Skip to content
OpenAdvisories

Archive

November 2014

Vulnerabilities first published in this month (UTC), newest first.

← October 2014 2014 / November December 2014 →
  1. 15
  2. 23
  3. 318
  4. 446
  5. 519
  6. 630
  7. 721
  8. 87
  9. 9 
  10. 1017
  11. 1150
  12. 125
  13. 139
  14. 147
  15. 1511
  16. 1622
  17. 1715
  18. 1828
  19. 1924
  20. 2028
  21. 2113
  22. 22 
  23. 239
  24. 2438
  25. 2520
  26. 2626
  27. 271
  28. 2816
  29. 29 
  30. 3013
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • High 8.8
    CVE-2014-8439 Exploited EPSS 20%

    Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on…

    flashplugin-nonfree Ubuntu
    KEV May 25, 2022
  • High —
    CVE-2014-7845

    Moodle Temporary Passwords are Brute Force-able

    The generate_password function in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide a sufficient number of possible temporary passwords, which allows remote attackers to obtain access via a brute-force atta…

    moodle/moodle Packagist
  • High 7.3
    CVE-2014-8682 Public exploit Scanner template EPSS 33%

    SQL Injection in Gogs

    Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/r…

    gogs.io/gogs Go
  • High 8.8
    CVE-2014-6324 Exploited Public exploit EPSS 87%

    The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008…

    KEV Mar 25, 2022
  • High —
    CVE-2014-8770 Public exploit

    MAGMI plugin for Magento Unsafe File Upload

    Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for Magento Community Edition (CE) allows remote authenticated users to execute arbitrary code by uploading a ZIP file that conta…

    dweeves/magmi Packagist
  • High 7.8
    CVE-2014-4077 Exploited EPSS 55%

    Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Office 200…

    KEV May 25, 2022
  • High 8.8
    CVE-2014-6332 Exploited Public exploit EPSS 95%

    OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Window…

    KEV Mar 25, 2022
  • High 7.5
    CVE-2014-2374

    Accuenergy Accuenergy Acuvim II Client-Side Enforcement of Server-Side Security

    The AXN-NET Ethernet module accessory 3.04 for the Accuenergy Acuvim II allows remote attackers to discover passwords and modify settings via vectors involving JavaScript.

    Accuenergy Accuenergy Acuvim II AXN-NET Ethernet module
  • High 7.5
    CVE-2014-2373

    Accuenergy Accuenergy Acuvim II Client-Side Enforcement of Server-Side Security

    The AXN-NET Ethernet module accessory 3.04 for the Accuenergy Acuvim II allows remote attackers to discover passwords and modify settings via vectors involving JavaScript.

    Accuenergy Accuenergy Acuvim II AXN-NET Ethernet module
  • High 7.5
    CVE-2014-5417

    Meinberg Radio Clocks LANTIME M-Series

    Cross-site scripting (XSS) vulnerability in Meinberg NTP Server firmware on LANTIME M-Series devices 6.15.019 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Meinberg Radio Clocks LANTIME M-Series
  • High 7.5
    CVE-2014-5408

    Nordex NC2 Cross-site Scripting

    Cross-site scripting (XSS) vulnerability in the login script in the Wind Farm Portal on Nordex Control 2 (NC2) SCADA devices 15 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter.

    Nordex Nordex Control 2 (NC2) SCADA
  • High 7.5
    CVE-2012-6661

    Plone and Zope2 do not reseed pseudo-random number generator

    Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG), which makes it easier for remote attackers to guess the value via unspecified vectors. NOTE: this issue was SPLIT from CVE-201…

    plone zope2 PyPI
  • High —
    CVE-2014-8350

    Smarty arbitrary PHP code execution

    Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code as demonstrated by "{literal}<{/literal}script language=php>" in a template.

    smarty3 smarty/smarty Debian Packagist