2014 CVEs (page 5)
Page 5 of 91 — CVEs published in 2014, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2014-3585 | Critical | 9.8 | 2019-11-22 | redhat-upgrade-tool: Does not check GPG signatures when upgrading versions |
CVE-2014-5255 | High | 7.0 | 2019-11-21 | xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files. Note: A different… |
CVE-2014-5254 | Medium | 4.7 | 2019-11-21 | xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files. |
CVE-2014-2904 | High | 7.5 | 2019-11-21 | wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication. |
CVE-2014-2902 | High | 7.5 | 2019-11-21 | wolfssl before 3.2.0 does not properly authorize CA certificate for signing other certificates. |
CVE-2014-2901 | High | 7.5 | 2019-11-21 | wolfssl before 3.2.0 does not properly issue certificates for a server's hostname. |
CVE-2014-8356 | High | 8.8 | 2019-11-21 | The web administrative portal in Zhone zNID 2426A before S3.0.501 allows remote authenticated users to bypass intended access restrictions via a modified serve… |
CVE-2014-3700 | Critical | 9.8 | 2019-11-21 | eDeploy through at least 2014-10-14 has remote code execution due to eval() of untrusted data |
CVE-2014-1938 | Medium | 5.5 | 2019-11-21 | python-rply before 0.7.4 insecurely creates temporary files. |
CVE-2014-1937 | High | 7.5 | 2019-11-21 | Gamera before 3.4.1 insecurely creates temporary files. |
CVE-2014-1936 | High | 7.5 | 2019-11-21 | rc before 1.7.1-5 insecurely creates temporary files. |
CVE-2014-1935 | Medium | 5.3 | 2019-11-21 | 9base 1:6-6 and 1:6-7 insecurely creates temporary files which results in predictable filenames. |
CVE-2014-0084 | Medium | 5.5 | 2019-11-21 | Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily and cron.weekly. |
CVE-2014-0083 | Medium | 5.5 | 2019-11-21 | The Ruby net-ldap gem before 0.11 uses a weak salt when generating SSHA passwords. |
CVE-2014-5439 | High | 7.8 | 2019-11-19 | Multiple Stack-based Buffer Overflow vulnerabilities exists in Sniffit prior to 0.3.7 via a crafted configuration file that will bypass Non-eXecutable bit NX… |
CVE-2014-5118 | Medium | 5.5 | 2019-11-18 | Trusted Boot (tboot) before 1.8.2 has a 'loader.c' Security Bypass Vulnerability |
CVE-2014-0023 | High | 7.8 | 2019-11-15 | OpenShift: Install script has temporary file creation vulnerability which can result in arbitrary code execution |
CVE-2014-0021 | High | 7.5 | 2019-11-15 | Chrony before 1.29.1 has traffic amplification in cmdmon protocol |
CVE-2014-1214 | High | 8.8 | 2019-11-13 | views/upload.php in the ProJoom Smart Flash Header (NovaSFH) component 3.0.2 and earlier for Joomla! allows remote attackers to upload and execute arbitrary fi… |
CVE-2014-8167 | Medium | 5.9 | 2019-11-13 | vdsm and vdsclient does not validate certficate hostname from another vdsm which could facilitate a man-in-the-middle attack |
CVE-2014-3655 | Medium | 4.3 | 2019-11-13 | JBoss KeyCloak is vulnerable to soft token deletion via CSRF |
CVE-2014-3592 | Medium | 6.1 | 2019-11-13 | OpenShift Origin: Improperly validated team names could allow stored XSS attacks |
CVE-2014-7143 | High | 7.5 | 2019-11-12 | Python Twisted 14.0 trustRoot is not respected in HTTP client |
CVE-2014-3599 | Medium | 6.5 | 2019-11-12 | HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy |
CVE-2014-9014 | Medium | 4.3 | 2019-11-06 | Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin before 2.4.1 for WordPress allows remote… |
CVE-2014-9013 | High | 8.8 | 2019-11-06 | The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to create arbitrary use… |
CVE-2014-3180 | Critical | 9.1 | 2019-11-06 | In kernel/compat.c in the Linux kernel before 3.17, as used in Google Chrome OS and other products, there is a possible out-of-bounds read. restart_syscall use… |
