Skip to content
OpenAdvisories

Archive

November 2014

Vulnerabilities first published in this month (UTC), newest first.

← October 2014 2014 / November December 2014 →
  1. 15
  2. 23
  3. 318
  4. 446
  5. 519
  6. 630
  7. 721
  8. 87
  9. 9 
  10. 1017
  11. 1150
  12. 125
  13. 139
  14. 147
  15. 1511
  16. 1622
  17. 1715
  18. 1828
  19. 1924
  20. 2028
  21. 2113
  22. 22 
  23. 239
  24. 2438
  25. 2520
  26. 2626
  27. 271
  28. 2816
  29. 29 
  30. 3013
All Critical High Medium Low Exploited only Public exploit

34 results · Clear filters · Feed

  • Medium —
    CVE-2014-7839

    XML External Entity Reference in RESTEasy

    DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.

    org.jboss.resteasy:resteasy-jaxrs Maven
  • Medium —
    CVE-2012-6662

    jquery-ui Tooltip widget vulnerable to XSS

    Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handl…

    org.webjars.npm:jquery-ui jqueryui jquery-ui jquery-ui-rails Debian npm Maven NuGet RubyGems
  • Medium 6.2
    CVE-2014-8991

    pip lack of randomness in build directory

    pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.

    python-pip pip python-pip Debian Ubuntu PyPI
  • Medium —
    CVE-2014-7838

    Moodle has multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow remote attackers to hijack the authentication of arbitrary users for requests that se…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-7837

    Moodle allows attackers to remove wiki pages

    mod/wiki/admin.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote authenticated users to remove wiki pages by leveraging delete access within a different subwiki.

    moodle/moodle Packagist
  • Medium —
    CVE-2014-7847

    Moodle allows attackers to cause a denial of service

    iplookup/index.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote attackers to cause a denial of service (resource consumption) by triggering the calculation of an estimated latitude and longitude for an…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-7848

    Moodle allows attacks to obtain sensitive information

    lib/phpunit/bootstrap.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.

    moodle/moodle Packagist
  • Medium —
    CVE-2014-7846

    Moodle does not consider the moodle/tag:edit capability before adding a tag

    tag/tag_autocomplete.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not consider the moodle/tag:edit capability before adding a tag, which allows remote authenticated users to bypass intended access restricti…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-7836

    Moodle multiple cross-site request forgery (CSRF) vulnerabilities

    Multiple cross-site request forgery (CSRF) vulnerabilities in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow remote attackers to hijack the authentication of arbitrary users for a (1) mod/lti/requ…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-7834

    Moodle does not verify group permissions

    mod/forum/externallib.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not verify group permissions, which allows remote authenticated users to access a forum via the forum_get_discussions web service.

    moodle/moodle Packagist
  • Medium —
    CVE-2014-7832

    Moodle allows attackers to bypass the mod/lti:view capability requirement

    mod/lti/launch.php in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 performs access control at the course level rather than at the activity level, which allows remote authenticated users to bypass the …

    moodle/moodle Packagist
  • Medium —
    CVE-2014-7833

    Moodle allows attackers to obtain sensitive information

    mod/data/edit.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 sets a certain group ID to zero upon a database-entry change, which allows remote authenticated users to obtain sensitive information by accessing the d…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-7831

    Moodle exposes hidden grades to students

    lib/classes/grades_external.php in Moodle 2.7.x before 2.7.3 does not consider the moodle/grade:viewhidden capability before displaying hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role to ac…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-9060

    Moodle allows attackers to trigger the generation of arbitrary messages

    The LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not properly restrict the parameters used in a return URL, which allows remote attackers to trigger the generation of arbitrary messages via a modifie…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-9059

    Moodle does not provide charset information in HTTP headers

    lib/setup.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide charset information in HTTP headers, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via UTF-7 characters …

    moodle/moodle Packagist
  • Medium —
    CVE-2014-5325

    Exposure of Sensitive Information to an Unauthorized Actor in Direct Web Remoting

    The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allow remote attackers to read arbitrary files via DOM data containing an XML external entity decla…

    org.directwebremoting:dwr Maven
  • Medium —
    CVE-2014-5326

    Improper Neutralization of Input During Web Page Generation in Direct Web Remoting

    Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    org.directwebremoting:dwr Maven
  • Medium 6.1
    CVE-2010-5312 EPSS 18%

    Cross-site Scripting in jquery-ui

    Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.

    drupal7 org.webjars.npm:jquery-ui jqueryui jquery-ui Debian Alpine npm Maven NuGet RubyGems
  • Medium —
    CVE-2014-8683

    Cross-site Scripting in Gogs

    Cross-site scripting (XSS) vulnerability in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown.

    gogs.io/gogs Go
  • Medium 6.5
    CVE-2014-8681 Public exploit

    SQL Injection in gogs.io/gogs

    SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before 0.5.6.1025 Beta allows remote attackers to execute arbitrary SQL commands via the label parameter to user/repos/issues.

    gogs.io/gogs github.com/gogits/gogs Go
  • Medium —
    CVE-2014-3625 Public exploit

    Improper Limitation of a Pathname to a Restricted Directory in Spring Framework

    Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.

    libspring-java libspring-java org.springframework:spring-webmvc Debian Ubuntu Maven
  • Medium —
    CVE-2014-7829

    Directory traversal vulnerability in actionpack

    Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remo…

    rails actionpack Debian RubyGems
  • Medium 5.3
    CVE-2014-5277

    Man-in-the-Middle (MitM)

    Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position b…

    docker.io docker.io github.com/docker/docker docker-py Debian Ubuntu PyPI Go
  • Medium —
    CVE-2014-3248

    facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability

    Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local us…

    puppet puppet mcollective facter Debian Ubuntu RubyGems
  • Medium —
    CVE-2014-2682

    Several Zend Products Vulnerable to XXE and XEE attacks

    Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, Zend…

    zendframework/zendframework1 zendframework/zendopenid zendframework/zendservice-audioscrobbler zendframework/zendservice-slideshare Packagist
  • Medium —
    CVE-2014-2681

    Several Zend Products Vulnerable to XXE and XEE attacks

    Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, Zend…

    zendframework/zendframework1 zendframework/zendopenid zendframework/zendservice-slideshare zendframework/zendservice-windowsazure Packagist
  • Medium —
    CVE-2014-2683

    Several Zend Products Vulnerable to XXE and XEE attacks

    Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, Zend…

    zendframework/zendframework1 zendframework/zendopenid zendframework/zendservice-api zendframework/zendrest Packagist
  • Medium —
    CVE-2014-7819

    sprockets vulnerable to Path Traversal

    Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10…

    sprockets ruby-sprockets Debian RubyGems
  • Medium —
    CVE-2014-7818

    actionpack vulnerable to Path Traversal

    Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remo…

    rails actionpack Debian RubyGems
  • Medium —
    CVE-2014-6300

    phpMyAdmin micro history Implementation XSS Vulnerability

    Cross-site scripting (XSS) vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1 allows remote attackers to inject arbitrary web script or HTML, and consequently conduct a cross-…

    phpmyadmin phpmyadmin phpmyadmin/phpmyadmin Debian Ubuntu Packagist
  • Medium —
    CVE-2014-8326

    phpMyAdmin Implementation XSS Vulnerability on Server Monitor Page

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.5, 4.1.x before 4.1.14.6, and 4.2.x before 4.2.10.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name…

    phpmyadmin phpmyadmin phpmyadmin/phpmyadmin Debian Ubuntu Packagist
  • Medium —
    CVE-2014-0204

    OpenStack Identity Keystone Improper Privilege Management

    OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with the same ID.

    keystone keystone Debian PyPI
  • Medium 5.3
    CVE-2012-5500

    Plone contains Cross-site Request Forgery

    The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titles of content items by leveraging a valid CSRF token in a crafted request.

    plone PyPI
  • Medium 5.3
    CVE-2012-5508

    Exposure of Sensitive Information in Plone

    The error pages in Plone before 4.2.3 and 4.3 before beta 1 allow remote attackers to obtain random numbers and derive the PRNG state for password resets via unspecified vectors. NOTE: this identifier was SPLIT per ADT2 due to different vulnerability types. C…

    plone PyPI