Skip to content
OpenAdvisories

Archive

11 April 2014

Vulnerabilities first published on this day (UTC), newest first.

← March 2014 2014 / April /11 May 2014 →
  1. 123
  2. 233
  3. 33
  4. 415
  5. 511
  6. 62
  7. 74
  8. 824
  9. 917
  10. 1037
  11. 1126
  12. 1220
  13. 13 
  14. 1415
  15. 1569
  16. 1697
  17. 1720
  18. 1818
  19. 1915
  20. 202
  21. 2116
  22. 2214
  23. 2346
  24. 249
  25. 2518
  26. 269
  27. 2719
  28. 2814
  29. 2932
  30. 3037
All Critical High Medium Low Exploited only Public exploit

26 results · Feed

  • Unscored —
    CVE-2014-0636

    EMC RSA BSAFE Micro Edition Suite (MES) 3.2.x before 3.2.6 and 4.0.x before 4.0.5 does not properly validate X.509 cert…

  • Unscored —
    CVE-2014-1210

    VMware vSphere Client 5.0 before Update 3 and 5.1 before Update 2 does not properly validate X.509 certificates, which …

  • Unscored —
    CVE-2014-1209

    VMware vSphere Client 4.0, 4.1, 5.0 before Update 3, and 5.1 before Update 2 does not properly validate updates to Clie…

  • High 8.3
    CVE-2014-0777

    OServer Out of Bounds Read

    The Modbus slave/outstation driver in the OPC Drivers 1.0.20 and earlier in IOServer OPC Server allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted packet.

    IOServer OPC Drivers
  • Unscored —
    CVE-2014-1969

    Directory traversal vulnerability in the apps4u@android SD Card Manager application before 20140224 for Android allows …

  • Medium —
    CVE-2012-6130

    Roundup Cross-site Scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link.

    roundup PyPI
  • Medium —
    CVE-2012-6131

    Roundup Cross-site scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1.

    roundup PyPI
  • Unscored —
    CVE-2014-0172

    Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used in elfutils 0.153 and…

    elfutils elfutils Debian Ubuntu
  • Unscored —
    CVE-2014-2849 Public exploit EPSS 61%

    The Change Password dialog box (change_password) in Sophos Web Appliance before 3.8.2 allows remote authenticated users…

  • Unscored —
    CVE-2014-2847 Public exploit

    SQL injection vulnerability in default.asp in CIS Manager CMS allows remote attackers to execute arbitrary SQL commands…

  • Unscored —
    CVE-2014-2850 Public exploit EPSS 58%

    The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrato…

  • Unscored —
    CVE-2014-2848

    A race condition in the wmi_malware_scan.nbin plugin before 201402262215 for Nessus 5.2.1 allows local users to gain pr…

  • Unscored —
    CVE-2013-4795

    Cross-site scripting (XSS) vulnerability in the Submitters list in Review Board 1.6.x before 1.6.18 and 1.7.x before 1.…

  • Unscored —
    CVE-2013-6369

    Stack-based buffer overflow in the jbg_dec_in function in libjbig/jbig.c in JBIG-KIT before 2.1 allows remote attackers…

    jbigkit jbigkit Debian Ubuntu
  • Unscored —
    CVE-2013-2706

    Cross-site request forgery (CSRF) vulnerability in the Stream Video Player plugin 1.4.0 for WordPress allows remote att…

  • Unscored —
    CVE-2013-2708

    Cross-site request forgery (CSRF) vulnerability in the Content Slide plugin 1.4.2 for WordPress allows remote attackers…

  • Unscored —
    CVE-2014-1985

    Open redirect vulnerability in the redirect_back_or_default function in app/controllers/application_controller.rb in Re…

    redmine Debian
  • Unscored —
    CVE-2014-2540 Public exploit

    SQL injection vulnerability in OrbitScripts Orbit Open Ad Server before 1.1.1 allows remote attackers to execute arbitr…

  • Unscored —
    CVE-2014-2333

    Cross-site scripting (XSS) vulnerability in the Lazyest Gallery plugin before 1.1.21 for WordPress allows remote attack…

  • High —
    CVE-2014-2741

    Ignite Realtime Openfire vulnerable to XMPPbomb attack

    nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "x…

    org.igniterealtime.openfire:parent Maven
  • Unscored —
    CVE-2014-2742

    Isode M-Link before 16.0v7 does not properly restrict the processing of compressed XML elements, which allows remote at…

  • Unscored —
    CVE-2014-2743

    plugins/mod_compression.lua in Lightwitch Metronome through 3.4 does not properly restrict the processing of compressed…

  • Unscored —
    CVE-2014-2746

    net/IOService.java in Tigase before 5.2.1 does not properly restrict the processing of compressed XML elements, which a…

  • Unscored —
    CVE-2014-2744

    plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream comp…

    prosody lua-expat Debian
  • Unscored —
    CVE-2014-2745

    Prosody before 0.9.4 does not properly restrict the processing of compressed XML elements, which allows remote attacker…

    prosody Debian
  • High —
    CVE-2014-2829

    Erlang Solutions MongooseIM vulnerable to denial of service (DoS) via crafted XMPP stream

    Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.

    MongooseIM Hex