2014 CVEs (page 3)
Page 3 of 91 — CVEs published in 2014, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2014-9390 | Critical | 9.8 | 2020-02-12 | Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows a… |
CVE-2014-6262 | High | 7.5 | 2020-02-12 | Multiple format string vulnerabilities in the python module in RRDtool, as used in Zenoss Core before 4.2.5 and other products, allow remote attackers to execu… |
CVE-2014-4968 | High | 8.8 | 2020-02-12 | The WebView class and use of the WebView.addJavascriptInterface method in the Boat Browser application 8.0 and 8.0.1 for Android allow remote attackers to exec… |
CVE-2014-2595 | Critical | 9.8 | 2020-02-12 | Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained fro… |
CVE-2014-0234 | Critical | 9.8 | 2020-02-12 | The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attac… |
CVE-2014-3827 | Medium | 5.4 | 2020-02-11 | Multiple cross-site scripting (XSS) vulnerabilities in the MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenticated users to inject arbitrary web scr… |
CVE-2014-3826 | Medium | 5.4 | 2020-02-11 | Cross-site scripting (XSS) vulnerability in MyBB before 1.6.13 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter… |
CVE-2014-9753 | Critical | 9.8 | 2020-02-11 | confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the auto_login parameter. |
CVE-2014-9748 | High | 8.1 | 2020-02-11 | The uv_rwlock_t fallback implementation for Windows XP and Server 2003 in libuv before 1.7.4 does not properly prevent threads from releasing the locks of othe… |
CVE-2014-6447 | High | 7.1 | 2020-02-11 | Multiple vulnerabilities exist in Juniper Junos J-Web error handling that may lead to cross site scripting (XSS) issues or crash the J-Web service (DoS). This… |
CVE-2014-2052 | Critical | 9.8 | 2020-02-11 | Zend Framework, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or… |
CVE-2014-8347 | High | 7.8 | 2020-02-11 | An Authentication Bypass vulnerability exists in the MatchPasswordData function in DBEngine.dll in Filemaker Pro 13.03 and Filemaker Pro Advanced 12.04, which… |
CVE-2014-5086 | High | 8.8 | 2020-02-10 | A Command Execution vulnerability exists in Sphider Pro, and Sphider Plus 3.2 due to insufficient sanitization of fwrite to conf.php, which could let a remote… |
CVE-2014-5085 | High | 8.8 | 2020-02-10 | A Command Execution vulnerability exists in Sphider Plus 3.2 due to insufficient sanitization of fwrite to conf.php, which could let a remote malicious user ex… |
CVE-2014-5084 | High | 8.8 | 2020-02-10 | A Command Execution vulnerability exists in Sphider Pro 3.2 due to insufficient sanitization of fwrite, which could let a remote malicious user execute arbitra… |
CVE-2014-5083 | High | 8.8 | 2020-02-10 | A Command Execution vulnerability exists in Sphider before 1.3.6 due to insufficient sanitization of fwrite to conf.php, which could let a remote malicious use… |
CVE-2014-8739 | Critical | 9.8 | 2020-02-08 | Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Cre… |
CVE-2014-9470 | Medium | 6.1 | 2020-02-08 | Cross-site scripting (XSS) vulnerability in the loadForm function in Frontend/Modules/Search/Actions/Index.php in Fork CMS before 3.8.4 allows remote attackers… |
CVE-2014-9127 | Medium | 6.5 | 2020-02-08 | Open-School Community Edition 2.2 does not properly restrict access to the export functionality, which allows remote authenticated users to obtain sensitive in… |
CVE-2014-9126 | Medium | 6.1 | 2020-02-08 | Multiple cross-site scripting (XSS) vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to inject arbitrary web script or HTML via the… |
CVE-2014-7863 | High | 7.5 | 2020-02-08 | The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, an… |
CVE-2014-2225 | High | 8.8 | 2020-02-08 | Multiple cross-site request forgery (CSRF) vulnerabilities in Ubiquiti Networks UniFi Controller before 3.2.1 allow remote attackers to hijack the authenticati… |
CVE-2014-5278 | Medium | 5.3 | 2020-02-07 | A vulnerability exists in Docker before 1.2 via container names, which may collide with and override container IDs. |
CVE-2014-5091 | Critical | 9.8 | 2020-02-07 | A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, which could let a malicious user execute… |
CVE-2014-5087 | Critical | 9.8 | 2020-02-07 | A vulnerability exists in Sphider Search Engine prior to 1.3.6 due to exec calls in admin/spiderfuncs.php, which could let a remote malicious user execute arbi… |
CVE-2014-5468 | High | 8.8 | 2020-02-07 | A File Inclusion vulnerability exists in Railo 4.2.1 and earlier via a specially-crafted URL request to the thumbnail.cfm to specify a malicious PNG file, whic… |
CVE-2014-5288 | High | 8.8 | 2020-02-07 | A CSRF Vulnerability exists in Kemp Load Master before 7.0-18a via unspecified vectors in administrative pages. |
CVE-2014-7224 | High | 8.8 | 2020-02-07 | A Code Execution vulnerability exists in Android prior to 4.4.0 related to the addJavascriptInterface method and the accessibility and accessibilityTraversal o… |
CVE-2014-6413 | Medium | 6.1 | 2020-02-07 | A Cross-site Scripting (XSS) vulnerability exists in WatchGuard XTM 11.8.3 via the poll_name parameter in the firewall/policy script. |
CVE-2014-9530 | Critical | 9.8 | 2020-02-07 | A vulnerability exists in nw.js before 0.11.3 when calling nw methods from normal frames, which has an unspecified impact. |
CVE-2014-2875 | Medium | 6.1 | 2020-02-06 | The session.lua library in CGILua 5.2 alpha 1 and 5.2 alpha 2 uses weak session IDs generated based on OS time, which allows remote attackers to hijack arbitra… |
CVE-2014-10400 | Medium | 6.1 | 2020-02-06 | The session.lua library in CGILua 5.0.x uses sequential session IDs, which makes it easier for remote attackers to predict the session ID and hijack arbitrary… |
CVE-2014-10399 | Medium | 6.1 | 2020-02-06 | The session.lua library in CGILua 5.1.x uses the same ID for each session, which allows remote attackers to hijack arbitrary sessions. NOTE: this vulnerability… |
CVE-2014-8271 | Medium | 6.8 | 2020-02-06 | Buffer overflow in the Reclaim function in Tianocore EDK2 before SVN 16280 allows physically proximate attackers to gain privileges via a long variable name. |
CVE-2014-2030 | High | 8.8 | 2020-02-06 | Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick, possibly 6.8.8-5, allows remote attackers to cause a denial of servic… |
CVE-2014-1958 | High | 8.8 | 2020-02-06 | Buffer overflow in the DecodePSDPixels function in coders/psd.c in ImageMagick before 6.8.8-5 might allow remote attackers to execute arbitrary code via a craf… |
CVE-2014-8328 | Medium | 5.3 | 2020-02-03 | The default configuration in the Dynamic Content Elements (dce) extension before 0.11.5 for TYPO3 allows remote attackers to obtain sensitive installation envi… |
CVE-2014-8141 | High | 7.8 | 2020-01-31 | Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip f… |
CVE-2014-2025 | Critical | 9.8 | 2020-01-31 | Unrestricted file upload vulnerability in an unspecified third party tool in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6… |
CVE-2014-8338 | Medium | 6.1 | 2020-01-31 | Cross-site scripting (XSS) vulnerability in vwrooms/js/jsor-jcarousel/examples/special_textscroller.php in the VideoWhisper Webcam plugins for Drupal 7.x allow… |
CVE-2014-8322 | Critical | 9.8 | 2020-01-31 | Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute arbitrary code via a cr… |
CVE-2014-8321 | High | 7.8 | 2020-01-31 | Stack-based buffer overflow in the gps_tracker function in airodump-ng.c in Aircrack-ng before 1.2 RC 1 allows local users to execute arbitrary code or gain pr… |
CVE-2014-8140 | High | 7.8 | 2020-01-31 | Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip… |
CVE-2014-8139 | High | 7.8 | 2020-01-31 | Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file… |
CVE-2014-8126 | High | 8.8 | 2020-01-31 | The scheduler in HTCondor before 8.2.6 allows remote authenticated users to execute arbitrary code. |
CVE-2014-5236 | High | 7.5 | 2020-01-31 | Multiple absolute path traversal vulnerabilities in documentconverter in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allow remot… |
CVE-2014-5039 | Critical | 9.6 | 2020-01-31 | Cross-site scripting (XSS) vulnerability in Eucalyptus Management Console (EMC) 4.0.x before 4.0.2 allows remote attackers to inject arbitrary web script or HT… |
CVE-2014-3868 | High | 8.8 | 2020-01-31 | Multiple SQL injection vulnerabilities in ZeusCart 4.x. |
CVE-2014-3809 | Medium | 6.1 | 2020-01-31 | Cross-site scripting (XSS) vulnerability in the management interface in Alcatel-Lucent 1830 Photonic Service Switch (PSS) 6.0 and earlier allows remote attacke… |
