Archive
July 2014
Vulnerabilities first published in this month (UTC), newest first.
653 results · Feed
-
Unscored —
OpenStack Neutron before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to …
-
Unscored —
Heap-based buffer overflow in Autodesk SketchBook Pro before 6.2.6 allows remote attackers to execute arbitrary code vi…
-
Unscored —
The web interface in CUPS before 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack …
-
Unscored —
Integer overflow in Autodesk SketchBook Pro before 6.2.6 allows remote attackers to execute arbitrary code via crafted …
-
Unscored —
The ConvolveHorizontally function in Skia, as used in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Th…
-
Unscored —
The mozilla::dom::AudioBufferSourceNodeEngine::CopyFromInputBuffer function in Mozilla Firefox before 31.0 and Thunderb…
-
Unscored —
Mozilla Firefox before 31.0 does not properly restrict use of drag-and-drop events to spoof customization events, which…
-
Unscored —
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0 and Thunderbird before 31.0 a…
-
Unscored —
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7…
-
Unscored —
Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to execut…
-
Unscored —
Use-after-free vulnerability in the nsDocLoader::OnProgress function in Mozilla Firefox before 31.0, Firefox ESR 24.x b…
-
Unscored —
Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (X.509 cert…
-
Unscored —
Use-after-free vulnerability in the MediaInputPort class in Mozilla Firefox before 31.0 and Thunderbird before 31.0 all…
-
Unscored —
Mozilla Firefox before 31.0 and Thunderbird before 31.0 do not properly implement the sandbox attribute of the IFRAME e…
-
Unscored —
Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (X.509 cert…
-
Unscored —
Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (X.509 cert…
-
Unscored —
Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services…
-
Unscored —
Use-after-free vulnerability in the FontTableRec destructor in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.…
-
Unscored —
Buffer overflow in the HVM graphics console support in Citrix XenServer 6.2 Service Pack 1 and earlier has unspecified …
-
Unscored —
Unspecified vulnerability in Citrix XenServer 6.2 Service Pack 1 and earlier allows attackers to cause a denial of serv…
-
Unscored —
jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0, Red Hat JBos…
-
High —
XML External Entity Reference in org.picketlink:picketlink-common
The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and p…
-
Unscored —CVE-2013-7392 Public exploit
Gitlist allows remote attackers to execute arbitrary commands via shell metacharacters in a file name to Source/.
-
High —
Elasticsearch Logstash allows remote attackers to execute arbitrary commands
Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) zabbix.rb or (2) nagios_nsca.rb in outputs/.
-
Unscored —
The ssl_decrypt_buf function in library/ssl_tls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remote attack…
-
Unscored —
Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the web UI in Sophos Anti-Virus for Linux before 9.6.1 allow loc…
-
Unscored —
The multisite feature in Drupal 6.x before 6.32 and 7.x before 7.29 allows remote attackers to cause a denial of servic…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Ajax system in Drupal 7.x before 7.29 allows remote attackers to inject…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7.x before 7.29 allows …
-
Unscored —
The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authen…
-
Unscored —CVE-2014-5023 Public exploit
Repository.php in Gitter, as used in Gitlist, allows remote attackers with commit privileges to execute arbitrary comma…
-
Unscored —CVE-2014-4960 Public exploit
Multiple SQL injection vulnerabilities in models\gallery.php in Youtube Gallery (com_youtubegallery) component 4.x thro…
-
Unscored —
Cross-site scripting (XSS) vulnerability in e107_admin/db.php in e107 2.0 alpha2 and earlier allows remote attackers to…
-
Unscored —
Incomplete blacklist vulnerability in the autoEscape function in common_helper.php in LimeSurvey 2.05+ Build 140618 all…
-
Unscored —
SQL injection vulnerability in CPDB in application/controllers/admin/participantsaction.php in LimeSurvey 2.05+ Build 1…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in LimeSurvey 2.05+ Build 140618 allow remote attackers to inject a…
-
Unscored —CVE-2013-4352 EPSS 12%
The cache_invalidate function in modules/cache/cache_storage.c in the mod_cache module in the Apache HTTP Server 2.4.6,…
-
Unscored —CVE-2014-0118 EPSS 37%
The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when…
-
Unscored —
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a deni…