Archive
19 May 2014
Vulnerabilities first published on this day (UTC), newest first.
27 results · Feed
-
Unscored —
Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute …
-
Unscored —
LiveZilla 5.1.2.1 and earlier includes the MD5 hash of the operator password in plaintext in Javascript code that is ge…
-
Unscored —
UnrealIRCd 3.2.10 before 3.2.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and cr…
-
Unscored —
LiveZilla before 5.1.2.1 includes the operator password in plaintext in Javascript code that is generated by lz/mobile/…
-
Unscored —
pyxtrlock before 0.2 does not properly check the return values of the (1) xcb_grab_pointer and (2) xcb_grab_keyboard XC…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 allows rem…
-
Unscored —
Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 does not properly restrict access to artefacts, which …
-
Unscored —
pyxtrlock before 0.1 uses an incorrect variable name, which allows physically proximate attackers to bypass the lock sc…
-
Unscored —
Mahara before 1.5.13, 1.6.x before 1.6.8, and 1.7.x before 1.7.4 does not properly restrict access to folders, which al…
-
Unscored —
Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 does not properly prevent access to blocks, which allo…
-
Unscored —
The Quick Tabs module 6.x-2.x before 6.x-2.2, 6.x-3.x before 6.x-3.2, and 7.x-3.x before 7.x-3.6 for Drupal does not pr…
-
Unscored —CVE-2013-6765 Public exploit
OpenVAS Manager 3.0 before 3.0.7 and 4.0 before 4.0.4 allows remote attackers to bypass the OMP authentication restrict…
-
Unscored —
Use-after-free vulnerability in UnrealIRCd 3.2.10 before 3.2.10.2 allows remote attackers to cause a denial of service …
-
Unscored —
OpenVAS Administrator 1.2 before 1.2.2 and 1.3 before 1.3.2 allows remote attackers to bypass the OAP authentication re…
-
Unscored —
The client in OpenText Exceed OnDemand (EoD) 8 supports anonymous ciphers by default, which allows man-in-the-middle at…
-
Unscored —
OpenText Exceed OnDemand (EoD) 8 transmits the session ID in cleartext, which allows remote attackers to perform sessio…
-
Unscored —
OpenText Exceed OnDemand (EoD) 8 uses weak encryption for passwords, which makes it easier for (1) remote attackers to …
-
Unscored —
OpenText Exceed OnDemand (EoD) 8 allows man-in-the-middle attackers to disable bidirectional authentication and obtain …
-
Medium 6.2
Insecure Temporary File in Jinja2
FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2…
-
High 8.4
Incorrect Privilege Assignment in Jinja2
The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.
-
Unscored —
Xen 4.4.x does not properly validate the load address for 64-bit ARM guest kernels, which allows local users to read sy…
-
Unscored —
Unspecified vulnerability in the NSM XDB service in Juniper NSM before 2012.2R8 allows remote attackers to execute arbi…
-
Unscored —
The ARM image loading functionality in Xen 4.4.x does not properly validate kernel length, which allows local users to …
-
Unscored —
Xen 4.4.x does not properly check alignment, which allows local users to cause a denial of service (crash) via an unspe…
-
Unscored —
SAP NetWeaver 7.20 and earlier allows remote attackers to read arbitrary SAP Central User Administration (SAP CUA) tabl…
-
Unscored —
Buffer overflow in Xen 4.4.x allows local users to read system memory or cause a denial of service (crash) via a crafte…
-
Unscored —
ir41_32.ax 4.51.16.3 for Intel Indeo Video 4.5 allows remote attackers to cause a denial of service (crash) via a craft…