Skip to content
OpenAdvisories

Archive

October 2014

Vulnerabilities first published in this month (UTC), newest first.

← September 2014 2014 / October November 2014 →
  1. 18
  2. 254
  3. 330
  4. 429
  5. 56
  6. 628
  7. 720
  8. 842
  9. 96
  10. 1051
  11. 1111
  12. 122
  13. 1316
  14. 1411
  15. 15196
  16. 16126
  17. 1723
  18. 1825
  19. 19244
  20. 20146
  21. 21181
  22. 2219
  23. 2310
  24. 242
  25. 2521
  26. 2612
  27. 2716
  28. 289
  29. 2933
  30. 307
  31. 3129
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.8
    CVE-2011-4104

    Django Tastypie Improper Deserialization of YAML Data

    The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.

    django-tastypie django-tastypie Debian PyPI
  • Critical 9.8
    CVE-2011-4103

    Django-piston and Django-tastypie do not properly deserialize YAML data

    emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.

    django-piston PyPI
  • Critical 9.8
    CVE-2014-3137

    Bottle does not properly limit content-types

    Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; (semi-colon) and a Content-Ty…

    bottle python-bottle python-bottle Debian Ubuntu PyPI
  • Critical 9.8
    CVE-2014-1929

    python-gnupg vulnerable to shell injection

    python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection through positional arguments." NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.

    python-gnupg python-gnupg Debian PyPI
  • Critical —
    CVE-2014-7205 Public exploit EPSS 79%

    Arbitrary JavaScript Execution in bassmaster

    Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors.

    bassmaster npm
  • Critical 9.8
    CVE-2014-6287 Exploited Public exploit Scanner template EPSS 99%

    The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c …

    KEV Mar 25, 2022
  • Critical 10.0
    CVE-2014-0754

    Schneider Electric

    Directory traversal vulnerability in SchneiderWEB on Schneider Electric Modicon PLC Ethernet modules 140CPU65x Exec before 5.5, 140NOC78x Exec before 1.62, 140NOE77x Exec before 6.2, BMXNOC0401 before 2.05, BMXNOE0100 before 2.9, BMXNOE0110x Exec before 6.0, …

    Schneider Electric Ethernet modules for M340, Quantum and Premium PLC ranges ICS / OT