Skip to content
OpenAdvisories

Archive

June 2014

Vulnerabilities first published in this month (UTC), newest first.

← May 2014 2014 / June July 2014 →
  1. 14
  2. 231
  3. 310
  4. 430
  5. 532
  6. 612
  7. 71
  8. 817
  9. 923
  10. 1013
  11. 11102
  12. 12 
  13. 1323
  14. 146
  15. 15 
  16. 1611
  17. 1719
  18. 1834
  19. 1919
  20. 2011
  21. 218
  22. 223
  23. 239
  24. 24 
  25. 2511
  26. 26 
  27. 274
  28. 2812
  29. 29 
  30. 30 
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Medium —
    CVE-2011-4367 Public exploit EPSS 34%

    Apache MyFaces Vulnerable to Path Traversal

    Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.res…

    org.apache.myfaces.core:myfaces-impl Maven
  • Medium 6.1
    CVE-2014-4301

    Eugene Pankov Ajenti Cross-site scripting Vulnerabilities

    Multiple cross-site scripting (XSS) vulnerabilities in the respond_error function in routing.py in Eugene Pankov Ajenti before 1.2.21.7 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) resources.js or (2) resources.css in…

    ajenti PyPI
  • Medium —
    CVE-2014-3476

    OpenStack Identity Keystone is vulnerable to Block delegation escalation of privilege

    OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a (1) trust or (2) OAuth token with impersonati…

    keystone keystone keystone Debian Ubuntu PyPI
  • Medium 6.1
    CVE-2014-3994

    Djiblets Cross-site scripting Vulnerability via JSON Objects

    Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated …

    djblets PyPI
  • Medium 6.1
    CVE-2014-3995

    Djblets Cross-site scripting Vulnerability

    Cross-site scripting (XSS) vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django allows remote attackers to inject arbitrary web script or HTML via a user display name.

    djblets PyPI
  • Medium —
    CVE-2012-3522

    GeSHi vulnerable to Cross-site Scripting

    Cross-site scripting (XSS) vulnerability in contrib/langwiz.php in GeSHi before 1.0.8.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    geshi/geshi Packagist
  • Medium —
    CVE-2014-4036

    ImpressCMS Cross-site scripting Vulnerability

    Cross-site scripting (XSS) vulnerability in modules/system/admin.php in ImpressCMS 1.3.6.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a listimg action.

    impresscms/impresscms Packagist
  • Medium —
    CVE-2014-3004 Public exploit

    Improper Restriction of XML External Entity Reference in Castor

    The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.

    castor:castor castor org.codehaus.castor:castor Ubuntu Maven
  • Medium 4.0
    CVE-2014-2346

    COPA-DATA zenon DNP3 Improper Input Validation

    COPA-DATA zenon DNP3 NG driver (DNP3 master) 7.10 and 7.11 through 7.11 SP0 build 10238 and zenon DNP3 Process Gateway (DNP3 outstation) 7.11 SP0 build 10238 and earlier allow physically proximate attackers to cause a denial of service (infinite loop and proc…

    COPA-DATA zenon DNP3 Process Gateway (DNP3 outstation) zenon DNP3 NG driver (DNP3 master)
  • Medium —
    CVE-2014-2054

    PHPExcel vulnerable to XXE attacks through libxml

    PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an …

    phpoffice/phpexcel Packagist
  • Medium —
    CVE-2014-3941

    Typo3 Host Header Spoofing Vulnerability

    TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allows remote attackers to have unspecified impact via a crafted HTTP Host header, related to "Host Spoofing."

    typo3/cms Packagist
  • Medium —
    CVE-2014-3944

    TYPO3 Improper Session Invalidation

    The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote attackers to bypass authentication via unspecified vectors.

    typo3/cms Packagist
  • Medium —
    CVE-2014-3946

    Typo3 Information Disclosure

    The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors.

    typo3/cms Packagist
  • Medium —
    CVE-2013-2014

    OpenStack Identity (Keystone) Denial of Service

    OpenStack Identity (Keystone) before 2013.1 allows remote attackers to cause a denial of service (memory consumption and crash) via multiple long requests.

    keystone keystone Debian PyPI