Archive
January 2014
Vulnerabilities first published in this month (UTC), newest first.
74 results · Clear filters · Feed
-
Unscored —CVE-2014-1204 Public exploit
SQL injection vulnerability in Tableau Server 8.0.x before 8.0.7 and 8.1.x before 8.1.2 allows remote authenticated use…
-
Unscored —
MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support i…
-
Unscored —
Buffer overflow in the IconCreate method in an ActiveX control in the DaumGame ActiveX plugin 1.1.0.4 and 1.1.0.5 allow…
-
Unscored —CVE-2014-0793 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in the StackIdeas Komento (com_komento) component before 1.7.3 for …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business…
-
Unscored —CVE-2013-4898 Public exploit
Unrestricted file upload vulnerability in the user profile page feature in the Timeline Plugin 4.2.5p9 for SocialEngine…
-
Unscored —CVE-2013-4888 Public exploit
Cross-site scripting (XSS) vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to inject a…
-
Unscored —CVE-2013-4889 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in Digital Signage Xibo 1.4.2 allow remote atta…
-
Unscored —CVE-2013-5092 Public exploit
Cross-site scripting (XSS) vulnerability in afa/php/Login.php in AlgoSec Firewall Analyzer 6.1-b86 allows remote attack…
-
Unscored —
The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r24…
-
Unscored —CVE-2013-5094 Public exploit
Cross-site scripting (XSS) vulnerability in index.exp in McAfee Vulnerability Manager 7.5 allows remote attackers to in…
-
Unscored —
Directory traversal vulnerability in gmap/view_overlay.php in Bitweaver 2.8.1 and earlier allows remote attackers to re…
-
Unscored —CVE-2014-0794 Public exploit
SQL injection vulnerability in the JV Comment (com_jvcomment) component before 3.0.3 for Joomla! allows remote authenti…
-
Unscored —CVE-2014-1664 Public exploit
The Citrix GoToMeeting application 5.0.799.1238 for Android logs HTTP requests containing sensitive information, which …
-
Unscored —CVE-2013-7247 Public exploit
cgi-bin/tsaws.cgi in Franklin Fueling Systems TS-550 evo with firmware 2.0.0.6833 and other versions before 2.4.0 allow…
-
Unscored —CVE-2013-7248 Public exploit
Franklin Fueling Systems TS-550 evo with firmware 2.0.0.6833 and other versions before 2.4.0 has a hardcoded password f…
-
Unscored —
The "remember me" functionality in login.php in Burden before 1.8.1 allows remote attackers to bypass authentication an…
-
Unscored —CVE-2014-1671 Public exploit
Multiple SQL injection vulnerabilities in Dell KACE K1000 5.4.76847 and possibly earlier allow remote attackers or remo…
-
High 7.5
GE Proficy HMI/SCADA Path Traversal
Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via …
-
High —CVE-2014-1202 Public exploit
Code injection via property expansion in SoapUI
The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.
-
Unscored —CVE-2014-1447 Public exploit
Race condition in the virNetServerClientStartKeepAlive function in libvirt before 1.2.1 allows remote attackers to caus…
-
Unscored —CVE-2013-7316 Public exploit
Cross-site scripting (XSS) vulnerability in GitLab 6.0 and other versions before 6.5.0 allows remote attackers to injec…
-
Unscored —CVE-2013-7184 Public exploit
Gretech GOM Media Player 2.2.56.5158 and earlier allows remote attackers to cause a denial of service (memory corruptio…
-
Unscored —CVE-2013-2750 Public exploit
Cross-site scripting (XSS) vulnerability in e107_plugins/content/handlers/content_preset.php in e107 before 1.0.3 allow…
-
Unscored —CVE-2014-1637 Public exploit
Command School Student Management System 1.06.01 does not properly restrict access to sw/backup/backup_ray2.php, which …
-
Unscored —CVE-2014-1636 Public exploit
Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to ex…
-
Unscored —CVE-2013-6343 Public exploit
Multiple buffer overflows in web.c in httpd on the ASUS RT-N56U and RT-AC66U routers with firmware 3.0.0.4.374_979 allo…
-
Unscored —CVE-2013-4884 Public exploit
Cross-site scripting (XSS) vulnerability in McAfee SuperScan 4.0 allows remote attackers to inject arbitrary web script…
-
Unscored —CVE-2012-2997 Public exploit
XML External Entity (XXE) vulnerability in sam/admin/vpe2/public/php/server.php in F5 BIG-IP 10.0.0 through 10.2.4 and …
-
Unscored —CVE-2013-7219 Public exploit
SQL injection vulnerability in vote.php in the 2Glux Sexy Polling (com_sexypolling) component before 1.0.9 for Joomla! …
-
High 7.5CVE-2013-4200 Public exploit
Plone Open Redirection vulnerability via next parameter
The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a relative URL, which allows remote attackers to bypass the allow_external_login_sites fi…
-
Unscored —CVE-2013-6922 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in the Seagate BlackArmor NAS 220 devices with firmware sg20…
-
Unscored —CVE-2013-2594 Public exploit
SQL injection vulnerability in reports/calldiary.php in Hornbill Supportworks ITSM 1.0.0 through 3.4.14 allows remote a…
-
Unscored —CVE-2013-6872 Public exploit
SQL injection vulnerability in managetimetracker.php in Collabtive before 1.2 allows remote authenticated users to exec…
-
Unscored —CVE-2014-1618 Public exploit
Multiple SQL injection vulnerabilities in UAEPD Shopping Cart Script allow remote attackers to execute arbitrary SQL co…
-
Unscored —CVE-2014-1619 Public exploit
Multiple SQL injection vulnerabilities in Cubic CMS 5.1.1, 5.1.2, and 5.2 allow remote attackers to execute arbitrary S…
-
High 8.1CVE-2013-6040 Public exploit
MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls versions before 4.0 are vulnerable to arbitrary code via crafted HTML document.
MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls before version 4.0 vulnerable to arbitrary code via a crafted HTML document. Latest versions (4.0) of MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls have resolved the issue
-
Unscored —
Stack-based buffer overflow in the rf_report_error function in ermapper_u.dll in Intergraph ERDAS ER Viewer before 13.0…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in set_users.cgi in Conceptronic CIPCAMPTIWL Camera 1.0 with firmware 2…
-
Unscored —CVE-2012-6625 Public exploit
SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPres…