Archive
January 2015
Vulnerabilities first published in this month (UTC), newest first.
124 results · Clear filters · Feed
-
Unscored —CVE-2014-4481 Public exploit
Integer overflow in CoreGraphics in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows…
-
Unscored —
libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain…
-
Unscored —CVE-2014-8826 Public exploit
LaunchServices in Apple OS X before 10.10.2 does not properly handle file-type metadata, which allows attackers to bypa…
-
Unscored —CVE-2014-8835 Public exploit
The xpc_data_get_bytes function in libxpc in Apple OS X before 10.10.2 does not verify that a dictionary's Attributes k…
-
Unscored —CVE-2015-1422 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary…
-
Unscored —CVE-2015-1424 Public exploit
Cross-site request forgery (CSRF) vulnerability in Gecko CMS 2.2 and 2.3 allows remote attackers to hijack the authenti…
-
Unscored —CVE-2015-1423 Public exploit
Multiple SQL injection vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote administrators to execute arbitrary SQL co…
-
Unscored —
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,…
-
Unscored —
pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the uploa…
-
Unscored —
pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remo…
-
Unscored —CVE-2015-1373 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inj…
-
Unscored —CVE-2015-1362 Public exploit
Buffer overflow in the Customize 35mm tab in Two Pilots Exif Pilot 4.7.2 allows remote attackers to execute arbitrary c…
-
Unscored —CVE-2015-1371 Public exploit
Unrestricted file upload vulnerability in ferretCMS 1.0.4-alpha allows remote administrators to execute arbitrary code …
-
Unscored —CVE-2015-1366 Public exploit
Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress al…
-
Unscored —CVE-2015-1368 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Ansible Tower (aka Ansible UI) before 2.0.5 allow remote attacke…
-
Unscored —
Directory traversal vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows re…
-
Unscored —CVE-2015-1374 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers…
-
Unscored —CVE-2015-1372 Public exploit
SQL injection vulnerability in ferretCMS 1.0.4-alpha allows remote attackers to execute arbitrary SQL commands via the …
-
Unscored —CVE-2015-1364 Public exploit
SQL injection vulnerability in the getProfile function in system/profile.functions.php in Free Reprintables ArticleFR 3…
-
Unscored —
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.…
-
High 7.8
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windo…
KEV Apr 13, 2022 -
Unscored —CVE-2014-8802 Public exploit
The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-regis…
-
Unscored —
The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via…
-
Unscored —CVE-2014-8008 Public exploit
Absolute path traversal vulnerability in the Real-Time Monitoring Tool (RTMT) API in Cisco Unified Communications Manag…
-
Unscored —
The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6 does not properly res…
-
Unscored —CVE-2014-6598 Public exploit
Unspecified vulnerability in the Oracle Communications Diameter Signaling Router component in Oracle Communications App…
-
Unscored —CVE-2015-1028 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2730B router (rev C1) with firmware GE_1.01 allow rem…
-
Unscored —
Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27…
-
Unscored —CVE-2014-6577 Public exploit
Unspecified vulnerability in the XML Developer's Kit for C component in Oracle Database Server 11.2.0.3, 11.2.0.4, 12.1…
-
Unscored —CVE-2015-0516 Public exploit
Directory traversal vulnerability in EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 allows remote authe…
-
Unscored —CVE-2015-0514 Public exploit
EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 might allow remote attackers to obtain cleartext data-ce…
-
Unscored —CVE-2014-7289 Public exploit
SQL injection vulnerability in the management server in Symantec Critical System Protection (SCSP) 5.2.9 before MP6 and…
-
Unscored —CVE-2014-9597 Public exploit
The picture_pool_Delete function in misc/picture_pool.c in VideoLAN VLC media player 2.1.5 allows remote attackers to e…
-
Unscored —CVE-2014-9225 Public exploit
The ajaxswing webui in the management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symant…
-
Unscored —CVE-2014-9224 Public exploit
Cross-site scripting (XSS) vulnerability in the ajaxswing webui in the Management Console server in the management serv…
-
Unscored —CVE-2014-9598 Public exploit
The picture_Release function in misc/picture.c in VideoLAN VLC media player 2.1.5 allows remote attackers to execute ar…
-
Unscored —CVE-2014-9226 Public exploit
The management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security…
-
Unscored —CVE-2015-1201 Public exploit
Privoxy before 3.0.22 allows remote attackers to cause a denial of service (file descriptor consumption) via unspecifie…
-
Unscored —CVE-2014-8386 Public exploit
Multiple stack-based buffer overflows in Advantech AdamView 4.3 and earlier allow remote attackers to execute arbitrary…
-
Critical 10.0
Phoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical Function
Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic.