2014 CVEs (page 2)
Page 2 of 91 — CVEs published in 2014, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2014-125030 | Medium | 6.3 | 2023-01-01 | A vulnerability, which was classified as critical, has been found in taoeffect Empress. Affected by this issue is some unknown functionality. The manipulation… |
CVE-2014-125028 | Medium | 4.3 | 2022-12-31 | A vulnerability was found in valtech IDP Test Client and classified as problematic. Affected by this issue is some unknown functionality of the file python-fla… |
CVE-2014-125027 | Low | 3.5 | 2022-12-31 | A vulnerability has been found in Yuna Scatari TBDev up to 2.1.17 and classified as problematic. Affected by this vulnerability is the function get_user_icons… |
CVE-2014-125026 | Critical | 9.8 | 2022-12-27 | LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input. |
CVE-2014-0148 | Medium | 5.5 | 2022-09-29 | Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when calculating BAT entries, due to missing bo… |
CVE-2014-0147 | Medium | 6.2 | 2022-09-29 | Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are vulnerable to a possible crash caused by… |
CVE-2014-0144 | High | 8.6 | 2022-09-29 | QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer overf… |
CVE-2014-8164 | Critical | 9.1 | 2022-07-06 | A insecure configuration for certificate verification (http.verify_mode = OpenSSL::SSL::VERIFY_NONE) may lead to verification bypass in Red Hat CloudForms 5.x. |
CVE-2014-3650 | Medium | 5.4 | 2022-07-01 | Multiple persistent cross-site scripting (XSS) flaws were found in the way Aerogear handled certain user-supplied content. A remote attacker could use these fl… |
CVE-2014-3648 | High | 7.5 | 2022-07-01 | The simplepush server iterates through the application installations and pushes a notification to the server provided by deviceToken. But this is user controll… |
CVE-2014-0156 | Critical | 9.8 | 2022-06-30 | Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as arguments. If untrusted inp… |
CVE-2014-0068 | Medium | 5.5 | 2022-06-30 | It was reported that watchman in openshift node-utils creates /var/run/watchman.pid and /var/log/watchman.ouput with world writable permission. |
CVE-2014-125025 | Medium | 5.3 | 2022-06-19 | A vulnerability classified as problematic has been found in FFmpeg 2.0. This affects the function decode_pulses. The manipulation leads to memory corruption. I… |
CVE-2014-125024 | High | 7.3 | 2022-06-19 | A vulnerability was found in FFmpeg 2.0. It has been rated as critical. Affected by this issue is the function lag_decode_frame. The manipulation leads to memo… |
CVE-2014-125023 | Medium | 5.3 | 2022-06-19 | A vulnerability was found in FFmpeg 2.0. It has been declared as problematic. Affected by this vulnerability is the function truemotion1_decode_header of the c… |
CVE-2014-125022 | Medium | 5.3 | 2022-06-19 | A vulnerability was found in FFmpeg 2.0. It has been classified as problematic. Affected is the function shorten_decode_frame of the component Bitstream Buffer… |
CVE-2014-125021 | Medium | 5.3 | 2022-06-19 | A vulnerability was found in FFmpeg 2.0 and classified as problematic. This issue affects the function cmv_process_header. The manipulation leads to memory cor… |
CVE-2014-125020 | High | 7.3 | 2022-06-19 | A vulnerability has been found in FFmpeg 2.0 and classified as critical. This vulnerability affects the function decode_update_thread_context. The manipulation… |
CVE-2014-125019 | Medium | 5.3 | 2022-06-19 | A vulnerability, which was classified as problematic, was found in FFmpeg 2.0. This affects the function decode_nal_unit of the component Slice Segment Handler… |
CVE-2014-125018 | Medium | 5.3 | 2022-06-19 | A vulnerability, which was classified as problematic, has been found in FFmpeg 2.0. Affected by this issue is the function decode_slice_header. The manipulatio… |
CVE-2014-125017 | High | 7.3 | 2022-06-18 | A vulnerability classified as critical was found in FFmpeg 2.0. This vulnerability affects the function rpza_decode_stream. The manipulation leads to memory co… |
CVE-2014-125016 | Medium | 5.3 | 2022-06-18 | A vulnerability was found in FFmpeg 2.0. It has been rated as problematic. This issue affects the function ff_init_buffer_info of the file utils.c. The manipul… |
CVE-2014-125015 | High | 7.3 | 2022-06-18 | A vulnerability classified as critical has been found in FFmpeg 2.0. Affected is the function read_var_block_data. The manipulation leads to memory corruption… |
