# CVEs published 2014-06-09

23 CVEs were published on June 9, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-4003](https://cve.now/CVE-2014-4003.md): The System Landscape Directory (SLD) in SAP NetWeaver allows remote attackers to modify information via vectors related to adding a system. (no CVSS)
- [CVE-2014-4004](https://cve.now/CVE-2014-4004.md): The (1) Structures and (2) Project-Oriented Procurement components in SAP Project System has hardcoded credentials, which makes it easier fo (no CVSS)
- [CVE-2014-4005](https://cve.now/CVE-2014-4005.md): SAP Brazil add-on has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. (no CVSS)
- [CVE-2014-4006](https://cve.now/CVE-2014-4006.md): The SAP Trader's and Scheduler's Workbench (TSW) for SAP Oil & Gas has hardcoded credentials, which makes it easier for remote attackers to (no CVSS)
- [CVE-2014-4007](https://cve.now/CVE-2014-4007.md): The SAP Upgrade tools for ABAP has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vector (no CVSS)
- [CVE-2014-4008](https://cve.now/CVE-2014-4008.md): SAP Web Services Tool (CA-WUI-WST) has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified ve (no CVSS)
- [CVE-2014-4009](https://cve.now/CVE-2014-4009.md): SAP CCMS Monitoring (BC-CCM-MON) has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vect (no CVSS)
- [CVE-2014-4010](https://cve.now/CVE-2014-4010.md): SAP Transaction Data Pool has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. (no CVSS)
- [CVE-2014-4011](https://cve.now/CVE-2014-4011.md): SAP Capacity Leveling has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. (no CVSS)
- [CVE-2014-4012](https://cve.now/CVE-2014-4012.md): SAP Open Hub Service has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. (no CVSS)
- [CVE-2013-1756](https://cve.now/CVE-2013-1756.md): The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitr (no CVSS, dragonfly)
- [CVE-2013-1973](https://cve.now/CVE-2013-1973.md): The autocomplete callback in Autocomplete Widgets for Text and Number Fields (autocomplete\_widgets) module 6.x-1.x before 6.x-1.4 and 7.x-1. (no CVSS)
- [CVE-2013-2562](https://cve.now/CVE-2013-2562.md): Mambo CMS 4.6.5 stores the MySQL database password in cleartext in the document root, which allows local users to obtain sensitive informati (no CVSS)
- [CVE-2013-2563](https://cve.now/CVE-2013-2563.md): Mambo CMS 4.6.5 uses world-readable permissions on configuration.php, which allows local users to obtain the admin password hash by reading (no CVSS)
- [CVE-2013-2564](https://cve.now/CVE-2013-2564.md): Mambo CMS 4.6.5 allows remote attackers to cause a denial of service (memory and bandwidth consumption) by uploading a crafted file. (no CVSS)
- [CVE-2013-3081](https://cve.now/CVE-2013-3081.md): SQL injection vulnerability in the checkEmailFormat function in plugins/jojo\_core/classes/Jojo.php in Jojo before 1.2.2 allows remote attack (no CVSS)
- [CVE-2013-3082](https://cve.now/CVE-2013-3082.md): Cross-site scripting (XSS) vulnerability in plugins/jojo\_core/forgot\_password.php in Jojo before 1.2.2 allows remote attackers to inject arb (no CVSS)
- [CVE-2013-4595](https://cve.now/CVE-2013-4595.md): The Secure Pages module 6.x-2.x before 6.x-2.0 for Drupal does not properly match URLs, which causes HTTP to be used instead of HTTPS and ma (no CVSS)
- [CVE-2013-4597](https://cve.now/CVE-2013-4597.md): The Revisioning module 7.x-1.x before 7.x-1.6 for Drupal does not properly check node access permissions for content marked unpublished by t (no CVSS)
- [CVE-2013-4599](https://cve.now/CVE-2013-4599.md): The Misery module 6.x-2.x before 6.x-2.5 and 7.x-2.x before 7.x-2.2 for Drupal, when the "delay misery" configuration is set to a high value (no CVSS)
- [CVE-2013-5760](https://cve.now/CVE-2013-5760.md): QNAP Photo Station before firmware 4.0.3 build0912 allows remote attackers to list OS user accounts via a request to photo/p/api/list.php. (no CVSS)
- [CVE-2013-6223](https://cve.now/CVE-2013-6223.md): LiveZilla before 5.1.1.0 stores the admin Base64 encoded username and password in a 1click file, which allows local users to obtain access b (no CVSS)
- [CVE-2013-7323](https://cve.now/CVE-2013-7323.md): python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors. (no CVSS, python-gnupg)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-06-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.