2014 CVEs (page 4)
Page 4 of 91 — CVEs published in 2014, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2014-9382 | Medium | 6.5 | 2020-01-13 | Freebox OS Web interface 3.0.2 has CSRF which can allow VPN user account creation |
CVE-2014-6059 | High | 7.2 | 2020-01-13 | WordPress Advanced Access Manager Plugin before 2.8.2 has an Arbitrary File Overwrite Vulnerability |
CVE-2014-6039 | High | 7.5 | 2020-01-13 | ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. Fixed version 10 Build 10000. |
CVE-2014-6038 | High | 7.5 | 2020-01-13 | Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability. Fixed in EventLog Analyzer 10.0 Bui… |
CVE-2014-5381 | Critical | 9.8 | 2020-01-13 | Grand MA 300 allows a brute-force attack on the PIN. |
CVE-2014-5380 | High | 7.5 | 2020-01-13 | Grand MA 300 allows retrieval of the access PIN from sniffed data. |
CVE-2014-5093 | Critical | 9.8 | 2020-01-10 | Status2k does not remove the install directory allowing credential reset. |
CVE-2014-5092 | High | 8.8 | 2020-01-10 | Status2k allows Remote Command Execution in admin/options/editpl.php. |
CVE-2014-4561 | Medium | 6.1 | 2020-01-10 | The ultimate-weather plugin 1.0 for WordPress has XSS |
CVE-2014-5081 | Critical | 9.8 | 2020-01-10 | sphider prior to 1.3.6, sphider-pro prior to 3.2, and sphider-plus prior to 3.2 allow authentication bypass |
CVE-2014-4984 | Critical | 9.8 | 2020-01-10 | Déjà Vu Crescendo Sales CRM has remote SQL Injection |
CVE-2014-4982 | Critical | 9.8 | 2020-01-10 | LPAR2RRD ≤ 4.53 and ≤ 3.5 has arbitrary command injection on the application server. |
CVE-2014-4530 | Medium | 6.1 | 2020-01-10 | flog plugin 0.1 for WordPress has XSS |
CVE-2014-5013 | High | 8.8 | 2020-01-10 | DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383. |
CVE-2014-5012 | Medium | 6.5 | 2020-01-10 | DOMPDF before 0.6.2 allows denial of service. |
CVE-2014-5011 | Medium | 6.5 | 2020-01-10 | DOMPDF before 0.6.2 allows Information Disclosure. |
CVE-2014-3753 | Medium | 5.5 | 2020-01-09 | AgileBits 1Password through 1.0.9.340 allows security feature bypass |
CVE-2014-3449 | Critical | 9.8 | 2020-01-09 | BSS Continuity CMS 4.2.22640.0 has an Authentication Bypass vulnerability |
CVE-2014-3448 | Critical | 9.8 | 2020-01-09 | BSS Continuity CMS 4.2.22640.0 has a Remote Code Execution vulnerability due to unauthenticated file upload |
CVE-2014-3447 | High | 7.5 | 2020-01-09 | BSS Continuity CMS 4.2.22640.0 has a Remote Denial Of Service vulnerability |
CVE-2014-3211 | High | 7.5 | 2020-01-09 | Publify before 8.0.1 is vulnerable to a Denial of Service attack |
CVE-2014-2686 | High | 7.5 | 2020-01-09 | Ansible prior to 1.5.4 mishandles the evaluation of some strings. |
CVE-2014-2651 | Critical | 9.8 | 2020-01-09 | Unify OpenStage/OpenScape Desk Phone IP SIP before V3 R3.11.0 has an authentication bypass in the default mode of the Workpoint Interface |
CVE-2014-2650 | Critical | 9.8 | 2020-01-09 | Unify OpenStage / OpenScape Desk Phone IP before V3 R3.11.0 SIP has an OS command injection vulnerability in the web based management interface |
CVE-2014-5287 | High | 8.8 | 2020-01-08 | A Bash script injection vulnerability exists in Kemp Load Master 7.1-16 and earlier due to a failure to sanitize input in the Web User Interface (WUI). |
CVE-2014-2072 | Critical | 9.8 | 2020-01-08 | Dassault Systemes Catia V5-6R2013: Stack Buffer Overflow due to inadequate boundary checks |
CVE-2014-1860 | Critical | 9.8 | 2020-01-08 | Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities |
CVE-2014-1409 | Critical | 9.1 | 2020-01-08 | MobileIron VSP versions prior to 5.9.1 and Sentry versions prior to 5.0 have an authentication bypass vulnerability due to an XML file with obfuscated passwords |
CVE-2014-9908 | Medium | 6.5 | 2020-01-08 | A Denial of Service vulnerability exists in Google Android 4.4.4, 5.0.2, and 5.1.1, which allows malicious users to block Bluetooh access (Android Bug ID A-286… |
CVE-2014-1598 | Critical | 9.8 | 2020-01-08 | centurystar 7.12 ActiveX Control has a Stack Buffer Overflow |
CVE-2014-1454 | Medium | 4.8 | 2020-01-08 | Pearson eSIS (Enterprise Student Information System) message board has stored XSS due to improper validation of user input |
CVE-2014-5209 | Medium | 5.3 | 2020-01-08 | An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user… |
CVE-2014-8673 | Critical | 9.8 | 2020-01-07 | Multiple SQL vulnerabilities exist in planning.php, user_list.php, projets.php, user_groupes.php, and groupe_list.php in Simple Online Planning (SOPPlanning)be… |
CVE-2014-9405 | Medium | 5.4 | 2020-01-06 | A Cross-Site Scripting (XSS) vulnerability exists in the description field of an Download RSS item or Contacts in Freebox OS Web interface 3.0.2, which allows… |
CVE-2014-8674 | Medium | 5.4 | 2020-01-06 | Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the document.cookie in nb_mois and mb_ligness… |
CVE-2014-3743 | Medium | 6.1 | 2020-01-06 | Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML… |
CVE-2014-8516 | Critical | 9.8 | 2020-01-03 | Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute arbitrary code by uploading a file with an executab… |
CVE-2014-8337 | Critical | 9.8 | 2020-01-03 | Unrestricted file upload vulnerability in includes/classes/uploadify-v2.1.4/uploadify.php in HelpDEZk 1.0.1 and earlier allows remote attackers to execute arbi… |
CVE-2014-5516 | Medium | 6.5 | 2020-01-03 | Cross-site request forgery (CSRF) vulnerability in the Storefront Application in DS Data Systems KonaKart before 7.3.0.0 allows remote attackers to hijack the… |
CVE-2014-5140 | High | 8.8 | 2020-01-03 | The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : (colon) characters, which allows… |
CVE-2014-4196 | Medium | 6.1 | 2020-01-03 | Cross-site scripting (XSS) vulnerability in bsi.dll in Bank Soft Systems (BSS) RBS BS-Client 3.17.9 allows remote attackers to inject arbitrary web script or H… |
CVE-2014-10398 | Medium | 6.1 | 2020-01-03 | Multiple cross-site scripting (XSS) vulnerabilities in bsi.dll in Bank Soft Systems (BSS) RBS BS-Client. Private Client (aka RBS BS-Client. Retail Client) 2.5… |
CVE-2014-8182 | High | 7.5 | 2020-01-02 | An off-by-one error leading to a crash was discovered in openldap 2.4 when processing DNS SRV messages. If slapd was configured to use the dnssrv backend, an a… |
CVE-2014-6275 | Medium | 5.9 | 2020-01-02 | FusionForge before 5.3.2 use scripts that run under the shared Apache user, which is also used by project homepages by default. If project webpages are hosted… |
CVE-2014-3590 | Medium | 6.5 | 2020-01-02 | Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user… |
CVE-2014-0245 | Medium | 5.9 | 2020-01-02 | It was found that the implementation of the GTNSubjectCreatingInterceptor class in gatein-wsrp was not thread safe. For a specific WSRP endpoint, under high-co… |
CVE-2014-0183 | Medium | 6.1 | 2020-01-02 | Versions of Katello as shipped with Red Hat Subscription Asset Manager 1.4 are vulnerable to a XSS via HTML in the systems name when registering. |
CVE-2014-0169 | Medium | 6.5 | 2020-01-02 | In JBoss EAP 6 a security domain is configured to use a cache that is shared between all applications that are in the security domain. This could allow an auth… |
CVE-2014-0011 | Critical | 9.8 | 2020-01-02 | Multiple heap-based buffer overflows in the ZRLE_DECODE function in common/rfb/zrleDecode.h in TigerVNC before 1.3.1, when NDEBUG is enabled, allow remote VNC… |
CVE-2014-4553 | Medium | 6.1 | 2020-01-02 | Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attackers to execute arbitrary web script or HT… |
