Skip to content
OpenAdvisories

Archive

April 2014

Vulnerabilities first published in this month (UTC), newest first.

← March 2014 2014 / April May 2014 →
  1. 123
  2. 233
  3. 33
  4. 415
  5. 511
  6. 62
  7. 74
  8. 824
  9. 917
  10. 1037
  11. 1126
  12. 1220
  13. 13 
  14. 1415
  15. 1569
  16. 1697
  17. 1720
  18. 1818
  19. 1915
  20. 202
  21. 2116
  22. 2214
  23. 2346
  24. 249
  25. 2518
  26. 269
  27. 2719
  28. 2814
  29. 2932
  30. 3037
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.8
    CVE-2014-3007 EPSS 10%

    Pillow command injection

    Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.

    pillow pillow pillow Debian Ubuntu PyPI
  • Critical 9.8
    CVE-2014-1776 Exploited EPSS 83%

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary c…

    KEV Jan 28, 2022
  • Critical 9.3
    CVE-2014-0769

    Festo CECX-X-(C1/M1) Controller Improper Authentication

    The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to (1) modify the configuration via a req…

    Festo CECX-X-M1 Modular Controller with CoDeSys and SoftMotion CECX-X-C1 Modular Master Controller with CoDeSys
  • Critical 9.8
    CVE-2014-0780 Exploited Public exploit EPSS 75%

    InduSoft Web Studio Path Traversal

    Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.

    InduSoft Web Studio
    KEV Apr 15, 2022
  • Critical 9.3
    CVE-2014-0760

    Festo CECX-X-(C1/M1) Controller Improper Authentication

    The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion provide an undocumented access method involving the FTP protocol, which could allow a remote attacker to execute arbitrary code or cause a …

    Festo CECX-X-C1 Modular Master Controller with CoDeSys CECX-X-M1 Modular Controller with CoDeSys and SoftMotion
  • Critical 9.8
    CVE-2014-0472 Public exploit

    Code Injection in Django

    The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using u…

    python-django django python-django Debian Ubuntu PyPI
  • Critical 9.8
    CVE-2014-0474

    Django Vulnerable to MySQL Injection

    The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to…

    python-django django python-django Debian Ubuntu PyPI
  • Critical 10.0
    CVE-2014-0787 Public exploit EPSS 14%

    WellinTech KingSCADA Stack-based Buffer Overflow

    Stack-based buffer overflow in WellinTech KingSCADA before 3.1.2.13 allows remote attackers to execute arbitrary code via a crafted packet.

    WellinTech KingSCADA