Skip to content
OpenAdvisories

Archive

3 October 2014

Vulnerabilities first published on this day (UTC), newest first.

← September 2014 2014 / October /3 November 2014 →
  1. 18
  2. 254
  3. 330
  4. 429
  5. 56
  6. 628
  7. 720
  8. 842
  9. 96
  10. 1051
  11. 1111
  12. 122
  13. 1316
  14. 1411
  15. 15196
  16. 16126
  17. 1723
  18. 1825
  19. 19244
  20. 20146
  21. 21181
  22. 2219
  23. 2310
  24. 242
  25. 2521
  26. 2612
  27. 2716
  28. 289
  29. 2933
  30. 307
  31. 3129
All Critical High Medium Low Exploited only Public exploit

30 results · Feed

  • Critical 10.0
    CVE-2014-0754

    Schneider Electric

    Directory traversal vulnerability in SchneiderWEB on Schneider Electric Modicon PLC Ethernet modules 140CPU65x Exec before 5.5, 140NOC78x Exec before 1.62, 140NOE77x Exec before 6.2, BMXNOC0401 before 2.05, BMXNOE0100 before 2.9, BMXNOE0110x Exec before 6.0, …

    Schneider Electric Ethernet modules for M340, Quantum and Premium PLC ranges ICS / OT
  • High 7.1
    CVE-2014-5410

    Rockwell Automation Micrologix 1400 Improper Input Validation

    The DNP3 feature on Rockwell Automation Allen-Bradley MicroLogix 1400 1766-Lxxxxx A FRN controllers 7 and earlier and 1400 1766-Lxxxxx B FRN controllers before 15.001 allows remote attackers to cause a denial of service (process disruption) via malformed pack…

    Rockwell Automation Allen-Bradley MicroLogix 1400 ICS / OT
  • Unscored —
    CVE-2014-6291

    Cross-site scripting (XSS) vulnerability in the Alphabetic Sitemap (alpha_sitemap) extension 0.0.3 and earlier for TYPO…

  • High —
    CVE-2014-6289

    yag and pt_extbase extensions for TYPO3 allow remote attackers to bypass access restrictions

    The Ajax dispatcher for Extbase in the Yet Another Gallery (yag) extension before 3.0.1 and Tools for Extbase development (pt_extbase) extension before 1.5.1 allows remote attackers to bypass access restrictions and execute arbitrary controller actions via un…

    dl/yag punktde/pt_extbase Packagist
  • Unscored —
    CVE-2014-6290

    The News (tt_news) extension before 3.5.2 for TYPO3 allows remote attackers to have unspecified impact via vectors rela…

  • Unscored —
    CVE-2014-6298

    Unrestricted file upload vulnerability in the mm_forum extension before 1.9.3 for TYPO3 allows remote attackers to exec…

  • High —
    CVE-2014-6295

    WEC Map (wec_map) extension for TYPO3 allows SQL Injection

    SQL injection vulnerability in the WEC Map (wec_map) extension before 3.0.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

    jbartels/wec-map web-tp3/wec_map Packagist
  • Medium —
    CVE-2014-6292

    TYPO3 femanager extension allows remote frontend users to modify or delete records of other frontend users

    The femanager extension before 1.0.9 for TYPO3 allows remote frontend users to modify or delete the records of other frontend users via unspecified vectors.

    in2code/femanager Packagist
  • Unscored —
    CVE-2014-6297

    Cross-site scripting (XSS) vulnerability in the mm_forum extension before 1.9.3 for TYPO3 allows remote attackers to in…

  • Low —
    CVE-2014-6296

    WEC Map (wec_map) extension for TYPO3 allows Cross-site Scripting

    Cross-site scripting (XSS) vulnerability in the WEC Map (wec_map) extension before 3.0.3 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    jbartels/wec-map web-tp3/wec_map Packagist
  • Unscored —
    CVE-2014-6293

    SQL injection vulnerability in the Statistics (ke_stats) extension before 1.1.2 for TYPO3 allows remote attackers to ex…