CVE-2014-0161 | Medium | 5.9 | 2020-01-02 | ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as s… |
CVE-2014-0104 | Medium | 5.9 | 2020-01-02 | In fence-agents before 4.0.17 does not verify remote SSL certificates in the fence_cisco_ucs.py script which can potentially allow for man-in-the-middle attack… |
CVE-2014-0048 | Critical | 9.8 | 2020-01-02 | An issue was found in Docker before 1.6.0. Some programs and scripts in Docker are downloaded via HTTP and then executed or used in unsafe ways. |
CVE-2014-6420 | Medium | 6.1 | 2019-12-27 | Cross-site scripting (XSS) vulnerability in Livefyre LiveComments 3.0 allows remote attackers to inject arbitrary web script or HTML via the name of an uploade… |
CVE-2014-5289 | Critical | 9.8 | 2019-12-27 | Buffer overflow in Senkas Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a POST request. |
CVE-2014-3136 | High | 8.8 | 2019-12-27 | Cross-site request forgery (CSRF) vulnerability in D-Link DWR-113 (Rev. Ax) with firmware before 2.03b02 allows remote attackers to hijack the authentication o… |
CVE-2014-4550 | Medium | 6.1 | 2019-12-27 | Cross-site scripting (XSS) vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allows remote attackers… |
CVE-2014-4536 | Medium | 6.1 | 2019-12-27 | Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5… |
CVE-2014-4535 | Medium | 6.1 | 2019-12-27 | Cross-site scripting (XSS) vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script… |
CVE-2014-4567 | Medium | 6.1 | 2019-12-27 | Cross-site scripting (XSS) vulnerability in comments/videowhisper2/r_logout.php in the Video Comments Webcam Recorder plugin 1.55, as downloaded before 2014011… |
CVE-2014-4558 | Medium | 6.1 | 2019-12-27 | Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for WooCommerce plugin 2.7.1 and earlier for WordPress allows remote attacker… |
CVE-2014-4548 | Medium | 6.1 | 2019-12-27 | Cross-site scripting (XSS) vulnerability in tinymce/popup.php in the Ruven Toolkit plugin 1.1 and earlier for WordPress allows remote attackers to inject arbit… |
CVE-2014-4544 | Medium | 6.1 | 2019-12-27 | Cross-site scripting (XSS) vulnerability in the Podcast Channels plugin 0.20 and earlier for WordPress allows remote attackers to inject arbitrary web script o… |
CVE-2014-4539 | Medium | 6.1 | 2019-12-27 | Cross-site scripting (XSS) vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via… |
CVE-2014-4592 | Medium | 6.1 | 2019-12-27 | Cross-site scripting (XSS) vulnerability in rss.class/scripts/magpie_debug.php in the WP-Planet plugin 0.1 and earlier for WordPress allows remote attackers to… |
CVE-2014-4519 | Medium | 6.1 | 2019-12-27 | Cross-site scripting (XSS) vulnerability in the Conversador plugin 2.61 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTM… |
CVE-2014-4559 | Medium | 6.1 | 2019-12-27 | Multiple cross-site scripting (XSS) vulnerabilities in test-plugin.php in the Swipe Checkout for WP e-Commerce plugin 3.1.0 and earlier for WordPress allow rem… |
CVE-2014-4525 | Medium | 6.1 | 2019-12-27 | Cross-site scripting (XSS) vulnerability in magpie/scripts/magpie_slashbox.php in the Ebay Feeds for WordPress plugin 1.1 and earlier for WordPress allows remo… |
CVE-2014-4523 | Medium | 6.1 | 2019-12-27 | Cross-site scripting (XSS) vulnerability in the Easy Career Openings plugin 0.4 and earlier for WordPress allows remote attackers to inject arbitrary web scrip… |
CVE-2014-8179 | High | 7.5 | 2019-12-17 | Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during… |
CVE-2014-8178 | Medium | 5.5 | 2019-12-17 | Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attac… |
CVE-2014-8650 | Critical | 9.8 | 2019-12-15 | python-requests-Kerberos through 0.5 does not handle mutual authentication |
