Archive
April 2014
Vulnerabilities first published in this month (UTC), newest first.
665 results · Feed
-
Unscored —CVE-2013-1807 Public exploit
PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web doc…
-
Unscored —CVE-2013-1806 Public exploit
Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include a…
-
Medium 5.4
Ajenti Cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via the command field in the Cron functionality.
-
Unscored —
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, uses the DES-based crypt function to hash pa…
-
Unscored —
FortiGuard FortiAuthenticator before 3.0 allows remote administrators to gain privileges via the command line interface.
-
Unscored —
super.c in Super 3.30.0 does not check the return value of the setuid function when the -F flag is set, which allows lo…
-
Unscored —
Directory traversal vulnerability in the unpacking functionality in dpkg before 1.15.9, 1.16.x before 1.16.13, and 1.17…
-
Unscored —
FortiGuard FortiWeb before 5.0.3 allows remote authenticated users to gain privileges via unspecified vectors.
-
Unscored —
CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary HTTP heade…
-
Unscored —
Cross-site scripting (XSS) vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrar…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the InfoView application in SAP BusinessObjects allows remote attackers to …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 5.1.1 Alpha 9 allow remote attackers to inject arbitra…
-
Unscored —
SAP Netweaver Java Application Server does not properly restrict access, which allows remote attackers to obtain the li…
-
Unscored —
SAP Background Processing does not properly restrict access, which allows remote authenticated users to obtain sensitiv…
-
Unscored —
The Java Server Pages in the Software Lifecycle Manager (SLM) in SAP NetWeaver allows remote attackers to obtain sensit…
-
Unscored —
SAP Profile Maintenance does not properly restrict access, which allows remote authenticated users to obtain sensitive …
-
Unscored —
The ABAP Help documentation and translation tools (BC-DOC-HLP) in Basis in SAP Netweaver ABAP Application Server does n…
-
Unscored —
The commandline interface in Blue Coat Content Analysis System (CAS) 1.1 before 1.1.4.2 allows remote administrators to…
-
Unscored —
The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of …
-
Unscored —
The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraint…
-
High —
Arbitrary code execution in Apache Commons BeanUtils
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate…
-
Unscored —
The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 29.…
-
Unscored —
The sse2_composite_src_x888_8888 function in Pixman, as used in Cairo in Mozilla Firefox 28.0 and SeaMonkey 2.25 on Win…
-
Unscored —
Heap-based buffer overflow in the read_u32 function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thund…
-
Unscored —
Mozilla Firefox before 29.0 on Android allows remote attackers to spoof the address bar via crafted JavaScript code tha…
-
Unscored —
The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunde…
-
Unscored —
The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and …
-
Unscored —
The Web Notification API in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and Sea…
-
Unscored —
The mozilla::dom::TextTrack::AddCue function in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 does not properly…
-
Unscored —
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 all…
-
Unscored —
Use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox before 29.…
-
Unscored —
The XrayWrapper implementation in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows user-assisted remote att…
-
Unscored —
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5…
-
Unscored —
maintenservice_installer.exe in the Maintenance Service Installer in Mozilla Firefox before 29.0 and Firefox ESR 24.x b…
-
Unscored —
Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox…
-
Unscored —
TIBCO Managed File Transfer Internet Server before 7.2.2, Managed File Transfer Command Center before 7.2.2, Slingshot …
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco WebEx Meetings Server allows remote attac…
-
Unscored —
Android before 4.4 does not properly arrange for seeding of the OpenSSL PRNG, which makes it easier for attackers to de…
-
Unscored —
The engineNextBytes function in classlib/modules/security/src/main/java/common/org/apache/harmony/security/provider/cry…
-
Unscored —CVE-2013-1804 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbit…