Skip to content
OpenAdvisories

Archive

June 2014

Vulnerabilities first published in this month (UTC), newest first.

← May 2014 2014 / June July 2014 →
  1. 14
  2. 231
  3. 310
  4. 430
  5. 532
  6. 612
  7. 71
  8. 817
  9. 923
  10. 1013
  11. 11102
  12. 12 
  13. 1323
  14. 146
  15. 15 
  16. 1611
  17. 1719
  18. 1834
  19. 1919
  20. 2011
  21. 218
  22. 223
  23. 239
  24. 24 
  25. 2511
  26. 26 
  27. 274
  28. 2812
  29. 29 
  30. 30 
All Critical High Medium Low Exploited only Public exploit

445 results · Feed

  • Unscored —
    CVE-2014-4048

    The PJSIP Channel Driver in Asterisk Open Source before 12.3.1 allows remote attackers to cause a denial of service (de…

  • Unscored —
    CVE-2014-4045

    The Publish/Subscribe Framework in the PJSIP channel driver in Asterisk Open Source 12.x before 12.3.1, when sub_min_ex…

  • Unscored —
    CVE-2014-4044

    OpenAFS 1.6.8 does not properly clear the fields in the host structure, which allows remote attackers to cause a denial…

    openafs Debian
  • Unscored —
    CVE-2014-4188

    Cross-site request forgery (CSRF) vulnerability in Hitachi Tuning Manager before 7.6.1-06 and 8.x before 8.0.0-04 and J…

  • Unscored —
    CVE-2014-4187

    Cross-site scripting (XSS) vulnerability in signup.php in ClipBucket allows remote attackers to inject arbitrary web sc…

  • Unscored —
    CVE-2014-4046

    Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6 before 11.6-cert3 allows re…

    asterisk Debian
  • Unscored —
    CVE-2014-4190

    Multiple heap-based buffer overflows in Huawei Campus Series Switches S3700HI, S5700, S6700, S3300HI, S5300, S6300, S93…

  • Unscored —
    CVE-2014-4189

    Cross-site scripting (XSS) vulnerability in Hitachi Tuning Manager before 7.6.1-06 and 8.x before 8.0.0-04 and JP1/Perf…

  • Unscored —
    CVE-2014-3249

    Puppet Enterprise 2.8.x before 2.8.7 allows remote attackers to obtain sensitive information via vectors involving hidi…

  • Medium —
    CVE-2014-3476

    OpenStack Identity Keystone is vulnerable to Block delegation escalation of privilege

    OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a (1) trust or (2) OAuth token with impersonati…

    keystone keystone keystone Debian Ubuntu PyPI
  • Unscored —
    CVE-2014-4164

    Cross-site scripting (XSS) vulnerability in AlgoSec FireFlow 6.3-b230 allows remote attackers to inject arbitrary web s…

  • Unscored —
    CVE-2014-4162 Public exploit

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Zyxel P-660HW-T1 (v3) wireless router allow remote at…

  • Unscored —
    CVE-2014-4163 Public exploit

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Featured Comments plugin 1.2.1 for WordPress allow re…

  • Unscored —
    CVE-2014-4166 Public exploit

    Cross-site scripting (XSS) vulnerability in the song history in SHOUTcast DNAS 2.2.1 allows remote attackers to inject …

  • Unscored —
    CVE-2014-4165

    Cross-site scripting (XSS) vulnerability in ntop allows remote attackers to inject arbitrary web script or HTML via the…

    ntop Ubuntu
  • Medium 6.1
    CVE-2014-3994

    Djiblets Cross-site scripting Vulnerability via JSON Objects

    Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated …

    djblets PyPI
  • Unscored —
    CVE-2014-3428

    Cross-site scripting (XSS) vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inje…

  • Medium 6.1
    CVE-2014-3995

    Djblets Cross-site scripting Vulnerability

    Cross-site scripting (XSS) vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django allows remote attackers to inject arbitrary web script or HTML via a user display name.

    djblets PyPI
  • Unscored —
    CVE-2010-5111

    Multiple buffer overflows in readline.c in Echoping 6.0.2 allow remote attackers to cause a denial of service (crash) a…