CVE-2014-125014 | Medium | 5.3 | 2022-06-18 | A vulnerability classified as problematic was found in FFmpeg 2.0. Affected by this vulnerability is an unknown functionality of the component HEVC Video Decod… |
CVE-2014-125013 | Medium | 5.3 | 2022-06-18 | A vulnerability was found in FFmpeg 2.0 and classified as problematic. This issue affects the function msrle_decode_frame of the file libavcodec/msrle.c. The m… |
CVE-2014-125012 | Medium | 5.3 | 2022-06-18 | A vulnerability was found in FFmpeg 2.0. It has been classified as problematic. Affected is an unknown function of the file libavcodec/dxtroy.c. The manipulati… |
CVE-2014-125011 | Medium | 5.3 | 2022-06-18 | A vulnerability was found in FFmpeg 2.0. It has been declared as problematic. Affected by this vulnerability is the function decode_frame of the file libavcode… |
CVE-2014-125010 | Medium | 5.3 | 2022-06-18 | A vulnerability was found in FFmpeg 2.0. It has been rated as critical. Affected by this issue is the function decode_slice_header of the file libavcodec/h64.c… |
CVE-2014-125009 | Medium | 5.3 | 2022-06-18 | A vulnerability classified as problematic has been found in FFmpeg 2.0. This affects the function add_yblock of the file libavcodec/snow.h. The manipulation le… |
CVE-2014-125008 | Medium | 5.3 | 2022-06-18 | A vulnerability classified as problematic has been found in FFmpeg 2.0. Affected is the function vorbis_header of the file libavformat/oggparsevorbis.c. The ma… |
CVE-2014-125007 | Medium | 5.3 | 2022-06-18 | A vulnerability classified as problematic was found in FFmpeg 2.0. Affected by this vulnerability is the function intra_pred of the file libavcodec/hevcpred_te… |
CVE-2014-125006 | Medium | 5.3 | 2022-06-18 | A vulnerability, which was classified as problematic, has been found in FFmpeg 2.0. Affected by this issue is the function output_frame of the file libavcodec/… |
CVE-2014-125005 | Medium | 5.3 | 2022-06-18 | A vulnerability, which was classified as problematic, was found in FFmpeg 2.0. This affects the function decode_vol_header of the file libavcodec/mpeg4videodec… |
CVE-2014-125004 | Medium | 5.3 | 2022-06-18 | A vulnerability has been found in FFmpeg 2.0 and classified as problematic. This vulnerability affects the function decode_hextile of the file libavcodec/vmnc… |
CVE-2014-125003 | Medium | 5.3 | 2022-06-18 | A vulnerability was found in FFmpeg 2.0 and classified as problematic. This issue affects the function get_siz of the file libavcodec/jpeg2000dec.c. The manipu… |
CVE-2014-125002 | Medium | 5.3 | 2022-06-18 | A vulnerability was found in FFmpeg 2.0. It has been classified as problematic. Affected is the function dnxhd_init_rc of the file libavcodec/dnxhdenc.c. The m… |
CVE-2014-125001 | High | 8.1 | 2022-05-24 | A vulnerability classified as critical has been found in Cardo Systems Scala Rider Q3. Affected is the file /cardo/api of the Cardo-Updater. Unauthenticated re… |
CVE-2014-8597 | Medium | 6.1 | 2022-02-17 | A reflected cross-site scripting (XSS) vulnerability in PHP-Fusion 7.02.07 allows remote attackers to inject arbitrary web script or HTML via the status parame… |
CVE-2014-9320 | Critical | 9.8 | 2021-08-09 | SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SI_PLATFORM_SEARCH_SERVER_LOGON_TOKEN token and consequently gain SYSTEM privileges via vect… |
CVE-2014-10402 | Medium | 6.1 | 2020-09-16 | An issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open files from folders other than those specifically passed via the f_… |
CVE-2014-10401 | Medium | 6.1 | 2020-09-11 | An issue was discovered in the DBI module before 1.632 for Perl. DBD::File drivers can open files from folders other than those specifically passed via the f_d… |
CVE-2014-1420 | Low | 3.8 | 2020-09-11 | On desktop, Ubuntu UI Toolkit's StateSaver would serialise data on tmp/ files which an attacker could use to expose potentially sensitive data. StateSaver woul… |
CVE-2014-1422 | Medium | 5.0 | 2020-07-22 | In Ubuntu's trust-store, if a user revokes location access from an application, the location is still available to the application because the application will… |
CVE-2014-9702 | High | 7.5 | 2020-06-01 | system/classes/DbPDO.php in Cmfive through 2015-03-15, when database connectivity malfunctions, allows remote attackers to obtain sensitive information (userna… |
CVE-2014-8945 | Critical | 9.8 | 2020-06-01 | admin.php?page=projects in Lexiglot through 2014-11-20 allows command injection via username and password fields. |
CVE-2014-8944 | Medium | 5.4 | 2020-06-01 | Lexiglot through 2014-11-20 allows XSS (Reflected) via the username, or XSS (Stored) via the admin.php?page=config install_name, intro_message, or new_file_con… |
CVE-2014-8943 | High | 8.8 | 2020-06-01 | Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svn_url parameter. |
CVE-2014-8942 | High | 8.8 | 2020-06-01 | Lexiglot through 2014-11-20 allows CSRF. |
CVE-2014-8941 | Critical | 9.8 | 2020-06-01 | Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&from_id= or admin.php?page=history&limit= URI. |
CVE-2014-8940 | Medium | 5.3 | 2020-06-01 | Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (names and details of projects) by visiting the /update.log URI. |
CVE-2014-8939 | Medium | 5.3 | 2020-06-01 | Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (full path) via an include/smarty/plugins/modifier.date_format.php request… |
CVE-2014-8938 | High | 7.8 | 2020-06-01 | Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username and password are on the command line. |
CVE-2014-8937 | High | 7.5 | 2020-06-01 | Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a great deal of resources. |
CVE-2014-7175 | Critical | 9.8 | 2020-06-01 | FarLinX X25 Gateway through 2014-09-25 allows attackers to write arbitrary data to fsUI.xyz via fsSaveUIPersistence.php. |
CVE-2014-7174 | Medium | 5.3 | 2020-06-01 | FarLinX X25 Gateway through 2014-09-25 allows directory traversal via the log-handling feature. |
CVE-2014-7173 | Critical | 9.8 | 2020-06-01 | FarLinX X25 Gateway through 2014-09-25 allows command injection via shell metacharacters to sysSaveMonitorData.php, fsx25MonProxy.php, syseditdate.php, iframeu… |
CVE-2014-1423 | Medium | 5.9 | 2020-05-07 | signond before 8.57+15.04.20141127.1-0ubuntu1, as used in Ubuntu Touch, did not properly restrict applications from querying oath tokens due to incorrect check… |
CVE-2014-2723 | High | 8.8 | 2020-03-19 | In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user to gain privileged… |
CVE-2014-2722 | High | 8.8 | 2020-03-19 | In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user to gain privileged… |
CVE-2014-2721 | High | 8.8 | 2020-03-19 | In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user to gain privileged… |
CVE-2014-1634 | Critical | 9.8 | 2020-03-09 | SQL Injection exists in Advanced Newsletter Magento extension before 2.3.5 via the /store/advancednewsletter/index/subscribeajax/an_category_id/ PATH_INFO. |
CVE-2014-7914 | High | 8.1 | 2020-02-21 | btif/src/btif_dm.c in Android before 5.1 does not properly enforce the temporary nature of a Bluetooth pairing, which allows user-assisted remote attackers to… |
CVE-2014-4019 | High | 7.5 | 2020-02-20 | ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient access control, which allows remote at… |
CVE-2014-4650 | Critical | 9.8 | 2020-02-20 | The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attacke… |
CVE-2014-7951 | Medium | 4.6 | 2020-02-20 | Directory traversal vulnerability in the Android debug bridge (aka adb) in Android 4.0.4 allows physically proximate attackers with a direct connection to the… |
CVE-2014-4659 | Medium | 5.5 | 2020-02-20 | Ansible before 1.5.5 sets 0644 permissions for sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumst… |
CVE-2014-4658 | Medium | 5.5 | 2020-02-20 | The vault subsystem in Ansible before 1.5.5 does not set the umask before creation or modification of a vault file, which allows local users to obtain sensitiv… |
CVE-2014-4657 | Critical | 9.8 | 2020-02-20 | The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted… |
CVE-2014-3484 | Critical | 9.8 | 2020-02-20 | Multiple stack-based buffer overflows in the __dn_expand function in network/dn_expand.c in musl libc 1.1x before 1.1.2 and 0.9.13 through 1.0.3 allow remote a… |
CVE-2014-4678 | Critical | 9.8 | 2020-02-20 | The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted… |
CVE-2014-4660 | Medium | 5.5 | 2020-02-20 | Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtai… |
CVE-2014-9617 | Medium | 6.1 | 2020-02-19 | Open redirect vulnerability in remotereporter/load_logfiles.php in Netsweeper before 4.0.5 allows remote attackers to redirect users to arbitrary web sites and… |
CVE-2014-9615 | Medium | 6.1 | 2020-02-19 | Cross-site scripting (XSS) vulnerability in Netsweeper 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url parameter to webadmin/d… |
CVE-2014-9614 | Critical | 9.8 | 2020-02-19 | The Web Panel in Netsweeper before 4.0.5 has a default password of branding for the branding account, which makes it easier for remote attackers to obtain acce… |
