Skip to content
OpenAdvisories

Archive

January 2015

Vulnerabilities first published in this month (UTC), newest first.

← December 2014 2015 / January February 2015 →
  1. 134
  2. 233
  3. 39
  4. 47
  5. 517
  6. 66
  7. 713
  8. 816
  9. 929
  10. 1017
  11. 11 
  12. 126
  13. 1394
  14. 1418
  15. 1538
  16. 1635
  17. 1714
  18. 183
  19. 19 
  20. 209
  21. 21164
  22. 2236
  23. 2311
  24. 24 
  25. 25 
  26. 2610
  27. 2728
  28. 289
  29. 2910
  30. 3047
  31. 31 
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Medium —
    CVE-2015-1370

    VBScript Content Injection in marked

    Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.

    marked node-marked node-marked Debian Ubuntu npm
  • Medium —
    CVE-2014-9623

    OpenStack Glance Bypass the storage quota and Denial of service

    OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting an image in the saving state.

    glance glance Debian PyPI
  • Medium —
    CVE-2015-1195

    OpenStack Glance v2 API unrestricted path traversal through filesystem:// scheme

    The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE…

    glance glance Debian PyPI
  • Medium 5.3
    CVE-2014-8152

    Improper Input Validation in Apache Santuario XML Security

    Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document.

    org.apache.santuario:xmlsec Maven
  • Medium —
    CVE-2014-9490

    sentry-raven allows remote attackers to cause a denial of service via a large exponent value in a scientific number

    The numtok function in lib/raven/okjson.rb in the raven-ruby gem before 0.12.2 for Ruby allows remote attackers to cause a denial of service via a large exponent value in a scientific number.

    sentry-raven RubyGems
  • Medium 6.6
    CVE-2014-2355

    GE Proficy HMI/SCADA CIMPLICITY CimView

    The (1) CimView and (2) CimEdit components in GE Proficy HMI/SCADA-CIMPLICITY 8.2 and earlier allow remote attackers to gain privileges via a crafted CIMPLICITY screen (aka .CIM) file.

    GE Proficy HMI/SCADA–CIMPLICITY
  • Medium 5.4
    CVE-2014-9194

    Arbiter Systems 1094B GPS Clock Insufficient Verification of Data Authenticity

    Arbiter 1094B GPS Substation Clock allows remote attackers to cause a denial of service (disruption) via crafted radio transmissions that spoof GPS satellite broadcasts.

    Arbiter Systems Model 1094B GPS Substation Clock
  • Medium 5.0
    CVE-2014-5418

    GE Multilink Uncontrolled Resource Consumption

    GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810, ML3000, and ML3100 switches with firmware 5.2.0 and earlier allow remote attackers to cause a denial of service (resource consumption or reboot) via c…

    GE ML810/3000/3100 series switch Multilink ML800/1200/1600/2400
  • Medium 5.3
    CVE-2015-0219

    Django WSGI Header Spoofing Vulnerability

    Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.

    python-django django python-django Debian Ubuntu PyPI
  • Medium 6.1
    CVE-2015-0220

    Django Cross-site Scripting Vulnerability

    The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related…

    python-django django python-django Debian Ubuntu PyPI
  • Medium 5.3
    CVE-2015-1039

    ZF-Commons ZfcUser Vulnerable to XSS in Login Redirect

    Cross-site scripting (XSS) vulnerability in user/login.phtml in ZF-Commons ZfcUser before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter.

    zf-commons/zfc-user Packagist
  • Medium —
    CVE-2012-6684

    RedCloth Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in the RedCloth library 4.2.9 for Ruby and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI.

    RedCloth ruby-redcloth Debian RubyGems
  • Medium —
    CVE-2014-3628

    Improper Neutralization of Input During Web Page Generation in Apache Solr

    Cross-site scripting (XSS) vulnerability in the Admin UI Plugin / Stats page in Apache Solr 4.x before 4.10.3 allows remote attackers to inject arbitrary web script or HTML via the fieldvaluecache object.

    org.apache.solr:solr Maven
  • Medium —
    CVE-2014-9527

    Loop with Unreachable Exit Condition in Apache POI

    HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service (infinite loop and deadlock) via a crafted PPT file.

    libapache-poi-java libapache-poi-java org.apache.poi:poi Debian Ubuntu Maven
  • Medium —
    CVE-2014-9508

    Typo3 Open Redirect In Frontend Rendering

    The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to a…

    typo3/cms Packagist