Skip to content
OpenAdvisories

Archive

April 2014

Vulnerabilities first published in this month (UTC), newest first.

← March 2014 2014 / April May 2014 →
  1. 123
  2. 233
  3. 33
  4. 415
  5. 511
  6. 62
  7. 74
  8. 824
  9. 917
  10. 1037
  11. 1126
  12. 1220
  13. 13 
  14. 1415
  15. 1569
  16. 1697
  17. 1720
  18. 1818
  19. 1915
  20. 202
  21. 2116
  22. 2214
  23. 2346
  24. 249
  25. 2518
  26. 269
  27. 2719
  28. 2814
  29. 2932
  30. 3037
All Critical High Medium Low Exploited only Public exploit

665 results · Feed

  • Unscored —
    CVE-2013-5956

    Cross-site scripting (XSS) vulnerability in includes/flvthumbnail.php in the Youtube Gallery (com_youtubegallery) compo…

  • Unscored —
    CVE-2013-5954 Public exploit

    Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack…

  • Unscored —
    CVE-2012-4230

    The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive…

    tinymce Ubuntu
  • Unscored —
    CVE-2014-2729

    Cross-site scripting (XSS) vulnerability in content.aspx in Ektron CMS 8.7 before 8.7.0.055 allows remote authenticated…

  • Critical 9.3
    CVE-2014-0769

    Festo CECX-X-(C1/M1) Controller Improper Authentication

    The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to (1) modify the configuration via a req…

    Festo CECX-X-C1 Modular Master Controller with CoDeSys CECX-X-M1 Modular Controller with CoDeSys and SoftMotion
  • Critical 9.8
    CVE-2014-0780 Exploited Public exploit EPSS 75%

    InduSoft Web Studio Path Traversal

    Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.

    InduSoft Web Studio
    KEV Apr 15, 2022
  • Critical 9.3
    CVE-2014-0760

    Festo CECX-X-(C1/M1) Controller Improper Authentication

    The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion provide an undocumented access method involving the FTP protocol, which could allow a remote attacker to execute arbitrary code or cause a …

    Festo CECX-X-M1 Modular Controller with CoDeSys and SoftMotion CECX-X-C1 Modular Master Controller with CoDeSys
  • Unscored —
    CVE-2014-2908 Public exploit Scanner template EPSS 21%

    Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.…

  • Unscored —
    CVE-2014-2909

    CRLF injection vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows rem…

  • Unscored —
    CVE-2014-2734 Public exploit

    The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, whic…

  • Unscored —
    CVE-2014-2601

    The server in HP Integrated Lights-Out 2 (aka iLO 2) 2.23 and earlier allows remote attackers to cause a denial of serv…

  • Unscored —
    CVE-2014-0188

    The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authenti…

  • Unscored —
    CVE-2014-2915

    Xen 4.4.x, when running on ARM systems, does not properly restrict access to hardware features, which allows local gues…

    xen Ubuntu
  • Unscored —
    CVE-2014-2736

    Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL…

  • Unscored —
    CVE-2013-6738

    Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-…

  • Unscored —
    CVE-2012-3946

    Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances b…

  • Unscored —
    CVE-2012-5723

    Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial…

  • Unscored —
    CVE-2014-2907

    The srtp_add_address function in epan/dissectors/packet-rtp.c in the RTP dissector in Wireshark 1.10.x before 1.10.7 do…

    wireshark wireshark Debian Ubuntu
  • Unscored —
    CVE-2011-5279 EPSS 20%

    CRLF injection vulnerability in the CGI implementation in Microsoft Internet Information Services (IIS) 4.x and 5.x on …

  • Unscored —
    CVE-2014-0892

    IBM Notes and Domino 8.5.x before 8.5.3 FP6 IF3 and 9.x before 9.0.1 FP1 on 32-bit Linux platforms use incorrect gcc op…

  • Unscored —
    CVE-2014-1646

    Symantec PGP Desktop 10.0.x through 10.2.x and Encryption Desktop Professional 10.3.x before 10.3.2 MP1 do not properly…

  • Unscored —
    CVE-2014-1647

    Symantec PGP Desktop 10.0.x through 10.2.x and Encryption Desktop Professional 10.3.x before 10.3.2 MP1 do not properly…

  • Critical 9.8
    CVE-2014-0472 Public exploit

    Code Injection in Django

    The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using u…

    python-django django python-django Debian Ubuntu PyPI
  • High 7.5
    CVE-2014-0473

    Django Reuses Cached CSRF Token

    The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anon…

    python-django django python-django Debian Ubuntu PyPI
  • Critical 9.8
    CVE-2014-0474

    Django Vulnerable to MySQL Injection

    The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to…

    python-django django python-django Debian Ubuntu PyPI
  • Unscored —
    CVE-2014-2328

    lib/graph_export.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote authenticated users to execute arbitrary comman…

    cacti Debian
  • High —
    CVE-2014-2888

    sfpagent Command Injection vulnerability

    lib/sfpagent/bsig.rb in the sfpagent gem before 0.4.15 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the module name in a JSON request.

    sfpagent RubyGems
  • Unscored —
    CVE-2014-2554

    OTRS 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote attackers to conduct clickjacking a…

    otrs2 Debian
  • Unscored —
    CVE-2014-2327

    Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack …

    cacti cacti Debian Ubuntu
  • Unscored —
    CVE-2014-2983

    Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, whic…

    drupal7 Ubuntu
  • Unscored —
    CVE-2014-2893

    The GetHTMLRunDir function in the scan-build utility in Clang 3.5 and earlier allows local users to obtain sensitive in…

  • Unscored —
    CVE-2014-2709

    lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via shell metach…

    cacti Debian
  • Unscored —
    CVE-2014-2894

    Off-by-one error in the cmd_smart function in the smart self test in hw/ide/core.c in QEMU before 2.0 allows local user…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2014-2855

    The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of ser…

    rsync rsync Debian Ubuntu
  • Unscored —
    CVE-2014-2976 Public exploit

    Directory traversal vulnerability in Sixnet SixView Manager 2.4.1 allows remote attackers to read arbitrary files via a…

  • Unscored —
    CVE-2012-0360

    Memory leak in Cisco IOS before 15.1(1)SY, when IKEv2 debugging is enabled, allows remote attackers to cause a denial o…

  • Unscored —
    CVE-2012-1317

    The multicast implementation in Cisco IOS before 15.1(1)SY allows remote attackers to cause a denial of service (Route …

  • Unscored —
    CVE-2012-1366

    Cisco IOS before 15.1(1)SY on ASR 1000 devices, when Multicast Listener Discovery (MLD) tracking is enabled for IPv6, a…

  • Unscored —
    CVE-2012-4651

    Cisco IOS before 15.3(2)T, when scansafe is enabled, allows remote attackers to cause a denial of service (latency) via…

  • Unscored —
    CVE-2012-4658

    The ios-authproxy implementation in Cisco IOS before 15.1(1)SY3 allows remote attackers to cause a denial of service (w…