# CVEs published 2014-10-26

12 CVEs were published on October 26, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2013-6796](https://cve.now/CVE-2013-6796.md): The SMTP server in DeepOfix 3.3 and earlier allows remote attackers to bypass authentication via an empty password, which triggers an LDAP a (no CVSS)
- [CVE-2013-7408](https://cve.now/CVE-2013-7408.md): F5 BIG-IP Analytics 11.x before 11.4.0 uses a predictable session cookie, which makes it easier for remote attackers to have unspecified imp (no CVSS)
- [CVE-2014-3520](https://cve.now/CVE-2014-3520.md): OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated trustees to gain a (no CVSS)
- [CVE-2014-5148](https://cve.now/CVE-2014-5148.md): Xen 4.4.x, when running on an ARM system and "handling an unknown system register access from 64-bit userspace," returns to an instruction o (no CVSS)
- [CVE-2014-5520](https://cve.now/CVE-2014-5520.md): SQL injection vulnerability in XRMS CRM, possibly 1.99.2, allows remote attackers to execute arbitrary SQL commands via the user\_id paramete (no CVSS)
- [CVE-2014-6635](https://cve.now/CVE-2014-6635.md): Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.0 allows remote attackers to inject arbitrary web script or HTML via the src pa (no CVSS)
- [CVE-2014-6037](https://cve.now/CVE-2014-6037.md): Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows (no CVSS)
- [CVE-2014-2987](https://cve.now/CVE-2014-2987.md): Multiple cross-site request forgery (CSRF) vulnerabilities in EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edi (no CVSS)
- [CVE-2014-4812](https://cve.now/CVE-2014-4812.md): The installer in IBM Security AppScan Source 8.x and 9.x through 9.0.1 has an open network port for a debug service, which allows remote att (no CVSS)
- [CVE-2014-6099](https://cve.now/CVE-2014-6099.md): The Change Password feature in IBM Sterling B2B Integrator 5.2.x through 5.2.4 does not have a lockout protection mechanism for invalid logi (no CVSS)
- [CVE-2014-6133](https://cve.now/CVE-2014-6133.md): IBM API Management 3.x before 3.0.1.0 allows local users to obtain sensitive ciphertext information via unspecified vectors. (no CVSS)
- [CVE-2013-1641](https://cve.now/CVE-2013-1641.md): Directory traversal vulnerability in the zip download functionality in QuiXplorer before 2.5.5 allows remote attackers to read arbitrary fil (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-10-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.