Skip to content
OpenAdvisories

Archive

January 2014

Vulnerabilities first published in this month (UTC), newest first.

← December 2013 2014 / January February 2014 →
  1. 11
  2. 222
  3. 32
  4. 49
  5. 54
  6. 69
  7. 712
  8. 820
  9. 914
  10. 1024
  11. 114
  12. 1212
  13. 136
  14. 1412
  15. 15142
  16. 1633
  17. 177
  18. 188
  19. 199
  20. 207
  21. 2138
  22. 2219
  23. 2325
  24. 2423
  25. 256
  26. 2628
  27. 271
  28. 2813
  29. 2923
  30. 3017
  31. 318
All Critical High Medium Low Exploited only Public exploit

558 results · Feed

  • Low —
    CVE-2013-7048

    OpenStack Nova live snapshots use an insecure local directory

    OpenStack Compute (Nova) Grizzly 2013.1.4, Havana 2013.2.1, and earlier uses world-writable and world-readable permissions for the temporary directory used to store live snapshots, which allows local users to read and modify live snapshots.

    nova nova Debian PyPI
  • Medium —
    CVE-2013-4152 EPSS 26%

    Cross-Site Request Forgery in Spring Framework

    The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via…

    libspring-java org.springframework:spring-oxm Debian Maven
  • Unscored —
    CVE-2013-6934 EPSS 28%

    The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2013.11.26, as used in VideoLAN VLC Media …

  • Unscored —
    CVE-2013-6933 EPSS 17%

    The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in …

    vlc mplayer liblivemedia Debian
  • Unscored —
    CVE-2013-5371

    The client in IBM Tivoli Storage Manager (TSM) 6.3.1 and 6.4.0 on Windows does not preserve permissions of Resilient Fi…

  • Unscored —
    CVE-2014-0494

    Adobe Digital Editions 2.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption…

  • Unscored —
    CVE-2014-1242

    Apple iTunes before 11.1.4 uses HTTP for the iTunes Tutorials window, which allows man-in-the-middle attackers to spoof…

  • Unscored —
    CVE-2013-7314

    The OSPF implementation on NEC IP38X, IX1000, IX2000, and IX3000 routers does not consider the possibility of duplicate…

  • Unscored —
    CVE-2013-7310

    The OSPF implementation on Yamaha routers does not consider the possibility of duplicate Link State ID values in Link S…

  • Unscored —
    CVE-2013-7308

    The OSPF implementation on the D-Link DES-3810-28 switch with firmware R2.20.B017 does not consider the possibility of …

  • Unscored —
    CVE-2013-7306

    The OSPF implementation on Brocade routers does not consider the possibility of duplicate Link State ID values in Link …

  • Unscored —
    CVE-2013-7313

    The OSPF implementation in Juniper Junos through 13.x, JunosE, and ScreenOS through 6.3.x does not consider the possibi…

  • Unscored —
    CVE-2013-7311

    The OSPF implementation in Check Point Gaia OS R75.X and R76 and IPSO OS 6.2 R75.X and R76 does not consider the possib…

  • Unscored —
    CVE-2013-7312

    The OSPF implementation on Enterasys switches and routers does not consider the possibility of duplicate Link State ID …

  • Unscored —
    CVE-2013-7309

    The OSPF implementation in Extreme Networks EXOS does not consider the possibility of duplicate Link State ID values in…

  • Unscored —
    CVE-2013-7307

    The OSPF implementation on the Brocade Vyatta vRouter with software before 6.6R1 does not consider the possibility of d…

  • Unscored —
    CVE-2012-6447

    Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk 5.0.0 through 5.0.2 allows remote attackers to inject …

  • Unscored —
    CVE-2014-0675

    The Expressway component in Cisco TelePresence Video Communication Server (VCS) uses the same default X.509 certificate…

