cve.now/CVE-2013-2298.md): Multiple stack-based buffer overflows in the XML parser in BOINC 7.x allow attackers to have unspecified impact via a crafted XML file, rela (no CVSS)
- [CVE-2013-2710](https://cve.now/CVE-2013-2710.md): Cross-site request forgery (CSRF) vulnerability in the Contextual Related Posts plugin before 1.8.7 for WordPress allows remote attackers to (no CVSS)
- [CVE-2013-3257](https://cve.now/CVE-2013-3257.md): Cross-site request forgery (CSRF) vulnerability in the Related Posts plugin before 2.7.2 for WordPress allows remote attackers to hijack the (no CVSS)
- [CVE-2013-3258](https://cve.now/CVE-2013-3258.md): Cross-site request forgery (CSRF) vulnerability in he Digg Digg plugin before 5.3.5 for WordPress allows remote attackers to hijack the auth (no CVSS)
- [CVE-2013-3476](https://cve.now/CVE-2013-3476.md): Cross-site request forgery (CSRF) vulnerability in the WordPress Related Posts plugin before 2.6.2 for WordPress allows remote attackers to (no CVSS)
- [CVE-2013-4596](https://cve.now/CVE-2013-4596.md): The Node Access Keys module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permissions, which allows remote attackers to bypass a (no CVSS)
- [CVE-2013-6433](https://cve.now/CVE-2013-6433.md): The default configuration in the Red Hat openstack-neutron package before 2013.2.3-7 does not properly set a configuration file for rootwrap (no CVSS)
- [CVE-2013-6470](https://cve.now/CVE-2013-6470.md): The default configuration in the standalone controller quickstack manifest in openstack-foreman-installer, as used in Red Hat Enterprise Lin (no CVSS)
- [CVE-2013-7386](https://cve.now/CVE-2013-7386.md): Format string vulnerability in the PROJECT::write\_account\_file function in client/cs\_account.cpp in BOINC, possibly 7.2.33, allows remote at (no CVSS)
- [CVE-2013-7387](https://cve.now/CVE-2013-7387.md): Session fixation vulnerability in DataLife Engine (DLE) 9.7 and earlier allows remote attackers to hijack web sessions via the PHPSESSID coo (no CVSS)
- [CVE-2014-0040](https://cve.now/CVE-2014-0040.md): OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, uses an HTTP connection to download ( (no CVSS)
- [CVE-2014-0041](https://cve.now/CVE-2014-0041.md): OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets sslverify to false for certain Y (no CVSS)
- [CVE-2014-0042](https://cve.now/CVE-2014-0042.md): OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets gpgcheck to 0 for certain templa (no CVSS)
- [CVE-2014-3937](https://cve.now/CVE-2014-3937.md): SQL injection vulnerability in the Contextual Related Posts plugin before 1.8.10.2 for WordPress allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2014-3932](https://cve.now/CVE-2014-3932.md): SQL injection vulnerability in the device registration component in wsf/webservice.php in CoSoSys Endpoint Protector 4 4.3.0.4 and 4.4.0.2 a (no CVSS)
- [CVE-2014-3933](https://cve.now/CVE-2014-3933.md): Cross-site scripting (XSS) vulnerability in the address components field formatter in the AddressField Tokens module 7.x-1.x before 7.x-1.4 (no CVSS)
- [CVE-2014-3934](https://cve.now/CVE-2014-3934.md): SQL injection vulnerability in the Submit\_News module for PHP-Nuke 8.3 allows remote attackers to execute arbitrary SQL commands via the top (no CVSS)
- [CVE-2014-3935](https://cve.now/CVE-2014-3935.md): SQL injection vulnerability in glossaire-aff.php in the Glossaire module 1.0 for XOOPS allows remote attackers to execute arbitrary SQL comm (no CVSS)
- [CVE-2014-3936](https://cve.now/CVE-2014-3936.md): Stack-based buffer overflow in the do\_hnap function in www/my\_cgi.cgi in D-Link DSP-W215 (Rev. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-06-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.