Archive
April 2014
Vulnerabilities first published in this month (UTC), newest first.
665 results · Feed
-
Unscored —
Tools/gdomap.c in gdomap in GNUstep Base 1.24.6 and earlier, when run in daemon mode, does not properly handle the file…
-
Unscored —CVE-2014-2846 Public exploit
Directory traversal vulnerability in opt/arkeia/wui/htdocs/index.php in the WD Arkeia virtual appliance (AVA) with firm…
-
Medium —
DOMPDF Arbitrary File Read
dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=…
-
Unscored —
OpenJPEG 1.5.1 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-base…
-
Unscored —
The perl_trapd_handler function in perl/TrapReceiver/TrapReceiver.xs in Net-SNMP 5.7.3.pre3 and earlier, when using cer…
-
Unscored —
Directory traversal vulnerability in device-linux.c in the router advertisement daemon (radvd) before 1.8.2 allows loca…
-
Unscored —
The router advertisement daemon (radvd) before 1.8.2 does not properly handle errors in the privsep_init function, whic…
-
Unscored —
Race condition in pigz before 2.2.5 uses permissions derived from the umask when compressing a file before setting that…
-
Unscored —
DistUpgrade/DistUpgradeFetcherCore.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x be…
-
Unscored —
OpenJPEG 1.5.1 allows remote attackers to cause a denial of service via unspecified vectors that trigger NULL pointer d…
-
Medium —
OpenStack Image Registry and Delivery Service (Glance) Improper Input Validation vulnerability
The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote authenticated users with permission to insert or modify an image to execute arbitrary commands via a crafted l…
-
Critical 9.8CVE-2014-3007 EPSS 10%
Pillow command injection
Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.
-
Unscored —
The undo save quit routine in the kernel in Blender 2.5, 2.63a, and earlier allows local users to overwrite arbitrary f…
-
Unscored —
Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code and bypass a sandbox protect…
-
Unscored —CVE-2014-1763 EPSS 23%
Use-after-free vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary c…
-
Unscored —CVE-2014-1765 EPSS 16%
Multiple use-after-free vulnerabilities in Microsoft Internet Explorer 6 through 11 allow remote attackers to execute a…
-
Critical 9.8
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary c…
KEV Jan 28, 2022 -
Unscored —
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service…
-
Unscored —
Unspecified vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code…
-
Unscored —
Stack-based buffer overflow in Acunetix Web Vulnerability Scanner (WVS) 8 build 20120704 allows remote attackers to exe…
-
Unscored —
The Netlink implementation in the Linux kernel through 3.14.1 does not provide a mechanism for authorizing socket opera…
-
Unscored —
Off-by-one error in the bpf_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 3.1.8, when …
-
Unscored —
Google V8, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does no…
-
Unscored —
core/html/HTMLSelectElement.cpp in the DOM implementation in Blink, as used in Google Chrome before 34.0.1847.131 on Wi…
-
Unscored —
Multiple unspecified vulnerabilities in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132…
-
Unscored —
Multiple unspecified vulnerabilities in Google V8 before 3.24.35.33, as used in Google Chrome before 34.0.1847.131 on W…
-
Unscored —
The PointerCompare function in codegen.cc in Seccomp-BPF, as used in Google Chrome before 34.0.1847.131 on Windows and …
-
Unscored —
Use-after-free vulnerability in browser/ui/views/speech_recognition_bubble_views.cc in Google Chrome before 34.0.1847.1…
-
Unscored —
The Poco::Net::X509Certificate::verify method in the NetSSL library in POCO C++ Libraries before 1.4.6p4 allows man-in-…
-
Unscored —
The Misli.com application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-midd…
-
Unscored —
The Birebin.com application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-mi…
-
Unscored —CVE-2014-2996 Public exploit
XCloner Standalone 3.5 and earlier, when enable_db_backup and sql_mem are enabled, allows remote authenticated administ…
-
Unscored —CVE-2014-2579 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers…
-
Unscored —
Open redirect vulnerability in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Admin/login/default.asp in DDSN Interactive cm3 Acora CMS 6.0.6/…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/…
-
Unscored —
Heap-based buffer overflow in the __OLEdecode function in ppthtml 0.5.1 and earlier allows remote attackers to cause a …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in NETGEAR WNDR4700 with firmware 1.0.0.34 allow remote authenticat…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Ushahidi Platform 2.5.x through 2.6.1 allows remote attackers to inject arb…
-
Unscored —
Buffer overflow in Power Software WinArchiver 3.2 allows remote attackers to execute arbitrary code via a crafted .zip …