CVE-2014-3119 | High | 8.8 | 2020-01-31 | Multiple SQL injection vulnerabilities in web2Project 3.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search_str… |
CVE-2014-2843 | Medium | 6.1 | 2020-01-31 | Cross-site scripting (XSS) vulnerability in infoware MapSuite MapAPI 1.0.x before 1.0.36 and 1.1.x before 1.1.49 allows remote attackers to inject arbitrary we… |
CVE-2014-4860 | Medium | 6.8 | 2020-01-31 | Multiple integer overflows in the Pre-EFI Initialization (PEI) boot phase in the Capsule Update feature in the UEFI implementation in EDK2 allow physically pro… |
CVE-2014-4859 | Medium | 6.8 | 2020-01-31 | Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in the UEFI implementation in EDK2 allows physically proximate at… |
CVE-2014-3719 | Critical | 9.8 | 2020-01-30 | Multiple SQL injection vulnerabilities in cgi-bin/review_m.cgi in Ex Libris ALEPH 500 (Integrated library management system) 18.1 and 20 allow remote attackers… |
CVE-2014-3718 | Medium | 6.1 | 2020-01-30 | Multiple cross-site scripting (XSS) vulnerabilities in cgi-bin/tag_m.cgi in Ex Libris ALEPH 500 (Integrated library management system) 18.1 and 20 allow remote… |
CVE-2014-8490 | Medium | 6.1 | 2020-01-28 | Cross-site scripting (XSS) vulnerability in TennisConnect COMPONENTS 9.927 allows remote attackers to inject arbitrary web script or HTML via the pid parameter… |
CVE-2014-3856 | High | 7.0 | 2020-01-28 | The funced function in fish (aka fish-shell) 1.23.0 before 2.1.1 does not properly create temporary files, which allows local users to gain privileges via a te… |
CVE-2014-3230 | Medium | 5.9 | 2020-01-28 | The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server… |
CVE-2014-2914 | Critical | 9.8 | 2020-01-28 | fish (aka fish-shell) 2.0.0 before 2.1.1 does not restrict access to the configuration service (aka fish_config), which allows remote attackers to execute arbi… |
CVE-2014-2906 | High | 7.0 | 2020-01-28 | The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute arbitrary commands… |
CVE-2014-2898 | Critical | 9.8 | 2020-01-28 | wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact via multiple calls to the CyaSSL_read function which triggers an out-of-bounds r… |
CVE-2014-2897 | Critical | 9.8 | 2020-01-28 | The SSL 3 HMAC functionality in wolfSSL CyaSSL 2.5.0 before 2.9.4 does not check the padding length when verification fails, which allows remote attackers to h… |
CVE-2014-2896 | Critical | 9.8 | 2020-01-28 | The DoAlert function in the (1) TLS and (2) DTLS implementations in wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact and vectors… |
CVE-2014-3445 | Critical | 9.8 | 2020-01-28 | backup.php in HandsomeWeb SOS Webpages before 1.1.12 does not require knowledge of the cleartext password, which allows remote attackers to bypass authenticati… |
CVE-2014-2581 | High | 7.5 | 2020-01-28 | Smb4K before 1.1.1 allows remote attackers to obtain credentials via vectors related to the cuid option in the "Additional options" line edit. |
CVE-2014-8563 | Critical | 9.8 | 2020-01-27 | Synacor Zimbra Collaboration before 8.0.9 allows plaintext command injection during STARTTLS. |
CVE-2014-5500 | Medium | 6.1 | 2020-01-27 | Synacor Zimbra Collaboration before 8.0.8 has XSS. |
CVE-2014-8742 | High | 7.5 | 2020-01-27 | Directory traversal vulnerability in the ReportDownloadServlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers to read arbitrary fi… |
CVE-2014-8741 | Critical | 9.8 | 2020-01-27 | Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers to write to arbitra… |
CVE-2014-7303 | High | 7.8 | 2020-01-27 | SGI Tempo, as used on SGI ICE-X systems, uses weak permissions for certain files, which allows local users to obtain password hashes and possibly other unspeci… |
CVE-2014-7302 | High | 7.8 | 2020-01-27 | SGI Tempo, as used on SGI ICE-X systems, uses weak permissions for certain files, which allows local users to change the permissions of arbitrary files by exec… |
CVE-2014-7301 | Medium | 6.6 | 2020-01-27 | SGI Tempo, as used on SGI ICE-X systems, uses weak permissions for certain files, which allows local users to obtain password hashes and possibly other unspeci… |
