Skip to content
OpenAdvisories

Archive

September 2014

Vulnerabilities first published in this month (UTC), newest first.

← August 2014 2014 / September October 2014 →
  1. 13
  2. 212
  3. 310
  4. 423
  5. 515
  6. 6 
  7. 7 
  8. 85
  9. 9326
  10. 1079
  11. 1145
  12. 1222
  13. 13 
  14. 14 
  15. 1527
  16. 16 
  17. 1732
  18. 1893
  19. 1935
  20. 2041
  21. 21 
  22. 2262
  23. 2359
  24. 2412
  25. 2527
  26. 2623
  27. 2717
  28. 2842
  29. 2953
  30. 3083
All Critical High Medium Low Exploited only Public exploit

17 results · Clear filters · Feed

  • High 7.2
    CVE-2012-5485

    Plone Code Injection vulnerability

    registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

    plone PyPI
  • High 7.5
    CVE-2012-5486

    HTTP header injection in Plone and Zope2

    ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

    plone zope2 PyPI
  • High 7.5
    CVE-2012-5501

    Plone Arbitrary File Read

    at_download.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs (Files and Images) stored on custom content types via a crafted URL.

    plone PyPI
  • High 7.5
    CVE-2012-5505

    Plone Information Disclosure

    atat.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a request for a view without a name.

    plone PyPI
  • High 7.5
    CVE-2012-5496

    Plone DoS via Crafted URL

    kupu_spellcheck.py in Kupu in Plone before 4.0 allows remote attackers to cause a denial of service (ZServer thread lock) via a crafted URL.

    plone PyPI
  • High 7.5
    CVE-2012-5506

    Plone denial of service via RSS Feed Request

    python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (infinite loop) via an RSS feed request for a folder the user does not have permission to access.

    plone PyPI
  • High 7.5
    CVE-2012-5498

    Plone denial of service via Caching Bypass

    queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of service via a crafted request to a collection.

    plone PyPI
  • High 7.5
    CVE-2012-5499

    Plone is vulnerable to denial of service

    python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (memory consumption) via a large value, related to formatColumns.

    plone PyPI
  • High 7.5
    CVE-2012-5503

    Plone allows remote attackers to read hidden folder contents

    ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors.

    plone PyPI
  • High 7.5
    CVE-2012-5507

    Plone and Zope2 affected by Race Condition

    AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.

    plone zope2 PyPI
  • High 8.8
    CVE-2014-6278 Exploited Public exploit EPSS 100%

    GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, wh…

    bash bash Debian Ubuntu
    KEV Oct 2, 2025
  • High 8.8
    CVE-2013-3632 Public exploit EPSS 57%

    The Cron service in rpc.php in OpenMediaVault allows remote authenticated users to execute cron jobs as arbitrary users…

  • High —
    CVE-2013-2100

    Gentoo Portage does not verify X.509 certificates from SSL servers

    The urlopen function in pym/portage/util/_urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certi…

    portage PyPI
  • High 7.8
    CVE-2014-4404 Exploited Public exploit EPSS 49%

    Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbit…

    KEV Feb 10, 2022
  • High 8.3
    CVE-2014-2375

    Ecava IntegraXor SCADA Server External Control of File Name or Path

    Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service (disk consumption), via the CSV export feature.

    Ecava IntegraXor SCADA Server
  • High 7.5
    CVE-2014-2376

    Ecava IntegraXor SCADA Server SQL Injection

    SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

    Ecava IntegraXor SCADA Server
  • High —
    CVE-2012-6153

    Improper certificate validation in org.apache.httpcomponents:httpclient

    http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-m…

    org.apache.httpcomponents:httpclient commons-httpclient Debian Maven