CVE-2014-8561 | Medium | 6.5 | 2019-12-15 | imagemagick 6.8.9.6 has remote DOS via infinite loop |
CVE-2014-4913 | Medium | 6.1 | 2019-12-15 | ZF2014-03 has a potential cross site scripting vector in multiple view helpers |
CVE-2014-3701 | High | 8.1 | 2019-12-15 | eDeploy has tmp file race condition flaws |
CVE-2014-3699 | Critical | 9.8 | 2019-12-15 | eDeploy has RCE via cPickle deserialization of untrusted data |
CVE-2014-3652 | Medium | 6.1 | 2019-12-15 | JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL. |
CVE-2014-3643 | High | 7.5 | 2019-12-15 | jersey: XXE via parameter entities not disabled by the jersey SAX parser |
CVE-2014-3536 | Medium | 5.5 | 2019-12-15 | CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registration |
CVE-2014-3495 | High | 7.5 | 2019-12-13 | duplicity 0.6.24 has improper verification of SSL certificates |
CVE-2014-2387 | Medium | 4.4 | 2019-12-13 | Pen 0.18.0 has Insecure Temporary File Creation vulnerabilities |
CVE-2014-1867 | High | 7.8 | 2019-12-13 | suPHP before 0.7.2 source-highlighting feature allows security bypass which could lead to arbitrary code execution |
CVE-2014-0241 | Medium | 5.5 | 2019-12-13 | rubygem-hammer_cli_foreman: File /etc/hammer/cli.modules.d/foreman.yml world readable |
CVE-2014-0212 | High | 7.5 | 2019-12-13 | qpid-cpp: ACL policies only loaded if the acl-file option specified enabling DoS by consuming all available file descriptors |
CVE-2014-0197 | High | 8.8 | 2019-12-13 | CFME: CSRF protection vulnerability via permissive check of the referrer header |
CVE-2014-0175 | Critical | 9.8 | 2019-12-13 | mcollective has a default password set at install |
CVE-2014-7257 | Critical | 9.8 | 2019-12-11 | SQL injection vulnerability in DBD::PgPP 0.05 and earlier |
CVE-2014-0163 | High | 8.8 | 2019-12-11 | Openshift has shell command injection flaws due to unsanitized data being passed into shell commands. |
CVE-2014-0091 | Medium | 5.3 | 2019-12-11 | Foreman has improper input validation which could lead to partial Denial of Service |
CVE-2014-0026 | Medium | 6.5 | 2019-12-11 | katello-headpin is vulnerable to CSRF in REST API |
CVE-2014-3656 | Medium | 6.1 | 2019-12-10 | JBoss KeyCloak: XSS in login-status-iframe.html |
CVE-2014-0242 | High | 7.5 | 2019-12-09 | mod_wsgi module before 3.4 for Apache, when used in embedded mode, might allow remote attackers to obtain sensitive information via the Content-Type header whi… |
CVE-2014-9356 | High | 8.6 | 2019-12-02 | Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full… |
CVE-2014-3591 | Medium | 4.2 | 2019-11-29 | Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to ob… |
CVE-2014-3875 | Medium | 6.1 | 2019-11-27 | The addto parameter to fup in Frams' Fast File EXchange (F*EX, aka fex) before fex-2014053 allows remote attackers to conduct cross-site scripting (XSS) attacks |
CVE-2014-6311 | Critical | 9.8 | 2019-11-22 | generate_doygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp directory which allows attackers to gain elevated privileges. |
CVE-2014-6310 | Critical | 9.8 | 2019-11-22 | Buffer overflow in CHICKEN 4.9.0 and 4.9.0.1 may allow remote attackers to execute arbitrary code via the 'select' function. |
CVE-2014-2214 | Medium | 6.1 | 2019-11-22 | Multiple cross-site scripting (XSS) vulnerabilities in POSH (aka Posh portal or Portaneo) 3.0 through 3.2.1 allow remote attackers to inject arbitrary web scri… |
CVE-2014-2213 | Medium | 6.1 | 2019-11-22 | Open redirect vulnerability in the password reset functionality in POSH 3.0 through 3.2.1 allows remote attackers to redirect users to arbitrary web sites and… |
CVE-2014-1238 | Medium | 6.1 | 2019-11-22 | Cross-site scripting (XSS) vulnerability in ui/common/managedlistdialog.aspx in Gael Q-Pulse 0.6 and earlier. |