Skip to content
OpenAdvisories

Archive

27 October 2014

Vulnerabilities first published on this day (UTC), newest first.

← September 2014 2014 / October /27 November 2014 →
  1. 18
  2. 254
  3. 330
  4. 429
  5. 56
  6. 628
  7. 720
  8. 842
  9. 96
  10. 1051
  11. 1111
  12. 122
  13. 1316
  14. 1411
  15. 15196
  16. 16126
  17. 1723
  18. 1825
  19. 19244
  20. 20146
  21. 21181
  22. 2219
  23. 2310
  24. 242
  25. 2521
  26. 2612
  27. 2716
  28. 289
  29. 2933
  30. 307
  31. 3129
All Critical High Medium Low Exploited only Public exploit

16 results · Feed

  • Unscored —
    CVE-2012-5580

    Format string vulnerability in the print_proxies function in bin/proxy.c in libproxy 0.3.1 might allow context-dependen…

    libproxy Debian
  • Unscored —
    CVE-2014-4586

    Multiple cross-site scripting (XSS) vulnerabilities in the wp-football plugin 1.1 and earlier for WordPress allow remot…

  • Unscored —
    CVE-2011-2702 Public exploit

    Integer signedness error in Glibc before 2.13 and eglibc before 2.13, when using Supplemental Streaming SIMD Extensions…

  • Unscored —
    CVE-2012-1111

    lightdm before 1.0.9 does not properly close file descriptors before opening a child process, which allows local users …

    lightdm Debian
  • Unscored —
    CVE-2010-5077

    server/sv_main.c in Quake3 Arena, as used in ioquake3 before r1762, OpenArena, Tremulous, and other products, allows re…

    openarena Debian
  • Unscored —
    CVE-2003-1599

    PHP remote file inclusion vulnerability in wp-links/links.all.php in WordPress 0.70 allows remote attackers to execute …

  • Unscored —
    CVE-2014-3711

    namei in FreeBSD 9.1 through 10.1-RC2 allows remote attackers to cause a denial of service (memory exhaustion) via vect…

  • Unscored —
    CVE-2014-3955

    routed in FreeBSD 8.4 through 10.1-RC2 allows remote attackers to cause a denial of service (assertion failure and daem…

  • Unscored —
    CVE-2014-3954

    Stack-based buffer overflow in rtsold in FreeBSD 9.1 through 10.1-RC2 allows remote attackers to cause a denial of serv…

  • Medium —
    CVE-2014-8327

    fal_sftp extension for TYPO3 uses weak permissions for sFTP driver files and folders

    The fal_sftp extension before 0.2.6 for TYPO3 uses weak permissions for sFTP driver files and folders, which allows remote authenticated users to obtain sensitive information via unspecified vectors.

    vertexvaar/falsftp co-stack/fal_sftp Packagist
  • Medium —
    CVE-2011-4953

    Cobbler vulnerable to code injection via unsafe YAML loading

    The set_mgmt_parameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safe_load function, as demonstrated using Puppet.

    cobbler PyPI
  • Critical 9.8
    CVE-2011-4104

    Django Tastypie Improper Deserialization of YAML Data

    The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.

    django-tastypie django-tastypie Debian PyPI
  • Critical 9.8
    CVE-2011-4103

    Django-piston and Django-tastypie do not properly deserialize YAML data

    emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.

    django-piston PyPI
  • Unscored —
    CVE-2014-0136

    The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow rem…

  • Unscored —
    CVE-2014-2988

    EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupw…

  • Unscored —
    CVE-2010-4820

    Untrusted search path vulnerability in Ghostscript 8.62 allows local users to execute arbitrary PostScript code via a T…

    ghostscript Debian