CVE-2014-8181 | Medium | 5.5 | 2019-11-06 | The kernel in Red Hat Enterprise Linux 7 and MRG-2 does not clear garbage data for SG_IO buffer, which may leaking sensitive information to userspace. |
CVE-2014-3649 | Medium | 6.1 | 2019-11-04 | JBoss AeroGear has reflected XSS via the password field |
CVE-2014-2304 | High | 7.5 | 2019-10-23 | A vulnerability in version 0.90 of the Open Floodlight SDN controller software could result in a denial of service attack and crashing of the controller servic… |
CVE-2014-10397 | High | 7.5 | 2019-09-20 | The Antioch theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to lib/scripts/download.php. |
CVE-2014-10396 | High | 7.5 | 2019-09-20 | The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/download.php. |
CVE-2014-10395 | Medium | 6.1 | 2019-08-27 | The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list. |
CVE-2014-10393 | Medium | 6.1 | 2019-08-22 | The cforms2 plugin before 10.5 for WordPress has XSS. |
CVE-2014-10386 | Medium | 6.1 | 2019-08-22 | The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections. |
CVE-2014-10382 | Medium | 4.3 | 2019-08-22 | The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment. |
CVE-2014-10394 | Medium | 6.1 | 2019-08-22 | The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header. |
CVE-2014-10392 | Medium | 6.1 | 2019-08-22 | The cforms2 plugin before 10.2 for WordPress has XSS. |
CVE-2014-10391 | Medium | 6.1 | 2019-08-22 | The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection. |
CVE-2014-10390 | Critical | 9.1 | 2019-08-22 | The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has directory traversal. |
CVE-2014-10389 | Critical | 9.8 | 2019-08-22 | The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication. |
CVE-2014-10388 | Medium | 5.3 | 2019-08-22 | The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has full path disclosure. |
CVE-2014-10387 | Critical | 9.8 | 2019-08-22 | The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has SQL injection. |
CVE-2014-10385 | Medium | 6.1 | 2019-08-22 | The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST. |
CVE-2014-10384 | Critical | 9.8 | 2019-08-22 | The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion. |
CVE-2014-10383 | Critical | 9.8 | 2019-08-22 | The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion. |
CVE-2014-10379 | Critical | 9.8 | 2019-08-21 | The duplicate-post plugin before 2.6 for WordPress has SQL injection. |
CVE-2014-10378 | Medium | 6.1 | 2019-08-21 | The duplicate-post plugin before 2.6 for WordPress has XSS. |
CVE-2014-10377 | Medium | 6.1 | 2019-08-21 | The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php. |
CVE-2014-10380 | Medium | 6.1 | 2019-08-21 | The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms. |
CVE-2014-10381 | High | 8.8 | 2019-08-20 | The user-domain-whitelist plugin before 1.5 for WordPress has CSRF. |
CVE-2014-10376 | Critical | 9.8 | 2019-08-16 | The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection. |
CVE-2014-10375 | High | 7.5 | 2019-08-14 | handle_messages in eXtl_tls.c in eXosip before 5.0.0 mishandles a negative value in a content-length header. |
CVE-2014-8184 | High | 7.8 | 2019-08-02 | A vulnerability was found in liblouis, versions 2.5.x before 2.5.4. A stack-based buffer overflow was found in findTable() in liblouis. An attacker could creat… |
CVE-2014-8183 | High | 7.4 | 2019-08-01 | It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access… |
CVE-2014-10374 | Medium | 6.5 | 2019-07-15 | On Fitbit activity-tracker devices, certain addresses never change. According to the popets-2019-0036.pdf document, this leads to "permanent trackability" and… |
