Skip to content
OpenAdvisories

Archive

October 2014

Vulnerabilities first published in this month (UTC), newest first.

← September 2014 2014 / October November 2014 →
  1. 18
  2. 254
  3. 330
  4. 429
  5. 56
  6. 628
  7. 720
  8. 842
  9. 96
  10. 1051
  11. 1111
  12. 122
  13. 1316
  14. 1411
  15. 15196
  16. 16126
  17. 1723
  18. 1825
  19. 19244
  20. 20146
  21. 21181
  22. 2219
  23. 2310
  24. 242
  25. 2521
  26. 2612
  27. 2716
  28. 289
  29. 2933
  30. 307
  31. 3129
All Critical High Medium Low Exploited only Public exploit

1,413 results · Feed

  • Medium —
    CVE-2014-7960

    OpenStack Swift metadata constraints are not correctly enforced

    OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max_meta_count and other metadata constraints via multiple crafted requests which exceed the limit when combined.

    swift swift swift Debian Ubuntu PyPI
  • Medium —
    CVE-2014-2065

    Jenkins cross-site scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to inject arbitrary web script or HTML via the iconSize cookie.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-2063

    Jenkins Vulnerable to Clickjacking

    Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-2066

    Jenkins session fixation vulnerability

    Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors involving the "override" of Jenkins cookies.

    org.jenkins-ci.main:jenkins-core Maven
  • Low —
    CVE-2014-2068

    Jenkins allows attackers to obtain sensitive information

    The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users with the ADMINISTER permission to obtain sensitive information via vectors related to heapDump.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-2062

    Jenkins does not invalidate the API token when a user is deleted

    Jenkins before 1.551 and LTS before 1.532.2 does not invalidate the API token when a user is deleted, which allows remote authenticated users to retain access via the token.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-2060

    Jenkins allows Remote Attackers to Hijack Sessions

    The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-2058

    Jenkins allows attackers to execute arbitrary jobs

    BuildTrigger in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to bypass access restrictions and execute arbitrary jobs by configuring a job to trigger another job. NOTE: this vulnerability exists because of an incomplete fix fo…

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-2061

    Jenkin allows attackers to obtain passwords by reading the HTML source code

    The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by reading the HTML source code, related to the default value.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-2064 Public exploit

    Jenkins allows attackers to determine whether a user exists

    The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to determine whether a user exists via vectors related to failed login attempts.

    org.jenkins-ci.main:jenkins-core Maven
  • Unscored —
    CVE-2014-8756

    The NcrCtl4.NcrNet.1 control in Panasonic Network Camera Recorder before 4.04R03 allows remote attackers to execute arb…

  • Unscored —
    CVE-2014-8755

    Panasonic Network Camera View 3 and 4 allows remote attackers to execute arbitrary code via a crafted page, which trigg…

  • Unscored —
    CVE-2014-8074

    Buffer overflow in the SetLogFile method in Foxit.FoxitPDFSDKProCtrl.5 in Foxit PDF SDK ActiveX 2.3 through 5.0.1820 be…

  • Unscored —
    CVE-2014-8318

    Cross-site scripting (XSS) vulnerability in the Webform module 6.x-3.x before 6.x-3.20, 7.x-3.x before 7.x-3.20, and 7.…

  • Unscored —
    CVE-2014-8319

    Cross-site scripting (XSS) vulnerability in the easy_social_admin_summary function in the Easy Social module 7.x-2.x be…

  • Unscored —
    CVE-2014-8317

    Cross-site scripting (XSS) vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x…

  • Unscored —
    CVE-2014-8320

    Cross-site scripting (XSS) vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.1…

  • Unscored —
    CVE-2014-7015

    The JJ Texas Hold'em Poker (aka cn.jj.poker) application 1.13.23.HD for Android does not verify X.509 certificates from…

