Archive
April 2014
Vulnerabilities first published in this month (UTC), newest first.
73 results · Clear filters · Feed
-
Unscored —CVE-2013-1807 Public exploit
PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web doc…
-
Unscored —CVE-2013-1806 Public exploit
Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include a…
-
High —
Arbitrary code execution in Apache Commons BeanUtils
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate…
-
Unscored —CVE-2013-1804 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbit…
-
High —
ClassLoader manipulation in Apache Struts
CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted reque…
-
Unscored —
Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS…
-
High —
ClassLoader manipulation in Apache Struts
ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists beca…
-
Unscored —
Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attack…
-
Unscored —
Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attack…
-
Unscored —
Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attack…
-
Unscored —CVE-2014-3008 Public exploit
Unitrends Enterprise Backup 7.3.0 allows remote authenticated users to execute arbitrary commands via shell metacharact…
-
Unscored —CVE-2014-2846 Public exploit
Directory traversal vulnerability in opt/arkeia/wui/htdocs/index.php in the WD Arkeia virtual appliance (AVA) with firm…
-
Medium —
DOMPDF Arbitrary File Read
dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=…
-
Unscored —
Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code and bypass a sandbox protect…
-
Unscored —
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service…
-
Unscored —
Unspecified vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code…
-
Unscored —
Stack-based buffer overflow in Acunetix Web Vulnerability Scanner (WVS) 8 build 20120704 allows remote attackers to exe…
-
Unscored —CVE-2014-2996 Public exploit
XCloner Standalone 3.5 and earlier, when enable_db_backup and sql_mem are enabled, allows remote authenticated administ…
-
Unscored —CVE-2014-2579 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers…
-
Unscored —
Buffer overflow in Power Software WinArchiver 3.2 allows remote attackers to execute arbitrary code via a crafted .zip …
-
Unscored —CVE-2013-5954 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack…
-
Critical 9.8
InduSoft Web Studio Path Traversal
Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.
KEV Apr 15, 2022 -
Unscored —
Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.…
-
Unscored —CVE-2014-2734 Public exploit
The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, whic…
-
Critical 9.8CVE-2014-0472 Public exploit
Code Injection in Django
The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using u…
-
Unscored —CVE-2014-2976 Public exploit
Directory traversal vulnerability in Sixnet SixView Manager 2.4.1 allows remote attackers to read arbitrary files via a…
-
Unscored —CVE-2014-1322 Public exploit
The kernel in Apple OS X through 10.9.2 places a kernel pointer into an XNU object data structure accessible from user …
-
Unscored —CVE-2014-2922 Public exploit
The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.1.0 do…
-
High —CVE-2014-2921 Public exploit
Pimcore Vulnerable to PHP Object Injection Attacks
The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection…
-
Unscored —CVE-2013-5948 Public exploit
The Network Analysis tab (Main_Analysis_Content.asp) in the ASUS RT-AC68U and other RT series routers with firmware bef…
-
High —CVE-2014-1216 Public exploit
Improper Neutralization of Special Elements used in a Command in FitNesse Wiki
FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and TEST_RUNNER in the pageContent parameter when editing a page.
-
Unscored —CVE-2014-2341 Public exploit
Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web sessions via the PHPSESSI…
-
Unscored —CVE-2014-1990 Public exploit
Cross-site request forgery (CSRF) vulnerability in TopAccess (aka the web-based management utility) on TOSHIBA TEC e-St…
-
Unscored —CVE-2013-7196 Public exploit
static/ajax.php in PHPFox 3.7.3, 3.7.4, and 3.7.5 allows remote authenticated users to bypass intended "Only Me" restri…
-
Unscored —
The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the updat…
-
Unscored —CVE-2014-0984 Public exploit
The passwordCheck function in SAP Router 721 patch 117, 720 patch 411, 710 patch 029, and earlier terminates validation…
-
Unscored —CVE-2014-2880 Public exploit
Open redirect vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11…
-
Unscored —CVE-2014-2879 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Dell SonicWALL Email Security 7.4.5 and earlier allow remote aut…
-
Unscored —
EMC Cloud Tiering Appliance (CTA) 10 through SP1 allows remote attackers to read arbitrary files via an api/login reque…
-
Unscored —
Stack-based buffer overflow in gen_jumpex.dll in Winamp before 5.64 Build 3418 allows remote attackers to cause a denia…