  • Medium —
    CVE-2014-6288

    TYPO3 powermail extension allows remote attackers to bypass CAPTCHA protection mechanism

    The powermail extension 2.x before 2.0.11 for TYPO3 allows remote attackers to bypass the CAPTCHA protection mechanism via unspecified vectors.

    in2code/powermail Packagist
  • Unscored —
    CVE-2014-6299

    Cross-site request forgery (CSRF) vulnerability in the mm_forum extension before 1.9.3 for TYPO3 allows remote attacker…

  • Unscored —
    CVE-2014-6294

    Cross-site scripting (XSS) vulnerability in the External links click statistics (outstats) extension 0.0.3 and earlier …

  • High —
    CVE-2014-3947

    TYPO3 powermail extension has unrestricted file upload vulnerability

    Unrestricted file upload vulnerability in the powermail extension before 1.6.11 and 2.x before 2.0.14 for TYPO3 allows remote attackers to execute arbitrary code by uploading a file with a crafted extension, then accessing it via unspecified vectors.

    in2code/powermail Packagist
  • Low —
    CVE-2014-7217

    phpMyAdmin cross-site scripting Vulnerability via ENUM value

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.4, 4.1.x before 4.1.14.5, and 4.2.x before 4.2.9.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted ENUM value that is improperly handle…

    phpmyadmin phpmyadmin phpmyadmin/phpmyadmin Debian Ubuntu Packagist
  • Unscored —
    CVE-2014-4823

    The administration console in IBM Security Access Manager for Web 7.x before 7.0.0-ISS-WGA-IF0009 and 8.x before 8.0.0-…

  • Unscored —
    CVE-2014-4809

    The WebSEAL component in IBM Security Access Manager for Web 7.x before 7.0.0-ISS-WGA-IF0009 and 8.x before 8.0.0-ISS-W…

  • Unscored —
    CVE-2014-6901

    The RADIOS DEL ECUADOR (aka com.nobexinc.wls_87612622.rc) application 3.2.4 for Android does not verify X.509 certifica…

  • Unscored —
    CVE-2014-6905

    The H2O Human Harmony Organization (aka com.netpia.ha.theh2o) application 1.6.5 for Android does not verify X.509 certi…

  • Unscored —
    CVE-2014-6898

    The Boopsie MyLibrary (aka com.bredir.boopsie.mylibrary) application 4.5.110 for Android does not verify X.509 certific…

  • Unscored —
    CVE-2014-6897

    The Skyrim Map (aka com.neko.skyrimmap) application 2.1 for Android does not verify X.509 certificates from SSL servers…

  • Unscored —
    CVE-2014-6895

    The Throne Rush (aka com.progrestar.bft) application 2.3.10 for Android does not verify X.509 certificates from SSL ser…

  • Unscored —
    CVE-2014-6903

    The Gulf Power Mobile Bill Pay (aka com.tionetworks.gulf) application 1 for Android does not verify X.509 certificates …

  • Unscored —
    CVE-2014-6900

    The EAGE Amsterdam 2014 (aka com.coreapps.android.followme.eage_2014) application 6.1.1.2 for Android does not verify X…

  • Unscored —
    CVE-2014-6079

    Cross-site scripting (XSS) vulnerability in the Local Management Interface in IBM Security Access Manager for Web 7.x b…

  • Unscored —
    CVE-2014-6896

    The Yik Yak (aka com.yik.yak) application 2.0.002 for Android does not verify X.509 certificates from SSL servers, whic…

  • Unscored —
    CVE-2014-6894

    The Lucktastic (aka com.lucktastic.scratch) application 1.2.6 for Android does not verify X.509 certificates from SSL s…

  • Unscored —
    CVE-2014-6902

    The Anjuke (aka com.anjuke.android.app) application 7.1.7 for Android does not verify X.509 certificates from SSL serve…

  • Unscored —
    CVE-2014-6899

    The Jazeera Airways (aka com.winit.jazeeraairways) application 2.7 for Android does not verify X.509 certificates from …