  • Unscored —
    CVE-2013-6443

    CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protect_from_forger…

  • Unscored —
    CVE-2014-0979

    The start_authentication function in lightdm-gtk-greeter.c in LightDM GTK+ Greeter before 1.7.1 does not properly handl…

    lightdm-gtk-greeter Debian
  • High 7.5
    CVE-2014-0006

    OpenStack Swift Discloses Secret URLs to Timing Attack

    The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.

    swift swift Debian PyPI
  • Unscored —
    CVE-2013-6448

    The InterfaceGenerator handler in JBoss Seam Remoting in JBoss Seam 2 framework 2.3.1 and earlier, as used in JBoss Web…

  • Unscored —
    CVE-2013-6412

    The transform_save function in transform.c in Augeas 1.0.0 through 1.1.0 does not properly calculate the permission val…

    augeas Debian
  • Unscored —
    CVE-2013-6447

    Multiple XML External Entity (XXE) vulnerabilities in the (1) ExecutionHandler, (2) PollHandler, and (3) SubscriptionHa…

  • Unscored —
    CVE-2014-0806

    The Sleipnir Mobile application 2.12.1 and earlier and Sleipnir Mobile Black Edition application 2.12.1 and earlier for…

  • Critical 9.1
    CVE-2014-0808

    EC-CUBE vulnerable to authorization bypass

    Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is exploited, a user of the affected shopping website may obtain other users' informati…

    EC-CUBE S‑cubism EC-CUBE EC-Orange Packagist
  • Unscored —
    CVE-2014-0661

    The System Status Collection Daemon (SSCD) in Cisco TelePresence System 500-37, 1000, 1300-65, and 3xxx before 1.10.2(4…

  • Unscored —
    CVE-2014-0807

    data/class/pages/shopping/LC_Page_Shopping_Deliv.php in LOCKON EC-CUBE 2.4.4 and earlier, and 2.11.0 through 2.12.2, al…

  • Unscored —
    CVE-2014-0677

    The Label Distribution Protocol (LDP) functionality in Cisco NX-OS allows remote attackers to cause a denial of service…

  • Unscored —
    CVE-2014-0676

    Cisco NX-OS allows local users to bypass intended TACACS+ command restrictions via a series of multiple commands, aka B…

  • Unscored —
    CVE-2014-0662

    The SIP module in Cisco TelePresence Video Communication Server (VCS) before 8.1 allows remote attackers to cause a den…

  • Unscored —
    CVE-2014-0660

    Cisco TelePresence ISDN Gateway with software before 2.2(1.92) allows remote attackers to cause a denial of service (D-…

  • Unscored —
    CVE-2013-7305

    fpw.php in e107 through 1.0.4 does not check the user_ban field, which makes it easier for remote attackers to reset pa…

  • Unscored —
    CVE-2013-7304

    Check Point Endpoint Security MI Server through R73 3.0.0 HFA2.5 does not configure X.509 certificate validation for cl…

  • Unscored —
    CVE-2013-2750 Public exploit

    Cross-site scripting (XSS) vulnerability in e107_plugins/content/handlers/content_preset.php in e107 before 1.0.3 allow…

  • Unscored —
    CVE-2014-1637 Public exploit

    Command School Student Management System 1.06.01 does not properly restrict access to sw/backup/backup_ray2.php, which …

  • Unscored —
    CVE-2014-1636 Public exploit

    Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to ex…

  • Unscored —
    CVE-2013-6343 Public exploit

    Multiple buffer overflows in web.c in httpd on the ASUS RT-N56U and RT-AC66U routers with firmware 3.0.0.4.374_979 allo…

  • Unscored —
    CVE-2013-6746

    Cross-site scripting (XSS) vulnerability in FileNet P8 Platform Documentation Installable Info Center 4.5.1 through 5.2…

  • Unscored —
    CVE-2014-0670

    Cross-site scripting (XSS) vulnerability in the Search and Play interface in Cisco MediaSense allows remote attackers t…