Skip to content
OpenAdvisories

Archive

November 2014

Vulnerabilities first published in this month (UTC), newest first.

← October 2014 2014 / November December 2014 →
  1. 15
  2. 23
  3. 318
  4. 446
  5. 519
  6. 630
  7. 721
  8. 87
  9. 9 
  10. 1017
  11. 1150
  12. 125
  13. 139
  14. 147
  15. 1511
  16. 1622
  17. 1715
  18. 1828
  19. 1924
  20. 2028
  21. 2113
  22. 22 
  23. 239
  24. 2438
  25. 2520
  26. 2626
  27. 271
  28. 2816
  29. 29 
  30. 3013
All Critical High Medium Low Exploited only Public exploit

501 results · Feed

  • Unscored —
    CVE-2014-8626

    Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allo…

  • Unscored —
    CVE-2014-4807

    Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated us…

  • Unscored —
    CVE-2014-6183

    IBM Security Network Protection 5.1 before 5.1.0.0 FP13, 5.1.1 before 5.1.1.0 FP8, 5.1.2 before 5.1.2.0 FP9, 5.1.2.1 be…

  • Unscored —
    CVE-2014-7871

    SQL injection vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote…

  • Unscored —
    CVE-2014-7137

    Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arb…

  • Unscored —
    CVE-2014-8539

    Cross-site scripting (XSS) vulnerability in Simple Email Form 1.8.5 and earlier allows remote attackers to inject arbit…

  • Unscored —
    CVE-2014-8469 Public exploit

    Cross-site scripting (XSS) vulnerability in Guests/Boots in AdminCP in Moxi9 PHPFox before 4 Beta allows remote attacke…

  • High 7.3
    CVE-2014-8682 Public exploit Scanner template EPSS 33%

    SQL Injection in Gogs

    Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/r…

    gogs.io/gogs Go
  • Medium —
    CVE-2014-8683

    Cross-site Scripting in Gogs

    Cross-site scripting (XSS) vulnerability in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown.

    gogs.io/gogs Go
  • Medium 6.5
    CVE-2014-8681 Public exploit

    SQL Injection in gogs.io/gogs

    SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before 0.5.6.1025 Beta allows remote attackers to execute arbitrary SQL commands via the label parameter to user/repos/issues.

    gogs.io/gogs github.com/gogits/gogs Go
  • Unscored —
    CVE-2014-8090

    The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 a…

    ruby2.0 ruby1.9.1 Ubuntu
  • Unscored —
    CVE-2014-5395 Public exploit

    Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13…

  • Unscored —
    CVE-2014-7194

    TIBCO Managed File Transfer Internet Server before 7.2.4, Managed File Transfer Command Center before 7.2.4, Slingshot …

  • Unscored —
    CVE-2014-7195

    Spotfire Web Player Engine in TIBCO Spotfire Web Player 6.0.x before 6.0.2 and 6.5.x before 6.5.2, Spotfire Deployment …

  • Unscored —
    CVE-2014-8388

    Stack-based buffer overflow in Advantech WebAccess, formerly BroadWin WebAccess, before 8.0 allows remote attackers to …

  • Unscored —
    CVE-2014-8000

    Cisco Unified Communications Manager IM and Presence Service 9.1(1) produces different returned messages for URL reques…

  • Medium —
    CVE-2014-3625 Public exploit

    Improper Limitation of a Pathname to a Restricted Directory in Spring Framework

    Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.

    libspring-java libspring-java org.springframework:spring-webmvc Debian Ubuntu Maven
  • Unscored —
    CVE-2014-8768 Public exploit EPSS 20%

    Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow re…

    tcpdump tcpdump Debian Ubuntu
  • Unscored —
    CVE-2014-8493 Public exploit

    ZTE ZXHN H108L with firmware 4.0.0d_ZRQ_GR4 allows remote attackers to modify the CWMP configuration via a crafted requ…

  • Unscored —
    CVE-2014-8767

    Integer underflow in the olsr_print function in tcpdump 3.9.6 through 4.6.2, when in verbose mode, allows remote attack…

    tcpdump tcpdump Debian Ubuntu
  • Unscored —
    CVE-2014-8769

    tcpdump 3.8 through 4.6.2 might allow remote attackers to obtain sensitive information from memory or cause a denial of…

    tcpdump tcpdump Debian Ubuntu
  • Unscored —
    CVE-2014-9027

    Multiple cross-site request forgery (CSRF) vulnerabilities in ZTE ZXDSL 831CII allow remote attackers to hijack the aut…

  • Unscored —
    CVE-2014-9023

    The Twilio module 7.x-1.x before 7.x-1.9 for Drupal does not properly restrict access to the Twilio administration page…

  • Unscored —
    CVE-2014-9025

    The default checkout completion rule in the commerce_order module in the Drupal Commerce module 7.x-1.x before 7.x-1.10…

  • Unscored —
    CVE-2014-9024

    The Protected Pages module 7.x-2.x before 7.x-2.4 for Drupal allows remote attackers to bypass the password protection …

  • Unscored —
    CVE-2014-9020

    Cross-site scripting (XSS) vulnerability in the Quick Stats page (psilan.cgi) in ZTE ZXDSL 831 and 831CII allows remote…

  • Unscored —
    CVE-2014-9022

    The Webform Component Roles module 6.x-1.x before 6.x-1.8 and 7.x-1.x before 7.x-1.8 for Drupal allows remote attackers…

  • Unscored —
    CVE-2014-9026

    The Ubercart module 7.x-3.x before 7.x-3.7 for Drupal does not properly protect the per-user order history view, which …

  • Unscored —
    CVE-2014-9019

    Multiple cross-site request forgery (CSRF) vulnerabilities in ZTE ZXDSL 831CII allow remote attackers to hijack the aut…

  • Unscored —
    CVE-2014-9021

    Multiple cross-site scripting (XSS) vulnerabilities in ZTE ZXDSL 831 allow remote attackers to inject arbitrary web scr…

  • Unscored —
    CVE-2014-2382

    The DfDiskLo.sys driver in Faronics Deep Freeze Standard and Enterprise 8.10 and earlier allows local administrators to…

  • Unscored —
    CVE-2014-8999

    SQL injection vulnerability in htdocs/modules/system/admin.php in XOOPS before 2.5.7 Final allows remote authenticated …

  • Unscored —
    CVE-2014-8995 Public exploit

    SQL injection vulnerability in Maarch LetterBox 2.8 allows remote attackers to execute arbitrary SQL commands via the U…

  • Unscored —
    CVE-2014-8997 Public exploit

    Unrestricted file upload vulnerability in the Photo functionality in DigitalVidhya Digi Online Examination System 2.0 a…

  • Unscored —
    CVE-2014-8387 Public exploit EPSS 31%

    cgi/utility.cgi in Advantech EKI-6340 2.05 Wi-Fi Mesh Access Point allows remote authenticated users to execute arbitra…

  • Unscored —
    CVE-2014-8998 Public exploit EPSS 36%

    lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a …

  • Unscored —
    CVE-2014-8996

    Multiple cross-site scripting (XSS) vulnerabilities in Nibbleblog before 4.0.2 allow remote attackers to inject arbitra…

  • Unscored —
    CVE-2014-9000 Public exploit

    Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows…

  • Unscored —
    CVE-2014-9006

    Monstra 3.0.1 and earlier uses a cookie to track how many login attempts have been attempted, which allows remote attac…

  • Unscored —
    CVE-2014-9002

    Lantronix xPrintServer does not properly restrict access to ips/, which allows remote attackers to execute arbitrary co…