  • Unscored —
    CVE-2014-2003

    JustSystems JUST Online Update, as used in Ichitaro through 2014 and other products, does not properly validate signatu…

  • Unscored —
    CVE-2014-2004

    The PPP Access Concentrator (PPPAC) on SEIL SEIL/x86 routers 1.00 through 3.10, SEIL/X1 routers 1.00 through 4.50, SEIL…

  • Unscored —
    CVE-2014-0186

    A certain tomcat7 package for Apache Tomcat 7 in Red Hat Enterprise Linux (RHEL) 7 allows remote attackers to cause a d…

  • Unscored —
    CVE-2014-0960

    IBM PureApplication System 1.0 before 1.0.0.4 cfix8 and 1.1 before 1.1.0.4 IF1 allows remote authenticated users to byp…

  • Unscored —
    CVE-2014-3290

    The mDNS implementation in Cisco IOS XE 3.12S does not properly interact with autonomic networking, which allows remote…

  • Unscored —
    CVE-2014-2002

    Cross-site scripting (XSS) vulnerability in C-BOARD Moyuku 1.01b6 and earlier allows remote attackers to inject arbitra…

  • Unscored —
    CVE-2014-2176

    Cisco IOS XR 4.1.2 through 5.1.1 on ASR 9000 devices, when a Trident-based line card is used, allows remote attackers t…

  • Unscored —
    CVE-2014-3295

    The HSRP implementation in Cisco NX-OS 6.2(2a) and earlier allows remote attackers to bypass authentication and cause a…

  • Unscored —
    CVE-2013-1841

    Net-Server, when the reverse-lookups option is enabled, does not check if the hostname resolves to the source IP addres…

    libnet-server-perl libnet-server-perl Debian Ubuntu
  • Unscored —
    CVE-2013-4099

    Multiple unspecified vulnerabilities in OpenAL32.dll in JOAL 2.0-rc11, as used in JOGAMP, allow context-dependent attac…

  • Unscored —
    CVE-2013-3663 EPSS 32%

    Heap-based buffer overflow in paintlib, as used in Trimble SketchUp (formerly Google SketchUp) before 8 Maintenance 3, …

  • Unscored —
    CVE-2013-3843 Public exploit EPSS 20%

    Stack-based buffer overflow in the mk_request_header_process function in mk_request.c in Monkey HTTP Daemon (monkeyd) b…

  • Unscored —
    CVE-2013-2182 Public exploit

    The Mandril security plugin in Monkey HTTP Daemon (monkeyd) before 1.5.0 allows remote attackers to bypass access restr…

  • Unscored —
    CVE-2013-2163

    Monkey HTTP Daemon (monkeyd) before 1.2.2 allows remote attackers to cause a denial of service (infinite loop) via an o…

  • Unscored —
    CVE-2013-5353

    Unrestricted file upload vulnerability in system/controllers/ajax/attachments.php in Sharetronix 3.1.1.3, 3.1.1, and ea…

  • Unscored —
    CVE-2013-5356

    Sharetronix 3.1.1.3, 3.1.1, and earlier does not properly restrict access to unspecified AJAX functionality, which allo…

  • Unscored —
    CVE-2013-5352

    Sharetronix 3.1.1.3, 3.1.1, and earlier allows remote attackers to execute arbitrary PHP code via the (1) activities_te…

  • Medium —
    CVE-2012-3522

    GeSHi vulnerable to Cross-site Scripting

    Cross-site scripting (XSS) vulnerability in contrib/langwiz.php in GeSHi before 1.0.8.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    geshi/geshi Packagist
  • High —
    CVE-2012-3521

    GeSHi vulnerable to Directory Traversal

    Multiple directory traversal vulnerabilities in the cssgen contrib module in GeSHi before 1.0.8.11 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) geshi-path or (2) geshi-lang-path parameter.

    geshi geshi/geshi Debian Packagist
  • Unscored —
    CVE-2014-4159

    Open redirect vulnerability in in la/umTestSSO.jsp in SAP Supplier Relationship Management (SRM) allows remote attacker…

  • Unscored —
    CVE-2014-4161

    Cross-site scripting (XSS) vulnerability in la/umTestSSO.jsp in SAP Supplier Relationship Management (SRM) allows remot…