CVE-2014-3798 | Medium | 6.5 | 2019-07-11 | The Windows Guest Tools in Citrix XenServer 6.2 SP1 and earlier allows remote attackers to cause a denial of service (guest OS crash) via a crafted Ethernet fr… |
CVE-2014-9699 | High | 7.5 | 2019-06-24 | The MakerBot Replicator 5G printer runs an Apache HTTP Server with directory indexing enabled. Apache logs, system logs, design files (i.e., a history of print… |
CVE-2014-9919 | Medium | 6.1 | 2019-05-15 | An issue was discovered in Bilboplanet 2.0. Stored XSS exists in the fullname parameter to signup.php. |
CVE-2014-9918 | Medium | 6.1 | 2019-05-15 | An issue was discovered in Bilboplanet 2.0. Stored XSS exists in the user_id parameter to signup.php. |
CVE-2014-9917 | Medium | 6.1 | 2019-05-15 | An issue was discovered in Bilboplanet 2.0. There is a stored XSS vulnerability when adding a tag via the user/?page=tribes tags parameter. |
CVE-2014-1428 | Low | 2.0 | 2019-04-22 | A vulnerability in generate_filestorage_key of Ubuntu MAAS allows an attacker to brute-force filenames. This issue affects Ubuntu MAAS versions prior to 1.9.2. |
CVE-2014-1427 | Critical | 9.6 | 2019-04-22 | A vulnerability in the REST API of Ubuntu MAAS allows an attacker to cause a logged-in user to execute commands via cross-site scripting. This issue affects MA… |
CVE-2014-1426 | High | 8.6 | 2019-04-22 | A vulnerability in maasserver.api.get_file_by_name of Ubuntu MAAS allows unauthenticated network clients to download any file. This issue affects: Ubuntu MAAS… |
CVE-2014-9186 | Critical | 9.8 | 2019-04-08 | A file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which c… |
CVE-2014-5436 | High | 7.5 | 2019-04-08 | A directory traversal vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, wh… |
CVE-2014-5435 | Critical | 9.8 | 2019-04-08 | An arbitrary memory write vulnerability exists in the dual_onsrv.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R… |
CVE-2014-3603 | Medium | 5.9 | 2019-04-04 | The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify th… |
CVE-2014-7198 | High | 8.8 | 2019-04-01 | OMERO before 5.0.6 has multiple CSRF vulnerabilities because the framework for OMERO's web interface lacks CSRF protection. |
CVE-2014-5401 | Critical | 9.8 | 2019-03-26 | Hospira MedNet software version 5.8 and prior uses vulnerable versions of the JBoss Enterprise Application Platform software that may allow unauthenticated use… |
CVE-2014-5433 | Critical | 9.8 | 2019-03-26 | An unauthenticated remote attacker may be able to execute commands to view wireless account credentials that are stored in cleartext on Baxter SIGMA Spectrum I… |
CVE-2014-5432 | Critical | 9.8 | 2019-03-26 | Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 is remotely accessible via Port 22/SSH withou… |
CVE-2014-5431 | Medium | 6.8 | 2019-03-26 | Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 contains a hard-coded password, which provide… |
CVE-2014-5434 | Critical | 9.8 | 2019-03-26 | Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 has a default account with hard-coded credent… |
CVE-2014-9189 | Critical | 9.8 | 2019-03-25 | Multiple stack-based buffer overflow vulnerabilities were found in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all v… |
CVE-2014-9187 | Critical | 9.8 | 2019-03-25 | Multiple heap-based buffer overflow vulnerabilities exist in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all version… |
CVE-2014-10079 | Medium | 5.3 | 2019-02-23 | In Vembu StoreGrid 4.4.x, the front page of the server web interface leaks the private IP address in the "ipaddress" hidden form value of the HTML source code… |
CVE-2014-10078 | Medium | 6.1 | 2019-02-23 | Vembu StoreGrid 4.4.x has XSS in interface/registercustomer/onlineregsuccess.php, interface/registerreseller/onlineregfailure.php, interface/registerclient/onl… |
