Skip to content
OpenAdvisories

Archive

July 2014

Vulnerabilities first published in this month (UTC), newest first.

← June 2014 2014 / July August 2014 →
  1. 168
  2. 276
  3. 326
  4. 4 
  5. 5 
  6. 62
  7. 741
  8. 831
  9. 921
  10. 1021
  11. 1124
  12. 12 
  13. 13 
  14. 1412
  15. 1511
  16. 1616
  17. 1792
  18. 186
  19. 1920
  20. 2029
  21. 215
  22. 2214
  23. 2322
  24. 2422
  25. 256
  26. 2616
  27. 272
  28. 2818
  29. 2936
  30. 307
  31. 319
All Critical High Medium Low Exploited only Public exploit

653 results · Feed

  • Medium —
    CVE-2014-3547

    Moodle multiple cross-site scripting (XSS) vulnerabilities

    Multiple cross-site scripting (XSS) vulnerabilities in badges/renderer.php in Moodle 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via an external badge.

    moodle/moodle Packagist
  • Medium —
    CVE-2014-3545

    Moodle remote code execution via quiz questions

    Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to execute arbitrary code via a calculated question in a quiz.

    moodle/moodle Packagist
  • Unscored —
    CVE-2014-3549

    Cross-site scripting (XSS) vulnerability in the get_description function in lib/classes/event/user_login_failed.php in …

  • Low —
    CVE-2014-3544 Public exploit

    Moodle cross-site scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype I…

    moodle/moodle Packagist
  • Unscored —
    CVE-2014-3550

    Multiple cross-site scripting (XSS) vulnerabilities in admin/tool/task/scheduledtasks.php in Moodle 2.7.x before 2.7.1 …

  • Medium —
    CVE-2014-3546

    Moodle allows attackers to obtain username and course information

    Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce certain capability requirements in (1) notes/index.php and (2) user/edit.php, which allows remote attackers to obtain potentially sensi…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-3543

    Moodle Arbitrary File Read via XML External Entity vulnerability

    mod/imscp/locallib.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via a package with a manifest file containing an XML external entity declarati…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-3542

    Moodle allows remote attackers to read arbitrary files

    mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, r…

    moodle/moodle Packagist
  • Low —
    CVE-2014-3551 Public exploit

    Moodle multiple cross-site scripting (XSS) vulnerabilities

    Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote authenticated users to inject arbitrary web s…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-3548

    Moodle multiple cross-site scripting (XSS) vulnerabilities

    Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via vectors that trigger an AJAX ex…

    moodle/moodle Packagist
  • Unscored —
    CVE-2014-3552

    The Shibboleth authentication plugin in auth/shibboleth/index.php in Moodle through 2.3.11, 2.4.x before 2.4.11, and 2.…

  • High —
    CVE-2014-3541

    Moodle vulnerable to PHP object injection attacks

    The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data associated …

    moodle/moodle Packagist
  • Unscored —
    CVE-2013-7393

    The daemonize.py module in Subversion 1.8.0 before 1.8.2 allows local users to gain privileges via a symlink attack on …

    subversion Debian
  • Unscored —
    CVE-2013-4262

    svnwcsub.py in Subversion 1.8.0 before 1.8.3, when using the --pidfile option and running in foreground mode, allows lo…

    subversion Debian
  • High 8.1
    CVE-2014-3120 Exploited Public exploit Scanner template EPSS 89%

    Elasticsearch Improper Access Control vulnerability

    The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security pol…

    org.elasticsearch:elasticsearch Maven
    KEV Mar 25, 2022
  • Unscored —
    CVE-2013-4840

    Unspecified vulnerability in HP and H3C VPN Firewall Module products SECPATH1000FE before 5.20.R3177 and SECBLADEFW bef…

  • Unscored —
    CVE-2014-3304

    The OutlookAction Class in Cisco WebEx Meetings Server allows remote attackers to enumerate user accounts by entering c…

  • Unscored —
    CVE-2014-3303

    The web framework in Cisco WebEx Meetings Server does not properly restrict the content of query strings, which allows …

  • Unscored —
    CVE-2014-2974

    Cross-site request forgery (CSRF) vulnerability in php/user_account.php in Silver Peak VX through 6.2.4 allows remote a…

  • Unscored —
    CVE-2014-2975

    Cross-site scripting (XSS) vulnerability in php/user_account.php in Silver Peak VX before 6.2.4 allows remote attackers…

  • Unscored —
    CVE-2014-5109 Public exploit

    SQL injection vulnerability in maint/modules/endpointcfg/endpoint_generic.php in Fonality trixbox allows remote attacke…

  • Unscored —
    CVE-2014-5104 Public exploit

    Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands vi…

  • Unscored —
    CVE-2014-5111 Public exploit Scanner template EPSS 22%

    Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a .…

  • Unscored —
    CVE-2014-5110

    Cross-site scripting (XSS) vulnerability in user/help/html/index.php in Fonality trixbox allows remote attackers to inj…

  • Unscored —
    CVE-2014-5106

    Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.4.x through 3.4.6 allows…

  • Unscored —
    CVE-2014-5113

    Multiple cross-site scripting (XSS) vulnerabilities in test.php in Visualware MyConnection Server 9.7i allow remote att…

  • Unscored —
    CVE-2014-5108

    Cross-site scripting (XSS) vulnerability in single_pages\download_file.php in concrete5 before 5.6.3 allows remote atta…

  • Unscored —
    CVE-2014-5107

    concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a direct request to (1) system/basic…

  • Unscored —
    CVE-2014-5112 Public exploit

    maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metach…

  • Unscored —
    CVE-2014-5105

    Multiple cross-site scripting (XSS) vulnerabilities in ol-commerce 2.1.1 allow remote attackers to inject arbitrary web…

  • Unscored —
    CVE-2014-4725 Public exploit EPSS 61%

    The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authe…

  • Unscored —
    CVE-2014-4726

    Unspecified vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.8 for WordPress has unspec…

  • Unscored —
    CVE-2014-4748

    Cross-site scripting (XSS) vulnerability in the Classic Meeting Server in IBM Sametime 8.x through 8.5.2.1 allows remot…

  • Unscored —
    CVE-2014-4857

    Cross-site scripting (XSS) vulnerability in Gurock TestRail before 3.1.3 allows remote attackers to inject arbitrary we…

  • Unscored —
    CVE-2014-4971 Public exploit EPSS 23%

    Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write…

  • Unscored —
    CVE-2014-4747

    The Classic Meeting Server in IBM Sametime 8.x through 8.5.2.1 allows physically proximate attackers to discover a meet…

  • Unscored —
    CVE-2014-2626 EPSS 19%

    Directory traversal vulnerability in the toServerObject function in HP Network Virtualization 8.6 (aka Shunra Network V…

  • Unscored —
    CVE-2014-2966

    The ISO-8859-1 encoder in Resin Pro before 4.0.40 does not properly perform Unicode transformations, which allows remot…

  • Unscored —
    CVE-2014-2625

    Directory traversal vulnerability in the storedNtxFile function in HP Network Virtualization 8.6 (aka Shunra Network Vi…

  • Unscored —
    CVE-2014-4858

    Multiple SQL injection vulnerabilities in CWPLogin.aspx in Sabre AirCentre Crew products 2010.2.12.20008 and earlier al…