Skip to content
OpenAdvisories

Archive

20 May 2014

Vulnerabilities first published on this day (UTC), newest first.

← April 2014 2014 / May /20 June 2014 →
  1. 112
  2. 238
  3. 3 
  4. 4 
  5. 515
  6. 611
  7. 713
  8. 852
  9. 96
  10. 102
  11. 115
  12. 1221
  13. 1317
  14. 1465
  15. 158
  16. 1621
  17. 175
  18. 181
  19. 1927
  20. 2033
  21. 2114
  22. 2247
  23. 2325
  24. 246
  25. 253
  26. 2626
  27. 2726
  28. 282
  29. 2918
  30. 3025
  31. 316
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High —
    CVE-2013-4250

    TYPO3 doesn't properly check file extensions

    The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file.

    typo3/cms Packagist
  • High 7.5
    CVE-2013-4346

    SimpleGeo python-oauth2 does not check the nonce allowing replay attacks

    The Server.verify_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attacks via a signed URL.

    oauth2 PyPI
  • High —
    CVE-2013-4321

    TYPO3 vulnerable to remote authenticated arbitrary code execution

    The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists becaus…

    typo3/cms Packagist
  • High 7.5
    CVE-2014-2351

    CSWorks SQL Injection

    SQL injection vulnerability in the LiveData service in CSWorks before 2.5.5233.0 allows remote attackers to execute arbitrary SQL commands via vectors related to pathnames contained in web API requests.

    CSWorks CSWorks