Skip to content
OpenAdvisories

Archive

September 2014

Vulnerabilities first published in this month (UTC), newest first.

← August 2014 2014 / September October 2014 →
  1. 13
  2. 212
  3. 310
  4. 423
  5. 515
  6. 6 
  7. 7 
  8. 85
  9. 9326
  10. 1079
  11. 1145
  12. 1222
  13. 13 
  14. 14 
  15. 1527
  16. 16 
  17. 1732
  18. 1893
  19. 1935
  20. 2041
  21. 21 
  22. 2262
  23. 2359
  24. 2412
  25. 2527
  26. 2623
  27. 2717
  28. 2842
  29. 2953
  30. 3083
All Critical High Medium Low Exploited only Public exploit

1,146 results · Feed

  • High 7.5
    CVE-2012-5498

    Plone denial of service via Caching Bypass

    queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of service via a crafted request to a collection.

    plone PyPI
  • Medium 6.1
    CVE-2012-5504

    Plone Cross-site scripting Vulnerability

    Cross-site scripting (XSS) vulnerability in widget_traversal.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    plone PyPI
  • High 7.5
    CVE-2012-5499

    Plone is vulnerable to denial of service

    python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (memory consumption) via a large value, related to formatColumns.

    plone PyPI
  • High 7.5
    CVE-2012-5503

    Plone allows remote attackers to read hidden folder contents

    ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors.

    plone PyPI
  • High 7.5
    CVE-2012-5507

    Plone and Zope2 affected by Race Condition

    AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.

    plone zope2 PyPI
  • Unscored —
    CVE-2014-0170

    Teiid before 8.4.3 and before 8.7 and Red Hat JBoss Data Virtualization 6.0.0 before patch 3 allows remote attackers to…

  • Unscored —
    CVE-2014-7199

    Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.19, 1.22.x before 1.22.11, and 1.23.x before 1.23.4 a…

    mediawiki Debian
  • Unscored —
    CVE-2014-6273

    Buffer overflow in the HTTP transport code in apt-get in APT 1.0.1 and earlier allows man-in-the-middle attackers to ca…

    apt apt Debian Ubuntu
  • Unscored —
    CVE-2014-6269

    Multiple integer overflows in the http_request_forward_body function in proto_http.c in HAProxy 1.5-dev23 before 1.5.4 …

    haproxy Debian
  • Medium —
    CVE-2014-3558

    Improper Authentication in Hibernate Validator

    ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager (JSM) restrictions and execute restricted reflection calls vi…

    libhibernate-validator-java org.hibernate:hibernate-validator Debian Maven
  • Unscored —
    CVE-2014-5267

    modules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31 allows remote attackers to have unspecified impac…

    drupal7 Ubuntu
  • Unscored —
    CVE-2014-5444

    Geary before 0.6.3 does not present the user with a warning when a TLS certificate error is detected, which makes it ea…

    geary Debian
  • Unscored —
    CVE-2014-6813

    The klassens (aka com.mcreda.klassens.apps) application 1.0 for Android does not verify X.509 certificates from SSL ser…

  • Unscored —
    CVE-2014-6834

    The Instaroid - Instagram Viewer (aka net.muik.instaroid) application 1.2.1 for Android does not verify X.509 certifica…

  • Unscored —
    CVE-2014-6818

    The OHBM 20th Annual Meeting (aka com.coreapps.android.followme.ohbm2014) application 6.0.9.2 for Android does not veri…

  • Unscored —
    CVE-2014-6822

    The Nerdico (aka com.nerdico.danielepais) application 1.9 Stable for Android does not verify X.509 certificates from SS…

  • High 8.8
    CVE-2014-6278 Exploited Public exploit EPSS 100%

    GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, wh…

    bash bash Debian Ubuntu
    KEV Oct 2, 2025
  • Unscored —
    CVE-2014-6805

    The weibo (aka magic.weibo) application 1.2 for Android does not verify X.509 certificates from SSL servers, which allo…

