Archive
October 2014
Vulnerabilities first published in this month (UTC), newest first.
74 results · Clear filters · Feed
-
Unscored —CVE-2014-7177 Public exploit
XML External Entity vulnerability in Enalean Tuleap 7.2 and earlier allows remote authenticated users to read arbitrary…
-
Unscored —CVE-2014-8577 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Croogo before 2.1.0 allow remote attackers to inject arbitrary w…
-
Unscored —
Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possi…
-
Unscored —CVE-2013-3304 Public exploit
Directory traversal vulnerability in Dell EqualLogic PS4000 with firmware 6.0 allows remote attackers to read arbitrary…
-
Unscored —
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to …
-
Unscored —CVE-2011-2702 Public exploit
Integer signedness error in Glibc before 2.13 and eglibc before 2.13, when using Supplemental Streaming SIMD Extensions…
-
Unscored —CVE-2013-6796 Public exploit
The SMTP server in DeepOfix 3.3 and earlier allows remote attackers to bypass authentication via an empty password, whi…
-
Unscored —CVE-2014-5520 Public exploit
SQL injection vulnerability in XRMS CRM, possibly 1.99.2, allows remote attackers to execute arbitrary SQL commands via…
-
Unscored —
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and …
-
Unscored —CVE-2014-2987 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in EGroupware Enterprise Line (EPL) before 1.1.20140505, EGr…
-
Unscored —CVE-2014-0476 Public exploit
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute …
-
Unscored —CVE-2014-2021 Public exploit
Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.2.2 and earlier, and 5.0.x through 5.0.5 …
-
Unscored —CVE-2014-7281 Public exploit
Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN …
-
Unscored —
Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.…
-
Unscored —
displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allows remo…
-
High 7.8
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server …
KEV Feb 25, 2022 -
Unscored —CVE-2014-2531 Public exploit
SQL injection vulnerability in xhr.php in InterWorx Web Control Panel (aka InterWorx Hosting Control Panel and InterWor…
-
Unscored —CVE-2014-7280 Public exploit
Cross-site scripting (XSS) vulnerability in the Web UI before 2.3.4 Build #85 for Tenable Nessus 5.x allows remote web …
-
Unscored —CVE-2014-8380 Public exploit
Cross-site scripting (XSS) vulnerability in Splunk 6.1.1 allows remote attackers to inject arbitrary web script or HTML…
-
Unscored —
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attacker…
-
Unscored —
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attacker…
-
Unscored —CVE-2012-5702 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in dotProject before 2.1.7 allow remote attackers to inject arbitra…
-
Unscored —CVE-2012-5242 Public exploit
Directory traversal vulnerability in functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to…
-
Unscored —CVE-2012-5243 Public exploit
functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to read arbitrary database information …
-
Unscored —
Unspecified vulnerability in the management interface in Citrix NetScaler Application Delivery Controller (ADC) and Net…
-
Unscored —CVE-2014-8375 Public exploit
SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote adminis…
-
Unscored —CVE-2014-3978 Public exploit
SQL injection vulnerability in TomatoCart 1.1.8.6.1 allows remote authenticated users to execute arbitrary SQL commands…
-
Unscored —CVE-2014-5276 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated …
-
Unscored —CVE-2014-5275 Public exploit
Multiple SQL injection vulnerabilities in includes/functions.php in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote a…
-
Unscored —CVE-2012-5865 Public exploit
SQL injection vulnerability in dispatch.php in Achievo 1.4.5 allows remote authenticated users to execute arbitrary SQL…
-
Unscored —CVE-2012-5701 Public exploit
Multiple SQL injection vulnerabilities in dotProject before 2.1.7 allow remote authenticated administrators to execute …
-
Unscored —CVE-2014-2081 Public exploit
Multiple SQL injection vulnerabilities in the login in web_reports/cgi-bin/InfoStation.cgi in Innovative vtls-Virtua be…
-
Unscored —CVE-2014-5094 Public exploit
Status2k allows remote attackers to obtain configuration information via a phpinfo action in a request to status/index.…
-
Unscored —CVE-2012-5244 Public exploit
Multiple SQL injection vulnerabilities in Banana Dance B.2.6 and earlier allow remote attackers to execute arbitrary SQ…
-
Unscored —
Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. (dot…
-
Unscored —CVE-2014-2647 Public exploit
Cross-site scripting (XSS) vulnerability in HP Operations Agent in HP Operations Manager (formerly OpenView Communicati…
-
Unscored —CVE-2014-2995 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress all…
-
Unscored —CVE-2014-2559 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPr…
-
Medium —CVE-2014-2064 Public exploit
Jenkins allows attackers to determine whether a user exists
The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to determine whether a user exists via vectors related to failed login attempts.
-
Unscored —CVE-2014-8306 Public exploit
SQL injection vulnerability in the sql_query function in cart.php in C97net Cart Engine before 4.0 allows remote attack…