Archive
January 2014
Vulnerabilities first published in this month (UTC), newest first.
558 results · Feed
-
Unscored —
Cisco Context Directory Agent (CDA) allows remote attackers to modify the cache via a replay attack involving crafted R…
-
Unscored —
The administration portal in Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier does not properly han…
-
Unscored —
The administrative interface in Cisco Context Directory Agent (CDA) does not properly enforce authorization requirement…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Mappings page in Cisco Context Directory Agent (CDA) allows remote atta…
-
Unscored —
The Identity Firewall (IDFW) functionality in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers …
-
Unscored —
Cisco Context Directory Agent (CDA) allows remote authenticated users to trigger the omission of certain user-interface…
-
Unscored —
The Identity Firewall (IDFW) functionality in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers …
-
Unscored —
The dgram_recvmsg function in net/ieee802154/dgram.c in the Linux kernel before 3.12.4 updates a certain length value w…
-
Unscored —
Cross-site scripting (XSS) vulnerability in inc/raf_form.php in the Recommend to a friend plugin 2.0.2 for WordPress al…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Andy's PHP Knowledgebase (Aphpkb) before 0.95.8 allow remote att…
-
Unscored —CVE-2013-7280 Public exploit
Buffer overflow in HansoTools Hanso Player 2.1.0, 2.5.0, and earlier allows remote attackers to cause a denial of servi…
-
Unscored —
Cross-site scripting (XSS) vulnerability in views/video-management/preview_video.php in the S3 Video plugin before 0.98…
-
Unscored —CVE-2013-7274 Public exploit
Cross-site scripting (XSS) vulnerability in Wallpaper Script 3.5.0082 allows remote authenticated users to inject arbit…
-
Unscored —
Cross-site scripting (XSS) vulnerability in misc.php in MyBB (aka MyBulletinBoard) before 1.6.12 allows remote attacker…
-
Unscored —CVE-2013-7097 Public exploit
Directory traversal vulnerability in 7 Media Web Solutions eduTrac before 1.1.2 allows remote attackers to read arbitra…
-
Unscored —CVE-2013-7278 Public exploit
SQL injection vulnerability in Naxtech CMS Afroditi 1.0 allows remote attackers to execute arbitrary SQL commands via t…
-
Unscored —CVE-2014-0620 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Technicolor (formerly Thomson) TC7200 STD6.01.12 allow remote at…
-
Unscored —CVE-2014-0621 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in Technicolor (formerly Thomson) TC7200 STD6.01.12 allow re…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Foliopress WYSIWYG plugin before 2.6.8.5 for WordPress allows remote at…
-
Unscored —
Xen, possibly before 4.0.2, allows local 64-bit PV guests to cause a denial of service (host crash) by specifying user …
-
Unscored —
Xen, when using x86 Intel processors and the VMX virtualization extension is enabled, does not properly handle cpuid in…
-
Unscored —
The instruction emulation in Xen 3.0.3 allows local SMP guest users to cause a denial of service (host crash) by replac…
-
Unscored —
The get_free_port function in Xen allows local authenticated DomU users to cause a denial of service or possibly gain p…
-
Unscored —
The lxcDomainGetMemoryParameters method in lxc/lxc_driver.c in libvirt 1.0.5 through 1.2.0 does not properly check the …
-
Unscored —
Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local user…
-
Low —CVE-2013-6480 Public exploit
Libcloud does not properly scrub data when destroying a DigitalOcean node
Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.
-
Medium —
OpenStack Nova Router metadata queries are not restricted by tenant
Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port,…
-
Unscored —
Libreswan 3.6 allows remote attackers to cause a denial of service (crash) via a small length value and (1) no version …
-
Unscored —
Uscan in devscripts before 2.13.9 allows remote attackers to execute arbitrary code via a crafted tarball.
-
Unscored —
CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to execute arbitrary commands v…
-
Unscored —
The write-blocker in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a has a default "ditto" username and…
-
Unscored —
The mISDN_sock_recvmsg function in drivers/isdn/mISDN/socket.c in the Linux kernel before 3.12.4 does not ensure that a…
-
Unscored —
The atalk_recvmsg function in net/appletalk/ddp.c in the Linux kernel before 3.12.4 updates a certain length value with…
-
Unscored —
The l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c in the Linux kernel before 3.12.4 updates a certain length value bef…
-
Unscored —
The nr_recvmsg function in net/netrom/af_netrom.c in the Linux kernel before 3.12.4 updates a certain length value with…
-
Unscored —
The packet_recvmsg function in net/packet/af_packet.c in the Linux kernel before 3.12.4 updates a certain length value …
-
Unscored —
The x25_recvmsg function in net/x25/af_x25.c in the Linux kernel before 3.12.4 updates a certain length value without e…
-
Unscored —
The Linux kernel before 3.12.4 updates certain length values before ensuring that associated data structures have been …
-
Unscored —
The ipx_recvmsg function in net/ipx/af_ipx.c in the Linux kernel before 3.12.4 updates a certain length value without e…
-
Unscored —
The pn_recvmsg function in net/phonet/datagram.c in the Linux kernel before 3.12.4 updates a certain length value befor…