Skip to content
OpenAdvisories

Archive

July 2014

Vulnerabilities first published in this month (UTC), newest first.

← June 2014 2014 / July August 2014 →
  1. 168
  2. 276
  3. 326
  4. 4 
  5. 5 
  6. 62
  7. 741
  8. 831
  9. 921
  10. 1021
  11. 1124
  12. 12 
  13. 13 
  14. 1412
  15. 1511
  16. 1616
  17. 1792
  18. 186
  19. 1920
  20. 2029
  21. 215
  22. 2214
  23. 2322
  24. 2422
  25. 256
  26. 2616
  27. 272
  28. 2818
  29. 2936
  30. 307
  31. 319
All Critical High Medium Low Exploited only Public exploit

24 results · Clear filters · Feed

  • Medium —
    CVE-2014-3488

    Denial of service in Netty

    The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.

    io.netty:netty-handler Maven
  • Medium 4.3
    CVE-2014-2356

    Innominate mGuard Exposure of Sensitive Information to an Unauthorized Actor

    Innominate mGuard before 7.6.4 and 8.x before 8.0.3 does not require authentication for snapshot downloads, which allows remote attackers to obtain sensitive information via a crafted HTTPS request.

    Innominate mGuard
  • Medium —
    CVE-2014-3553

    Moodle does not enforce the moodle/site:accessallgroups capability requirement

    mod/forum/classes/post_form.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce the moodle/site:accessallgroups capability requirement before proceeding with a post to all groups, …

    moodle/moodle Packagist
  • Medium —
    CVE-2014-3547

    Moodle multiple cross-site scripting (XSS) vulnerabilities

    Multiple cross-site scripting (XSS) vulnerabilities in badges/renderer.php in Moodle 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via an external badge.

    moodle/moodle Packagist
  • Medium —
    CVE-2014-3545

    Moodle remote code execution via quiz questions

    Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to execute arbitrary code via a calculated question in a quiz.

    moodle/moodle Packagist
  • Medium —
    CVE-2014-3546

    Moodle allows attackers to obtain username and course information

    Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce certain capability requirements in (1) notes/index.php and (2) user/edit.php, which allows remote attackers to obtain potentially sensi…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-3543

    Moodle Arbitrary File Read via XML External Entity vulnerability

    mod/imscp/locallib.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via a package with a manifest file containing an XML external entity declarati…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-3542

    Moodle allows remote attackers to read arbitrary files

    mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, r…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-3548

    Moodle multiple cross-site scripting (XSS) vulnerabilities

    Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via vectors that trigger an AJAX ex…

    moodle/moodle Packagist
  • Medium 4.6
    CVE-2014-2369

    Omron NS Series HMI Cross-Site Request Forgery

    Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.

    Omron NS15 NS10 NS5 ICS / OT
  • Medium 4.0
    CVE-2014-2370

    Omron NS Series HMI Improper Neutralization of Input During Web Page Generation

    Cross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to inject arbitrary web script or HTML via crafted data.

    Omron NS10 NS5 NS12 ICS / OT
  • Medium 5.0
    CVE-2014-2360

    OleumTech WIO Family Improper Input Validation

    OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules allow remote attackers to execute arbitrary code via packets that report a high battery voltage.

    OleumTech Sensor Wireless I/O Modules WIO DH2 Wireless Gateway
  • Medium 6.5
    CVE-2014-2365

    Advantech WebAccess Improper Access Control

    Unspecified vulnerability in Advantech WebAccess before 7.2 allows remote authenticated users to create or delete arbitrary files via unknown vectors.

    Advantech WebAccess
  • Medium —
    CVE-2013-5855

    Improper Neutralization of Input During Web Page Generation in Mojarra

    Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attack…

    mojarra org.glassfish:javax.faces Debian Maven
  • Medium —
    CVE-2014-3503

    Apache Syncope uses a weak PNRG

    Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

    org.apache.syncope:syncope Maven
  • Medium 6.5
    CVE-2014-0207 EPSS 17%

    The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30…

    php5 file file Debian Ubuntu
  • Medium 6.5
    CVE-2014-3478 EPSS 15%

    Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP b…

    php5 file file Debian Ubuntu
  • Medium 6.5
    CVE-2014-3480 EPSS 11%

    The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5…

    php5 file file Debian Ubuntu
  • Medium —
    CVE-2014-4671 Public exploit EPSS 22%

    Rosetta-Flash JSONP Vulnerability in hapi

    Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 do not properly restr…

    flashplugin-nonfree hapi Ubuntu npm
  • Medium —
    CVE-2014-0035

    Cleartext Transmission of Sensitive Information in Apache CXF

    The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtai…

    org.apache.cxf:cxf-core Maven
  • Medium —
    CVE-2014-0034

    Improper Input Validation in Apache CXF

    The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token.

    org.apache.cxf:cxf-rt-ws-security Maven
  • Medium 6.5
    CVE-2013-3993 Exploited · Ransomware

    IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restr…

    KEV May 25, 2022
  • Medium —
    CVE-2014-3497

    OpenStack Swift Cross-site Scriping vulnerability

    Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or HTML via the WWW-Authenticate header.

    swift swift swift Debian Ubuntu PyPI
  • Medium 4.0
    CVE-2014-3477

    The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error …

    dbus dbus Debian Ubuntu