Archive
May 2014
Vulnerabilities first published in this month (UTC), newest first.
74 results · Clear filters · Feed
-
Unscored —
Buffer overflow in PCMan's FTP Server 2.0.7 allows remote attackers to execute arbitrary code via a long string in a US…
-
Unscored —CVE-2014-3757 Public exploit
SQL injection vulnerability in sorter.php in the phpManufaktur kitForm extension 0.43 and earlier for the KeepInTouch (…
-
Unscored —CVE-2014-3247 Public exploit
Cross-site scripting (XSS) vulnerability in Collabtive 1.2 allows remote authenticated users to inject arbitrary web sc…
-
Unscored —CVE-2013-7376 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.10, possibly before revision 82710, allow remot…
-
Unscored —CVE-2013-1765 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in jwplayer.swf in the smart-flv plugin for WordPress allow remote …
-
Unscored —
VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allows remote authenticated users to execu…
-
Unscored —CVE-2013-3514 Public exploit
Multiple directory traversal vulnerabilities in OpenX before 2.8.10 revision 82710 allow remote administrators to read …
-
Unscored —CVE-2013-2226 Public exploit
Multiple SQL injection vulnerabilities in GLPI before 0.83.9 allow remote attackers to execute arbitrary SQL commands v…
-
Unscored —CVE-2014-1603 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.3.1 allow remote attackers to inject arbitrary w…
-
Medium 6.1CVE-2014-3146 Public exploit
lxml Cross-site Scripting Via Control Characters
Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.
-
Unscored —CVE-2014-3441 Public exploit
codec\libpng_plugin.dll in VideoLAN VLC Media Player 2.1.3 allows remote attackers to cause a denial of service (crash)…
-
Unscored —CVE-2014-3443 Public exploit
JetMPAd.ax in JetAudio 8.1.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted .og…
-
Unscored —CVE-2014-0521 Public exploit
Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X do not properly implement Java…
-
Unscored —
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service…
-
Unscored —
The .NET Remoting implementation in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not p…
-
High 8.8
The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Wind…
KEV Nov 3, 2021 -
Unscored —
Foscam IP camera 11.37.2.49 and other versions, when using the Foscam DynDNS option, generates credentials based on pre…
-
Medium —CVE-2014-3225 Public exploit
Cobbler Path Traversal vulnerability
Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile.
-
Unscored —CVE-2014-2046 Public exploit
cgi-bin/rpcBridge in the web interface 1.1 on Broadcom Ltd PIPA C211 rev2 does not properly restrict access, which allo…
-
Unscored —
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.…
-
Unscored —CVE-2014-3246 Public exploit
SQL injection vulnerability in Collabtive 1.2 allows remote authenticated users to execute arbitrary SQL commands via t…
-
Unscored —CVE-2014-2989 Public exploit
Cross-site request forgery (CSRF) vulnerability in Open Assessment Technologies TAO 2.5.6 allows remote attackers to hi…
-
Unscored —CVE-2013-5748 Public exploit
Cross-site request forgery (CSRF) vulnerability in management/prioritize_planning.php in SimpleRisk before 20130916-001…
-
Unscored —
The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.…
-
Unscored —CVE-2014-2934 Public exploit
Multiple SQL injection vulnerabilities in Caldera 9.20 allow remote attackers to execute arbitrary SQL commands via the…
-
High 7.5
actionpack Path Traversal vulnerability
Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows re…
KEV Mar 25, 2022 -
Medium 5.5
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver …
KEV May 12, 2023 -
Unscored —
Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote att…
-
High 7.0CVE-2014-2347 Public exploit
AMTELCO miSecure Information Exposure
Amtelco miSecureMessages (aka MSM) 6.2 does not properly manage sessions, which allows remote authenticated users to obtain sensitive information via a modified message request.
-
Unscored —CVE-2013-7375 Public exploit
SQL injection vulnerability in includes/classes/Authenticate.class.php in PHP-Fusion 7.02.01 through 7.02.05 allows rem…
-
Unscored —CVE-2013-1803 Public exploit
Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL com…
-
Unscored —
F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary …
-
Unscored —CVE-2014-3139 Public exploit
recoveryconsole/bpl/snmpd.php in Unitrends Enterprise Backup 7.3.0 allows remote attackers to bypass authentication by …
-
Unscored —CVE-2014-3138 Public exploit
SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1 before Hotfix 24, and 6.6.1…