  • Unscored —
    CVE-2014-6821

    The voetbal (aka nl.jborsje.android.voetbal.az) application 4.7.2 for Android does not verify X.509 certificates from S…

  • Unscored —
    CVE-2014-6820

    The Amebra Ameba (aka jp.honeytrap15.amebra) application 1.0.0 for Android does not verify X.509 certificates from SSL …

  • Unscored —
    CVE-2014-6828

    The Gulf Credit Union (aka Fi_Mobile.Gulf) application 1.1 for Android does not verify X.509 certificates from SSL serv…

  • Unscored —
    CVE-2014-6830

    The Covet Fashion - Shopping Game (aka com.crowdstar.covetfashion) application 2.14.40 for Android does not verify X.50…

  • Unscored —
    CVE-2014-6806

    The Thanodi - Setswana Translator (aka com.thanodi.thanodi) application 1.0.0 for Android does not verify X.509 certifi…

  • Unscored —
    CVE-2014-6819

    The Lapp Group Catalogue (aka com.prinovis.LappKabel) application 1.4 for Android does not verify X.509 certificates fr…

  • Unscored —
    CVE-2014-6833

    The AuctionTrac Dealer (aka com.adesa.dealer.phone) application 2.0.3 for Android does not verify X.509 certificates fr…

  • Unscored —
    CVE-2014-6817

    The Cove (aka org.covechurch.app) application 1.0.2 for Android does not verify X.509 certificates from SSL servers, wh…

  • Unscored —
    CVE-2014-6824

    The kamkomesan (aka com.anek.kamkomesan) application 1.0 for Android does not verify X.509 certificates from SSL server…

  • Unscored —
    CVE-2014-6812

    The Aloha Guide (aka com.aloha.guide.english) application 1.5 for Android does not verify X.509 certificates from SSL s…

  • Unscored —
    CVE-2014-6815

    The Vouch! (aka com.voucherry.voucherry) application 2.1.6 for Android does not verify X.509 certificates from SSL serv…

  • Unscored —
    CVE-2014-6826

    The Tic-Tac To The MAX FREE (aka com.tothemax) application 1.2 for Android does not verify X.509 certificates from SSL …

  • Unscored —
    CVE-2014-6832

    The Bersa Forum (aka com.gcspublishing.bersaforum) application 3.9.16 for Android does not verify X.509 certificates fr…

  • Unscored —
    CVE-2014-6831

    The Hippo Studio (aka com.appgreen.hippostudio) application 1.0 for Android does not verify X.509 certificates from SSL…

  • Unscored —
    CVE-2014-6807

    The OLA School (aka com.conduit.app_00f9890a4f0145f2aae9d714e20b273a.app) application 1.2.7.132 for Android does not ve…

  • Unscored —
    CVE-2014-6814

    The Sentinels Randomizer (aka com.mikehipps.sentinelsrandomizer) application 1.1.0 for Android does not verify X.509 ce…

  • Unscored —
    CVE-2014-6808

    The Active 24 (aka com.zentity.app.active24) application 1.0.1 for Android does not verify X.509 certificates from SSL …

  • Unscored —
    CVE-2014-6827

    The DK ONLINE Beta (aka com.sgmobile.dkonline) application 1.0.2 for Android does not verify X.509 certificates from SS…

  • Unscored —
    CVE-2014-6829

    The Hook (aka com.hook.android) application 0.9.3 for Android does not verify X.509 certificates from SSL servers, whic…

  • Unscored —
    CVE-2014-6825

    The Teatro Franco Parenti (aka com.mintlab.mx.teatroparenti) application 1.4.0 for Android does not verify X.509 certif…

  • Unscored —
    CVE-2014-6823

    The kuailecaidengmi (aka com.licai.kuailecaidengmi) application 1.7.12.15 for Android does not verify X.509 certificate…

  • Unscored —
    CVE-2014-6810

    The RIMS 2014 Annual Conference (aka com.coreapps.android.followme.rims2014) application 6.0.7.4 for Android does not v…