Archive
October 2014
Vulnerabilities first published in this month (UTC), newest first.
74 results · Clear filters · Feed
-
Unscored —CVE-2014-8307 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in skins/default/outline.tpl in C97net Cart Engine before 4.0 allow…
-
Unscored —CVE-2014-8305 Public exploit
Open redirect vulnerability in the redir function in includes/function.php in C97net Cart Engine before 4.0 allows remo…
-
Unscored —
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct…
-
Unscored —CVE-2014-6312 Public exploit
Cross-site request forgery (CSRF) vulnerability in the Login Widget With Shortcode (login-sidebar-widget) plugin before…
-
Unscored —CVE-2014-2927 Public exploit
The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 befor…
-
Unscored —CVE-2014-2022 Public exploit
SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier …
-
Unscored —CVE-2014-8295 Public exploit
SQL injection vulnerability in joblogs.php in Bacula-Web 5.2.10 allows remote attackers to execute arbitrary SQL comman…
-
Unscored —
Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and be…
-
High 7.8
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server …
KEV Mar 3, 2022 -
Unscored —
Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted …
-
Unscored —
Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service…
-
Unscored —
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory c…
-
High 7.8
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 …
KEV May 4, 2022 -
Low 3.4
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which ma…
-
Unscored —CVE-2014-7200 Public exploit
Cross-site scripting (XSS) vulnerability in pi1/class.tx_dmmjobcontrol_pi1.php in the JobControl (dmmjobcontrol) extens…
-
Unscored —CVE-2014-7201 Public exploit
Multiple SQL injection vulnerabilities in the search function in pi1/class.tx_dmmjobcontrol_pi1.php in the JobControl (…
-
Unscored —CVE-2014-4312 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Epicor Enterprise 7.4 before FS74SP6_HotfixTL054181 allow remote…
-
Unscored —CVE-2014-4874 Public exploit
BMC Track-It! 11.3.0.355 allows remote authenticated users to read arbitrary files by visiting the TrackItWeb/Attachmen…
-
Unscored —
BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows remote attackers to upload arbi…
-
Unscored —CVE-2014-4873 Public exploit
SQL injection vulnerability in TrackItWeb/Grid/GetData in BMC Track-It! 11.3.0.355 allows remote authenticated users to…
-
Unscored —CVE-2014-7226 Public exploit
The file comment feature in Rejetto HTTP File Server (hfs) 2.3c and earlier allows remote attackers to execute arbitrar…
-
Unscored —CVE-2014-7981 Public exploit
SQL injection vulnerability in Joomla! CMS 3.1.x and 3.2.x before 3.2.3 allows remote attackers to execute arbitrary SQ…
-
Unscored —CVE-2014-5300 Public exploit
Adaptive Computing Moab before 7.2.9 and 8 before 8.0.0 allows remote attackers to bypass the signature check, imperson…
-
Critical —
Arbitrary JavaScript Execution in bassmaster
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors.
-
Unscored —CVE-2014-5308 Public exploit
Multiple SQL injection vulnerabilities in TestLink 1.9.11 allow remote authenticated users to execute arbitrary SQL com…
-
Unscored —
htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9,…
-
Critical 9.8
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c …
KEV Mar 25, 2022 -
Unscored —CVE-2013-1436 Public exploit
code injection in xmonad-contrib
The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.
-
Unscored —CVE-2014-6389 Public exploit
backup.php in PHPCompta/NOALYSS before 6.7.2 allows remote attackers to execute arbitrary commands via shell metacharac…
-
Unscored —CVE-2014-6607 Public exploit
M/Monit 3.3.2 and earlier does not verify the original password before changing passwords, which allows remote attacker…
-
Unscored —CVE-2014-6409 Public exploit
Cross-site request forgery (CSRF) vulnerability in M/Monit 3.3.2 and earlier allows remote attackers to hijack the auth…
-
Unscored —
Incomplete blacklist vulnerability in ajax/upload.php in ownCloud before 5.0, when running on Windows, allows remote au…
-
Unscored —CVE-2013-2645 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities on the TP-LINK WR1043N router with firmware TL-WR1043ND_V1_1…
-
Unscored —CVE-2014-6242 Public exploit
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow…