Archive
July 2014
Vulnerabilities first published in this month (UTC), newest first.
653 results · Feed
-
Unscored —
Multiple directory traversal vulnerabilities in the Vitamin plugin before 1.1.0 for WordPress allow remote attackers to…
-
Unscored —
Buffer overflow in the ndp_msg_opt_dnssl_domain function in libndp allows remote routers to cause a denial of service (…
-
Medium —
Denial of service in Netty
The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.
-
Unscored —
The License Measurement servlet in SAP Solution Manager 7.1 allows remote attackers to bypass authentication via unspec…
-
Unscored —
SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authen…
-
Unscored —
SAP FI Manager Self-Service has a hard-coded user name, which makes it easier for remote attackers to obtain access via…
-
Unscored —
SAP HANA Extend Application Services (XS) allows remote attackers to bypass access restrictions via a request to a priv…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the XS Administration Tools in SAP HANA allow remote attackers t…
-
Unscored —
The SAP Netweaver Business Warehouse component does not properly restrict access to the functions in the BW-SYS-DB-DB4 …
-
Unscored —
Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAY_EARLY cell is received by…
-
Medium 4.3
Innominate mGuard Exposure of Sensitive Information to an Unauthorized Actor
Innominate mGuard before 7.6.4 and 8.x before 8.0.3 does not require authentication for snapshot downloads, which allows remote attackers to obtain sensitive information via a crafted HTTPS request.
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management 6.2 through 6.2.8, 6.x and 7.1 throu…
-
Unscored —
Unspecified vulnerability in the server in IBM Rational Software Architect Design Manager 4.0.6 allows remote authentic…
-
Unscored —
Unspecified vulnerability in IBM Rational Software Architect Design Manager and Rational Rhapsody Design Manager 3.x an…
-
Unscored —
Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8 and 6.x and 7.x through 7.5.0…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management 6.2 through 6.2.8, 6.x and 7.1 throu…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in IBM Atlas Suite (aka Atlas Policy Suite), as used in Atlas eDisc…
-
Unscored —
CRLF injection vulnerability in IBM Maximo Asset Management 7.5 through 7.5.0.6, and 7.5 through 7.5.0.3 and 7.5.1 thro…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the web-server component in Cisco Prime Data Center Network Manager (DCNM) …
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Unified Task List (UTL) Portlet for IBM WebSphere Portal 7.x and 8.x th…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Homepage Decorator PerlMailer 3.10 and earlier allows remote attackers to i…
-
Unscored —
Multiple cross-site request forgery (CSRF) vulnerabilities in CGI programs in Seeds acmailer before 3.8.17 and 3.9.x be…
-
Unscored —
install.sh in the Embedded WebSphere Application Server (eWAS) 7.0 before FP33 in IBM Tivoli Integrated Portal (TIP) 2.…
-
Unscored —
SQL injection vulnerability in the Unified Task List (UTL) Portlet for IBM WebSphere Portal 7.x and 8.x through 8.0.0.1…
-
Unscored —
The Unified Task List (UTL) Portlet for IBM WebSphere Portal 7.x and 8.x through 8.0.0.1 CF12 allows remote attackers t…
-
Unscored —
The I-O DATA TS-WLCAM camera with firmware 1.06 and earlier, TS-WLCAM/V camera with firmware 1.06 and earlier, TS-WPTCA…
-
Unscored —
IBM Rational Team Concert (RTC) 3.x before 3.0.1.6 IF3 and 4.x before 4.0.7 does not properly integrate with build engi…
-
Unscored —
Multiple open redirect vulnerabilities in the Unified Task List (UTL) Portlet for IBM WebSphere Portal 7.x and 8.x thro…
-
Unscored —
WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache user…
-
Unscored —
Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent …
-
Unscored —
Integer overflow in the tr_bitfieldEnsureNthBitAlloced function in bitfield.c in Transmission before 2.84 allows remote…
-
Unscored —CVE-2014-4710 Public exploit
Cross-site scripting (XSS) vulnerability in zero_user_account.php in ZeroCMS 1.0 allows remote attackers to inject arbi…
-
Unscored —
Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-th…
-
Unscored —CVE-2014-5116 Public exploit
The cairo_image_surface_get_data function in Cairo 1.10.2, as used in GTK+ and Wireshark, allows context-dependent atta…
-
Unscored —
WeBid 1.1.1 allows remote attackers to conduct an LDAP injection attack via the (1) js or (2) cat parameter.
-
Unscored —
The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a fi…
-
Unscored —
The web interface in CUPS before 2.0 does not check that files have world-readable permissions, which allows remote att…
-
Unscored —CVE-2014-5115 Public exploit
Absolute path traversal vulnerability in DirPHP 1.0 allows remote attackers to read arbitrary files via a full pathname…
-
Unscored —
CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3)…
-
Medium —
Moodle does not enforce the moodle/site:accessallgroups capability requirement
mod/forum/classes/post_form.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce the moodle/site:accessallgroups capability requirement before proceeding with a post to all groups, …