Skip to content
OpenAdvisories

Archive

January 2015

Vulnerabilities first published in this month (UTC), newest first.

← December 2014 2015 / January February 2015 →
  1. 134
  2. 233
  3. 39
  4. 47
  5. 517
  6. 66
  7. 713
  8. 816
  9. 929
  10. 1017
  11. 11 
  12. 126
  13. 1394
  14. 1418
  15. 1538
  16. 1635
  17. 1714
  18. 183
  19. 19 
  20. 209
  21. 21164
  22. 2236
  23. 2311
  24. 24 
  25. 25 
  26. 2610
  27. 2728
  28. 289
  29. 2910
  30. 3047
  31. 31 
All Critical High Medium Low Exploited only Public exploit

713 results · Feed

  • Unscored —
    CVE-2014-8993

    Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite before 7.4.2-rev40, 7.6.0 before …

  • Unscored —
    CVE-2014-9567 Public exploit EPSS 43%

    Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows re…

  • Unscored —
    CVE-2014-4636

    Cross-site request forgery (CSRF) vulnerability in EMC Documentum Web Development Kit (WDK) before 6.8 allows remote at…

  • Unscored —
    CVE-2014-4637

    Open redirect vulnerability in EMC Documentum Web Development Kit (WDK) before 6.8 allows remote attackers to redirect …

  • Unscored —
    CVE-2014-4639

    EMC Documentum Web Development Kit (WDK) before 6.8 does not properly generate random numbers for a certain parameter r…

  • Unscored —
    CVE-2014-4638

    EMC Documentum Web Development Kit (WDK) before 6.8 allows remote attackers to conduct frame-injection attacks and obta…

  • Unscored —
    CVE-2014-4635

    Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum Web Development Kit (WDK) before 6.8 allow remote…

  • Unscored —
    CVE-2014-7209

    run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbit…

    mime-support mime-support Debian Ubuntu
  • Unscored —
    CVE-2014-3764

    Cross-site scripting (XSS) vulnerability in the web-based device management interface in Palo Alto Networks PAN-OS befo…

  • Medium —
    CVE-2014-3628

    Improper Neutralization of Input During Web Page Generation in Apache Solr

    Cross-site scripting (XSS) vulnerability in the Admin UI Plugin / Stats page in Apache Solr 4.x before 4.10.3 allows remote attackers to inject arbitrary web script or HTML via the fieldvaluecache object.

    org.apache.solr:solr Maven
  • Unscored —
    CVE-2014-8131

    The qemu implementation of virConnectGetAllDomainStats in libvirt before 1.2.11 does not properly handle locks when a d…

    libvirt Debian
  • Unscored —
    CVE-2014-9528 Public exploit

    SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListControll…

  • Medium —
    CVE-2014-9527

    Loop with Unreachable Exit Condition in Apache POI

    HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service (infinite loop and deadlock) via a crafted PPT file.

    libapache-poi-java org.apache.poi:poi libapache-poi-java Debian Ubuntu Maven
  • Unscored —
    CVE-2014-9526

    Multiple cross-site scripting (XSS) vulnerabilities in concrete5 5.7.2.1, 5.7.2, and earlier allow remote attackers to …

  • Unscored —
    CVE-2014-1679

    Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite before 7.2.2-rev31, 7.4.0 before 7.4.0-rev27, an…

  • Unscored —
    CVE-2014-2598 Public exploit

    Cross-site request forgery (CSRF) vulnerability in the Quick Page/Post Redirect plugin before 5.0.5 for WordPress allow…

  • Unscored —
    CVE-2014-8084

    Directory traversal vulnerability in oc-includes/osclass/controller/ajax.php in OSClass before 3.4.3 allows remote atta…

  • Unscored —
    CVE-2014-8083

    SQL injection vulnerability in the Search::setJsonAlert method in OSClass before 3.4.3 allows remote attackers to execu…

  • Unscored —
    CVE-2014-8085

    Unrestricted file upload vulnerability in the CWebContact::doModel method in oc-includes/osclass/controller/contact.php…

  • Unscored —
    CVE-2014-9517

    Cross-site scripting (XSS) vulnerability in D-link IP camera DCS-2103 with firmware before 1.20 allows remote attackers…

  • Unscored —
    CVE-2014-9516 Public exploit

    Cross-site scripting (XSS) vulnerability in Social Microblogging PRO 1.5 allows remote attackers to inject arbitrary we…

  • Unscored —
    CVE-2014-9525

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Timed Popup (wp-timed-popup) plugin 1.3 for WordPress…

  • Unscored —
    CVE-2014-9522 Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in CMS Papoo Light 6.0.0 (Rev 4701) allow remote attackers to injec…

  • Unscored —
    CVE-2014-9520

    SQL injection vulnerability in execute.php in InfiniteWP Admin Panel before 2.4.4 allows remote attackers to execute ar…

  • Unscored —
    CVE-2014-9519

    SQL injection vulnerability in login.php in InfiniteWP Admin Panel before 2.4.3 allows remote attackers to execute arbi…

  • Unscored —
    CVE-2014-9518

    Cross-site scripting (XSS) vulnerability in login.cgi in D-Link router DIR-655 (rev Bx) with firmware before 2.12b01 al…

  • Unscored —
    CVE-2014-9521

    Unrestricted file upload vulnerability in uploadScript.php in InfiniteWP Admin Panel before 2.4.4, when the allWPFiles …

  • Unscored —
    CVE-2014-9523

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Our Team Showcase (our-team-enhanced) plugin before 1…

  • Unscored —
    CVE-2014-9389

    Directory traversal vulnerability in Sonatype Nexus OSS and Pro before 2.11.1-01 allows remote attackers to read or wri…

  • Unscored —
    CVE-2014-9524

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Facebook Like Box (cardoza-facebook-like-box) plugin …

  • Unscored —
    CVE-2013-2131 Public exploit EPSS 11%

    Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attacke…

    rrdtool rrdtool Debian Ubuntu
  • Unscored —
    CVE-2014-9506

    MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates when a monitored issue …

  • High —
    CVE-2014-9509

    Typo3 Vulnerable to Cache Poisoning

    The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set to all or cached, allows remote attackers to have an unspecified impact (possibly resource consumption…

    typo3/cms Packagist
  • Unscored —
    CVE-2014-9276

    Cross-site request forgery (CSRF) vulnerability in the Special:ExpandedTemplates page in MediaWiki before 1.19.22, 1.20…

  • Unscored —
    CVE-2014-9277

    The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14…

    mediawiki Debian
  • Medium —
    CVE-2014-9508

    Typo3 Open Redirect In Frontend Rendering

    The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to a…

    typo3/cms Packagist
  • Unscored —
    CVE-2014-9507

    MediaWiki 1.21.x, 1.22.x before 1.22.14, and 1.23.x before 1.23.7, when $wgContentHandlerUseDB is enabled, allows remot…

  • Unscored —
    CVE-2014-9464 Public exploit

    SQL injection vulnerability in Category.php in Microweber CMS 0.95 before 20141209 allows remote attackers to execute a…

  • Unscored —
    CVE-2010-5314

    Cross-site scripting (XSS) vulnerability in controllers/home_controller.php in BEdita before 3.1 allows remote attacker…

  • Unscored —
    CVE-2010-5320

    Multiple cross-site request forgery (CSRF) vulnerabilities in MemHT Portal 4.0.1 allow remote attackers to hijack the a…