Archive
September 2014
Vulnerabilities first published in this month (UTC), newest first.
1,146 results · Feed
-
Unscored —
Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of servic…
-
Unscored —
Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified,…
-
Unscored —CVE-2014-5464 Public exploit
Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng (aka ntop) before 1.2.1 a…
-
Unscored —
IBM Cognos TM1 10.2.0.2 before IF1 and 10.2.2.0 before IF1 allows remote attackers to bypass intended access restrictio…
-
Unscored —
The Arris Touchstone DG950A cable modem with software 7.10.131 has an SNMP community of public, which allows remote att…
-
Unscored —CVE-2014-4862 EPSS 17%
The Netmaster CBW700N cable modem with software 81.447.392110.729.024 has an SNMP community of public, which allows rem…
-
Unscored —
Emurasoft EmFTP allows local users to gain privileges via a Trojan horse executable file that is launched during an att…
-
Unscored —
Session fixation vulnerability in Falcon WisePoint 4.1.19.7 and earlier allows remote attackers to hijack web sessions …
-
Medium 4.3
Sensys Networks Traffic Sensor Missing Encryption of Sensitive Data
Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not use encryption, which allows remote attackers to interfere with traffic control by replaying transmissions on a wireless network.
-
Medium 6.5
Sensys Networks Traffic Sensor Download of Code Without Integrity Check
Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not verify the integrity of downloaded updates, which allows remote attackers to execute arbitrary code via a Trojan horse update.
-
Unscored —
Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that trigge…
-
Unscored —
Buffer overflow in disp+work.exe 7000.52.12.34966 and 7200.117.19.50294 in the Dispatcher in SAP NetWeaver 7.00 and 7.2…
-
Unscored —
TorrentFlux 2.4 allows remote authenticated users to obtain other users' cookies via the cid parameter in an editCookie…
-
Unscored —
TorrentFlux 2.4 allows remote authenticated users to delete or modify other users' cookies via the cid parameter in an …
-
Unscored —
Multiple integer overflows in the HelpServ module (mod-helpserv.c) in srvx 1.3.1 allow remote authenticated IRCops or H…
-
Unscored —
The Storage Controller (SC) component in Eucalyptus 3.4.2 through 4.0.x before 4.0.1, when Dell Equallogic SAN is used,…
-
Unscored —
The client in Novell GroupWise before 8.0.3 HP4, 2012 before SP3, and 2014 before SP1 on Windows allows remote attacker…
-
Unscored —
The client in IBM Cognos TM1 9.5.2.3 before IF5, 10.1.1.2 before IF1, 10.2.0.2 before IF1, and 10.2.2.0 before IF1 stor…
-
High —
Improper certificate validation in org.apache.httpcomponents:httpclient
http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-m…
-
Unscored —
The get_option function in dhcpcd 4.0.0 through 6.x before 6.4.3 allows remote DHCP servers to cause a denial of servic…
-
Medium —
Improper Input Validation in Apache POI
Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
-
Medium —CVE-2014-3529 EPSS 13%
Improper Restriction of XML External Entity Reference in Apache POI
The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
-
Unscored —
The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Ze…
-
Unscored —
expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and ex…
-
Unscored —
The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attacker…
-
Unscored —
Stack-based buffer overflow in SAP Crystal Reports allows remote attackers to execute arbitrary code via a crafted data…
-
Unscored —
Double free vulnerability in SAP Crystal Reports allows remote attackers to execute arbitrary code via crafted connecti…
-
Unscored —
Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to …
-
Unscored —
ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user ac…
-
Unscored —
SolarWinds Log and Event Manager before 6.0 uses "static" credentials, which makes it easier for remote attackers to ob…
-
Unscored —CVE-2012-4234 Public exploit
Cross-site scripting (XSS) vulnerability in the group moderation screen in the control center (control.php) in Phorum b…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote atta…
-
Unscored —
An unspecified Ajax service in the Content Management toolkit in IBM Business Process Manager (BPM) 8.5.x through 8.5.5…
-
Unscored —
IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.x allow remote authenticated …
-
Unscored —
IBM DB2 10.5 before FP4 on Linux and AIX creates temporary files during CDE table LOAD operations, which allows local u…
-
Unscored —
The SQL engine in IBM DB2 9.5 through FP10, 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on…
-
Unscored —
Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombar…
-
Unscored —
Cisco IOS XR 4.3(.2) and earlier, as used in Cisco Carrier Routing System (CRS), allows remote attackers to cause a den…
-
Unscored —
Stack-based buffer overflow in IBM DB2 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linu…
-
Unscored —
Unspecified vulnerability in the Authentication Module in TIBCO Spotfire Server before 4.5.2, 5.0.x before 5.0.3, 5.5.x…