CVE-2014-3979 | High | 7.5 | 2020-01-27 | Bytemark Symbiosis allows remote attackers to cause a denial of service via a crafted username, which triggers the firewall to blacklist the IP. |
CVE-2014-9481 | Medium | 5.9 | 2020-01-27 | The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, relat… |
CVE-2014-8161 | Medium | 4.3 | 2020-01-27 | PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sens… |
CVE-2014-4156 | Medium | 5.3 | 2020-01-27 | Proxmox VE prior to 3.2: 'AccessControl.pm' User Enumeration Vulnerability |
CVE-2014-9630 | High | 7.8 | 2020-01-24 | The rtp_packetize_xiph_config function in modules/stream_out/rtpfmt.c in VideoLAN VLC media player before 2.1.6 uses a stack-allocation approach with a size de… |
CVE-2014-9629 | High | 7.8 | 2020-01-24 | Integer overflow in the Encode function in modules/codec/schroedinger.c in VideoLAN VLC media player before 2.1.6 and 2.2.x before 2.2.1 allows remote attacker… |
CVE-2014-9628 | High | 7.8 | 2020-01-24 | The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to trigger an unintended zero-s… |
CVE-2014-9627 | High | 7.8 | 2020-01-24 | The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit inte… |
CVE-2014-9626 | High | 7.8 | 2020-01-24 | Integer underflow in the MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to cause a… |
CVE-2014-9625 | High | 7.8 | 2020-01-24 | The GetUpdateFile function in misc/update.c in the Updater in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit integer… |
CVE-2014-4172 | Critical | 9.8 | 2020-01-24 | A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CA… |
CVE-2014-9720 | Medium | 6.5 | 2020-01-24 | Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attacker… |
CVE-2014-1925 | Critical | 9.8 | 2020-01-24 | SQL injection vulnerability in the MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12… |
CVE-2014-1924 | Critical | 9.8 | 2020-01-24 | The MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x be… |
CVE-2014-1923 | High | 7.5 | 2020-01-24 | Multiple directory traversal vulnerabilities in the (1) staff interface help editor (edithelp.pl) or (2) member-picupload.pl in Koha before 3.8.23, 3.10.x befo… |
CVE-2014-1922 | High | 7.5 | 2020-01-24 | Absolute path traversal vulnerability in tools/pdfViewer.pl in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 allow… |
CVE-2014-2050 | Medium | 6.5 | 2020-01-23 | Cross-site request forgery (CSRF) vulnerability in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to hijack the authentication of… |
CVE-2014-7238 | Medium | 6.1 | 2020-01-23 | The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSS |
CVE-2014-2680 | High | 8.1 | 2020-01-21 | The update process in Xmind 3.4.1 and earlier allow remote attackers to execute arbitrary code via a man-in-the-middle attack. |
CVE-2014-5007 | Critical | 9.8 | 2020-01-17 | Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP)… |
CVE-2014-6448 | High | 7.8 | 2020-01-15 | Juniper Junos OS 13.2 before 13.2R5, 13.2X51, 13.2X52, and 13.3 before 13.3R3 allow local users to bypass intended restrictions and execute arbitrary Python co… |
CVE-2014-7844 | High | 7.8 | 2020-01-14 | BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address. |
CVE-2014-2271 | High | 8.1 | 2020-01-14 | cn.wps.moffice.common.beans.print.CloudPrintWebView in Kingsoft Office 5.3.1, as used in Huawei P2 devices before V100R001C00B043, falls back to HTTP when the… |
CVE-2014-5238 | High | 7.8 | 2020-01-14 | XML external entity (XXE) vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers to read arbitrary… |
CVE-2014-5138 | High | 7.5 | 2020-01-14 | Innovative Interfaces Sierra Library Services Platform 1.2_3 does not properly handle query strings with multiple instances of the same parameter, which allows… |
CVE-2014-4610 | High | 8.8 | 2020-01-14 | Integer overflow in the get_len function in libavutil/lzo.c in FFmpeg before 0.10.14, 1.1.x before 1.1.12, 1.2.x before 1.2.7, 2.0.x before 2.0.5, 2.1.x before… |
CVE-2014-4609 | High | 8.8 | 2020-01-14 | Integer overflow in the get_len function in libavutil/lzo.c in Libav before 0.8.13, 9.x before 9.14, and 10.x before 10.2 allows remote attackers to execute ar… |
CVE-2014-9211 | Medium | 6.1 | 2020-01-14 | ClickDesk version 4.3 and below has persistent cross site scripting |