Skip to content
OpenAdvisories

Archive

17 October 2014

Vulnerabilities first published on this day (UTC), newest first.

← September 2014 2014 / October /17 November 2014 →
  1. 18
  2. 254
  3. 330
  4. 429
  5. 56
  6. 628
  7. 720
  8. 842
  9. 96
  10. 1051
  11. 1111
  12. 122
  13. 1316
  14. 1411
  15. 15196
  16. 16126
  17. 1723
  18. 1825
  19. 19244
  20. 20146
  21. 21181
  22. 2219
  23. 2310
  24. 242
  25. 2521
  26. 2612
  27. 2716
  28. 289
  29. 2933
  30. 307
  31. 3129
All Critical High Medium Low Exploited only Public exploit

23 results · Feed

  • Unscored —
    CVE-2014-6283

    SAP Adaptive Server Enterprise (ASE) 15.7 before SP122 or SP63, 15.5 before ESD#5.4, and 15.0.3 before ESD#4.4 does not…

  • Unscored —
    CVE-2014-2279

    Multiple directory traversal vulnerabilities in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allow (1) remote auth…

  • Unscored —
    CVE-2014-2278

    Unrestricted file upload vulnerability in op/op.AddFile2.php in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allow…

  • Unscored —
    CVE-2014-2995 Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress all…

  • Unscored —
    CVE-2014-2559 Public exploit

    Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPr…

  • Medium —
    CVE-2013-7330

    Jenkins allows attackers to configure restricted projects

    Jenkins before 1.502 allows remote authenticated users to configure an otherwise restricted project via vectors related to post-build actions.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-7960

    OpenStack Swift metadata constraints are not correctly enforced

    OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max_meta_count and other metadata constraints via multiple crafted requests which exceed the limit when combined.

    swift swift swift Debian Ubuntu PyPI
  • Medium —
    CVE-2014-2065

    Jenkins cross-site scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to inject arbitrary web script or HTML via the iconSize cookie.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-2063

    Jenkins Vulnerable to Clickjacking

    Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-2066

    Jenkins session fixation vulnerability

    Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors involving the "override" of Jenkins cookies.

    org.jenkins-ci.main:jenkins-core Maven
  • Low —
    CVE-2014-2068

    Jenkins allows attackers to obtain sensitive information

    The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users with the ADMINISTER permission to obtain sensitive information via vectors related to heapDump.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-2062

    Jenkins does not invalidate the API token when a user is deleted

    Jenkins before 1.551 and LTS before 1.532.2 does not invalidate the API token when a user is deleted, which allows remote authenticated users to retain access via the token.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-2060

    Jenkins allows Remote Attackers to Hijack Sessions

    The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-2058

    Jenkins allows attackers to execute arbitrary jobs

    BuildTrigger in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to bypass access restrictions and execute arbitrary jobs by configuring a job to trigger another job. NOTE: this vulnerability exists because of an incomplete fix fo…

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-2061

    Jenkin allows attackers to obtain passwords by reading the HTML source code

    The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by reading the HTML source code, related to the default value.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-2064 Public exploit

    Jenkins allows attackers to determine whether a user exists

    The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to determine whether a user exists via vectors related to failed login attempts.

    org.jenkins-ci.main:jenkins-core Maven
  • Unscored —
    CVE-2014-8756

    The NcrCtl4.NcrNet.1 control in Panasonic Network Camera Recorder before 4.04R03 allows remote attackers to execute arb…

  • Unscored —
    CVE-2014-8755

    Panasonic Network Camera View 3 and 4 allows remote attackers to execute arbitrary code via a crafted page, which trigg…

  • Unscored —
    CVE-2014-8074

    Buffer overflow in the SetLogFile method in Foxit.FoxitPDFSDKProCtrl.5 in Foxit PDF SDK ActiveX 2.3 through 5.0.1820 be…

  • Unscored —
    CVE-2014-8318

    Cross-site scripting (XSS) vulnerability in the Webform module 6.x-3.x before 6.x-3.20, 7.x-3.x before 7.x-3.20, and 7.…

  • Unscored —
    CVE-2014-8319

    Cross-site scripting (XSS) vulnerability in the easy_social_admin_summary function in the Easy Social module 7.x-2.x be…

  • Unscored —
    CVE-2014-8317

    Cross-site scripting (XSS) vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x…

  • Unscored —
    CVE-2014-8320

    Cross-site scripting (XSS) vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.1…