CVE-2014-10077 | High | 7.5 | 2018-11-06 | Hash#slice in lib/i18n/core_ext/hash.rb in the i18n gem before 0.8.0 for Ruby allows remote attackers to cause a denial of service (application crash) via a ca… |
CVE-2014-10076 | High | 7.5 | 2018-10-05 | The wp-db-backup plugin 2.2.4 for WordPress relies on a five-character string for access control, which makes it easier for remote attackers to read backup arc… |
CVE-2014-10075 | Critical | 9.8 | 2018-10-05 | The karo gem 2.3.8 for Ruby allows Remote command injection via the host field. |
CVE-2014-6050 | Medium | 5.3 | 2018-08-28 | phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request. |
CVE-2014-6049 | Low | 2.7 | 2018-08-28 | phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter. |
CVE-2014-6048 | Medium | 5.3 | 2018-08-28 | phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request. |
CVE-2014-6047 | Medium | 5.3 | 2018-08-28 | phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by leveraging incorrect "download an attachment… |
CVE-2014-6046 | High | 8.8 | 2018-08-28 | Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users f… |
CVE-2014-6045 | High | 7.2 | 2018-08-28 | SQL injection vulnerability in phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via vectors… |
CVE-2014-4932 | Medium | 6.1 | 2018-08-28 | Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or… |
CVE-2014-10074 | Critical | 9.8 | 2018-08-27 | Umbraco before 7.2.0 has a remote PHP code execution vulnerability because Umbraco.Web.UI/config/umbracoSettings.Release.config does not block the upload of .p… |
CVE-2014-4150 | Medium | 5.5 | 2018-07-20 | The scheme48-send-definition function in cmuscheme48.el in Scheme 48 allows local users to write to arbitrary files via a symlink attack on /tmp/s48lose.tmp. |
CVE-2014-2296 | High | 8.8 | 2018-07-20 | XML external entity (XXE) vulnerability in java/org/jasig/cas/util/SamlUtils.java in Jasig CAS server before 3.4.12.1 and 3.5.x before 3.5.2.1, when Google Acc… |
CVE-2014-2302 | Critical | 9.8 | 2018-07-19 | The installer script in webEdition CMS before 6.2.7-s1 and 6.3.x before 6.3.8-s1 allows remote attackers to conduct PHP Object Injection attacks by interceptin… |
CVE-2014-0243 | Medium | 5.5 | 2018-07-19 | Check_MK through 1.2.5i2p1 allows local users to read arbitrary files via a symlink attack to a file in /var/lib/check_mk_agent/job. |
CVE-2014-2079 | Medium | 5.5 | 2018-07-16 | X File Explorer (aka xfe) might allow local users to bypass intended access restrictions and gain access to arbitrary files by leveraging failure to use direct… |
CVE-2014-5220 | High | 7.8 | 2018-06-08 | The mdcheck script of the mdadm package for openSUSE 13.2 prior to version 3.3.1-5.14.1 does not properly sanitize device names, which allows local attackers t… |
CVE-2014-0594 | High | 8.8 | 2018-06-08 | In the Open Build Service (OBS) before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's… |
CVE-2014-0593 | High | 7.8 | 2018-06-08 | The set_version script as shipped with obs-service-set_version is a source validator for the Open Build Service (OBS). In versions prior to 0.5.3-1.1 this scri… |
CVE-2014-10066 | High | 7.5 | 2018-05-31 | Versions less than 0.1.4 of the static file server module fancy-server are vulnerable to directory traversal. An attacker can provide input such as `../` to re… |
CVE-2014-10065 | Medium | 6.1 | 2018-05-31 | Certain input when passed into remarkable before 1.4.1 will bypass the bad protocol check that disallows the javascript: scheme allowing for javascript: url's… |
CVE-2014-10064 | High | 7.5 | 2018-05-31 | The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will bl… |