Skip to content
OpenAdvisories

Archive

29 April 2014

Vulnerabilities first published on this day (UTC), newest first.

← March 2014 2014 / April /29 May 2014 →
  1. 123
  2. 233
  3. 33
  4. 415
  5. 511
  6. 62
  7. 74
  8. 824
  9. 917
  10. 1037
  11. 1126
  12. 1220
  13. 13 
  14. 1415
  15. 1569
  16. 1697
  17. 1720
  18. 1818
  19. 1915
  20. 202
  21. 2116
  22. 2214
  23. 2346
  24. 249
  25. 2518
  26. 269
  27. 2719
  28. 2814
  29. 2932
  30. 3037
All Critical High Medium Low Exploited only Public exploit

32 results · Feed

  • Unscored —
    CVE-2013-7373

    Android before 4.4 does not properly arrange for seeding of the OpenSSL PRNG, which makes it easier for attackers to de…

  • Unscored —
    CVE-2013-7372

    The engineNextBytes function in classlib/modules/security/src/main/java/common/org/apache/harmony/security/provider/cry…

  • Unscored —
    CVE-2013-1804 Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbit…

  • Medium —
    CVE-2014-2853

    Cross-site scripting vulnerability in includes/actions/InfoAction.php

    Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action.

    mediawiki/core Packagist
  • Unscored —
    CVE-2013-7068

    The Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users to bypass group rest…

  • High —
    CVE-2013-7259

    Neo4J vulnerable to Cross-Site Request Forgery

    Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/exe…

    org.neo4j:neo4j Maven
  • Unscored —
    CVE-2013-7234

    Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to conduct clickjacking attacks …

  • Unscored —
    CVE-2013-7063

    The Invitation module 7.x-2.x for Drupal does not properly check permissions, which allows remote attackers to obtain s…

  • Unscored —
    CVE-2013-7236

    Simple Machines Forum (SMF) 2.0.6, 1.1.19, and earlier allows remote attackers to impersonate arbitrary users via a Uni…

  • Unscored —
    CVE-2013-7064

    Cross-site scripting (XSS) vulnerability in the EU Cookie Compliance module 7.x-1.x before 7.x-1.12 for Drupal allows r…

  • Unscored —
    CVE-2013-7065

    The Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal allows remote attackers to bypass access restrictions …

  • Unscored —
    CVE-2013-7221

    The automatic screen lock functionality in GNOME Shell (aka gnome-shell) before 3.10 does not prevent access to the "En…

    gnome-shell Debian
  • Unscored —
    CVE-2013-7284

    The PlRPC module, possibly 0.2020 and earlier, for Perl uses the Storable module, which allows remote attackers to exec…

  • Unscored —
    CVE-2013-7066

    The Entity reference module 7.x-1.x before 7.x-1.1-rc1 for Drupal allows remote attackers to read private nodes titles …

  • Medium —
    CVE-2013-7111

    Exposure of Sensitive Information in bio-basespace-sdk

    The put_call function in the API client (api/api_client.rb) in the BaseSpace Ruby SDK (aka bio-basespace-sdk) gem 0.1.7 for Ruby uses the API_KEY on the command line, which allows remote attackers to obtain sensitive information by listing the processes.

    bio-basespace-sdk RubyGems
  • Unscored —
    CVE-2013-7273

    GNOME Display Manager (gdm) 3.4.1 and earlier, when disable-user-list is set to true, allows local users to cause a den…

    gdm3 Debian
  • Unscored —
    CVE-2013-7134

    Juvia uses the same secret key for all installations, which allows remote attackers to have unspecified impact by lever…

  • Unscored —
    CVE-2013-7235

    Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to impersonate arbitrary users v…

  • Unscored —
    CVE-2013-7302

    Session fixation vulnerability in the Ubercart module 6.x-2.x before 6.x-2.13 and 7.x-3.x before 7.x-3.6 for Drupal, wh…

  • Unscored —
    CVE-2013-7220

    js/ui/screenShield.js in GNOME Shell (aka gnome-shell) before 3.8 allows physically proximate attackers to execute arbi…

    gnome-shell Debian
  • Unscored —
    CVE-2014-0088

    The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11, when running on a 32-bit plat…

  • High —
    CVE-2014-0113 Public exploit EPSS 78%

    ClassLoader manipulation in Apache Struts

    CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted reque…

    org.apache.struts:struts2-core Maven
  • Unscored —
    CVE-2014-0515 Public exploit EPSS 94%

    Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS…

  • High —
    CVE-2014-0112 Public exploit EPSS 98%

    ClassLoader manipulation in Apache Struts

    ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists beca…

    org.apache.struts:struts2-core Maven
  • Unscored —
    CVE-2014-1841 Public exploit Scanner template

    Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attack…

  • Unscored —
    CVE-2014-1842 Public exploit Scanner template

    Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attack…

  • Unscored —
    CVE-2014-1843 Public exploit Scanner template

    Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attack…

  • Unscored —
    CVE-2014-2180

    The Document Management component in Cisco Unified Contact Center Express does not properly validate a parameter, which…

  • Unscored —
    CVE-2014-2182

    Cisco Adaptive Security Appliance (ASA) Software, when DHCPv6 replay is configured, allows remote attackers to cause a …

  • Unscored —
    CVE-2014-2184

    The IP Manager Assistant (IPMA) component in Cisco Unified Communications Manager (Unified CM) allows remote attackers …

  • Unscored —
    CVE-2014-2185

    The Call Detail Records (CDR) Management component in Cisco Unified Communications Manager (Unified CM) allows remote a…

  • Unscored —
    CVE-2014-2183

    The L2TP module in Cisco IOS XE 3.10S(.2) and earlier on ASR 1000 routers allows remote authenticated users to cause a …