Skip to content
OpenAdvisories

Archive

20 November 2014

Vulnerabilities first published on this day (UTC), newest first.

← October 2014 2014 / November /20 December 2014 →
  1. 15
  2. 23
  3. 318
  4. 446
  5. 519
  6. 630
  7. 721
  8. 87
  9. 9 
  10. 1017
  11. 1150
  12. 125
  13. 139
  14. 147
  15. 1511
  16. 1622
  17. 1715
  18. 1828
  19. 1924
  20. 2028
  21. 2113
  22. 22 
  23. 239
  24. 2438
  25. 2520
  26. 2626
  27. 271
  28. 2816
  29. 29 
  30. 3013
All Critical High Medium Low Exploited only Public exploit

28 results · Feed

  • Medium —
    CVE-2014-3625 Public exploit

    Improper Limitation of a Pathname to a Restricted Directory in Spring Framework

    Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.

    libspring-java libspring-java org.springframework:spring-webmvc Debian Ubuntu Maven
  • Unscored —
    CVE-2014-8768 Public exploit EPSS 20%

    Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow re…

    tcpdump tcpdump Debian Ubuntu
  • Unscored —
    CVE-2014-8493 Public exploit

    ZTE ZXHN H108L with firmware 4.0.0d_ZRQ_GR4 allows remote attackers to modify the CWMP configuration via a crafted requ…

  • Unscored —
    CVE-2014-8767

    Integer underflow in the olsr_print function in tcpdump 3.9.6 through 4.6.2, when in verbose mode, allows remote attack…

    tcpdump tcpdump Debian Ubuntu
  • Unscored —
    CVE-2014-8769

    tcpdump 3.8 through 4.6.2 might allow remote attackers to obtain sensitive information from memory or cause a denial of…

    tcpdump tcpdump Debian Ubuntu
  • Unscored —
    CVE-2014-9027

    Multiple cross-site request forgery (CSRF) vulnerabilities in ZTE ZXDSL 831CII allow remote attackers to hijack the aut…

  • Unscored —
    CVE-2014-9023

    The Twilio module 7.x-1.x before 7.x-1.9 for Drupal does not properly restrict access to the Twilio administration page…

  • Unscored —
    CVE-2014-9025

    The default checkout completion rule in the commerce_order module in the Drupal Commerce module 7.x-1.x before 7.x-1.10…

  • Unscored —
    CVE-2014-9024

    The Protected Pages module 7.x-2.x before 7.x-2.4 for Drupal allows remote attackers to bypass the password protection …

  • Unscored —
    CVE-2014-9020

    Cross-site scripting (XSS) vulnerability in the Quick Stats page (psilan.cgi) in ZTE ZXDSL 831 and 831CII allows remote…

  • Unscored —
    CVE-2014-9022

    The Webform Component Roles module 6.x-1.x before 6.x-1.8 and 7.x-1.x before 7.x-1.8 for Drupal allows remote attackers…

  • Unscored —
    CVE-2014-9026

    The Ubercart module 7.x-3.x before 7.x-3.7 for Drupal does not properly protect the per-user order history view, which …

  • Unscored —
    CVE-2014-9019

    Multiple cross-site request forgery (CSRF) vulnerabilities in ZTE ZXDSL 831CII allow remote attackers to hijack the aut…

  • Unscored —
    CVE-2014-9021

    Multiple cross-site scripting (XSS) vulnerabilities in ZTE ZXDSL 831 allow remote attackers to inject arbitrary web scr…

  • Unscored —
    CVE-2014-2382

    The DfDiskLo.sys driver in Faronics Deep Freeze Standard and Enterprise 8.10 and earlier allows local administrators to…

  • Unscored —
    CVE-2014-8999

    SQL injection vulnerability in htdocs/modules/system/admin.php in XOOPS before 2.5.7 Final allows remote authenticated …

  • Unscored —
    CVE-2014-8995 Public exploit

    SQL injection vulnerability in Maarch LetterBox 2.8 allows remote attackers to execute arbitrary SQL commands via the U…

  • Unscored —
    CVE-2014-8997 Public exploit

    Unrestricted file upload vulnerability in the Photo functionality in DigitalVidhya Digi Online Examination System 2.0 a…

  • Unscored —
    CVE-2014-8387 Public exploit EPSS 31%

    cgi/utility.cgi in Advantech EKI-6340 2.05 Wi-Fi Mesh Access Point allows remote authenticated users to execute arbitra…

  • Unscored —
    CVE-2014-8998 Public exploit EPSS 36%

    lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a …

  • Unscored —
    CVE-2014-8996

    Multiple cross-site scripting (XSS) vulnerabilities in Nibbleblog before 4.0.2 allow remote attackers to inject arbitra…

  • Unscored —
    CVE-2014-9000 Public exploit

    Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows…

  • Unscored —
    CVE-2014-9006

    Monstra 3.0.1 and earlier uses a cookie to track how many login attempts have been attempted, which allows remote attac…

  • Unscored —
    CVE-2014-9002

    Lantronix xPrintServer does not properly restrict access to ips/, which allows remote attackers to execute arbitrary co…

  • Unscored —
    CVE-2014-9001 Public exploit

    reminders/index.php in Incredible PBX 11 2.0.6.5.0 allows remote authenticated users to execute arbitrary commands via …

  • Unscored —
    CVE-2014-9004 Public exploit

    Cross-site scripting (XSS) vulnerability in vldPersonals before 2.7.1 allows remote attackers to inject arbitrary web s…

  • Unscored —
    CVE-2014-9005 Public exploit

    Multiple SQL injection vulnerabilities in vldPersonals before 2.7.1 allow remote attackers to execute arbitrary SQL com…

  • Unscored —
    CVE-2014-9003

    Cross-site request forgery (CSRF) vulnerability in Lantronix xPrintServer allows remote attackers to hijack the authent…