Skip to content
OpenAdvisories

Archive

February 2014

Vulnerabilities first published in this month (UTC), newest first.

← January 2014 2014 / February March 2014 →
  1. 19
  2. 27
  3. 35
  4. 424
  5. 523
  6. 648
  7. 77
  8. 810
  9. 9 
  10. 1019
  11. 1111
  12. 1235
  13. 1316
  14. 1436
  15. 1520
  16. 16 
  17. 1710
  18. 1812
  19. 19 
  20. 2010
  21. 214
  22. 2224
  23. 23 
  24. 2414
  25. 256
  26. 2623
  27. 2749
  28. 2820
All Critical High Medium Low Exploited only Public exploit

442 results · Feed

  • Medium —
    CVE-2013-4590

    Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

    Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document c…

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2013-4841 EPSS 10%

    Unspecified vulnerability in dbd_manager in LeftHand OS before 11.0 in HP StoreVirtual 4000 and StoreVirtual VSA Softwa…

  • Medium —
    CVE-2013-4322 Public exploit

    Apache Tomcat Denial of Service vulnerability

    Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which a…

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2013-6204

    The Web Console in HP Application Information Optimizer (formerly HP Database Archiving) 6.2, 6.3, 6.4, 7.0, and 7.1 al…

  • Unscored —
    CVE-2013-6731

    IBM Netezza Performance Portal 2.x before 2.0.0.3 allows remote authenticated users to change arbitrary passwords via a…

  • Unscored —
    CVE-2013-6203

    The Web Console in HP Application Information Optimizer (formerly HP Database Archiving) 6.2, 6.3, 6.4, 7.0, and 7.1 al…

  • Unscored —
    CVE-2013-2824

    Schneider Electric StruxureWare SCADA Expert Vijeo Citect 7.40, Vijeo Citect 7.20 through 7.30SP1, CitectSCADA 7.20 thr…

  • Medium —
    CVE-2014-0033

    Improper Input Validation in Apache Tomcat

    org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL.

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2014-2093

    Untrusted search path vulnerability in Catfish through 0.4.0.3 allows local users to gain privileges via a Trojan horse…

    catfish Debian
  • Unscored —
    CVE-2014-2096

    Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0 allows local users to gain privileges via a Trojan h…

    catfish catfish Debian Ubuntu
  • Unscored —
    CVE-2014-2095

    Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0, when a Fedora package such as 0.8.2-1 is not used, …

    catfish Debian
  • Unscored —
    CVE-2014-2094

    Untrusted search path vulnerability in Catfish through 0.4.0.3, when a Fedora package such as 0.4.0.2-2 is not used, al…

    catfish Debian
  • Unscored —
    CVE-2014-0839

    IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allows remote authenticated users to mod…

  • Unscored —
    CVE-2014-0853

    Multiple cross-site scripting (XSS) vulnerabilities in the (1) ForwardController and (2) AttributeEditor scripts in IBM…

  • Unscored —
    CVE-2014-0842

    The account-creation functionality in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 pl…

  • Unscored —
    CVE-2014-0840

    Multiple cross-site scripting (XSS) vulnerabilities in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.…

  • Unscored —
    CVE-2014-0843

    Cross-site scripting (XSS) vulnerability in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.…

  • Unscored —
    CVE-2013-6047

    Multiple cross-site scripting (XSS) vulnerabilities in the site creation interface in ikiwiki-hosting before 0.20131025…

    ikiwiki-hosting Debian
  • Unscored —
    CVE-2013-6661

    Multiple unspecified vulnerabilities in Google Chrome before 33.0.1750.117 allow attackers to bypass the sandbox protec…

  • Unscored —
    CVE-2013-6654

    The SVGAnimateElement::calculateAnimatedValue function in core/svg/SVGAnimateElement.cpp in Blink, as used in Google Ch…

  • Unscored —
    CVE-2013-6202

    Multiple cross-site request forgery (CSRF) vulnerabilities in HP Service Manager 9.30, 9.31, 9.32, and 9.33 allow remot…

  • Unscored —
    CVE-2013-6660

    The drag-and-drop implementation in Google Chrome before 33.0.1750.117 does not properly restrict the information in We…

  • Unscored —
    CVE-2013-6657

    core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 33.0.1750.117, inserts the…

  • Unscored —
    CVE-2013-6653

    Use-after-free vulnerability in the web contents implementation in Google Chrome before 33.0.1750.117 allows remote att…

  • Unscored —
    CVE-2013-6658

    Multiple use-after-free vulnerabilities in the layout implementation in Blink, as used in Google Chrome before 33.0.175…

  • Unscored —
    CVE-2013-6652

    Directory traversal vulnerability in sandbox/win/src/named_pipe_dispatcher.cc in Google Chrome before 33.0.1750.117 on …

  • Unscored —
    CVE-2013-6659

    The SSLClientSocketNSS::Core::OwnAuthCertHandler function in net/socket/ssl_client_socket_nss.cc in Google Chrome befor…

  • Unscored —
    CVE-2013-6655

    Use-after-free vulnerability in Blink, as used in Google Chrome before 33.0.1750.117, allows remote attackers to cause …

  • Unscored —
    CVE-2013-6656

    The XSSAuditor::init function in core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome …

  • Unscored —
    CVE-2013-2817 Public exploit

    An ActiveX control in IcoLaunch.dll in Mitsubishi Electric Automation MC-WorX Suite 8.02 allows user-assisted remote at…

  • Critical 9.3
    CVE-2014-0758

    ICONICS GENESIS32 Exposed Dangerous Method or Function

    An ActiveX control in GenLaunch.htm in ICONICS GENESIS32 8.0, 8.02, 8.04, and 8.05 allows remote attackers to execute arbitrary programs via a crafted HTML document.

    ICONICS GENESIS32
  • Unscored —
    CVE-2014-1966

    The SNMP implementation in Siemens RuggedCom ROS before 3.11, ROS 3.11 for RS950G, ROS 3.12 before 3.12.4, and ROS 4.0 …

  • Unscored —
    CVE-2013-6951

    The Belkin WeMo Home Automation firmware before 3949 does not maintain a set of Certification Authority public keys, wh…

  • Unscored —
    CVE-2013-6949

    The Belkin WeMo Home Automation firmware before 3949 does not properly use the STUN and TURN protocols, which allows re…

  • Unscored —
    CVE-2013-6952

    The Belkin WeMo Home Automation firmware before 3949 has a hardcoded GPG key, which makes it easier for remote attacker…

  • Unscored —
    CVE-2013-6948

    The peerAddresses API in the Belkin WeMo Home Automation firmware before 3949 allows remote attackers to read arbitrary…

  • Unscored —
    CVE-2013-6732

    Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6,…

  • Unscored —
    CVE-2013-6734

    IBM WebSphere eXtreme Scale Client 7.1 through 8.6.0.4 does not properly isolate the cached data of different users, wh…

  • Unscored —
    CVE-2013-6950

    The Belkin WeMo Home Automation firmware before 3949 does not use SSL for the distribution feed, which allows man-in-th…

  • Unscored —
    CVE-2014-0854

    The server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 …