Skip to content
OpenAdvisories

Archive

December 2014

Vulnerabilities first published in this month (UTC), newest first.

← November 2014 2014 / December January 2015 →
  1. 118
  2. 226
  3. 323
  4. 47
  5. 530
  6. 68
  7. 76
  8. 834
  9. 918
  10. 1069
  11. 1150
  12. 1231
  13. 132
  14. 14 
  15. 1527
  16. 1622
  17. 1718
  18. 1823
  19. 1948
  20. 209
  21. 21 
  22. 2210
  23. 2313
  24. 2431
  25. 255
  26. 2619
  27. 2713
  28. 2813
  29. 2910
  30. 304
  31. 3127
All Critical High Medium Low Exploited only Public exploit

97 results · Clear filters · Feed

  • Unscored —
    CVE-2014-8270 Public exploit EPSS 20%

    BMC Track-It! 11.3 allows remote attackers to gain privileges and execute arbitrary code by creating an account whose n…

  • High —
    CVE-2014-7192 Public exploit EPSS 13%

    Potential for Script Injection in syntax-error

    Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remote attackers to execute arbitrary code via a crafted file.

    libv8-3.14 syntax-error Ubuntu npm
  • Unscored —
    CVE-2014-6363 Public exploit EPSS 28%

    vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 6 through 11 and other products, all…

  • Unscored —
    CVE-2014-7866 Public exploit EPSS 80%

    Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and…

  • Unscored —
    CVE-2014-9349 Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in admin/robots.lib.php in RobotStats 1.0 allow remote attackers to…

  • Unscored —
    CVE-2014-9345 Public exploit

    SQL injection vulnerability in Guruperl.net Advertise With Pleasure! Professional (aka AWP PRO) 6.6 and earlier allows …

  • Unscored —
    CVE-2014-9348 Public exploit

    SQL injection vulnerability in the formulaireRobot function in admin/robots.lib.php in RobotStats 1.0 allows remote att…

  • Unscored —
    CVE-2014-9265 Public exploit

    Stack-based buffer overflow in the BackupToAvi method in the CNC_Ctrl ActiveX control in Samsung SmartViewer allows rem…

  • Unscored —
    CVE-2014-9350 Public exploit

    TP-Link TL-WR740N 4 with firmware 3.17.0 Build 140520, 3.16.6 Build 130529, and 3.16.4 Build 130205 allows remote attac…

  • Unscored —
    CVE-2014-9347 Public exploit

    SQL injection vulnerability in dosearch.php in phpMyRecipes 1.2.2 allows remote attackers to execute arbitrary SQL comm…

  • Unscored —
    CVE-2014-9305 Public exploit

    SQL injection vulnerability in the shortcodeProductsTable function in models/Cart66Ajax.php in the Cart66 Lite plugin b…

  • Unscored —
    CVE-2014-9344 Public exploit

    Cross-site request forgery (CSRF) vulnerability in Snowfox CMS before 1.0.10 allows remote attackers to hijack the auth…

  • Unscored —
    CVE-2014-5462 Public exploit

    Multiple SQL injection vulnerabilities in OpenEMR 4.1.2 (Patch 7) and earlier allow remote authenticated users to execu…

  • Unscored —
    CVE-2014-4880 Public exploit EPSS 71%

    Buffer overflow in Hikvision DVR DS-7204 Firmware 2.2.10 build 131009, and other models and versions, allows remote att…

  • Unscored —
    CVE-2014-9219 Public exploit

    Cross-site scripting (XSS) vulnerability in the redirection feature in url.php in phpMyAdmin 4.2.x before 4.2.13.1 allo…

    phpmyadmin phpmyadmin Debian Ubuntu
  • Unscored —
    CVE-2014-9218 Public exploit EPSS 11%

    libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows r…

    phpmyadmin phpmyadmin Debian Ubuntu
  • Unscored —
    CVE-2014-8868 Public exploit

    EntryPass N5200 Active Network Control Panel does not properly restrict access, which allows remote attackers to obtain…

  • Unscored —
    CVE-2014-9302 Public exploit

    Server-side request forgery (SSRF) vulnerability in the cmisbrowser servlet in Content Management Interoperability Serv…

  • Unscored —
    CVE-2014-9304 Public exploit

    Plex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and …

  • Unscored —
    CVE-2014-9301 Public exploit

    Server-side request forgery (SSRF) vulnerability in the proxy servlet in Alfresco Community Edition before 5.0.a allows…

  • Unscored —
    CVE-2014-9303 Public exploit

    EntryPass N5200 Active Network Control Panel allows remote attackers to read device memory and obtain the administrator…

  • Unscored —
    CVE-2014-8877 Public exploit EPSS 14%

    The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plu…

  • Unscored —
    CVE-2014-4703 Public exploit

    lib/parse_ini.c in Nagios Plugins 2.0.2 allows local users to obtain sensitive information via a symlink attack on the …

  • Unscored —
    CVE-2014-3997 Public exploit EPSS 13%

    SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Mana…

  • Unscored —
    CVE-2014-3996 Public exploit EPSS 38%

    SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Centra…

  • Unscored —
    CVE-2014-8800 Public exploit

    Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect plugin before…

  • Unscored —
    CVE-2014-9143 Public exploit

    Open redirect vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to redirect u…

  • Unscored —
    CVE-2014-9142 Public exploit

    Cross-site scripting (XSS) vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers …

  • Unscored —
    CVE-2014-9144 Public exploit

    Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to execute arbitrary commands via shell meta…

  • Unscored —
    CVE-2014-9215 Public exploit

    SQL injection vulnerability in the CheckEmail function in includes/functions.class.php in PBBoard 3.0.1 before 20141128…

  • Unscored —
    CVE-2014-7868 Public exploit EPSS 73%

    Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT…

  • Unscored —
    CVE-2014-6034 Public exploit EPSS 79%

    Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in …

  • Unscored —
    CVE-2014-6036 Public exploit EPSS 36%

    Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Soci…

  • Unscored —
    CVE-2014-6035 Public exploit EPSS 29%

    Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier a…

  • Unscored —
    CVE-2014-5446 Public exploit EPSS 55%

    Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2…

  • Unscored —
    CVE-2014-5445 Public exploit EPSS 98%

    Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 …

  • Unscored —
    CVE-2014-9241 Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in MyBB (aka MyBulletinBoard) 1.8.x before 1.8.2 allow remote attac…

  • Unscored —
    CVE-2014-9242 Public exploit

    SQL injection vulnerability in admin/pages/modify.php in WebsiteBaker 2.8.3 allows remote attackers to execute arbitrar…

  • Unscored —
    CVE-2014-9240 Public exploit

    SQL injection vulnerability in member.php in MyBB (aka MyBulletinBoard) 1.8.x before 1.8.2 allows remote attackers to e…

  • Unscored —
    CVE-2014-9243 Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in WebsiteBaker 2.8.3 allow remote attackers to inject arbitrary we…