Archive
February 2015
Vulnerabilities first published in this month (UTC), newest first.
486 results · Feed
-
Unscored —
The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that f…
-
Unscored —
type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an erro…
-
Unscored —
The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, wh…
-
Unscored —
The tt_sbit_decoder_load_image function in sfnt/ttsbit.c in FreeType before 2.5.4 does not properly check for an intege…
-
Unscored —
The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR reco…
-
Unscored —
FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attack…
-
Unscored —
The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association w…
-
Unscored —
Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers t…
-
Unscored —
Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 allows remote…
-
Unscored —
sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which a…
-
Unscored —
Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of servic…
-
Unscored —
cff/cf2intrp.c in the CFF CharString interpreter in FreeType before 2.5.4 proceeds with additional hints after the hint…
-
Unscored —
The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values wit…
-
Unscored —
The woff_open_font function in sfnt/sfobjs.c in FreeType before 2.5.4 proceeds with offset+length calculations without …
-
Unscored —
cff/cf2ft.c in FreeType before 2.5.4 does not validate the return values of point-allocation functions, which allows re…
-
Unscored —
The Load_SBit_Png function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows and pitch values of PN…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass …
-
Unscored —
The mobility extension on Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allows remote attackers to obt…
-
Unscored —
The administrative web interface in Cisco WebEx Meetings Server 1.0 through 1.5 allows remote authenticated users to ex…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Mrs. Shiromuku Perl CGI shiromuku(u1)GUESTBOOK 1.62 and earlier allows remo…
-
Unscored —
The mobility extension on Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allows remote attackers to cau…
-
Unscored —
Buffer overflow in the Field Device Tool (FDT) Frame application in the HART Device Type Manager (DTM) library, as used…
-
Unscored —
The uuencode inspection engine in Cisco AsyncOS on Cisco Email Security Appliance (ESA) devices 8.5 and earlier allows …
-
Unscored —
Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allow local users to cause a denial of service (device r…
-
Unscored —
Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier use weak permissions for unspecified files, which allows…
-
Unscored —
The web framework on Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allows remote attackers to upload f…
-
Unscored —
The Proxy Bypass Content Rewriter feature in the WebVPN subsystem in Cisco Adaptive Security Appliance (ASA) Software 9…
-
Unscored —CVE-2015-1467 Public exploit
Multiple SQL injection vulnerabilities in Translations in Fork CMS before 3.8.6 allow remote authenticated users to exe…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in FancyFon FAMOC before 3.17.4 allow remote attackers to inject ar…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the web administration frontend in the httpd package in fli4l be…
-
Unscored —CVE-2015-1305 Public exploit
McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows local users to write to arbitrary memory locations, a…
-
Unscored —
SQL injection vulnerability in views/zero_transact_user.php in the administrative backend in ZeroCMS 1.3.3, 1.3.2, and …
-
Unscored —
Multiple SQL injection vulnerabilities in FancyFon FAMOC before 3.17.4 allow (1) remote attackers to execute arbitrary …
-
Unscored —
SQL injection vulnerability in SIPhone Enterprise PBX allows remote attackers to execute arbitrary SQL commands via the…
-
Unscored —CVE-2014-9643 Public exploit
K7Sentry.sys in K7 Computing Ultimate Security, Anti-Virus Plus, and Total Security before 14.2.0.253 allows local user…
-
Unscored —CVE-2014-9642 Public exploit
bdagent.sys in BullGuard Antivirus, Internet Security, Premium Protection, and Online Backup before 15.0.288 allows loc…
-
Unscored —CVE-2014-9641 Public exploit
The tmeext.sys driver before 2.0.0.1015 in Trend Micro Antivirus Plus, Internet Security, and Maximum Security allows l…
-
Unscored —CVE-2014-9632 Public exploit
The TDI driver (avgtdix.sys) in AVG Internet Security before 2013.3495 Hot Fix 18 and 2015.x before 2015.5315 and Prote…
-
Unscored —CVE-2014-9636 EPSS 12%
unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra fie…
-
Unscored —
The OriginCanAccessServiceWorkers function in content/browser/service_worker/service_worker_dispatcher_host.cc in Googl…