Archive
December 2014
Vulnerabilities first published in this month (UTC), newest first.
614 results · Feed
-
Unscored —
Cisco-Meraki MS, MR, and MX devices with firmware before 2014-09-24 allow remote authenticated users to install arbitra…
-
Unscored —
Cisco-Meraki MS, MR, and MX devices with firmware before 2014-09-24 allow remote attackers to obtain sensitive credenti…
-
Unscored —CVE-2014-9412 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers…
-
Unscored —CVE-2014-9115 Public exploit
SQL injection vulnerability in the rate_picture function in include/functions_rate.inc.php in Piwigo before 2.5.5, 2.6.…
-
Unscored —
NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allows remote authenticated administrators to discover service-account …
-
Unscored —
nps/servlet/webacc in iManager in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 …
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Acc…
-
Unscored —CVE-2014-5216 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote att…
-
Unscored —
IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8…
-
Unscored —
IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8…
-
Unscored —
IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8…
-
Unscored —
Cross-site scripting (XSS) vulnerability in IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFi…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Guest Server in Cisco Jabber allows remote attackers to inject arbitrar…
-
Unscored —
The API in the Guest Server in Cisco Jabber, when HTML5 is used, allows remote attackers to obtain sensitive informatio…
-
Unscored —
The API in the Guest Server in Cisco Jabber, when the HTML5 CORS feature is used, allows remote attackers to obtain sen…
-
Unscored —
Cross-site scripting (XSS) vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl …
-
Unscored —
The Sponsor Portal in Cisco Identity Services Engine (ISE) allows remote authenticated users to obtain access to an arb…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Business Voice Services Manager (BVSM) pages in the Application …
-
Unscored —
The periodic-backup feature in Cisco Identity Services Engine (ISE) allows remote attackers to discover backup-encrypti…
-
Unscored —
BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.0…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Collaboration Server in IBM InfoSphere Master Data Management Server fo…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Collaboration Server in IBM InfoSphere Master Data Management Server fo…
-
Unscored —
The Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Collaboration Server in IBM InfoSphere Master Data Management Server fo…
-
Unscored —CVE-2014-7286 Public exploit
Buffer overflow in AClient in Symantec Deployment Solution 6.9 and earlier on Windows XP and Server 2003 allows local u…
-
Unscored —
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.…
-
Unscored —CVE-2014-9293 EPSS 13%
The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key…
-
Unscored —
Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via …
-
Unscored —CVE-2014-9294 EPSS 13%
util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attacker…
-
Unscored —CVE-2014-9296 EPSS 16%
The receive function in ntp_proto.c in ntpd in NTP before 4.2.8 continues to execute after detecting a certain authenti…
-
Unscored —
The syslog-management subsystem in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to obtain a…
-
Unscored —
Cisco Prime Infrastructure allows remote authenticated users to read device-discovery passwords by examining the HTML s…
-
Unscored —
Directory traversal vulnerability in Cisco Enterprise Content Delivery System (ECDS) allows remote attackers to read ar…
-
High 8.5
Innominate mGuard Improper Privilege Management
Innominate mGuard with firmware before 7.6.6 and 8.x before 8.1.4 allows remote authenticated admins to obtain root privileges by changing a PPP configuration setting.
-
Unscored —
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) vi…
-
Unscored —
nds/files/opt/novell/eDirectory/lib64/ndsimon/public/images in iMonitor in Novell eDirectory before 8.8 SP8 Patch 4 all…
-
Unscored —
Cross-site scripting (XSS) vulnerability in nds/search/data in iMonitor in Novell eDirectory before 8.8 SP8 Patch 4 all…
-
Unscored —
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which m…
-
Unscored —
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependen…
-
Unscored —CVE-2014-7208 Public exploit
GParted before 0.15.0 allows local users to execute arbitrary commands with root privileges via shell metacharacters in…