Skip to content
OpenAdvisories

Archive

17 April 2014

Vulnerabilities first published on this day (UTC), newest first.

← March 2014 2014 / April /17 May 2014 →
  1. 123
  2. 233
  3. 33
  4. 415
  5. 511
  6. 62
  7. 74
  8. 824
  9. 917
  10. 1037
  11. 1126
  12. 1220
  13. 13 
  14. 1415
  15. 1569
  16. 1697
  17. 1720
  18. 1818
  19. 1915
  20. 202
  21. 2116
  22. 2214
  23. 2346
  24. 249
  25. 2518
  26. 269
  27. 2719
  28. 2814
  29. 2932
  30. 3037
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium —
    CVE-2014-0036

    rbovirt uses the rest-client gem with SSL verification disabled

    The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.

    rbovirt RubyGems
  • Medium —
    CVE-2014-0054 EPSS 91%

    Cross-Site Request Forgery in Spring Framework

    The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF atta…

    libspring-java org.springframework:spring-webmvc Debian Maven
  • Medium —
    CVE-2014-0111

    Apache Syncope JEXL Code Injection

    Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource m…

    org.apache.syncope:syncope Maven
  • Medium 4.0
    CVE-2014-1933

    Pillow Temporary file name leakage

    The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by lis…

    pillow pillow Debian PyPI