Archive
December 2014
Vulnerabilities first published in this month (UTC), newest first.
614 results · Feed
-
Unscored —
The import/export functionality in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and…
-
Unscored —
Directory traversal vulnerability in an export function in the Process Center in IBM Business Process Manager (BPM) 8.0…
-
Unscored —
The Disaster Recovery (DRA) feature on the Cisco ISB8320-E High-Definition IP-Only DVR allows remote attackers to bypas…
-
Unscored —
IBM WebSphere Process Server 7.0, WebSphere Enterprise Service Bus 7.0, and Business Process Manager Advanced 7.5.x thr…
-
Unscored —
SQL injection vulnerability in CA Release Automation (formerly iTKO LISA Release Automation) before 4.7.1 b448 allows r…
-
Unscored —
Cross-site scripting (XSS) vulnerability in CA Release Automation (formerly iTKO LISA Release Automation) before 4.7.1 …
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in CA Release Automation (formerly iTKO LISA Release Automation) before…
-
Unscored —
plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when the K…
-
Unscored —
The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 …
-
Unscored —
Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose…
-
Unscored —
The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in goYWP WebPress 13.00.06 allow remote attackers to inject arbitra…
-
Unscored —
SQL injection vulnerability in Php/Functions/log_function.php in phpTrafficA 2.3 and earlier allows remote attackers to…
-
Unscored —
Heap-based buffer overflow in PCRE 8.36 and earlier allows remote attackers to cause a denial of service (crash) or hav…
-
Unscored —
Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in…
-
Unscored —
mod_wsgi before 4.2.4 for Apache, when creating a daemon process group, does not properly handle when group privileges …
-
Medium 6.5
Directory Traversal in Docker
Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry communications."
-
Unscored —
SQL injection vulnerability in the XML-RPC interface in Movable Type before 5.18, 5.2.x before 5.2.11, and 6.x before 6…
-
Unscored —
Directory traversal vulnerability in the CollectorConfInfoServlet servlet in ManageEngine NetFlow Analyzer allows remot…
-
Unscored —
The xdr_status_vector function in Firebird before 2.1.7 and 2.5.x before 2.5.3 SU1 allows remote attackers to cause a d…
-
Critical 9.8
Arbitrary Code Execution
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction.
-
Unscored —
Directory traversal vulnerability in the UploadAccountActivities servlet in ManageEngine Password Manager Pro (PMP) bef…
-
Unscored —CVE-2014-9371 EPSS 19%
The NativeAppServlet in ManageEngine Desktop Central MSP before 90075 allows remote attackers to execute arbitrary code…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Dashboard in Splunk Web in Splunk Enterprise 6.1.x before 6.1.4, 6.0.x …
-
Unscored —
Directory traversal vulnerability in SafeNet Authentication Service (SAS) Outlook Web Access Agent (formerly CRYPTOCard…
-
Unscored —
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0…
-
Unscored —
The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 …
-
Unscored —
Open redirect vulnerability in the login form in Zenoss Core before 4.2.5 SP161 allows remote attackers to redirect use…
-
Unscored —
An unspecified endpoint in Zenoss Core through 5 Beta 3 allows remote attackers to cause a denial of service (CPU consu…
-
Unscored —
Multiple cross-site request forgery (CSRF) vulnerabilities in Zenoss Core through 5 Beta 3 allow remote attackers to hi…
-
Unscored —
Zenoss Core through 5 Beta 3 does not require a password for modifying the pager command string, which allows remote at…
-
Unscored —
Zenoss Core through 5 Beta 3 allows remote attackers to bypass intended access restrictions by using a web-endpoint URL…
-
Unscored —
The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier does not prope…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Zenoss Core through 5 Beta 3 allow remote attackers to inject ar…
-
Unscored —
Zenoss Core through 5 Beta 3 allows remote attackers to bypass intended access restrictions and place files in a direct…
-
Unscored —
The HandleRFBServerMessage function in libvncclient/rfbproto.c in LibVNCServer 0.9.9 and earlier does not check certain…
-
Unscored —
Zenoss Core through 5 Beta 3 does not properly detect recursion during entity expansion, which allows remote attackers …
-
Unscored —CVE-2014-6261 EPSS 20%
Zenoss Core through 5 Beta 3 does not properly implement the Check For Updates feature, which allows remote attackers t…
-
Unscored —CVE-2014-3583 EPSS 11%
The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows re…
-
Unscored —CVE-2014-8967 EPSS 12%
Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute arbitrary code via a cra…