Archive
October 2014
Vulnerabilities first published in this month (UTC), newest first.
1,413 results · Feed
-
Medium 4.3
Fox-IT DataDiode Appliance CSRF
Multiple cross-site request forgery (CSRF) vulnerabilities in the administrative web interface in the proxy server on Fox-IT Fox DataDiode appliances before 1.7.2 allow remote attackers to hijack the authentication of administrators for requests that (1) crea…
-
Unscored —CVE-2014-2647 Public exploit
Cross-site scripting (XSS) vulnerability in HP Operations Agent in HP Operations Manager (formerly OpenView Communicati…
-
Unscored —
CareFusion Pyxis SupplyStation 8.1 with hardware test tool before 1.0.16 has a hardcoded service password, which makes …
-
Unscored —
IOServer before Beta2112.exe allows remote attackers to cause a denial of service (out-of-bounds read and master entry …
-
Unscored —
CareFusion Pyxis SupplyStation 8.1 with hardware test tool before 1.0.16 allows local users to obtain potentially sensi…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Aflax allows remote attackers to inject arbitrary web script or HTML via un…
-
Unscored —
CareFusion Pyxis SupplyStation 8.1 with hardware test tool before 1.0.16 has a hardcoded application password, which ma…
-
Unscored —
Cross-site scripting (XSS) vulnerability in BirdBlog allows remote attackers to inject arbitrary web script or HTML via…
-
Unscored —
CareFusion Pyxis SupplyStation 8.1 with hardware test tool 1.0.16 and earlier has a hardcoded database password, which …
-
Unscored —
Buffer overflow in QuickTime in Apple OS X before 10.10 allows remote attackers to execute arbitrary code or cause a de…
-
Unscored —
The kernel in Apple OS X before 10.10 allows physically proximate attackers to cause a denial of service (NULL pointer …
-
Unscored —
Mail Service in Apple OS X Server before 4.0 does not enforce SACL changes until after a service restart, which allows …
-
Unscored —
Dock in Apple OS X before 10.10 does not properly manage the screen-lock state, which allows physically proximate attac…
-
Unscored —
Apple OS X before 10.10 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted ASN…
-
Unscored —
Profile Manager in Apple OS X Server before 4.0 allows local users to discover cleartext passwords by reading a file af…
-
Unscored —
IOHIDFamily in Apple OS X before 10.10 allows attackers to cause denial of service (out-of-bounds read operation) via a…
-
Unscored —
Safari in Apple OS X before 10.10 allows remote attackers to cause a denial of service (universal Push Notification out…
-
Unscored —
LaunchServices in Apple OS X before 10.10 allows attackers to bypass intended sandbox restrictions via an application t…
-
Unscored —
Bluetooth in Apple OS X before 10.10 does not require encryption for HID Low Energy devices, which allows remote attack…
-
Unscored —
App Sandbox in Apple OS X before 10.10 allows attackers to bypass a sandbox protection mechanism via the accessibility …
-
Unscored —
The Code Signing feature in Apple OS X before 10.10 does not properly handle incomplete resource envelopes in signed bu…
-
Unscored —
The kernel in Apple OS X before 10.10 allows local users to cause a denial of service (panic) via a message to a system…
-
Unscored —
Race condition in LoginWindow in Apple OS X before 10.10 allows physically proximate attackers to obtain access by leve…
-
Unscored —
The "iCloud Find My Mac" feature in Apple OS X before 10.10 does not properly enforce rate limiting of lost-mode PIN en…
-
Unscored —
SecurityAgent in Apple OS X before 10.10 does not ensure that a Kerberos ticket is in the cache for the correct user, w…
-
Unscored —
AFP File Server in Apple OS X before 10.10 allows remote attackers to discover the network addresses of all interfaces …
-
Unscored —
NetFS Client Framework in Apple OS X before 10.10 does not ensure that the disabling of File Sharing is always possible…
-
Unscored —
fdesetup in Apple OS X before 10.10 does not properly display the encryption status in between a setting-update action …
-
Unscored —
Mail in Apple OS X before 10.10 does not properly recognize the removal of a recipient address from a message, which ma…
-
Unscored —
CoreStorage in Apple OS X before 10.10 retains a volume's encryption keys upon an eject action in the unlocked state, w…
-
Unscored —
CFPreferences in Apple OS X before 10.10 does not properly enforce the "require password after sleep or screen saver be…
-
Unscored —
The MCX Desktop Config Profiles implementation in Apple OS X before 10.10 retains web-proxy settings from uninstalled m…
-
Unscored —
Heap-based buffer overflow in the kernel in Apple OS X before 10.10 allows physically proximate attackers to execute ar…
-
Unscored —
The oVirt Engine backend module, as used in Red Hat Enterprise Virtualization Manager before 3.4.2, uses an "insecure D…
-
Unscored —
SAP Adaptive Server Enterprise (ASE) 15.7 before SP122 or SP63, 15.5 before ESD#5.4, and 15.0.3 before ESD#4.4 does not…
-
Unscored —
Multiple directory traversal vulnerabilities in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allow (1) remote auth…
-
Unscored —
Unrestricted file upload vulnerability in op/op.AddFile2.php in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allow…
-
Unscored —CVE-2014-2995 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress all…
-
Unscored —CVE-2014-2559 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPr…
-
Medium —
Jenkins allows attackers to configure restricted projects
Jenkins before 1.502 allows remote authenticated users to configure an otherwise restricted project via vectors related to post-build actions.