Archive
October 2014
Vulnerabilities first published in this month (UTC), newest first.
1,413 results · Feed
-
Unscored —
The Ethernet Connectivity Fault Management (CFM) handling feature in Cisco IOS 12.2(33)SRE9a and earlier and IOS XE 3.1…
-
Unscored —
Electric Cloud ElectricCommander before 4.2.6 and 5.x before 5.0.3 uses world-writable permissions for (1) eccert.pl an…
-
Unscored —
Stack-based buffer overflow in CPUMiner before 2.4.1 allows remote attackers to have an unspecified impact by sending a…
-
Unscored —
WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the…
-
Medium —
Improper Validation of Certificate with Host Mismatch in Not Yet Commons SSL
Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via …
-
Unscored —CVE-2014-2021 Public exploit
Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.2.2 and earlier, and 5.0.x through 5.0.5 …
-
Unscored —
ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to…
-
Unscored —
adsetgroups in Centrify Server Suite 2008 through 2014.1 and Centrify DirectControl 3.x through 4.2.0 on Linux and UNIX…
-
Unscored —
The Remote Controls feature on Samsung mobile devices does not validate the source of lock-code data received over a ne…
-
Unscored —
Untrusted search path vulnerability in Hamster Free ZIP Archiver 2.0.1.7 allows local users to execute arbitrary code a…
-
Unscored —
Open redirect vulnerability in the Click-Through feature in Newtelligence dasBlog 2.1 (2.1.8102.813), 2.2 (2.2.8279.161…
-
Unscored —CVE-2014-7281 Public exploit
Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN …
-
Unscored —
Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers t…
-
Unscored —
The administration module in OpenMRS 2.1 Standalone Edition allows remote authenticated users to obtain read access via…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in OpenMRS 2.1 Standalone Edition allows remote attackers to hijack the…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in OpenMRS 2.1 Standalone Edition allow remote attackers to inject …
-
Unscored —
IBM Sametime Classic Meeting Server 8.0.x and 8.5.x allows remote attackers to obtain sensitive information by reading …
-
Unscored —
Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.…
-
Unscored —
displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allows remo…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in the MRBS module for Drupal allows remote attackers to hijack the aut…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the search.php in LiteCart 1.1.2.1 and earlier allow remote atta…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps plugin before 6.0.27 for WordPress allow remo…
-
Unscored —
VDSM allows remote attackers to cause a denial of service (connection blocking) by keeping an SSL connection open.
-
High 7.8
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server …
KEV Feb 25, 2022 -
Unscored —
gpc_api.php in MantisBT 1.2.17 and earlier allows remote attackers to bypass authenticated via a password starting will…
-
Unscored —
Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via a crafted IPv6 address, relate…
-
Unscored —
Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list, which trigger…
-
Unscored —
Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 packet.
-
Unscored —
inc/template.php in DokuWiki before 2014-05-05a only checks for access to the root namespace, which allows remote attac…
-
Medium —
Zend Access Restriction Bypass
The (1) Zend_Ldap class in Zend before 1.12.9 and (2) Zend\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote attackers to bypass authentication via a password starting with a null byte, which triggers an unauthenticated bind.
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Megapolis.Portal Manager allow remote attackers to inject arbitr…
-
Unscored —
The ajax_mediadiff function in DokuWiki before 2014-05-05a allows remote attackers to access arbitrary images via a cra…
-
Unscored —
DokuWiki 2014-05-05a and earlier, when using Active Directory for LDAP authentication, allows remote attackers to bypas…
-
Unscored —
DokuWiki before 2014-05-05b, when using Active Directory for LDAP authentication, allows remote attackers to bypass aut…
-
Unscored —
The Calendar Base (cal) extension before 1.5.9 and 1.6.x before 1.6.1 for TYPO3 allows remote attackers to cause a deni…
-
Unscored —
iCloud Data Access in Apple iOS before 8.1 does not verify X.509 certificates from TLS servers, which allows man-in-the…
-
Unscored —
The QuickType feature in the Keyboards subsystem in Apple iOS before 8.1 collects typing-prediction data from fields wi…
-
Unscored —
House Arrest in Apple iOS before 8.1 relies on the hardware UID for its encryption key, which makes it easier for physi…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in FOG 0.27 through 0.32 allow remote authenticated users to inject…
-
Unscored —CVE-2014-2531 Public exploit
SQL injection vulnerability in xhr.php in InterWorx Web Control Panel (aka InterWorx Hosting Control Panel and InterWor…