Skip to content
OpenAdvisories

Archive

January 2014

Vulnerabilities first published in this month (UTC), newest first.

← December 2013 2014 / January February 2014 →
  1. 11
  2. 222
  3. 32
  4. 49
  5. 54
  6. 69
  7. 712
  8. 820
  9. 914
  10. 1024
  11. 114
  12. 1212
  13. 136
  14. 1412
  15. 15142
  16. 1633
  17. 177
  18. 188
  19. 199
  20. 207
  21. 2138
  22. 2219
  23. 2325
  24. 2423
  25. 256
  26. 2628
  27. 271
  28. 2813
  29. 2923
  30. 3017
  31. 318
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • High 7.1
    CVE-2014-0757

    Smart Software Solutions (3S) CoDeSys Runtime Toolkit NULL Pointer Dereference

    Smart Software Solutions (3S) CoDeSys Runtime Toolkit before 2.4.7.44 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors.

    Smart Software Solutions (3S) CoDeSys Runtime Toolkit
  • High 7.3
    CVE-2014-1692

    The hash_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protoc…

  • High 7.5
    CVE-2014-0750 Public exploit EPSS 70%

    GE Proficy HMI/SCADA Path Traversal

    Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via …

    GE Proficy HMI/SCADA–CIMPLICITY Proficy Process Systems with CIMPLICITY
  • High —
    CVE-2014-1202 Public exploit

    Code injection via property expansion in SoapUI

    The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.

    com.smartbear.soapui:soapui Maven
  • High 7.5
    CVE-2014-0006

    OpenStack Swift Discloses Secret URLs to Timing Attack

    The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.

    swift swift Debian PyPI
  • High 7.5
    CVE-2013-2104

    python-keystoneclient missing expiration check in PKI token validation

    python-keystoneclient before 0.2.4, as used in OpenStack Keystone (Folsom), does not properly check expiry for PKI tokens, which allows remote authenticated users to (1) retain use of a token after it has expired, or (2) use a revoked token once it expires.

    python-keystoneclient python-keystoneclient Debian PyPI
  • High 7.5
    CVE-2013-4200 Public exploit

    Plone Open Redirection vulnerability via next parameter

    The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a relative URL, which allows remote attackers to bypass the allow_external_login_sites fi…

    plone PyPI
  • High 8.1
    CVE-2013-6040 Public exploit

    MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls versions before 4.0 are vulnerable to arbitrary code via crafted HTML document.

    MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls before version 4.0 vulnerable to arbitrary code via a crafted HTML document. Latest versions (4.0) of MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls have resolved the issue

    MW6 Tech MW6 DataMatrix ActiveX Controls MW6 Aztec ActiveX Controls MW6 MaxiCode ActiveX Controls
  • High 7.8
    CVE-2014-0753

    Ecava IntegraXor Stack-based Buffer Overflow

    Stack-based buffer overflow in the SCADA server in Ecava IntegraXor before 4.1.4390 allows remote attackers to cause a denial of service (system crash) by triggering access to DLL code located in the IntegraXor directory.

    Ecava IntegraXor
  • High —
    CVE-2013-2185

    Deserialization of Untrusted Data in Apache Tomcat

    The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name i…

    org.apache.tomcat:tomcat Maven
  • High 7.5
    CVE-2013-2037

    httplib2 incorrectly checks SSL certificate

    httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers …

    httplib2 python-httplib2 Debian PyPI
  • High 8.8
    CVE-2014-0496 Exploited EPSS 40%

    Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac …

    KEV Mar 3, 2022
  • High 7.5
    CVE-2014-0752

    Ecava IntegraXor Exposure of Access Control List Files to an Unauthorized Control Sphere

    The SCADA server in Ecava IntegraXor before 4.1.4369 allows remote attackers to read arbitrary project backup files via a crafted URL.

    Ecava IntegraXor