Skip to content
OpenAdvisories

Archive

16 October 2014

Vulnerabilities first published on this day (UTC), newest first.

← September 2014 2014 / October /16 November 2014 →
  1. 18
  2. 254
  3. 330
  4. 429
  5. 56
  6. 628
  7. 720
  8. 842
  9. 96
  10. 1051
  11. 1111
  12. 122
  13. 1316
  14. 1411
  15. 15196
  16. 16126
  17. 1723
  18. 1825
  19. 19244
  20. 20146
  21. 21181
  22. 2219
  23. 2310
  24. 242
  25. 2521
  26. 2612
  27. 2716
  28. 289
  29. 2933
  30. 307
  31. 3129
All Critical High Medium Low Exploited only Public exploit

126 results · Feed

  • Unscored —
    CVE-2014-6970

    The North American Ismaili Games (aka hr.apps.n166983741) application 5.26.2 for Android does not verify X.509 certific…

  • Unscored —
    CVE-2014-6973

    The Care4Kids (aka com.codetherapy.care4kids) application 1.03 for Android does not verify X.509 certificates from SSL …

  • Unscored —
    CVE-2014-6980

    The LINE PLAY (aka jp.naver.lineplay.android) application 2.3.1.1 for Android does not verify X.509 certificates from S…

  • Unscored —
    CVE-2014-6991

    The LiveAuctions.tv (aka air.LiveAndroidMaxx) application 2.005 for Android does not verify X.509 certificates from SSL…

  • Unscored —
    CVE-2014-6968

    The Grandma's Grotto (aka com.mobileappsuite.grandmasgrotto) application 1 for Android does not verify X.509 certificat…

  • Unscored —
    CVE-2014-6965

    The FAZ.NET (aka net.faz.FAZ) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which …

  • Unscored —
    CVE-2014-6988

    The Quotes in Images (aka pt.lumberapps.imagensfrases) application 3.7.5 for Android does not verify X.509 certificates…

  • Unscored —
    CVE-2014-6994

    The Atecea (aka com.atecea) application 1.2 for Android does not verify X.509 certificates from SSL servers, which allo…

  • Unscored —
    CVE-2014-6953

    The AFTERLIFE WITH ARCHIE (aka com.afterlifewitharchie.afterlifewitharchie) application 2.4.1 for Android does not veri…

  • Unscored —
    CVE-2014-6954

    The Deer Hunting Calls + Guide (aka com.anawaz.deerhuntingcalls.free) application 4.0.1 for Android does not verify X.5…

  • Unscored —
    CVE-2014-6983

    The NBE (aka com.nbe.app) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows…

  • Unscored —
    CVE-2014-6974

    The MifaShow Hairstyles (aka com.mifashow) application 3.7 for Android does not verify X.509 certificates from SSL serv…

  • Unscored —
    CVE-2014-6960

    The Multitrac (aka com.multitrac) application 1.04 for Android does not verify X.509 certificates from SSL servers, whi…

  • Unscored —
    CVE-2014-6955

    The Le Grand Bleu (aka com.appzone468) application 1.0 for Android does not verify X.509 certificates from SSL servers,…

  • Unscored —
    CVE-2014-6962

    The Elk Grove PublicStuff (aka com.wassabi.elkgrove) application 3.2 for Android does not verify X.509 certificates fro…

  • Unscored —
    CVE-2014-6984

    The Shots (aka com.shots.android) application 1.0.8 for Android does not verify X.509 certificates from SSL servers, wh…

  • Unscored —
    CVE-2014-6972

    The Kazakhstan Radio (aka com.wordbox.kazakhstanRadio) application 2.5 for Android does not verify X.509 certificates f…

  • Unscored —
    CVE-2014-6982

    The Arabic Troll Football (aka com.hamoosh.ArabicTrollFootball) application 1.0.1 for Android does not verify X.509 cer…

  • Medium —
    CVE-2014-3663

    Jenkins allows remote authenticated users to bypass intended restrictions and create or destroy arbitrary jobs

    Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/CONFIGURE permission to bypass intended restrictions and create or destroy arbitrary jobs via unspecified vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-3667

    Jenkins allows Remote Users to Obtain Sensitive Information from a Plugin Code

    Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain sensitive information by reading the plugin code.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-3679

    Jenkins Monitoring Plugin Reveals Sensitive Information via Unspecified Pages

    The Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to obtain sensitive information by accessing unspecified pages.

    org.jvnet.hudson.plugins:monitoring Maven
  • Medium —
    CVE-2014-3662

    Jenkins Exposure of Sensitive Information to an Unauthorized Actor vulnerability

    Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-3661

    Jenkins Denial of Service vulnerability

    Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to cause a denial of service (thread consumption) via vectors related to a CLI handshake.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-3680

    Jenkins Exposure of Sensitive Information to an Unauthorized Actor vulnerability

    Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/READ permission to obtain the default value for the password field of a parameterized job by reading the DOM.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-3666

    Jenkins allows for Code Execution via Crafted Packet to the CLI

    Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel.

    org.jenkins-ci.main:jenkins-core Maven
  • Unscored —
    CVE-2014-8308

    Cross-site scripting (XSS) vulnerability in the Send to Inbox functionality in SAP BusinessObjects BI EDGE 4.0 allows r…

  • Unscored —
    CVE-2014-8240

    Integer overflow in TigerVNC allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitr…

    tigervnc Debian
  • Unscored —
    CVE-2014-8311

    SAP BusinessObjects Edge 4.0 allows remote attackers to obtain sensitive information via an InfoStore query to a CORBA …

  • Unscored —
    CVE-2014-8304

    Cross-site scripting (XSS) vulnerability in In-Portal CMS 5.2.0 and earlier allows remote attackers to inject arbitrary…

  • Unscored —
    CVE-2014-8309

    SAP BusinessObjects 4.0 and BusinessObjects XI (BOXI) R2 and 3.1 generates error messages for a failed logon attempt wi…

  • Unscored —
    CVE-2014-8301

    Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 5.0.x before 5.0.10 allows remote attackers…

  • Unscored —
    CVE-2014-8314

    Multiple cross-site scripting (XSS) vulnerabilities in SAP HANA Developer Edition Revision 70 allow remote attackers to…

  • Unscored —
    CVE-2014-8316

    XML External Entity (XXE) vulnerability in polestar_xml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 allows rem…

  • Unscored —
    CVE-2014-8313

    Eval injection in ide/core/base/server/net.xsjs in the Developer Workbench in SAP HANA allows remote attackers to execu…

  • Unscored —
    CVE-2014-8306 Public exploit

    SQL injection vulnerability in the sql_query function in cart.php in C97net Cart Engine before 4.0 allows remote attack…

  • Unscored —
    CVE-2014-8315

    polestar_xml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 replies with different timing depending on if a conne…

  • Unscored —
    CVE-2014-8307 Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in skins/default/outline.tpl in C97net Cart Engine before 4.0 allow…

  • Unscored —
    CVE-2014-8312

    Business Warehouse (BW) in SAP Netweaver AS ABAP 7.31 allows remote authenticated users to obtain sensitive information…

  • Unscored —
    CVE-2014-8302

    Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.1.x before 6.1.4, 6.0.x before 6.0.6, and…

  • Unscored —
    CVE-2014-8310

    The CMS CORBA listener in SAP BusinessObjects BI Edge 4.0 allows remote attackers to cause a denial of service (server …