Archive

July 2014

Vulnerabilities first published in this month (UTC), newest first.

← June 2014 2014 / July August 2014 →

All Critical High Medium Low Exploited only Public exploit

653 results · Feed

Unscored —

CVE-2014-4979

Apple QuickTime allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via …

Jul 26, 2014
Unscored —

CVE-2014-3301

The ProfileAction controller in Cisco WebEx Meetings Server (CWMS) 1.5(.1.131) and earlier allows remote attackers to o…

Jul 26, 2014
Unscored —

CVE-2014-3071

Cross-site scripting (XSS) vulnerability in the Data Quality Console in IBM InfoSphere Information Server 11.3 allows r…

Jul 26, 2014
Unscored —

CVE-2014-3324

Multiple cross-site scripting (XSS) vulnerabilities in the login page in the administrative web interface in Cisco Tele…

Jul 26, 2014
Unscored —

CVE-2014-3305

Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco WebEx Meetings Server 1.5(.1.131) and ear…

Jul 26, 2014
Unscored —

CVE-2014-3326

SQL injection vulnerability in the web framework in Cisco Security Manager 4.5 and 4.6 allows remote authenticated user…

Jul 26, 2014
Unscored —

CVE-2014-3328

The Intercluster Sync Agent Service in Cisco Unified Presence Server allows remote attackers to cause a denial of servi…

Jul 26, 2014
Critical 10.0

CVE-2014-2363

Morpho Itemiser 3 Hard-Coded Credential

Morpho Itemiser 3 8.17 has hardcoded administrative credentials, which makes it easier for remote attackers to obtain access via a login request.

Morpho Itemiser 3

Jul 26, 2014
Unscored —

CVE-2014-2227 Public exploit

The default Flash cross-domain policy (crossdomain.xml) in Ubiquiti Networks UniFi Video (formerly AirVision aka AirVis…

Jul 25, 2014
Unscored —

CVE-2014-5103

Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine EventLog Analyzer 9 build 9000 allows remote attackers to…

Jul 25, 2014
Unscored —

CVE-2014-5027

Cross-site scripting (XSS) vulnerability in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allows remote attac…

Jul 25, 2014
Unscored —

CVE-2014-5100 Public exploit

Multiple cross-site request forgery (CSRF) vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the a…

Jul 25, 2014
Unscored —

CVE-2014-5102

SQL injection vulnerability in vBulletin 5.0.4 through 5.1.3 Alpha 5 allows remote attackers to execute arbitrary SQL c…

Jul 25, 2014
Unscored —

CVE-2014-5101 Public exploit

Multiple cross-site scripting (XSS) vulnerabilities in WeBid 1.1.1 allow remote attackers to inject arbitrary web scrip…

Jul 25, 2014
Unscored —

CVE-2014-0607

Unrestricted file upload vulnerability in Attachmate Verastream Process Designer (VPD) before R6 SP1 Hotfix 1 allows re…

Jul 24, 2014
Unscored —

CVE-2014-1419

Race condition in the power policy functions in policy-funcs in acpi-support before 0.142 allows local users to gain pr…

acpi-support Debian

Jul 24, 2014
Unscored —

CVE-2014-4685

Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows local users to gain privileges by leveragi…

Jul 24, 2014
Unscored —

CVE-2014-4736 Public exploit

SQL injection vulnerability in E2 before 2.4 (2845) allows remote attackers to execute arbitrary SQL commands via the n…

Jul 24, 2014
Unscored —

CVE-2014-4686

The Project administration application in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, has a h…

Jul 24, 2014
Unscored —

CVE-2014-4927 Public exploit EPSS 11%

Buffer overflow in ACME micro_httpd, as used in D-Link DSL2750U and DSL2740U and NetGear WGR614 and MR-ADSL-DG834 route…

micro-httpd Ubuntu

Jul 24, 2014
Unscored —

CVE-2014-4682

The WebNavigator server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote attacker…

