Skip to content
OpenAdvisories

Archive

21 January 2014

Vulnerabilities first published on this day (UTC), newest first.

← December 2013 2014 / January /21 February 2014 →
  1. 11
  2. 222
  3. 32
  4. 49
  5. 54
  6. 69
  7. 712
  8. 820
  9. 914
  10. 1024
  11. 114
  12. 1212
  13. 136
  14. 1412
  15. 15142
  16. 1633
  17. 177
  18. 188
  19. 199
  20. 207
  21. 2138
  22. 2219
  23. 2325
  24. 2423
  25. 256
  26. 2628
  27. 271
  28. 2813
  29. 2923
  30. 3017
  31. 318
All Critical High Medium Low Exploited only Public exploit

38 results · Feed

  • Unscored —
    CVE-2013-0485

    Unspecified vulnerability in IBM Java SDK 7 before SR4-FP1, 6 before SR13-FP1, 5.0 before SR16-FP1, and 1.4.2 before SR…

  • Unscored —
    CVE-2013-0340 EPSS 19%

    expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_Set…

    expat libxmltok Debian
  • Unscored —
    CVE-2013-0339

    libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xml…

    libxml2 Debian
  • Unscored —
    CVE-2013-0157

    (a) mount and (b) umount in util-linux 2.14.1, 2.17.2, and probably other versions allow local users to determine the e…

    util-linux util-linux Debian Ubuntu
  • Unscored —
    CVE-2013-1769

    A certain hashing algorithm in Telepathy Gabble 0.16.x before 0.16.5 and 0.17.x before 0.17.3 allows remote attackers t…

  • Unscored —
    CVE-2013-1923

    rpc-gssd in nfs-utils before 1.2.8 performs reverse DNS resolution for server names during GSSAPI authentication, which…

    nfs-utils Debian
  • Unscored —
    CVE-2013-1361

    Untrusted search path vulnerability in Lenovo Thinkpad Bluetooth with Enhanced Data Rate Software 6.4.0.2900 and earlie…

  • Unscored —
    CVE-2013-4884 Public exploit

    Cross-site scripting (XSS) vulnerability in McAfee SuperScan 4.0 allows remote attackers to inject arbitrary web script…

  • Unscored —
    CVE-2013-4160

    Little CMS (lcms2) before 2.5, as used in OpenJDK 7 and possibly other products, allows remote attackers to cause a den…

    lcms2 Debian
  • Unscored —
    CVE-2013-2152

    Unquoted Windows search path vulnerability in the SPICE service, as used in Red Hat Enterprise Virtualization (RHEV) 3.…

  • Unscored —
    CVE-2013-2151

    Unquoted Windows search path vulnerability in Red Hat Enterprise Virtualization (RHEV) 3 and 3.2 allows local users to …

  • High 7.5
    CVE-2013-2104

    python-keystoneclient missing expiration check in PKI token validation

    python-keystoneclient before 0.2.4, as used in OpenStack Keystone (Folsom), does not properly check expiry for PKI tokens, which allows remote authenticated users to (1) retain use of a token after it has expired, or (2) use a revoked token once it expires.

    python-keystoneclient python-keystoneclient Debian PyPI
  • Unscored —
    CVE-2013-5987

    Unspecified vulnerability in NVIDIA graphics driver Release 331, 325, 319, 310, and 304 allows local users to bypass in…

    nvidia-graphics-drivers Debian
  • Unscored —
    CVE-2013-5986

    Unspecified vulnerability in NVIDIA graphics driver Release 331, 325, 319, 310, and 304 has unknown impact and attack v…

    nvidia-graphics-drivers Debian
  • Unscored —
    CVE-2012-2997 Public exploit

    XML External Entity (XXE) vulnerability in sam/admin/vpe2/public/php/server.php in F5 BIG-IP 10.0.0 through 10.2.4 and …

  • Unscored —
    CVE-2013-7219 Public exploit

    SQL injection vulnerability in vote.php in the 2Glux Sexy Polling (com_sexypolling) component before 1.0.9 for Joomla! …

