Skip to content
OpenAdvisories

Archive

April 2014

Vulnerabilities first published in this month (UTC), newest first.

← March 2014 2014 / April May 2014 →
  1. 123
  2. 233
  3. 33
  4. 415
  5. 511
  6. 62
  7. 74
  8. 824
  9. 917
  10. 1037
  11. 1126
  12. 1220
  13. 13 
  14. 1415
  15. 1569
  16. 1697
  17. 1720
  18. 1818
  19. 1915
  20. 202
  21. 2116
  22. 2214
  23. 2346
  24. 249
  25. 2518
  26. 269
  27. 2719
  28. 2814
  29. 2932
  30. 3037
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High —
    CVE-2014-0114 Public exploit EPSS 99%

    Arbitrary code execution in Apache Commons BeanUtils

    Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate…

    commons-beanutils:commons-beanutils commons-beanutils commons-beanutils Debian Ubuntu Maven
  • High —
    CVE-2014-0113 Public exploit EPSS 78%

    ClassLoader manipulation in Apache Struts

    CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted reque…

    org.apache.struts:struts2-core Maven
  • High —
    CVE-2014-0112 Public exploit EPSS 98%

    ClassLoader manipulation in Apache Struts

    ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists beca…

    org.apache.struts:struts2-core Maven
  • High —
    CVE-2014-2921 Public exploit

    Pimcore Vulnerable to PHP Object Injection Attacks

    The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection…

    pimcore/pimcore Packagist
  • High —
    CVE-2014-1216 Public exploit

    Improper Neutralization of Special Elements used in a Command in FitNesse Wiki

    FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and TEST_RUNNER in the pageContent parameter when editing a page.

    org.fitnesse:fitnesse Maven
  • High 7.5
    CVE-2014-0763 Public exploit EPSS 16%

    Advantech WebAccess SQL Injection

    An attacker using SQL injection may use arguments to construct queries without proper sanitization. The DBVisitor.dll is exposed through SOAP interfaces, and the exposed functions are vulnerable to SOAP injection. This may allow unexpected SQL action and acce…

    Advantech WebAccess
  • High 7.5
    CVE-2014-0160 Exploited Public exploit EPSS 100%

    The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension pack…

    openssl Debian
    KEV May 4, 2022