Archive
July 2014
Vulnerabilities first published in this month (UTC), newest first.
72 results · Clear filters · Feed
-
Unscored —CVE-2014-4710 Public exploit
Cross-site scripting (XSS) vulnerability in zero_user_account.php in ZeroCMS 1.0 allows remote attackers to inject arbi…
-
Unscored —CVE-2014-5116 Public exploit
The cairo_image_surface_get_data function in Cairo 1.10.2, as used in GTK+ and Wireshark, allows context-dependent atta…
-
Unscored —CVE-2014-5115 Public exploit
Absolute path traversal vulnerability in DirPHP 1.0 allows remote attackers to read arbitrary files via a full pathname…
-
Low —CVE-2014-3544 Public exploit
Moodle cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype I…
-
Low —CVE-2014-3551 Public exploit
Moodle multiple cross-site scripting (XSS) vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote authenticated users to inject arbitrary web s…
-
High 8.1
Elasticsearch Improper Access Control vulnerability
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security pol…
KEV Mar 25, 2022 -
Unscored —CVE-2014-5109 Public exploit
SQL injection vulnerability in maint/modules/endpointcfg/endpoint_generic.php in Fonality trixbox allows remote attacke…
-
Unscored —CVE-2014-5104 Public exploit
Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands vi…
-
Unscored —
Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a .…
-
Unscored —CVE-2014-5112 Public exploit
maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metach…
-
Unscored —
The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authe…
-
Unscored —
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write…
-
Unscored —CVE-2014-2227 Public exploit
The default Flash cross-domain policy (crossdomain.xml) in Ubiquiti Networks UniFi Video (formerly AirVision aka AirVis…
-
Unscored —CVE-2014-5100 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the a…
-
Unscored —CVE-2014-5101 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in WeBid 1.1.1 allow remote attackers to inject arbitrary web scrip…
-
Unscored —CVE-2014-4736 Public exploit
SQL injection vulnerability in E2 before 2.4 (2845) allows remote attackers to execute arbitrary SQL commands via the n…
-
Unscored —
Buffer overflow in ACME micro_httpd, as used in D-Link DSL2750U and DSL2740U and NetGear WGR614 and MR-ADSL-DG834 route…
-
Unscored —CVE-2014-3110 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities on Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earl…
-
Unscored —CVE-2013-7392 Public exploit
Gitlist allows remote attackers to execute arbitrary commands via shell metacharacters in a file name to Source/.
-
Unscored —
Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in…
-
Unscored —CVE-2014-5023 Public exploit
Repository.php in Gitter, as used in Gitlist, allows remote attackers with commit privileges to execute arbitrary comma…
-
Unscored —CVE-2014-4960 Public exploit
Multiple SQL injection vulnerabilities in models\gallery.php in Youtube Gallery (com_youtubegallery) component 4.x thro…
-
Unscored —
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a deni…
-
Unscored —CVE-2014-4943 Public exploit
The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by…
-
High 7.5
Advantech WebAccess Stack-Based Buffer Overflow
Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4) CCDParameter, (5) SetColor, (6) AlarmImage, (7) GetParameter…
-
Unscored —
Unspecified vulnerability in HP Storage Data Protector 8.x allows remote attackers to execute arbitrary code via unknow…
-
Unscored —
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 all…
-
Unscored —CVE-2014-2477 Public exploit
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.…
-
Unscored —CVE-2013-5755 Public exploit
config/.htpasswd in Yealink IP Phone SIP-T38G has a hardcoded password of (1) user (s7C9Cx.rLsWFA) for the user account…
-
Unscored —CVE-2014-4018 Public exploit
The ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK has a default password of admin for the admin account, which…
-
Unscored —
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute…
-
Unscored —CVE-2014-4154 Public exploit
ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficien…
-
Unscored —CVE-2014-3427 Public exploit
CRLF injection vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary…
-
Unscored —CVE-2014-4663 Public exploit
TimThumb 2.8.13 and WordThumb 1.07, when Webshot (aka Webshots) is enabled, allows remote attackers to execute arbitrar…
-
Unscored —CVE-2014-4964 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to hija…
-
Unscored —CVE-2014-4965 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to inject arbi…
-
Unscored —CVE-2014-4962 Public exploit
Shopizer 1.1.5 and earlier allows remote attackers to reduce the total cost of their shopping cart via a negative numbe…
-
Unscored —CVE-2014-4963 Public exploit
Shopizer 1.1.5 and earlier allows remote attackers to modify the account settings of arbitrary users via the customer.c…
-
Unscored —CVE-2014-3418 Public exploit
config/userAdmin/login.tdf in Infoblox NetMRI before 6.8.5 allows remote attackers to execute arbitrary commands via sh…
-
Unscored —CVE-2014-4944 Public exploit
Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress a…