27 January 2015

28 results · Feed

• Unscored —
  CVE-2015-1373 Public exploit

  Multiple cross-site scripting (XSS) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inj…

  Jan 27, 2015
• Unscored —
  CVE-2015-1367

  SQL injection vulnerability in index.php in CatBot 0.4.2 allows remote attackers to execute arbitrary SQL commands via …

  Jan 27, 2015
• Unscored —
  CVE-2015-1362 Public exploit

  Buffer overflow in the Customize 35mm tab in Two Pilots Exif Pilot 4.7.2 allows remote attackers to execute arbitrary c…

  Jan 27, 2015
• Unscored —
  CVE-2015-1363

  Cross-site scripting (XSS) vulnerability in Free Reprintables ArticleFR 3.0.5 allows remote attackers to inject arbitra…

  Jan 27, 2015
• Unscored —
  CVE-2015-1371 Public exploit

  Unrestricted file upload vulnerability in ferretCMS 1.0.4-alpha allows remote administrators to execute arbitrary code …

  Jan 27, 2015
• High —
  CVE-2015-1369

  SQL Injection in sequelize

  SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter.

  sequelize npm
  Jan 27, 2015
• Unscored —
  CVE-2015-1366 Public exploit

  Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress al…

  Jan 27, 2015
• Unscored —
  CVE-2015-1368 Public exploit

  Multiple cross-site scripting (XSS) vulnerabilities in Ansible Tower (aka Ansible UI) before 2.0.5 allow remote attacke…

  Jan 27, 2015
• Unscored —
  CVE-2015-1365 Public exploit EPSS 13%

  Directory traversal vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows re…

  Jan 27, 2015
• Medium —
  CVE-2015-1370

  VBScript Content Injection in marked

  Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.

  marked node-marked node-marked Debian Ubuntu npm
  Jan 27, 2015
• Unscored —
  CVE-2015-1374 Public exploit

  Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers…

  Jan 27, 2015
• Unscored —
  CVE-2015-1372 Public exploit

  SQL injection vulnerability in ferretCMS 1.0.4-alpha allows remote attackers to execute arbitrary SQL commands via the …

  Jan 27, 2015
• Unscored —
  CVE-2015-1364 Public exploit

  SQL injection vulnerability in the getProfile function in system/profile.functions.php in Free Reprintables ArticleFR 3…

  Jan 27, 2015
• Unscored —
  CVE-2014-9650

  CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attack…

  rabbitmq-server Debian
  Jan 27, 2015
• Unscored —
  CVE-2014-9649

  Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows r…

  rabbitmq-server Debian
  Jan 27, 2015
• Unscored —
  CVE-2015-1182

  The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does no…

  Jan 27, 2015
• Unscored —
  CVE-2014-8154

  The Gst.MapInfo function in Vala 0.26.0 and 0.26.1 uses an incorrect buffer length declaration for the Gstreamer bindin…

  Jan 27, 2015
• Unscored —
  CVE-2014-5211

  Stack-based buffer overflow in the Attachmate Reflection FTP Client before 14.1.433 allows remote FTP servers to execut…

  Jan 27, 2015
• Unscored —
  CVE-2015-0232 EPSS 16%

  The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 …

  php5 Ubuntu
  Jan 27, 2015
• Unscored —
  CVE-2015-0231 Public exploit EPSS 44%

  Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.…

  php5 Ubuntu
  Jan 27, 2015
• Unscored —
  CVE-2015-1360

  Skia, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (buffer over-r…

  chromium-browser oxide-qt Ubuntu
  Jan 27, 2015
• Unscored —
  CVE-2015-1361

  platform/image-decoders/ImageFrame.h in Blink, as used in Google Chrome before 40.0.2214.91, does not initialize a vari…

  chromium-browser oxide-qt Ubuntu
  Jan 27, 2015
• Unscored —
  CVE-2015-1359

  Multiple off-by-one errors in fpdfapi/fpdf_font/font_int.h in PDFium, as used in Google Chrome before 40.0.2214.91, all…

  chromium-browser Ubuntu
  Jan 27, 2015
• Critical 10.0
  CVE-2014-9198

  Schneider Electric ETG3000 FactoryCast HMI Gateway Use of Hard-coded Credentials

  The FTP server on the Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware through 1.60 IR 04 has hardcoded credentials, which makes it easier for remote attackers to obtain access via an FTP session.

  Schneider Electric ETG3000 FactoryCast HMI Gateway ICS / OT
  Jan 27, 2015
• Unscored —
  CVE-2014-9648

  components/navigation_interception/intercept_navigation_resource_throttle.cc in Google Chrome before 40.0.2214.91 on An…

  Jan 27, 2015
• Unscored —
  CVE-2014-9646

  Unquoted Windows search path vulnerability in the GoogleChromeDistribution::DoPostUninstallOperations function in insta…

  Jan 27, 2015
• Critical 10.0
  CVE-2014-9197

  Schneider Electric ETG3000 FactoryCast HMI Gateway Missing Authentication for Critical Function

  The Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware before 1.60 IR 04 stores rde.jar under the web root with insufficient access control, which allows remote attackers to obtain sensitive setup and configuration information via a direct reque…

  Schneider Electric ETG3000 FactoryCast HMI Gateway ICS / OT
  Jan 27, 2015
• Unscored —
  CVE-2014-9647

  Use-after-free vulnerability in PDFium, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause …

  chromium-browser Ubuntu
  Jan 27, 2015