Skip to content
OpenAdvisories

Archive

December 2014

Vulnerabilities first published in this month (UTC), newest first.

← November 2014 2014 / December January 2015 →
  1. 118
  2. 226
  3. 323
  4. 47
  5. 530
  6. 68
  7. 76
  8. 834
  9. 918
  10. 1069
  11. 1150
  12. 1231
  13. 132
  14. 14 
  15. 1527
  16. 1622
  17. 1718
  18. 1823
  19. 1948
  20. 209
  21. 21 
  22. 2210
  23. 2313
  24. 2431
  25. 255
  26. 2619
  27. 2713
  28. 2813
  29. 2910
  30. 304
  31. 3127
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium —
    CVE-2014-8144

    Doorkeeper vulnerable to Cross-site Request Forgery

    Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of unspecified victims for requests that read a user OAuth authorization code via unknown vectors.

    doorkeeper RubyGems
  • Medium —
    CVE-2013-6919

    phpThumb is vulnerable to Server-Side Request Forgery (SSRF)

    The default configuration of phpThumb before 1.7.12 has a false value for the disable_debug option, which allows remote attackers to conduct Server-Side Request Forgery (SSRF) attacks via the src parameter.

    james-heinrich/phpthumb Packagist
  • Medium —
    CVE-2013-5958

    Symfony Denial of Service Via Long Password Hashing

    The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as d…

    symfony/symfony symfony/security symfony/polyfill Packagist
  • Medium —
    CVE-2014-7193

    CORS Token Disclosure in crumb

    The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS enabled, which allows remote attackers to obtain sensitive information, and potentially obtain the ability to spoof requests to…

    crumb npm
  • Medium 6.5
    CVE-2014-9358

    Directory Traversal in Docker

    Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry communications."

    docker.io github.com/docker/docker Debian Go
  • Medium —
    CVE-2014-6408

    Access Restriction Bypass in Docker

    Docker 1.3.0 through 1.3.1 allows remote attackers to modify the default run profile of image containers and possibly bypass the container by applying unspecified security options to an image.

    docker.io github.com/docker/docker Debian Go
  • Medium —
    CVE-2014-7809

    Cross-Site Request Forgery in Apache Struts

    Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable <s:token/> values, which allows remote attackers to bypass the CSRF protection mechanism.

    org.apache.struts:struts2-core Maven
  • Medium —
    CVE-2014-9120

    Subrion CMS Cross-site scripting in search

    Cross-site scripting (XSS) vulnerability in Subrion CMS before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to subrion/search/.

    intelliants/subrion Packagist
  • Medium —
    CVE-2014-3627

    Improper Link Resolution Before File Access in Apache Hadoop

    The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive…

    org.apache.hadoop:hadoop-client Maven
  • Medium —
    CVE-2014-7816 Public exploit EPSS 25%

    Improper Limitation of a Pathname to a Restricted Directory in JBoss Undertow

    Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read arbitrary files via a .. (dot dot) in a resource URI.

    io.undertow:undertow-core Maven