Archive
April 2014
Vulnerabilities first published in this month (UTC), newest first.
73 results · Clear filters · Feed
-
Unscored —CVE-2011-4089 Public exploit
The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle temporary fil…
-
Unscored —
Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7.0 allows remote…
-
Unscored —CVE-2014-2399 Public exploit
Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 2.2.2 allows remote attacke…
-
Unscored —
The Adobe Reader Mobile application before 11.2 for Android does not properly restrict use of JavaScript, which allows …
-
Unscored —CVE-2013-7368 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Gnew 2013.1 allow remote attackers to inject arbitrary web scrip…
-
Unscored —CVE-2014-0358 Public exploit
Multiple directory traversal vulnerabilities in Xangati XSR before 11 and XNR before 7 allow remote attackers to read a…
-
Unscored —CVE-2014-2851 Public exploit
Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local user…
-
Critical 10.0
WellinTech KingSCADA Stack-based Buffer Overflow
Stack-based buffer overflow in WellinTech KingSCADA before 3.1.2.13 allows remote attackers to execute arbitrary code via a crafted packet.
-
High 7.5
Advantech WebAccess SQL Injection
An attacker using SQL injection may use arguments to construct queries without proper sanitization. The DBVisitor.dll is exposed through SOAP interfaces, and the exposed functions are vulnerable to SOAP injection. This may allow unexpected SQL action and acce…
-
Unscored —
The Change Password dialog box (change_password) in Sophos Web Appliance before 3.8.2 allows remote authenticated users…
-
Unscored —CVE-2014-2847 Public exploit
SQL injection vulnerability in default.asp in CIS Manager CMS allows remote attackers to execute arbitrary SQL commands…
-
Unscored —
The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrato…
-
Unscored —CVE-2014-2540 Public exploit
SQL injection vulnerability in OrbitScripts Orbit Open Ad Server before 1.1.1 allows remote attackers to execute arbitr…
-
Unscored —
Cisco Adaptive Security Appliance (ASA) Software 8.x before 8.2(5.48), 8.3 before 8.3(2.40), 8.4 before 8.4(7.9), 8.6 b…
-
Unscored —CVE-2014-0166 Public exploit
The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does…
-
Unscored —CVE-2011-4958 Public exploit
Cross-site scripting (XSS) vulnerability in the process function in SSViewer.php in SilverStripe before 2.3.13 and 2.4.…
-
Unscored —CVE-2011-5278 Public exploit
SQL injection vulnerability in signature.php in Advanced Forum Signatures plugin (aka afsignatures) 2.0.4 for MyBB allo…
-
Unscored —CVE-2011-5277 Public exploit
Multiple SQL injection vulnerabilities in signature.php in the Advanced Forum Signatures (aka afsignatures) plugin 2.0.…
-
Unscored —CVE-2012-6644 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in ClipBucket 2.6 allow remote attackers to inject arbitrary web sc…
-
Unscored —CVE-2012-6643 Public exploit
Multiple SQL injection vulnerabilities in the update_counter function in includes/functions.php in ClipBucket 2.6 allow…
-
Unscored —CVE-2012-2095 Public exploit
The SetWiredProperty function in the D-Bus interface in WICD before 1.7.2 allows local users to write arbitrary configu…
-
High 7.5
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension pack…
KEV May 4, 2022 -
Unscored —CVE-2013-5680 Public exploit
Heap-based buffer overflow in hfaxd in HylaFAX+ 5.2.4 through 5.5.3, when using LDAP authentication, might allow remote…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in views/notify.php in the Uploader plugin 1.0.4 for WordPress allo…
-
Unscored —
Buffer overflow in the PrepareSync method in the SyncService.dll ActiveX control in Samsung Kies before 2.5.1.12123_2_7…
-
Unscored —CVE-2014-2340 Public exploit
Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attacker…
-
Unscored —CVE-2013-2945 Public exploit
SQL injection vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote authenticated administrators t…
-
Unscored —CVE-2013-4240 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress a…
-
Unscored —CVE-2013-3213 Public exploit
Multiple SQL injection vulnerabilities in vTiger CRM 5.0.0 through 5.4.0 allow remote attackers to execute arbitrary SQ…
-
Unscored —
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to …
-
Unscored —CVE-2013-7349 Public exploit
Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the …
-
Unscored —CVE-2013-5640 Public exploit
Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the …
-
Unscored —CVE-2009-5141 Public exploit
Format string vulnerability in War FTP Daemon (warftpd) 1.82 RC 12 allows remote authenticated users to cause a denial …