CVE-2014-9613 | Critical | 9.8 | 2020-02-19 | Multiple SQL injection vulnerabilities in Netsweeper before 2.6.29.10 allow remote attackers to execute arbitrary SQL commands via the (1) login parameter to w… |
CVE-2014-9612 | Critical | 9.8 | 2020-02-19 | SQL injection vulnerability in remotereporter/load_logfiles.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers… |
CVE-2014-9609 | Medium | 5.3 | 2020-02-19 | Directory traversal vulnerability in webadmin/reporter/view_server_log.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remot… |
CVE-2014-9608 | Medium | 6.1 | 2020-02-19 | Cross-site scripting (XSS) vulnerability in webadmin/policy/group_table_ajax.php/ in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow… |
CVE-2014-9607 | Medium | 6.1 | 2020-02-19 | Cross-site scripting (XSS) vulnerability in remotereporter/load_logfiles.php in Netsweeper 4.0.3 and 4.0.4 allows remote attackers to inject arbitrary web scri… |
CVE-2014-9606 | Medium | 6.1 | 2020-02-19 | Multiple cross-site scripting (XSS) vulnerabilities in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow remote attackers to inject ar… |
CVE-2014-2727 | Critical | 9.8 | 2020-02-19 | The STARTTLS implementation in MailMarshal before 7.2 allows plaintext command injection. |
CVE-2014-2228 | Critical | 9.8 | 2020-02-19 | The XStream extension in HP Fortify SCA before 2.2 RC3 allows remote attackers to execute arbitrary code via unsafe deserialization of XML messages. |
CVE-2014-3622 | Critical | 9.8 | 2020-02-19 | Use-after-free vulnerability in the add_post_var function in the Posthandler component in PHP 5.6.x before 5.6.1 might allow remote attackers to execute arbitr… |
CVE-2014-3879 | Critical | 9.8 | 2020-02-18 | OpenPAM Nummularia 9.2 through 10.0 does not properly handle the error reported when an include directive refers to a policy that does not exist, which causes… |
CVE-2014-4967 | Critical | 9.8 | 2020-02-18 | Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed… |
CVE-2014-4966 | Critical | 9.8 | 2020-02-18 | Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows rem… |
CVE-2014-4651 | Critical | 9.8 | 2020-02-18 | It was found that the jclouds scriptbuilder Statements class wrote a temporary file to a predictable location. An attacker could use this flaw to access sensit… |
CVE-2014-8089 | Critical | 9.8 | 2020-02-17 | SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote att… |
CVE-2014-7236 | Critical | 9.1 | 2020-02-17 | Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary Perl code via the debugenableplugins pa… |
CVE-2014-4981 | Critical | 9.8 | 2020-02-17 | LPAR2RRD in 3.5 and earlier allows remote attackers to execute arbitrary commands due to insufficient input sanitization of the web GUI parameters. |
CVE-2014-1947 | High | 7.8 | 2020-02-17 | Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick 6.5.4 and earlier allows remote attackers to cause a denial of service… |
CVE-2014-1617 | Medium | 6.5 | 2020-02-13 | Microsys PROMOTIC 8.2.13 contains an ActiveX Control Start Buffer Overflow vulnerability which can lead to denial of service. |
CVE-2014-3208 | High | 7.5 | 2020-02-13 | A Denial of Service vulnerability exists in askpop3d 0.7.7 in free (pszQuery), |
CVE-2014-4198 | Critical | 9.1 | 2020-02-13 | A Two-Factor Authentication Bypass Vulnerability exists in BS-Client Private Client 2.4 and 2.5 via an XML request that neglects the use of ADPswID and AD para… |
CVE-2014-4170 | Critical | 9.8 | 2020-02-13 | A Privilege Escalation Vulnerability exists in Free Reprintables ArticleFR 11.06.2014 due to insufficient access restrictions in the data.php script, which cou… |
CVE-2014-3919 | Critical | 9.3 | 2020-02-13 | A vulnerability exists in Netgear CG3100 devices before 3.9.2421.13.mp3 V0027 via an embed malicious script in an unspecified page, which could let a malicious… |
CVE-2014-3860 | High | 7.8 | 2020-02-12 | Xilisoft Video Converter Ultimate 7.8.1 build-20140505 has a DLL Hijacking vulnerability |
CVE-2014-4607 | High | 8.8 | 2020-02-12 | Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07 on 32-bit platforms might allow remote attackers to execute arbitrary… |
CVE-2014-2560 | High | 7.5 | 2020-02-12 | The PhonerLite phone before 2.15 provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote attackers t… |
CVE-2014-8128 | Medium | 6.5 | 2020-02-12 | LibTIFF prior to 4.0.4, as used in Apple iOS before 8.4 and OS X before 10.10.4 and other products, allows remote attackers to cause a denial of service (out-o… |