Skip to content
OpenAdvisories

Archive

January 2014

Vulnerabilities first published in this month (UTC), newest first.

← December 2013 2014 / January February 2014 →
  1. 11
  2. 222
  3. 32
  4. 49
  5. 54
  6. 69
  7. 712
  8. 820
  9. 914
  10. 1024
  11. 114
  12. 1212
  13. 136
  14. 1412
  15. 15142
  16. 1633
  17. 177
  18. 188
  19. 199
  20. 207
  21. 2138
  22. 2219
  23. 2325
  24. 2423
  25. 256
  26. 2628
  27. 271
  28. 2813
  29. 2923
  30. 3017
  31. 318
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Low —
    CVE-2014-1624

    pyxdg Arbitrary File Overwrite via Race Condition

    Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to…

    pyxdg pyxdg pyxdg Debian Ubuntu PyPI
  • Low —
    CVE-2014-1604

    RPLY Predictable Tmpfile Names Allows Cache Spoofing

    The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name.

    python-rply rply Debian PyPI
  • Low —
    CVE-2013-2192

    Improper Authentication in Apache Hadoop

    The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensiti…

    org.apache.hadoop:hadoop-common Maven
  • Low —
    CVE-2013-7048

    OpenStack Nova live snapshots use an insecure local directory

    OpenStack Compute (Nova) Grizzly 2013.1.4, Havana 2013.2.1, and earlier uses world-writable and world-readable permissions for the temporary directory used to store live snapshots, which allows local users to read and modify live snapshots.

    nova nova Debian PyPI
  • Low —
    CVE-2013-7078

    TYPO3 Cross-site scripting (XSS) vulnerability in the Extbase Framework

    Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in the Extbase Framework in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6, when the Rewritten Property Mapp…

    typo3/cms-core Packagist
  • Low —
    CVE-2014-1234

    Paratrooper-newrelic Exposes of Sensitive Information to an Unauthorized Actor

    The paratrooper-newrelic gem 1.0.1 for Ruby allows local users to obtain the X-Api-Key value by listing the curl process.

    paratrooper-newrelic RubyGems
  • Low —
    CVE-2014-1233

    Local API Login Credentials Disclosure in paratrooper-pingdom

    The paratrooper-pingdom gem 1.0.0 for Ruby allows local users to obtain the App-Key, username, and password values by listing the curl process.

    paratrooper-pingdom RubyGems
  • Low —
    CVE-2013-6480 Public exploit

    Libcloud does not properly scrub data when destroying a DigitalOcean node

    Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.

    apache-libcloud PyPI