Archive
January 2014
Vulnerabilities first published in this month (UTC), newest first.
558 results · Feed
-
Unscored —
SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0 Management Engine (CFME) 5.1 and Man…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Rich Text Editor in Movable Type 5.0x, 5.1x before 5.161, 5.2.x before …
-
Unscored —
Stack-based buffer overflow in the yyerror function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to …
-
Unscored —
Cross-site scripting (XSS) vulnerability in the mycode_parse_video function in inc/class_parser.php in MyBB (aka MyBull…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in register.php in Andy's PHP Knowledgebase (Aphpkb) before 0.95.8 …
-
Unscored —
The Application/Device Control (ADC) component in the client in Symantec Endpoint Protection (SEP) 11.x before 11.0.7.4…
-
Unscored —
The Management Console in Symantec Endpoint Protection (SEP) 11.x before 11.0.7.4 and 12.x before 12.1.2 RU2 and Endpoi…
-
Unscored —
Unquoted Windows search path vulnerability in the client in Symantec Endpoint Protection (SEP) 11.x before 11.0.7.4 and…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the web framework in Cisco Secure Access Control System (ACS) allows remote…
-
Unscored —
The server in Cisco Unity Connection allows remote authenticated users to cause a denial of service (CPU consumption) v…
-
Unscored —
Cisco 9900 Unified IP phones allow remote attackers to cause a denial of service (unregistration) via a crafted SIP hea…
-
Unscored —
The Conceptronic C54APM access point with runtime code 1.26 has a default password of admin for the admin account, whic…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities on the Conceptronic C54APM access point with runtime code 1.26 allo…
-
Unscored —
CRLF injection vulnerability in goform/formWlSiteSurvey on the Conceptronic C54APM access point with runtime code 1.26 …
-
Unscored —
Multiple open redirect vulnerabilities on the Conceptronic C54APM access point with runtime code 1.26 allow remote atta…
-
Unscored —
Amberdms Billing System (ABS) before 1.4.1 does not properly implement blacklisting after detection of invalid login at…
-
Unscored —
Amberdms Billing System (ABS) before 1.4.1, when a multi-instance installation is configured, might allow local users t…
-
Unscored —
Cross-site scripting (XSS) vulnerability in account_sponsor_page.php in MantisBT 1.0.0 through 1.2.15 allows remote aut…
-
Unscored —
Stack-based buffer overflow in the chkNum function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to h…
-
Unscored —CVE-2013-7282 Public exploit
The management web interface on the Nisuta NS-WIR150NE router with firmware 5.07.41 and Nisuta NS-WIR300N router with f…
-
Unscored —
SQL injection vulnerability in IBM Atlas eDiscovery Process Management 6.0.1.5 and earlier and 6.0.2, Disposal and Gove…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the web interface in Cisco Secure Access Control System (ACS) allows remote…
-
Unscored —
IBM Atlas eDiscovery Process Management 6.0.1.5 and earlier and 6.0.2, Disposal and Governance Management for IT 6.0.1.…
-
Low —
Paratrooper-newrelic Exposes of Sensitive Information to an Unauthorized Actor
The paratrooper-newrelic gem 1.0.1 for Ruby allows local users to obtain the X-Api-Key value by listing the curl process.
-
Low —
Local API Login Credentials Disclosure in paratrooper-pingdom
The paratrooper-pingdom gem 1.0.0 for Ruby allows local users to obtain the App-Key, username, and password values by listing the curl process.
-
Unscored —
Race condition in the libreswan.spec files for Red Hat Enterprise Linux (RHEL) and Fedora packages in libreswan 3.6 has…
-
Unscored —
Directory traversal vulnerability in lib/functions/d-load.php in Horizon Quick Content Management System (QCMS) 4.0 and…
-
Unscored —CVE-2013-7139 Public exploit
SQL injection vulnerability in download.php in Horizon Quick Content Management System (QCMS) 4.0 and earlier allows re…
-
Unscored —CVE-2013-6462 EPSS 10%
Stack-based buffer overflow in the bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont 1.1 through 1.4.6 a…
-
Unscored —CVE-2013-6923 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Seagate BlackArmor NAS 220 devices with firmware sg2000-2000.133…
-
Unscored —
Absolute path traversal vulnerability in cgi-bin/jc.cgi in QNAP QTS before 4.1.0 allows remote attackers to read arbitr…
-
Unscored —
webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before…
-
High 7.5
Ecava IntegraXor Exposure of Access Control List Files to an Unauthorized Control Sphere
The SCADA server in Ecava IntegraXor before 4.1.4369 allows remote attackers to read arbitrary project backup files via a crafted URL.
-
Unscored —CVE-2013-4353 EPSS 12%
The ssl3_take_mac function in ssl/s3_both.c in OpenSSL 1.0.1 before 1.0.1f allows remote TLS servers to cause a denial …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange (OX) AppSuite 7.4.0 and earlier allow remote attack…
-
Unscored —
Integer overflow in Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 allows remote attackers to execute arbitrary…
-
Unscored —
Stack-based buffer overflow in Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 might allow remote attackers to e…
-
Unscored —
Integer underflow in Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 allows remote attackers to execute arbitrar…
-
Unscored —
Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 allows remote attackers to trigger memory corruption via a craft…
-
Unscored —
The BGP implementation in Cisco NX-OS 6.2(2a) and earlier does not properly handle the interaction of UPDATE messages w…