Skip to content
OpenAdvisories

Archive

29 July 2014

Vulnerabilities first published on this day (UTC), newest first.

← June 2014 2014 / July /29 August 2014 →
  1. 168
  2. 276
  3. 326
  4. 4 
  5. 5 
  6. 62
  7. 741
  8. 831
  9. 921
  10. 1021
  11. 1124
  12. 12 
  13. 13 
  14. 1412
  15. 1511
  16. 1616
  17. 1792
  18. 186
  19. 1920
  20. 2029
  21. 215
  22. 2214
  23. 2322
  24. 2422
  25. 256
  26. 2616
  27. 272
  28. 2818
  29. 2936
  30. 307
  31. 319
All Critical High Medium Low Exploited only Public exploit

36 results · Feed

  • Unscored —
    CVE-2014-0889

    Multiple cross-site scripting (XSS) vulnerabilities in IBM Atlas Suite (aka Atlas Policy Suite), as used in Atlas eDisc…

  • Unscored —
    CVE-2014-3026

    CRLF injection vulnerability in IBM Maximo Asset Management 7.5 through 7.5.0.6, and 7.5 through 7.5.0.3 and 7.5.1 thro…

  • Unscored —
    CVE-2014-3329

    Cross-site scripting (XSS) vulnerability in the web-server component in Cisco Prime Data Center Network Manager (DCNM) …

  • Unscored —
    CVE-2014-3057

    Cross-site scripting (XSS) vulnerability in the Unified Task List (UTL) Portlet for IBM WebSphere Portal 7.x and 8.x th…

  • Unscored —
    CVE-2014-3897

    Cross-site scripting (XSS) vulnerability in Homepage Decorator PerlMailer 3.10 and earlier allows remote attackers to i…

  • Unscored —
    CVE-2014-3896

    Multiple cross-site request forgery (CSRF) vulnerabilities in CGI programs in Seeds acmailer before 3.8.17 and 3.9.x be…

  • Unscored —
    CVE-2014-3020

    install.sh in the Embedded WebSphere Application Server (eWAS) 7.0 before FP33 in IBM Tivoli Integrated Portal (TIP) 2.…

  • Unscored —
    CVE-2014-3055

    SQL injection vulnerability in the Unified Task List (UTL) Portlet for IBM WebSphere Portal 7.x and 8.x through 8.0.0.1…

  • Unscored —
    CVE-2014-3056

    The Unified Task List (UTL) Portlet for IBM WebSphere Portal 7.x and 8.x through 8.0.0.1 CF12 allows remote attackers t…

  • Unscored —
    CVE-2014-3895

    The I-O DATA TS-WLCAM camera with firmware 1.06 and earlier, TS-WLCAM/V camera with firmware 1.06 and earlier, TS-WPTCA…

  • Unscored —
    CVE-2014-3050

    IBM Rational Team Concert (RTC) 3.x before 3.0.1.6 IF3 and 4.x before 4.0.7 does not properly integrate with build engi…

  • Unscored —
    CVE-2014-3054

    Multiple open redirect vulnerabilities in the Unified Task List (UTL) Portlet for IBM WebSphere Portal 7.x and 8.x thro…

  • Unscored —
    CVE-2014-0103

    WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache user…

  • Unscored —
    CVE-2014-0475

    Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent …

    glibc eglibc Debian Ubuntu
  • Unscored —
    CVE-2014-4909

    Integer overflow in the tr_bitfieldEnsureNthBitAlloced function in bitfield.c in Transmission before 2.84 allows remote…

    transmission transmission Debian Ubuntu
  • Unscored —
    CVE-2014-4710 Public exploit

    Cross-site scripting (XSS) vulnerability in zero_user_account.php in ZeroCMS 1.0 allows remote attackers to inject arbi…

  • Unscored —
    CVE-2014-2226

    Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-th…

  • Unscored —
    CVE-2014-5116 Public exploit

    The cairo_image_surface_get_data function in Cairo 1.10.2, as used in GTK+ and Wireshark, allows context-dependent atta…

    wireshark Ubuntu
  • Unscored —
    CVE-2014-5114

    WeBid 1.1.1 allows remote attackers to conduct an LDAP injection attack via the (1) js or (2) cat parameter.

  • Unscored —
    CVE-2014-5029

    The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a fi…

    cups cups Debian Ubuntu
  • Unscored —
    CVE-2014-5031

    The web interface in CUPS before 2.0 does not check that files have world-readable permissions, which allows remote att…

    cups cups Debian Ubuntu
  • Unscored —
    CVE-2014-5115 Public exploit

    Absolute path traversal vulnerability in DirPHP 1.0 allows remote attackers to read arbitrary files via a full pathname…

  • Unscored —
    CVE-2014-5030

    CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3)…

    cups cups Debian Ubuntu
  • Medium —
    CVE-2014-3553

    Moodle does not enforce the moodle/site:accessallgroups capability requirement

    mod/forum/classes/post_form.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce the moodle/site:accessallgroups capability requirement before proceeding with a post to all groups, …

    moodle/moodle Packagist
  • Medium —
    CVE-2014-3547

    Moodle multiple cross-site scripting (XSS) vulnerabilities

    Multiple cross-site scripting (XSS) vulnerabilities in badges/renderer.php in Moodle 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via an external badge.

    moodle/moodle Packagist
  • Medium —
    CVE-2014-3545

    Moodle remote code execution via quiz questions

    Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to execute arbitrary code via a calculated question in a quiz.

    moodle/moodle Packagist
  • Unscored —
    CVE-2014-3549

    Cross-site scripting (XSS) vulnerability in the get_description function in lib/classes/event/user_login_failed.php in …

  • Low —
    CVE-2014-3544 Public exploit

    Moodle cross-site scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype I…

    moodle/moodle Packagist
  • Unscored —
    CVE-2014-3550

    Multiple cross-site scripting (XSS) vulnerabilities in admin/tool/task/scheduledtasks.php in Moodle 2.7.x before 2.7.1 …

  • Medium —
    CVE-2014-3546

    Moodle allows attackers to obtain username and course information

    Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce certain capability requirements in (1) notes/index.php and (2) user/edit.php, which allows remote attackers to obtain potentially sensi…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-3543

    Moodle Arbitrary File Read via XML External Entity vulnerability

    mod/imscp/locallib.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via a package with a manifest file containing an XML external entity declarati…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-3542

    Moodle allows remote attackers to read arbitrary files

    mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, r…

    moodle/moodle Packagist
  • Low —
    CVE-2014-3551 Public exploit

    Moodle multiple cross-site scripting (XSS) vulnerabilities

    Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote authenticated users to inject arbitrary web s…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-3548

    Moodle multiple cross-site scripting (XSS) vulnerabilities

    Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via vectors that trigger an AJAX ex…

    moodle/moodle Packagist
  • Unscored —
    CVE-2014-3552

    The Shibboleth authentication plugin in auth/shibboleth/index.php in Moodle through 2.3.11, 2.4.x before 2.4.11, and 2.…

  • High —
    CVE-2014-3541

    Moodle vulnerable to PHP object injection attacks

    The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data associated …

    moodle/moodle Packagist