  • High 7.5
    CVE-2013-4200 Public exploit

    Plone Open Redirection vulnerability via next parameter

    The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a relative URL, which allows remote attackers to bypass the allow_external_login_sites fi…

    plone PyPI
  • Unscored —
    CVE-2013-6922 Public exploit

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Seagate BlackArmor NAS 220 devices with firmware sg20…

  • Unscored —
    CVE-2013-2594 Public exploit

    SQL injection vulnerability in reports/calldiary.php in Hornbill Supportworks ITSM 1.0.0 through 3.4.14 allows remote a…

  • Unscored —
    CVE-2013-6305

    IBM Platform Symphony 5.2 before build 229037 and 6.1.0.1 before build 229073 uses the same credentials encryption key …

  • Unscored —
    CVE-2013-6872 Public exploit

    SQL injection vulnerability in managetimetracker.php in Collabtive before 1.2 allows remote authenticated users to exec…

  • Unscored —
    CVE-2014-1618 Public exploit

    Multiple SQL injection vulnerabilities in UAEPD Shopping Cart Script allow remote attackers to execute arbitrary SQL co…

  • Unscored —
    CVE-2014-1619 Public exploit

    Multiple SQL injection vulnerabilities in Cubic CMS 5.1.1, 5.1.2, and 5.2 allow remote attackers to execute arbitrary S…

  • Unscored —
    CVE-2014-1452

    Stack-based buffer overflow in lib/snmpagent.c in bsnmpd, as used in FreeBSD 8.3 through 10.0, allows remote attackers …

  • Unscored —
    CVE-2014-1620

    Multiple cross-site scripting (XSS) vulnerabilities in add.php in HIOX Guest Book (HGB) 5.0 allow remote attackers to i…

  • Unscored —
    CVE-2011-5270

    wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publish_posts capability requirement, which allo…

    wordpress Debian
  • Unscored —
    CVE-2013-4030

    Integrated Management Module (IMM) 2 1.00 through 2.00 on IBM System X and Flex System servers supports SSL cipher suit…

  • High 8.1
    CVE-2013-6040 Public exploit

    MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls versions before 4.0 are vulnerable to arbitrary code via crafted HTML document.

    MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls before version 4.0 vulnerable to arbitrary code via a crafted HTML document. Latest versions (4.0) of MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls have resolved the issue

    MW6 Tech MW6 Aztec ActiveX Controls MW6 MaxiCode ActiveX Controls MW6 DataMatrix ActiveX Controls
  • Unscored —
    CVE-2013-5429

    The Risk Based Access functionality in IBM Tivoli Federated Identity Manager (TFIM) 6.2.2 before FP9 and Tivoli Federat…

  • Unscored —
    CVE-2012-6634

    wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass i…

    wordpress Debian
  • Unscored —
    CVE-2012-6635

    wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view acces…

    wordpress Debian
  • Unscored —
    CVE-2012-6633

    Cross-site scripting (XSS) vulnerability in wp-includes/default-filters.php in WordPress before 3.3.3 allows remote att…

    wordpress Debian
  • High 7.8
    CVE-2014-0753

    Ecava IntegraXor Stack-based Buffer Overflow

    Stack-based buffer overflow in the SCADA server in Ecava IntegraXor before 4.1.4390 allows remote attackers to cause a denial of service (system crash) by triggering access to DLL code located in the IntegraXor directory.

    Ecava IntegraXor
  • Unscored —
    CVE-2010-5295

    Cross-site scripting (XSS) vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers…

    wordpress Debian
  • Unscored —
    CVE-2010-5294

    Multiple cross-site scripting (XSS) vulnerabilities in the request_filesystem_credentials function in wp-admin/includes…

    wordpress Debian
  • Unscored —
    CVE-2010-5296

    wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Su…

    wordpress Debian
  • Unscored —
    CVE-2010-5297

    WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add use…

    wordpress Debian
  • Unscored —
    CVE-2010-5293

    wp-includes/comment.php in WordPress before 3.0.2 does not properly whitelist trackbacks and pingbacks in the blogroll,…

    wordpress Debian