Archive
February 2014
Vulnerabilities first published in this month (UTC), newest first.
442 results · Feed
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Command School Student Management System 1.06.01 allow remote at…
-
Unscored —
Siemens SIMATIC WinCC OA before 3.12 P002 January uses a weak hash algorithm for passwords, which makes it easier for r…
-
Unscored —
The Web Email Protection component in Symantec Encryption Management Server (aka PGP Universal Server) before 3.3.2 all…
-
Unscored —
The integrated web server in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to execute arbit…
-
Unscored —
Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to cause a denial of service (monitoring-serv…
-
Unscored —
Directory traversal vulnerability in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to read …
-
Unscored —
Unrestricted file upload vulnerability in IBM Algo One UDS 4.7.0 through 5.0.0 allows remote authenticated users to exe…
-
Unscored —
Buffer overflow in the Launcher in IBM WebSphere Transformation Extender 8.4.x before 8.4.0.4 allows local users to cau…
-
Unscored —
Cross-site scripting (XSS) vulnerability in adminui/user_list.php on the Dell KACE K1000 management appliance 5.5.90545…
-
Unscored —
The IMAP server in IBM Domino 8.5.x before 8.5.3 FP6 IF1 and 9.0.x before 9.0.1 FP1 allows remote attackers to cause a …
-
Unscored —
Opera before 19 on Mac OS X allows user-assisted remote attackers to spoof the address bar via vectors involving a drag…
-
Critical —
Heap Based Buffer Overflow in libyaml
The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted tags in a YAML document, whic…
-
Unscored —
The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, all…
-
Unscored —
The intent: URL implementation in Opera before 18 on Android allows attackers to read local files by leveraging an inte…
-
Unscored —
The web service in EMC Documentum Foundation Services (DFS) 6.5 through 6.7 before 6.7 SP1 P22, 6.7 SP2 before P08, 7.0…
-
High 7.5
OpenStack Nova Live migration can leak root disk into ephemeral storage
The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obt…
-
Unscored —
Integer signedness error in the MXit functionality in Pidgin before 2.10.8 allows remote attackers to cause a denial of…
-
Unscored —
Pidgin before 2.10.8 allows remote MSN servers to cause a denial of service (NULL pointer dereference and crash) via a …
-
Unscored —
The SIMPLE protocol functionality in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a n…
-
Unscored —
Integer overflow in libpurple/protocols/gg/lib/http.c in the Gadu-Gadu (gg) parser in Pidgin before 2.10.8 allows remot…
-
Unscored —
libpurple/protocols/yahoo/libymsg.c in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (crash…
-
Unscored —
The NMEA0183 driver in gpsd before 3.9 allows remote attackers to cause a denial of service (daemon termination) and po…
-
Unscored —
osc before 0.134 might allow remote OBS repository servers or package maintainers to execute arbitrary commands via a c…
-
Unscored —
Unspecified vulnerability in Citrix XenMobile Device Manager server (formerly Zenprise Device Manager server) 8.5, 8.6,…
-
High 7.2
cpio, as used in build 2007.05.10, 2010.07.28, and possibly other versions, allows remote attackers to overwrite arbitr…
-
Unscored —
Cross-site scripting (XSS) vulnerability in D-Link DAP-2253 Access Point (Rev. A1) with firmware before 1.30 allows rem…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in D-Link DAP-2253 Access Point (Rev. A1) with firmware before 1.30 all…
-
Unscored —CVE-2013-7319 Public exploit
Cross-site scripting (XSS) vulnerability in the Download Manager plugin before 2.5.9 for WordPress allows remote attack…
-
Unscored —
util.c in libpurple in Pidgin before 2.10.8 does not properly allocate memory for HTTP responses that are inconsistent …
-
Unscored —
Buffer overflow in util.c in libpurple in Pidgin before 2.10.8 allows remote HTTP servers to cause a denial of service …
-
Unscored —
The XMPP protocol plugin in libpurple in Pidgin before 2.10.8 does not properly determine whether the from address in a…
-
Unscored —
gtkimhtml.c in Pidgin before 2.10.8 does not properly interact with underlying library support for wide Pango layouts, …
-
Unscored —
gtkutils.c in Pidgin before 2.10.8 on Windows allows user-assisted remote attackers to execute arbitrary programs via a…
-
Unscored —
Multiple integer signedness errors in libpurple in Pidgin before 2.10.8 allow remote attackers to cause a denial of ser…
-
Unscored —
The STUN protocol implementation in libpurple in Pidgin before 2.10.8 allows remote STUN servers to cause a denial of s…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in GuppY before 4.6.28 allow remote attackers to inject arbitrary w…
-
Unscored —
The Yahoo! protocol plugin in libpurple in Pidgin before 2.10.8 does not properly validate UTF-8 data, which allows rem…
-
Unscored —
The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts, which allows remote IRC…
-
Low —
OpenStack Nova denial of service through compressed disk images
OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) via a compressed QCOW2 image. NOTE: this issue is due to…
-
Unscored —
The file-download implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 does not properly restrict th…