Jul 24, 2014
Unscored —

CVE-2014-4684

The database server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote authenticate…

Jul 24, 2014
Unscored —

CVE-2014-4910

Directory traversal vulnerability in tools/backlight_helper.c in X.Org xf86-video-intel 2.99.911 allows remote attacker…

Jul 24, 2014
Unscored —

CVE-2014-4683

The WebNavigator server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote authenti…

Jul 24, 2014
Unscored —

CVE-2014-3322

Cisco IOS XR 4.3(.2) and earlier on ASR 9000 devices does not properly perform NetFlow sampling of IP packets, which al…

Jul 24, 2014
Unscored —

CVE-2014-3110 Public exploit

Multiple cross-site scripting (XSS) vulnerabilities on Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earl…

Jul 24, 2014
Medium 4.6

CVE-2014-2369

Omron NS Series HMI Cross-Site Request Forgery

Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.

Omron NS12 NS8 NS15 ICS / OT

Jul 24, 2014
Unscored —

CVE-2014-2968

Cross-site scripting (XSS) vulnerability in the web interface on the Huawei E355 CH1E355SM modem with software 21.157.3…

Jul 24, 2014
Unscored —

CVE-2014-2717

Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.1…

Jul 24, 2014
Medium 4.0

CVE-2014-2370

Omron NS Series HMI Improper Neutralization of Input During Web Page Generation

Cross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to inject arbitrary web script or HTML via crafted data.

Omron NS12 NS8 NS15 ICS / OT

Jul 24, 2014
High 7.2

CVE-2014-2361

OleumTech WIO Family Key Management Errors

OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules, when BreeZ is used, do not require authentication for reading the site security key, which allows physically proximate attackers to spoof communication by obtaining this key after use of dire…

OleumTech WIO DH2 Wireless Gateway Sensor Wireless I/O Modules

Jul 24, 2014
Medium 5.0

CVE-2014-2360

OleumTech WIO Family Improper Input Validation

OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules allow remote attackers to execute arbitrary code via packets that report a high battery voltage.

OleumTech Sensor Wireless I/O Modules WIO DH2 Wireless Gateway

Jul 24, 2014
Unscored —

CVE-2014-2971

Cross-site scripting (XSS) vulnerability in AddStdLetter.jsp in MicroPact iComplaints before 8.0.2.1.8.8014 allows remo…

Jul 24, 2014
High 7.8

CVE-2014-2362

OleumTech WIO Use of Cryptographically Weak Pseudo-Random Number Generator

OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules rely exclusively on a time value for entropy in key generation, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by predicting the time of project creat…

OleumTech Sensor Wireless I/O Modules WIO DH2 Wireless Gateway

Jul 24, 2014
Unscored —

CVE-2014-5015

bozotic HTTP server (aka bozohttpd) before 20140708, as used in NetBSD, truncates paths when checking .htpasswd restric…

bozohttpd Ubuntu

Jul 24, 2014
Unscored —

CVE-2014-5024

Cross-site scripting (XSS) vulnerability in sgms/panelManager in Dell SonicWALL GMS, Analyzer, and UMA before 7.2 SP1 a…

Jul 24, 2014
Unscored —

CVE-2014-4501

Multiple stack-based buffer overflows in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 3.3.0 allow re…

Jul 23, 2014
Unscored —

CVE-2014-4503

The parse_notify function in util.c in sgminer before 4.2.2 and cgminer 3.3.0 through 4.0.1 allows man-in-the-middle at…

Jul 23, 2014
Unscored —

CVE-2014-4980

The /server/properties resource in Tenable Web UI before 2.3.5 for Nessus 5.2.3 through 5.2.7 allows remote attackers t…

Jul 23, 2014
Unscored —

CVE-2014-4502

Multiple heap-based buffer overflows in the parse_notify function in sgminer before 4.2.2, cgminer before 4.3.5, and BF…

Jul 23, 2014