Archive
December 2014
Vulnerabilities first published in this month (UTC), newest first.
97 results · Clear filters · Feed
-
Unscored —CVE-2014-9236 Public exploit
Cross-site scripting (XSS) vulnerability in php/edit_photos.php in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier a…
-
Unscored —CVE-2014-9235 Public exploit
Multiple SQL injection vulnerabilities in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allow remote authenticated…
-
Unscored —CVE-2014-9237 Public exploit
SQL injection vulnerability in Proticaret E-Commerce 3.0 allows remote attackers to execute arbitrary SQL commands via …
-
Unscored —CVE-2014-8773 Public exploit
MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request forgery (CSRF) protection me…
-
Unscored —CVE-2014-8774 Public exploit
Cross-site scripting (XSS) vulnerability in manager/index.php in MODX Revolution 2.x before 2.2.15 allows remote attack…
-
Unscored —CVE-2014-8775 Public exploit
MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, whi…
-
Unscored —CVE-2014-9141 Public exploit
The installer in Thomson Reuters Fixed Assets CS 13.1.4 and earlier uses weak permissions for connectbgdl.exe, which al…
-
Unscored —CVE-2014-8728 Public exploit
SQL injection vulnerability in the login page (login/login) in Subex ROC Fraud Management (aka Fraud Management System …
-
Unscored —CVE-2014-9175 Public exploit
SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remot…
-
Unscored —CVE-2014-9179 Public exploit
Cross-site scripting (XSS) vulnerability in the SupportEzzy Ticket System plugin 1.2.5 for WordPress allows remote auth…
-
Unscored —CVE-2014-9173 Public exploit
SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote att…
-
Unscored —CVE-2014-9113 Public exploit
CCH Wolters Kluwer ProSystem fx Engagement (aka PFX Engagement) 7.1 and earlier uses weak permissions (Authenticated Us…
-
Unscored —CVE-2014-9181 Public exploit
Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitra…
-
Unscored —CVE-2014-9178 Public exploit
Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager pl…
-
Unscored —
project/register.php in Tuleap before 7.7, when sys_create_project_in_one_step is disabled, allows remote authenticated…
-
Unscored —CVE-2014-5284 Public exploit
host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without verifying ownership, wh…
-
Medium —
Improper Limitation of a Pathname to a Restricted Directory in JBoss Undertow
Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read arbitrary files via a .. (dot dot) in a resource URI.