  • Unscored —
    CVE-2014-7007

    The Master Mix (aka com.nobexinc.wls_24832536.rc) application 3.3.5 for Android does not verify X.509 certificates from…

  • Unscored —
    CVE-2014-7002

    The Sopexa Pavillon France (aka com.goomeoevents.pavillonfrance) application 3.6.5 for Android does not verify X.509 ce…

  • Unscored —
    CVE-2014-7045

    The Bust Out Bail (aka com.onesolutionapps.bustoutbailandroid) application 1.1 for Android does not verify X.509 certif…

  • Unscored —
    CVE-2014-7020

    The Diabetes Forum (aka com.tapatalk.diabetescoukdiabetesforum) application 3.9.30 for Android does not verify X.509 ce…

  • Unscored —
    CVE-2014-7050

    The givenu give (aka com.givenu.give) application 1.5.3 for Android does not verify X.509 certificates from SSL servers…

  • Unscored —
    CVE-2014-7033

    The Cure Viewer (aka com.livedoor.android.cureviewer) application 1.03 for Android does not verify X.509 certificates f…

  • Unscored —
    CVE-2014-7004

    The PETA (aka com.peta.android) application 1.1 for Android does not verify X.509 certificates from SSL servers, which …

  • Unscored —
    CVE-2014-7008

    The Forum FrAndroid beta (aka com.tapatalk.forumfrandroidcom) application 3.4.3 for Android does not verify X.509 certi…

  • Unscored —
    CVE-2014-7038

    The Al Jazeera (aka com.Al.Jazeera.net) application 6.0 for Android does not verify X.509 certificates from SSL servers…

  • Unscored —
    CVE-2014-7010

    The UTSA Mobile (aka com.dub.app.utsa) application 1.4.21 for Android does not verify X.509 certificates from SSL serve…

  • Unscored —
    CVE-2014-7018

    The LOVE DANCE (aka com.efunfun.ddianle.lovedance) application 1.2.0626 for Android does not verify X.509 certificates …

  • Unscored —
    CVE-2014-7016

    The Mahasna Batik (aka com.batik.mahasna) application 1.0 for Android does not verify X.509 certificates from SSL serve…

  • Unscored —
    CVE-2014-7041

    The SimGene (aka com.japanbioinformatics.simgene) application 1.3 for Android does not verify X.509 certificates from S…

  • Unscored —
    CVE-2014-7026

    The LIFE TIME FITNESS (aka com.lifetimefitness.ltfmobile) application 1.9 for Android does not verify X.509 certificate…

  • Unscored —
    CVE-2014-7001

    The Jian Ren (aka cn.sh.scustom.janren) application 1.5.1 for Android does not verify X.509 certificates from SSL serve…

  • Unscored —
    CVE-2014-7019

    The Clarks Inn (aka com.ClarksInn) application 3.3.0 for Android does not verify X.509 certificates from SSL servers, w…

  • Unscored —
    CVE-2014-7003

    The Goodwin (aka com.goodwin.Goodwin) application 1.15 for Android does not verify X.509 certificates from SSL servers,…

  • Unscored —
    CVE-2014-7011

    The NWTC Mobile (aka com.dub.app.nwtc) application 1.4.17 for Android does not verify X.509 certificates from SSL serve…

  • Unscored —
    CVE-2014-7013

    The Funny Photo Color Editor (aka com.doirdeditor.funcloreditor) application 0.0.4 for Android does not verify X.509 ce…

  • Unscored —
    CVE-2014-7005

    The Foconet (aka suporte.com.foconet) application 1.0 for Android does not verify X.509 certificates from SSL servers, …

  • Unscored —
    CVE-2014-7012

    The Coffee Inn (aka lt.lemonlabs.android.coffeeinn) application 2.0.1 for Android does not verify X.509 certificates fr…

  • Unscored —
    CVE-2014-7036

    The Quest Federal CU Mobile (aka com.metova.cuae.questfcu) application 1.0.27 for Android does not verify X.509 certifi…