Skip to content
OpenAdvisories

Archive

26 August 2014

Vulnerabilities first published on this day (UTC), newest first.

← July 2014 2014 / August /26 September 2014 →
  1. 113
  2. 2 
  3. 35
  4. 4 
  5. 5 
  6. 620
  7. 725
  8. 8 
  9. 9 
  10. 10 
  11. 117
  12. 1279
  13. 1312
  14. 1424
  15. 156
  16. 163
  17. 1717
  18. 1810
  19. 1920
  20. 2018
  21. 2112
  22. 2230
  23. 237
  24. 24 
  25. 2516
  26. 2621
  27. 2712
  28. 2813
  29. 2924
  30. 302
  31. 315
All Critical High Medium Low Exploited only Public exploit

21 results · Feed

  • High 7.5
    CVE-2014-0481

    Django denial of service via file upload naming

    The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, w…

    python-django django python-django Debian Ubuntu PyPI
  • Medium 5.3
    CVE-2014-0483

    Django data leakage via querystring manipulation in admin

    The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obt…

    python-django django python-django Debian Ubuntu PyPI
  • Medium 6.5
    CVE-2014-0482

    Django Middleware Enables Session Hijacking

    The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users …

    python-django django python-django Debian Ubuntu PyPI
  • High 7.5
    CVE-2014-0480

    Django Incorrectly Validates URLs

    The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a U…

    python-django django python-django Debian Ubuntu PyPI
  • Unscored —
    CVE-2014-3061

    Cross-site request forgery (CSRF) vulnerability in IBM Emptoris Spend Analysis 9.5.x before 9.5.0.4, 10.0.1.x before 10…

  • Unscored —
    CVE-2014-3041

    SQL injection vulnerability in IBM Emptoris Contract Management 9.5.x before 9.5.0.6 iFix 10, 10.0.0.x before 10.0.0.1 …

  • Unscored —
    CVE-2014-3907

    Cross-site request forgery (CSRF) vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.11 f…

  • Unscored —
    CVE-2014-3524 EPSS 14%

    Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecifie…

    libreoffice Ubuntu
  • Unscored —
    CVE-2014-3034

    Cross-site scripting (XSS) vulnerability in IBM Emptoris Contract Management 9.5.x before 9.5.0.6 iFix 10, 10.0.0.x bef…

  • Unscored —
    CVE-2014-3035

    Cross-site scripting (XSS) vulnerability in IBM Emptoris Spend Analysis 9.5.x before 9.5.0.4, 10.0.1.x before 10.0.1.3,…

  • Unscored —
    CVE-2014-2527

    kcleanup.cpp in KDirStat 2.7.0 does not properly quote strings when deleting a directory, which allows remote attackers…

  • Unscored —
    CVE-2014-2528

    kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory, which allows remote attackers…

    k4dirstat Debian
  • Unscored —
    CVE-2014-5307

    Heap-based buffer overflow in the PavTPK.sys kernel mode driver of Panda Security 2014 products before hft131306s24_r1 …

  • Unscored —
    CVE-2014-5263

    vmstate_xhci_event in hw/usb/hcd-xhci.c in QEMU 1.6.0 does not terminate the list with the VMSTATE_END_OF_LIST macro, w…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2014-5336

    Monkey HTTP Server before 1.5.3, when the File Descriptor Table (FDT) is enabled and custom error messages are set, all…

  • Unscored —
    CVE-2014-5035

    The Netconf (TCP) service in OpenDaylight 1.0 allows remote attackers to read arbitrary files via an XML external entit…

  • Unscored —
    CVE-2013-6335

    The Backup-Archive client in IBM Tivoli Storage Manager (TSM) for Space Management 5.x and 6.x before 6.2.5.3, 6.3.x be…

  • Unscored —
    CVE-2014-4790

    IBM Emptoris Sourcing Portfolio 9.5.x before 9.5.1.3, 10.0.0.x before 10.0.0.1, 10.0.1.x before 10.0.1.3, and 10.0.2.x …

  • Unscored —
    CVE-2014-3033

    Cross-site scripting (XSS) vulnerability in IBM Emptoris Sourcing Portfolio 9.5.x before 9.5.1.3, 10.0.0.x before 10.0.…

  • Unscored —
    CVE-2014-3335

    Cisco IOS XR 4.3(.2) and earlier on ASR 9000 devices does not properly perform NetFlow sampling of packets with multica…

  • Unscored —
    CVE-2014-3040

    Cross-site request forgery (CSRF) vulnerability in IBM Emptoris Contract Management 9.5.x before 9.5.0.6 iFix 10, 10.0.…