Archive
November 2014
Vulnerabilities first published in this month (UTC), newest first.
501 results · Feed
-
Unscored —
The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of an external file and cause a de…
-
Unscored —
The QSvg module in Qt, as used in the Mumble client 1.2.x before 1.2.6, allows remote attackers to cause a denial of se…
-
Unscored —CVE-2014-8949 Public exploit
The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbit…
-
Unscored —CVE-2014-8948 Public exploit
Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows r…
-
Unscored —
The MobileUI (aka RT-Extension-MobileUI) extension before 1.04 in Request Tracker (RT) 4.0.0 before 4.0.13, when using …
-
Unscored —
The Ubercart module 6.x-2.x before 6.x-2.8 for Drupal allows remote authenticated users with the "administer product cl…
-
Unscored —
The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow l…
-
Unscored —
views/Index.php in the Install module in vTiger 6.0 before Security Patch 2 does not properly restrict access, which al…
-
Unscored —
Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when exist_ok is set to true an…
-
Medium —
Several Zend Products Vulnerable to XXE and XEE attacks
Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, Zend…
-
Medium —
Several Zend Products Vulnerable to XXE and XEE attacks
Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, Zend…
-
Medium —
Several Zend Products Vulnerable to XXE and XEE attacks
Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, Zend…
-
Unscored —
The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Ze…
-
Unscored —
Integer overflow in the getword function in options.c in pppd in Paul's PPP Package (ppp) before 2.4.7 allows attackers…
-
Unscored —
Apache Cordova Android before 3.5.1 allows remote attackers to change the start page via a crafted intent URL.
-
Unscored —
Apache Cordova Android before 3.5.1 allows remote attackers to open and send data to arbitrary applications via a URL w…
-
Unscored —
Apache Cordova Android before 3.5.1 allows remote attackers to bypass the HTTP whitelist and connect to arbitrary serve…
-
Unscored —
The mod_auth_mellon module before 0.8.1 allows remote attackers to obtain sensitive information or cause a denial of se…
-
Unscored —
Off-by-one error in the pci_read function in the ACPI PCI hotplug interface (hw/acpi/pcihp.c) in QEMU allows local gues…
-
Unscored —
Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain…
-
Unscored —
The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option,…
-
Unscored —
Cisco IOS on Aironet access points, when "dot11 aaa authenticator" debugging is enabled, allows remote attackers to cau…
-
Unscored —
Cross-site scripting (XSS) vulnerability in IPA iLogScanner 4.0 allows remote attackers to inject arbitrary web script …
-
Unscored —
The DHCP implementation in Cisco IOS on Aironet access points does not properly handle error conditions with short leas…
-
Unscored —
The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a sm…
-
Unscored —
The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory locations and …
-
Unscored —
The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash)…
-
Unscored —CVE-2014-7878 EPSS 10%
The Application Lifecycle Service (ALS) in HP Helion Cloud Development Platform 1.0, when a virtual machine is derived …
-
Unscored —
The Core Server in OpenAM 9.5.3 through 9.5.5, 10.0.0 through 10.0.2, 10.1.0-Xpress, and 11.0.0 through 11.0.2, when de…
-
Unscored —
The Remote Mobile Access Subsystem in Cisco Unified Communications Manager (CM) 10.0(1) and earlier does not properly v…
-
Unscored —CVE-2014-5424 EPSS 11%
Rockwell Automation Connected Components Workbench (CCW) before 7.00.00 allows remote attackers to cause a denial of se…
-
Unscored —
The virDomainGetXMLDesc API in Libvirt before 1.2.11 allows remote read-only users to obtain the VNC password by using …
-
Unscored —
Red Hat OpenShift Enterprise before 2.2 does not properly restrict access to gears, which allows remote attackers to ac…
-
Unscored —
Red Hat OpenShift Enterprise before 2.2 allows local users to obtain IP address and port number information for remote …
-
Unscored —
SQL injection vulnerability in the mc_project_get_attachments function in api/soap/mc_project_api.php in MantisBT befor…
-
Unscored —CVE-2014-8359 Public exploit
Untrusted search path vulnerability in Huawei Mobile Partner for Windows 23.009.05.03.1014 allows local users to execut…
-
High —CVE-2014-8770 Public exploit
MAGMI plugin for Magento Unsafe File Upload
Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for Magento Community Edition (CE) allows remote authenticated users to execute arbitrary code by uploading a ZIP file that conta…
-
Unscored —
The setlogin function in FreeBSD 8.4 through 10.1-RC4 does not initialize the buffer used to store the login name, whic…
-
Unscored —
The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x b…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in JExperts Channel Platform 5.0.33_CCB allow remote attackers to i…