Skip to content
OpenAdvisories

Archive

November 2014

Vulnerabilities first published in this month (UTC), newest first.

← October 2014 2014 / November December 2014 →
  1. 15
  2. 23
  3. 318
  4. 446
  5. 519
  6. 630
  7. 721
  8. 87
  9. 9 
  10. 1017
  11. 1150
  12. 125
  13. 139
  14. 147
  15. 1511
  16. 1622
  17. 1715
  18. 1828
  19. 1924
  20. 2028
  21. 2113
  22. 22 
  23. 239
  24. 2438
  25. 2520
  26. 2626
  27. 271
  28. 2816
  29. 29 
  30. 3013
All Critical High Medium Low Exploited only Public exploit

75 results · Clear filters · Feed

  • Unscored —
    CVE-2014-7178 Public exploit

    Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which i…

  • Unscored —
    CVE-2014-8423 Public exploit EPSS 62%

    Unspecified vulnerability in the management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to execute a…

  • Unscored —
    CVE-2014-8424 Public exploit EPSS 60%

    ARRIS VAP2500 before FW08.41 does not properly validate passwords, which allows remote attackers to bypass authenticati…

  • Unscored —
    CVE-2014-8801 Public exploit EPSS 18%

    Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPres…

  • Unscored —
    CVE-2014-8799 Public exploit EPSS 68%

    Directory traversal vulnerability in the dp_img_resize function in php/dp-functions.php in the DukaPress plugin before …

  • Unscored —
    CVE-2014-8429 Public exploit

    Cross-site request forgery (CSRF) vulnerability in Xavoc Technocrats xEpan CMS 1.0.4.1, 1.0.4, 1.0.1, and earlier allow…

  • Unscored —
    CVE-2014-8425 Public exploit

    The management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to obtain credentials by reading the conf…

  • Unscored —
    CVE-2014-9097 Public exploit

    Multiple SQL injection vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibl…

  • Unscored —
    CVE-2014-9101 Public exploit

    Multiple cross-site request forgery (CSRF) vulnerabilities in Oxwall 1.7.0 (build 7907 and 7906) and SkaDate Lite 2.0 (…

  • Unscored —
    CVE-2014-9098 Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin…

  • Unscored —
    CVE-2014-9096 Public exploit

    Multiple SQL injection vulnerabilities in recover.php in Pligg CMS 2.0.1 and earlier allow remote attackers to execute …

  • Unscored —
    CVE-2014-9094 Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Vid…

    Web / CMS
  • Unscored —
    CVE-2014-9095 Public exploit

    Multiple SQL injection vulnerabilities in Raritan Power IQ 4.1.0 and 4.2.1 allow remote attackers to execute arbitrary …

  • Unscored —
    CVE-2014-9099 Public exploit

    Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attacke…

  • Unscored —
    CVE-2014-9034 Public exploit EPSS 83%

    wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 al…

    wordpress Debian
  • Unscored —
    CVE-2014-8420 Public exploit EPSS 24%

    The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer befor…

  • Unscored —
    CVE-2014-9016 Public exploit EPSS 79%

    The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.…

    drupal7 Ubuntu
  • Unscored —
    CVE-2014-8469 Public exploit

    Cross-site scripting (XSS) vulnerability in Guests/Boots in AdminCP in Moxi9 PHPFox before 4 Beta allows remote attacke…

  • High 7.3
    CVE-2014-8682 Public exploit EPSS 33%

    SQL Injection in Gogs

    Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/r…

    gogs.io/gogs Go
  • Medium 6.5
    CVE-2014-8681 Public exploit

    SQL Injection in gogs.io/gogs

    SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before 0.5.6.1025 Beta allows remote attackers to execute arbitrary SQL commands via the label parameter to user/repos/issues.

    gogs.io/gogs github.com/gogits/gogs Go
  • Unscored —
    CVE-2014-5395 Public exploit

    Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13…

  • Medium —
    CVE-2014-3625 Public exploit

    Improper Limitation of a Pathname to a Restricted Directory in Spring Framework

    Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.

    libspring-java libspring-java org.springframework:spring-webmvc Debian Ubuntu Maven
  • Unscored —
    CVE-2014-8768 Public exploit EPSS 20%

    Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow re…

    tcpdump tcpdump Debian Ubuntu
  • Unscored —
    CVE-2014-8493 Public exploit

    ZTE ZXHN H108L with firmware 4.0.0d_ZRQ_GR4 allows remote attackers to modify the CWMP configuration via a crafted requ…

  • Unscored —
    CVE-2014-8995 Public exploit

    SQL injection vulnerability in Maarch LetterBox 2.8 allows remote attackers to execute arbitrary SQL commands via the U…

  • Unscored —
    CVE-2014-8997 Public exploit

    Unrestricted file upload vulnerability in the Photo functionality in DigitalVidhya Digi Online Examination System 2.0 a…

  • Unscored —
    CVE-2014-8387 Public exploit EPSS 31%

    cgi/utility.cgi in Advantech EKI-6340 2.05 Wi-Fi Mesh Access Point allows remote authenticated users to execute arbitra…

  • Unscored —
    CVE-2014-8998 Public exploit EPSS 36%

    lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a …

  • Unscored —
    CVE-2014-9000 Public exploit

    Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows…

  • Unscored —
    CVE-2014-9001 Public exploit

    reminders/index.php in Incredible PBX 11 2.0.6.5.0 allows remote authenticated users to execute arbitrary commands via …

  • Unscored —
    CVE-2014-9004 Public exploit

    Cross-site scripting (XSS) vulnerability in vldPersonals before 2.7.1 allows remote attackers to inject arbitrary web s…

  • Unscored —
    CVE-2014-9005 Public exploit

    Multiple SQL injection vulnerabilities in vldPersonals before 2.7.1 allow remote attackers to execute arbitrary SQL com…

  • Unscored —
    CVE-2014-7910 Public exploit

    Multiple unspecified vulnerabilities in Google Chrome before 39.0.2171.65 allow attackers to cause a denial of service …

    chromium-browser oxide-qt Ubuntu
  • High 8.8
    CVE-2014-6324 Exploited Public exploit EPSS 87%

    The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008…

    KEV Mar 25, 2022
  • Unscored —
    CVE-2014-7146 Public exploit EPSS 51%

    The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a c…

  • Unscored —
    CVE-2014-8598 Public exploit EPSS 38%

    The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to (1) upload ar…

  • Unscored —
    CVE-2014-7992 Public exploit EPSS 27%

    The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensit…

  • Unscored —
    CVE-2012-1669 Public exploit

    Directory traversal vulnerability in index.php in phpMoneyBooks before 1.0.3 allows remote attackers to include and exe…

  • Unscored —
    CVE-2012-6665 Public exploit

    Directory traversal vulnerability in index.php in phpMoneyBooks 1.0.4 allows remote attackers to read arbitrary files v…

  • Unscored —
    CVE-2014-8499 Public exploit EPSS 36%

    Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Serv…