Skip to content
OpenAdvisories

Archive

December 2014

Vulnerabilities first published in this month (UTC), newest first.

← November 2014 2014 / December January 2015 →
  1. 118
  2. 226
  3. 323
  4. 47
  5. 530
  6. 68
  7. 76
  8. 834
  9. 918
  10. 1069
  11. 1150
  12. 1231
  13. 132
  14. 14 
  15. 1527
  16. 1622
  17. 1718
  18. 1823
  19. 1948
  20. 209
  21. 21 
  22. 2210
  23. 2313
  24. 2431
  25. 255
  26. 2619
  27. 2713
  28. 2813
  29. 2910
  30. 304
  31. 3127
All Critical High Medium Low Exploited only Public exploit

614 results · Feed

  • Unscored —
    CVE-2014-9424

    Double free vulnerability in the ssl_parse_clienthello_use_srtp_ext function in d1_srtp.c in LibreSSL before 2.1.2 allo…

  • Unscored —
    CVE-2014-6229

    The HashContext class in hphp/runtime/ext/ext_hash.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 incorrect…

  • Unscored —
    CVE-2014-6228

    Integer overflow in the string_chunk_split function in hphp/runtime/base/zend-string.cpp in Facebook HipHop Virtual Mac…

  • Unscored —
    CVE-2014-2208

    CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook Hip…

  • Unscored —
    CVE-2014-2209

    Facebook HipHop Virtual Machine (HHVM) before 3.1.0 does not drop supplemental group memberships within hphp/util/capab…

  • Unscored —
    CVE-2014-5386

    The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook HipHop Virtual Machine (HHVM) befor…

  • Unscored —
    CVE-2011-4722 Public exploit EPSS 58%

    Directory traversal vulnerability in the TFTP Server 1.0.0.24 in Ipswitch WhatsUp Gold allows remote attackers to read …

  • Unscored —
    CVE-2012-1303

    Multiple cross-site scripting (XSS) vulnerabilities in amCharts Flash 1 allow remote attackers to inject arbitrary web …

  • Unscored —
    CVE-2012-1415 Public exploit

    Cross-site request forgery (CSRF) vulnerability in lib/logout.php in DFLabs PTK 1.0.5 and earlier allows remote attacke…

  • Unscored —
    CVE-2012-1302

    Multiple cross-site scripting (XSS) vulnerabilities in amMap 2.6.3 allow remote attackers to inject arbitrary web scrip…

  • Unscored —
    CVE-2010-5075 Public exploit

    Integer overflow in aswFW.sys 5.0.594.0 in Avast! Internet Security 5.0 Korean Trial allows local users to cause a deni…

  • Unscored —
    CVE-2011-4720 Public exploit

    Hillstone HS TFTP Server 1.3.2 allows remote attackers to cause a denial of service (daemon crash) via a long filename …

  • Unscored —
    CVE-2013-4663

    git_http_controller.rb in the redmine_git_hosting plugin for Redmine allows remote attackers to execute arbitrary comma…

  • Unscored —
    CVE-2012-1203 Public exploit

    Cross-site request forgery (CSRF) vulnerability in starnet/index.php in SyndeoCMS 3.0 and earlier allows remote attacke…

  • Unscored —
    CVE-2013-4793

    The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS…

  • Unscored —
    CVE-2013-6041 Public exploit

    index.php in Softaculous Webuzo before 2.1.4 allows remote attackers to execute arbitrary commands via shell metacharac…

  • Unscored —
    CVE-2013-6043 Public exploit

    The login function in Softaculous Webuzo before 2.1.4 provides different error messages for invalid authentication atte…

  • Medium —
    CVE-2013-6919

    phpThumb is vulnerable to Server-Side Request Forgery (SSRF)

    The default configuration of phpThumb before 1.7.12 has a false value for the disable_debug option, which allows remote attackers to conduct Server-Side Request Forgery (SSRF) attacks via the src parameter.

    james-heinrich/phpthumb Packagist
  • Unscored —
    CVE-2013-6227 Public exploit

    Unrestricted file upload vulnerability in plugins/editor.zoho/agent/save_zoho.php in the Zoho plugin in Pydio (formerly…

  • Unscored —
    CVE-2013-6241

    The Birthday widget in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14,…

  • Medium —
    CVE-2013-5958

    Symfony Denial of Service Via Long Password Hashing

    The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as d…

    symfony/symfony symfony/security symfony/polyfill Packagist
  • Unscored —
    CVE-2014-8512

    Buffer overflow in an ActiveX control in Atx45.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers …

  • Unscored —
    CVE-2014-8514

    Buffer overflow in an ActiveX control in MDraw30.ocx in Schneider Electric ProClima before 6.1.7 allows remote attacker…

  • Unscored —
    CVE-2014-8511

    Buffer overflow in an ActiveX control in Atx45.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers …

  • Unscored —
    CVE-2014-8513

    Buffer overflow in an ActiveX control in MDraw30.ocx in Schneider Electric ProClima before 6.1.7 allows remote attacker…

  • Critical 10.0
    CVE-2014-9188

    Schneider Electric ProClima Command Injection

    Buffer overflow in an ActiveX control in MDraw30.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8513 and CVE-2014-8514. NOTE: this may be clari…

    Schneider Electric ProClima ICS / OT
  • Unscored —
    CVE-2014-0748

    apinit on Cray devices with CLE before 4.2.UP02 and 5.x before 5.1.UP00 does not use alpsauth data to validate the UID …

  • Unscored —
    CVE-2013-4769

    The cloud controller (aka CLC) component in Eucalyptus 3.3.x and 3.4.x before 3.4.2, when the dns.recursive.enabled set…

  • Unscored —
    CVE-2013-4754

    Multiple cross-site scripting (XSS) vulnerabilities in Owl Intranet Knowledgebase 1.10 allow remote authenticated users…

  • Unscored —
    CVE-2013-4753

    Multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.11.9 and earlier allow remote authenticated users to…

  • Unscored —
    CVE-2011-3623

    Multiple stack-based buffer overflows in VideoLAN VLC media player before 1.0.2 allow remote attackers to execute arbit…

    vlc Debian
  • Unscored —
    CVE-2010-1441

    Multiple heap-based buffer overflows in VideoLAN VLC media player before 1.0.6 allow remote attackers to cause a denial…

    vlc Debian
  • Unscored —
    CVE-2010-1444

    The ZIP archive decompressor in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of ser…

    vlc Debian
  • Unscored —
    CVE-2010-1445

    Heap-based buffer overflow in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of servi…

    vlc Debian
  • Unscored —
    CVE-2010-1443

    The parse_track_node function in modules/demux/playlist/xspf.c in the XSPF playlist parser in VideoLAN VLC media player…

    vlc Debian
  • Unscored —
    CVE-2010-1442

    VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and …

    vlc Debian
  • Unscored —
    CVE-2010-2062

    Integer underflow in the real_get_rdt_chunk function in real.c, as used in modules/access/rtsp/real.c in VideoLAN VLC m…

    vlc mplayer Debian
  • Unscored —
    CVE-2011-1798

    rendering/svg/RenderSVGText.cpp in WebCore in WebKit in Google Chrome before 11.0.696.65 does not properly perform a ca…

  • Unscored —
    CVE-2011-1796

    Use-after-free vulnerability in the FrameView::calculateScrollbarModesForLayout function in page/FrameView.cpp in WebCo…

  • Unscored —
    CVE-2011-1795

    Integer underflow in the HTMLFormElement::removeFormElement function in html/HTMLFormElement.cpp in WebCore in WebKit i…