Archive
August 2014
Vulnerabilities first published in this month (UTC), newest first.
401 results · Feed
-
Unscored —
IBM WebSphere Portal 8.0.0 before 8.0.0.1 CF13 and 8.5.0 through CF01 provides different error codes for firewall-trave…
-
Unscored —
Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.0.0 through 7.0.0.2 CF28 and 8.0.0 before 8.0.0.1 CF…
-
Unscored —
Gretech GOM Player 2.2.51.5149 and earlier allows remote attackers to cause a denial of service (launch outage) via a c…
-
Unscored —CVE-2014-2630 Public exploit
Unspecified vulnerability in HP Operations Agent 11.00, when Glance is used, allows local users to gain privileges via …
-
Unscored —
The Data Growth Solution for JD Edwards EnterpriseOne in IBM InfoSphere Optim 3.0 through 9.1 has hardcoded database cr…
-
Unscored —
The Outlook Extension in IBM Content Collector 4.0.0.x before 4.0.0.0-ICC-OE-IF004 allows local users to bypass the int…
-
Unscored —
Unspecified vulnerability in the IBM Java Virtual Machine, as used in IBM WebSphere Real Time 3 before Service Refresh …
-
Unscored —
Cross-site scripting (XSS) vulnerability in IBM Tivoli Business Service Manager 4.2.0 before 4.2.0.0 IF12 and 4.2.1 bef…
-
Unscored —
Multiple CRLF injection vulnerabilities in the Universal Access component in IBM Curam Social Program Management (SPM) …
-
Unscored —
Unspecified vulnerability in HP Application Lifecycle Management (aka Quality Center) 11.5x and 12.0x allows local user…
-
Unscored —
Unspecified vulnerability in HP Enterprise Maps 1 allows remote authenticated users to obtain sensitive information via…
-
Unscored —
IBM Business Process Manager (BPM) 8.5 through 8.5.5 allows remote attackers to obtain potentially sensitive informatio…
-
Unscored —
The EnergyWise module in Cisco IOS 12.2, 15.0, 15.1, 15.2, and 15.4 and IOS XE 3.2.xXO, 3.3.xSG, 3.4.xSG, and 3.5.xE be…
-
Unscored —
Cisco NX-OS 6.1(2)I2(1) on Nexus 9000 switches does not properly process packet-drop policy checks for logged packets, …
-
High 8.3
SUBNET SubSTATION Server 2 Telegyr 8979 Master Protocol Improper Input Validation
The GPT library in the Telegyr 8979 Master Protocol application in SUBNET SubSTATION Server 2 before SSNET 2.12 HF18808 allows remote attackers to cause a denial of service (persistent service crash) via a long RTU-to-Master message.
-
Unscored —
The server in Cisco Unity Connection 9.1(1) and 9.1(2) allows remote authenticated users to obtain privileged access by…
-
Unscored —
Cisco Unified Communications Manager (CM) 8.6(.2) and earlier has an incorrect CLI restrictions setting, which allows r…
-
Unscored —
SQL injection vulnerability in the web framework in Cisco Unity Connection 9.1(2) and earlier allows remote authenticat…
-
Unscored —
The "runshellscript echo.sh" script in Splunk before 5.0.5 allows remote authenticated users to execute arbitrary comma…
-
Unscored —
Directory traversal vulnerability in the collect script in Splunk before 5.0.5 allows remote attackers to execute arbit…
-
Unscored —
Stack-based buffer overflow in the loadExtensionFactory method in the TSVisualization ActiveX control in Embarcadero ER…
-
Unscored —CVE-2014-3854 Public exploit
Cross-site request forgery (CSRF) vulnerability in admin/addScript.py in Pyplate 0.08 allows remote attackers to hijack…
-
Unscored —
TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via the language file path in a (1) reques…
-
Unscored —
usr/lib/cgi-bin/create_passwd_file.py in Pyplate 0.08 uses world-readable permissions for passwd.db, which allows local…
-
Medium —
OpenStack Compute (Nova) Exposure of Sensitive Information to an Unauthorized Actor vulnerability
api/metadata/handler.py in OpenStack Compute (Nova) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2, when proxying metadata requests through Neutron, makes it easier for remote attackers to guess instance ID signatures via a brute-force attack…
-
Unscored —
Directory traversal vulnerability in download.py in Pyplate 0.08 allows remote attackers to read arbitrary files via a …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in items.php in TeamPass before 2.1.20 allow remote attackers to in…
-
Unscored —
XBMC 13.0 uses world-readable permissions for .xbmc/userdata/sources.xml, which allows local users to obtain user names…
-
Unscored —
Pyplate 0.08 does not include the HTTPOnly flag in a Set-Cookie header for the id cookie, which makes it easier for rem…
-
Unscored —
Directory traversal vulnerability in the Admin Center for Tivoli Storage Manager (TSM) in Rocket ServerGraph 1.2 allows…
-
Unscored —CVE-2014-3459 EPSS 12%
Heap-based buffer overflow in SolarWinds Network Configuration Manager (NCM) before 7.3 allows remote attackers to exec…
-
Unscored —
Pyplate 0.08 does not set the secure flag for the id cookie in an https session, which makes it easier for remote attac…
-
Unscored —
TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via a request to index.php followed by a d…
-
Unscored —
Multiple SQL injection vulnerabilities in TeamPass before 2.1.20 allow remote attackers to execute arbitrary SQL comman…
-
Critical 9.8
IPython Notebook vulnerable to improper validation of the origin of websocket requests
IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.
-
Unscored —
Cross-site scripting (XSS) vulnerability in captcha-secureimage/test/index.php in the SI CAPTCHA Anti-Spam plugin 2.7.4…
-
Unscored —
Unity before 7.2.3 and 7.3.x before 7.3.1, as used in Ubuntu, does not properly take focus of the keyboard when switchi…
-
Unscored —CVE-2014-5192 Public exploit
SQL injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to execute arbitrary SQL comman…
-
Unscored —CVE-2014-5194 Public exploit
Static code injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote authenticated users to inject arb…
-
Medium —
The Preview plugin in CKEditor allows Cross-site scripting (XSS)
Cross-site scripting (XSS) vulnerability in the Preview plugin before 4.4.3 in CKEditor allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.