Archive
4 September 2014
Vulnerabilities first published on this day (UTC), newest first.
23 results · Feed
-
High —
Improper certificate validation in org.apache.httpcomponents:httpclient
http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-m…
-
Unscored —
The get_option function in dhcpcd 4.0.0 through 6.x before 6.4.3 allows remote DHCP servers to cause a denial of servic…
-
Medium —
Improper Input Validation in Apache POI
Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
-
Medium —CVE-2014-3529 EPSS 13%
Improper Restriction of XML External Entity Reference in Apache POI
The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
-
Unscored —
The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Ze…
-
Unscored —
expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and ex…
-
Unscored —
The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attacker…
-
Unscored —
Stack-based buffer overflow in SAP Crystal Reports allows remote attackers to execute arbitrary code via a crafted data…
-
Unscored —
Double free vulnerability in SAP Crystal Reports allows remote attackers to execute arbitrary code via crafted connecti…
-
Unscored —
Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to …
-
Unscored —
ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user ac…
-
Unscored —
SolarWinds Log and Event Manager before 6.0 uses "static" credentials, which makes it easier for remote attackers to ob…
-
Unscored —CVE-2012-4234 Public exploit
Cross-site scripting (XSS) vulnerability in the group moderation screen in the control center (control.php) in Phorum b…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote atta…
-
Unscored —
An unspecified Ajax service in the Content Management toolkit in IBM Business Process Manager (BPM) 8.5.x through 8.5.5…
-
Unscored —
IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.x allow remote authenticated …
-
Unscored —
IBM DB2 10.5 before FP4 on Linux and AIX creates temporary files during CDE table LOAD operations, which allows local u…
-
Unscored —
The SQL engine in IBM DB2 9.5 through FP10, 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on…
-
Unscored —
Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombar…
-
Unscored —
Cisco IOS XR 4.3(.2) and earlier, as used in Cisco Carrier Routing System (CRS), allows remote attackers to cause a den…
-
Unscored —
Stack-based buffer overflow in IBM DB2 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linu…
-
Unscored —
Unspecified vulnerability in the Authentication Module in TIBCO Spotfire Server before 4.5.2, 5.0.x before 5.0.3, 5.5.x…
-
Unscored —CVE-2014-5461 EPSS 12%
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attacke…