Archive
December 2014
Vulnerabilities first published in this month (UTC), newest first.
614 results · Feed
-
Unscored —CVE-2014-8610 Public exploit
AndroidManifest.xml in Android before 5.0.0 does not require the SEND_SMS permission for the SmsReceiver receiver, whic…
-
Unscored —CVE-2014-8609 Public exploit
The addAccount method in src/com/android/settings/accounts/AddAccountSettings.java in the Settings application in Andro…
-
Unscored —CVE-2014-8507 Public exploit
Multiple SQL injection vulnerabilities in the queryLastApp method in packages/WAPPushManager/src/com/android/smspush/Wa…
-
Unscored —
Zenoss Core through 5 Beta 3 allows remote authenticated users to obtain sensitive (1) user account, (2) e-mail address…
-
Unscored —
Zenoss Core through 5 Beta 3 allows remote attackers to obtain sensitive information by attempting a product-rename act…
-
Unscored —
The default configuration of Zenoss Core before 5 allows remote attackers to read or modify database information by con…
-
Unscored —
Zenoss Core through 5 Beta 3 stores cleartext passwords in the session database, which might allow local users to obtai…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Zenoss Core through 5 Beta 3 allows remote attackers to hijack the a…
-
Unscored —
Zenoss Core through 5 Beta 3 uses a weak algorithm to hash passwords, which makes it easier for context-dependent attac…
-
Unscored —
Zenoss Core before 4.2.5 SP161 sets an infinite lifetime for the session ID cookie, which makes it easier for remote at…
-
Unscored —
Zenoss Core through 5 Beta 3 does not include the HTTPOnly flag in a Set-Cookie header for the authentication cookie, w…
-
Unscored —
Zenoss Core through 5 Beta 3 does not require complex passwords, which makes it easier for remote attackers to obtain a…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the web framework in Cisco Prime Security Manager (aka PRSM) 9.2…
-
Unscored —
Multiple stack-based buffer overflows in (1) HWOPOSScale.ocx and (2) HWOPOSSCANNER.ocx in Honeywell OPOS Suite before 1…
-
Unscored —
Cross-site scripting (XSS) vulnerability in EMC RSA Archer GRC Platform 5.x before 5.5.1.1 allows remote attackers to i…
-
Unscored —
Cross-site scripting (XSS) vulnerability in EMC Isilon InsightIQ 2.x and 3.x before 3.1 allows remote attackers to inje…
-
Unscored —
Open redirect vulnerability in EMC RSA Authentication Manager 8.x before 8.1 Patch 6 allows remote attackers to redirec…
-
Unscored —
The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel through 3.18 uses an improper paravirt_ena…
-
Unscored —
IBM DB2 9.5 through FP10, 9.7 through FP10, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP5 on Linux, UNIX, and …
-
Unscored —
IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP5 on Linux, UNIX, and Windows allows rem…
-
Unscored —
The remoteClientFreeFunc function in daemon/remote.c in libvirt before 1.1.3, when ACLs are used, does not set an ident…
-
Unscored —
The host_from_stream_offset function in arch_init.c in QEMU, when loading RAM during migration, allows remote attackers…
-
Unscored —
Heap-based buffer overflow in the K7FWFilt.sys kernel mode driver (aka K7Firewall Packet Driver) before 14.0.1.16, as u…
-
High 7.3
Arbitrary Code Execution in Docker
Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.
-
Unscored —
Juniper WLC devices with WLAN Software releases 8.0.x before 8.0.4, 9.0.x before 9.0.2.11, 9.0.3.x before 9.0.3.5, and …
-
Medium —
Access Restriction Bypass in Docker
Docker 1.3.0 through 1.3.1 allows remote attackers to modify the default run profile of image containers and possibly bypass the container by applying unspecified security options to an image.
-
Unscored —
The K7Sentry.sys kernel mode driver (aka K7AV Sentry Device Driver) before 12.8.0.119, as used in multiple K7 Computing…
-
Unscored —
OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records whe…
-
Unscored —
Stack-based buffer overflow in the K7Sentry.sys kernel mode driver (aka K7AV Sentry Device Driver) before 12.8.0.119, a…
-
Unscored —
Open redirect vulnerability in startSSO.ping in the SP Endpoints in Ping Identity PingFederate 6.10.1 allows remote att…
-
Unscored —
The web interface in BitTorrent allows remote attackers to execute arbitrary commands by leveraging knowledge of the pa…
-
Unscored —
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14…
-
Unscored —
Cross-site scripting (XSS) vulnerability in LinPHA allows remote attackers to inject arbitrary web script or HTML via u…
-
Unscored —CVE-2014-4323 Public exploit
The mdp_lut_hw_update function in drivers/video/msm/mdp.c in the MDP display driver for the Linux kernel 3.x, as used i…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence 10.1 before IF10, 10.1.1 bef…
-
Unscored —
The IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to bypass intended …
-
Unscored —
core/string_api.php in MantisBT before 1.2.18 does not properly categorize URLs when running under the web root, which …
-
Unscored —
BMC Track-It! 11.3 allows remote attackers to gain privileges and execute arbitrary code by creating an account whose n…
-
Unscored —
The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x b…
-
Unscored —
The TCP stack in 4.3BSD Net/2, as used in FreeBSD 5.4, NetBSD possibly 2.0, and OpenBSD possibly 3.6, does not properly…