Skip to content
OpenAdvisories

Archive

October 2014

Vulnerabilities first published in this month (UTC), newest first.

← September 2014 2014 / October November 2014 →
  1. 18
  2. 254
  3. 330
  4. 429
  5. 56
  6. 628
  7. 720
  8. 842
  9. 96
  10. 1051
  11. 1111
  12. 122
  13. 1316
  14. 1411
  15. 15196
  16. 16126
  17. 1723
  18. 1825
  19. 19244
  20. 20146
  21. 21181
  22. 2219
  23. 2310
  24. 242
  25. 2521
  26. 2612
  27. 2716
  28. 289
  29. 2933
  30. 307
  31. 3129
All Critical High Medium Low Exploited only Public exploit

1,413 results · Feed

  • Medium —
    CVE-2014-3473

    Horizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name

    Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestrati…

    horizon horizon horizon Debian Ubuntu PyPI
  • Unscored —
    CVE-2014-3475

    Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013…

    horizon horizon Debian Ubuntu
  • Low —
    CVE-2014-3474

    OpenStack Horizon Cross-site scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject…

    horizon horizon horizon Debian Ubuntu PyPI
  • Unscored —
    CVE-2014-8578

    Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 b…

    horizon horizon Debian Ubuntu
  • Medium —
    CVE-2013-0334

    Bundler may install gems from a different source than expected

    Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.

    bundler RubyGems
  • Unscored —
    CVE-2014-7987

    Cross-site scripting (XSS) vulnerability in EspoCRM before 2.6.0 allows remote attackers to inject arbitrary web script…

  • Unscored —
    CVE-2014-7985

    Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary loca…

  • Unscored —
    CVE-2014-7177 Public exploit

    XML External Entity vulnerability in Enalean Tuleap 7.2 and earlier allows remote authenticated users to read arbitrary…

  • Unscored —
    CVE-2014-7986

    install/index.php in EspoCRM before 2.6.0 allows remote attackers to re-install the application via a 1 value in the in…

  • Medium —
    CVE-2014-3708

    OpenStack Compute (Nova) Denial of Service vulnerability

    OpenStack Compute (Nova) before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (CPU consumption) via an IP filter in a list active servers API request.

    nova nova Debian PyPI
  • Unscored —
    CVE-2014-2335

    Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 all…

  • Unscored —
    CVE-2014-2334

    Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiAnalyzer before 5.0.7 al…

  • Unscored —
    CVE-2014-2336

    Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 and…

  • Unscored —
    CVE-2014-8577 Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in Croogo before 2.1.0 allow remote attackers to inject arbitrary w…

  • Unscored —
    CVE-2014-8081

    lib/execute/execSetResults.php in TestLink before 1.9.13 allows remote attackers to conduct PHP object injection attack…

  • Unscored —
    CVE-2014-8495

    Citrix XenMobile MDX Toolkit before 9.0.4, when used to wrap iOS 8 applications, does not properly encrypt cached appli…

  • Unscored —
    CVE-2014-8399

    The default configuration in systemd-shim 8 enables the Abandon debugging clause, which allows local users to cause a d…

  • Unscored —
    CVE-2014-8334

    The WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote authenticated users to execute …

  • Unscored —
    CVE-2014-8509

    The lazy_bdecode function in BitTorrent bootstrap-dht (aka Bootstrap) allows remote attackers to execute arbitrary code…

  • Unscored —
    CVE-2014-8082

    lib/functions/database.class.php in TestLink before 1.9.13 allows remote attackers to obtain sensitive information via …

  • Medium —
    CVE-2014-8333

    OpenStack Nova VMware instance leak potentially leading to compute DoS

    The VMware driver in OpenStack Compute (Nova) before 2014.1.4 allows remote authenticated users to cause a denial of service (disk consumption) by deleting an instance in the resize state.

    nova nova Debian PyPI
  • Unscored —
    CVE-2014-6148

    IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.2.0.0 through 7.2.0.10, 7.2.1.0 through 7.2.1.6, and 7.2.…

  • Unscored —
    CVE-2014-6101

    Cross-site scripting (XSS) vulnerability in the redirect-login feature in IBM Business Process Manager (BPM) Advanced 7…

  • Unscored —
    CVE-2014-6150

    Cross-site scripting (XSS) vulnerability in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.2.1.0 through…

  • Unscored —
    CVE-2014-3375

    Multiple cross-site scripting (XSS) vulnerabilities in the CCM Service interface in the Server in Cisco Unified Communi…

  • Unscored —
    CVE-2014-3373

    Multiple cross-site scripting (XSS) vulnerabilities in the CCM Dialed Number Analyzer interface in the Server in Cisco …

  • Unscored —
    CVE-2014-3372

    Multiple cross-site scripting (XSS) vulnerabilities in the CCM reports interface in the Server in Cisco Unified Communi…

  • Unscored —
    CVE-2014-3374

    Multiple cross-site scripting (XSS) vulnerabilities in the CCM admin interface in the Server in Cisco Unified Communica…

  • Unscored —
    CVE-2014-3366

    SQL injection vulnerability in the administrative web interface in Cisco Unified Communications Manager allows remote a…

  • Unscored —
    CVE-2013-7409 Public exploit EPSS 68%

    Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possi…

  • Unscored —
    CVE-2013-3304 Public exploit

    Directory traversal vulnerability in Dell EqualLogic PS4000 with firmware 6.0 allows remote attackers to read arbitrary…

  • Unscored —
    CVE-2014-3446

    SQL injection vulnerability in wcm/system/pages/admin/getnode.aspx in BSS Continuity CMS 4.2.22640.0 allows remote atta…

  • Medium —
    CVE-2014-3623

    Improper Authentication in Apache WSS4J

    Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to …

    org.apache.ws.security:wss4j org.apache.wss4j:wss4j-ws-security-dom Maven
  • Medium —
    CVE-2014-3584

    Loop with Unreachable Exit Condition in Apache CXF

    The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service.

    org.apache.cxf:cxf-rt-frontend-jaxrs Maven
  • Unscored —
    CVE-2014-3684

    The tm_adopt function in lib/Libifl/tm.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manag…

    torque Ubuntu
  • Unscored —
    CVE-2014-7877

    Unspecified vulnerability in the kernel in HP HP-UX B.11.31 allows local users to cause a denial of service via unknown…

  • Unscored —
    CVE-2014-8538

    The Hijab Modern (aka com.Aisyaidea.HijabModern) application 1.0 for Android does not verify X.509 certificates from SS…

  • Unscored —
    CVE-2014-8523

    Cross-site request forgery (CSRF) vulnerability in McAfee Network Data Loss Prevention (NDLP) before 9.3 allows remote …

  • Unscored —
    CVE-2014-8526

    McAfee Network Data Loss Prevention (NDLP) before 9.3 allows local users to obtain sensitive information by reading a J…

  • Unscored —
    CVE-2014-8528

    McAfee Network Data Loss Prevention (NDLP) before 9.3 logs session IDs, which allows local users to obtain sensitive in…