2014 CVEs (page 7)
Page 7 of 91 — CVEs published in 2014, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2014-4912 | Critical | 9.8 | 2018-03-22 | An Arbitrary File Upload issue was discovered in Frog CMS 0.9.5 due to lack of extension validation. |
CVE-2014-4928 | High | 8.8 | 2018-03-20 | SQL injection vulnerability in Invision Power Board (aka IPB or IP.Board) before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the cId pa… |
CVE-2014-3990 | Critical | 9.8 | 2018-03-20 | The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side request forgery (SSRF) a… |
CVE-2014-2032 | Medium | 5.9 | 2018-03-20 | Deadwood before 2.3.09, 3.x before 3.2.05, and as used in MaraDNS before 1.4.14 and 2.x before 2.0.09, allow remote attackers to cause a denial of service (out… |
CVE-2014-2031 | Medium | 5.9 | 2018-03-20 | Deadwood before 2.3.09, 3.x before 3.2.05, and as used in MaraDNS before 1.4.14 and 2.x before 2.0.09, allow remote attackers to cause a denial of service (out… |
CVE-2014-1665 | Medium | 5.4 | 2018-03-20 | Cross-site scripting (XSS) vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the filename of… |
CVE-2014-1457 | High | 8.8 | 2018-03-20 | Open Web Analytics (OWA) before 1.5.6 improperly generates random nonce values, which makes it easier for remote attackers to bypass a CSRF protection mechanis… |
CVE-2014-1215 | High | 7.8 | 2018-03-20 | Multiple buffer overflows in Core FTP Server before 1.2 build 508 allow local users to gain privileges via vectors related to reading data from config.dat and… |
CVE-2014-5450 | Medium | 5.5 | 2018-03-19 | Zarafa Collaboration Platform 4.1 uses world-readable permissions for /etc/zarafa/license, which allows local users to obtain sensitive information by reading… |
CVE-2014-5443 | High | 7.8 | 2018-03-19 | Seafile Server before 3.1.2 and Server Professional Edition before 3.1.0 allow local users to gain privileges via vectors related to ccnet handling user accoun… |
CVE-2014-4024 | Medium | 5.9 | 2018-03-19 | SSL virtual servers in F5 BIG-IP systems 10.x before 10.2.4 HF9, 11.x before 11.2.1 HF12, 11.3.0 before HF10, 11.4.0 before HF8, 11.4.1 before HF5, 11.5.0 befo… |
CVE-2014-2885 | High | 7.1 | 2018-03-19 | Multiple integer overflows in TrueCrypt 7.1a allow local users to (1) obtain sensitive information via vectors involving a crafted item->OriginalLength value i… |
CVE-2014-2884 | Low | 3.3 | 2018-03-19 | The ProcessVolumeDeviceControlIrp function in Ntdriver.c in TrueCrypt 7.1a allows local users to bypass access restrictions and obtain sensitive information ab… |
CVE-2014-2675 | Medium | 6.5 | 2018-03-19 | Cross-site request forgery (CSRF) vulnerability in inc/AdminPage.php in the WP HTML Sitemap plugin 1.2 for WordPress allows remote attackers to hijack the auth… |
CVE-2014-2674 | High | 7.5 | 2018-03-19 | Directory traversal vulnerability in the Ajax Pagination (twitter Style) plugin 1.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot… |
CVE-2014-2652 | Critical | 9.8 | 2018-03-19 | SQL injection vulnerability in OpenScape Deployment Service (DLS) before 6.x and 7.x before R1.11.3 allows remote attackers to execute arbitrary SQL commands v… |
CVE-2014-2550 | High | 8.8 | 2018-03-19 | Cross-site request forgery (CSRF) vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack the authentication… |
CVE-2014-2297 | Medium | 6.1 | 2018-03-19 | Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote attackers to inject… |
CVE-2014-2274 | High | 8.8 | 2018-03-19 | Cross-site request forgery (CSRF) vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the… |
CVE-2014-3626 | High | 7.5 | 2018-03-19 | The Grails Resource Plugin often has to exchange URIs for resources with other internal components. Those other components will decode any URI passed to them… |
CVE-2014-4613 | Medium | 6.5 | 2018-03-16 | Cross-site request forgery (CSRF) vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attackers to hijack the authentication of admi… |
CVE-2014-4612 | Medium | 6.1 | 2018-03-16 | Cross-site scripting (XSS) vulnerability in the keywords manager (keywordmgr.php) in Coppermine Photo Gallery before 1.5.27 and 1.6.x before 1.6.01 allows remo… |
CVE-2014-8130 | Medium | 6.5 | 2018-03-12 | The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service (divide-by-zero… |
CVE-2014-8129 | High | 8.8 | 2018-03-12 | LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted TIFF image, as… |
CVE-2014-6617 | Critical | 9.8 | 2018-03-09 | Softing FG-100 PB PROFIBUS firmware version FG-x00-PB_V2.02.0.00 contains a hardcoded password for the root account, which allows remote attackers to obtain ad… |
CVE-2014-4861 | Critical | 9.8 | 2018-03-09 | The Remote Desktop Launcher in Thycotic Secret Server before 8.6.000010 does not properly cleanup a temporary file that contains an encrypted password once a s… |
CVE-2014-2592 | Critical | 9.8 | 2018-03-09 | Unrestricted file upload vulnerability in Aruba Web Management portal allows remote attackers to execute arbitrary code by uploading a file with an executable… |
CVE-2014-7272 | High | 7.8 | 2018-03-08 | Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to gain root privileges because code running as root performs write operations within a… |
CVE-2014-7271 | High | 7.8 | 2018-03-08 | Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to log in as user "sddm" without authentication. |
CVE-2014-8780 | Medium | 5.4 | 2018-03-07 | Cross-site scripting (XSS) vulnerability in Jease 2.11 allows remote authenticated users to inject arbitrary web script or HTML via a content section note. |
CVE-2014-5044 | Critical | 9.8 | 2018-03-07 | Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of service (Fortran application crash) via v… |
CVE-2014-10072 | Critical | 9.8 | 2018-02-27 | In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links. |
CVE-2014-10071 | Critical | 9.8 | 2018-02-27 | In exec.c in zsh before 5.0.7, there is a buffer overflow for very long fds in the ">& fd" syntax. |
CVE-2014-10070 | High | 7.8 | 2018-02-27 | zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment (instead of treating them as literal numbers). That… |
CVE-2014-3206 | Critical | 9.8 | 2018-02-23 | Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmgt/localJob.php or the auth_name paramet… |
CVE-2014-3205 | Critical | 9.8 | 2018-02-23 | backupmgt/pre_connect_check.php in Seagate BlackArmor NAS contains a hard-coded password of '!~@##$$%FREDESWWSED' for a backdoor user. |
CVE-2014-3972 | Medium | 5.3 | 2018-02-19 | Directory traversal vulnerability in Apexis APM-J601-WS cameras with firmware before 17.35.2.49 allows remote attackers to read arbitrary files via unspecified… |
CVE-2014-0014 | Medium | 5.4 | 2018-02-15 | Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross… |
CVE-2014-0013 | Medium | 5.4 | 2018-02-15 | Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross… |
CVE-2014-8171 | Medium | 5.5 | 2018-02-09 | The memory resource controller (aka memcg) in the Linux kernel allows local users to cause a denial of service (deadlock) by spawning new processes within a me… |
CVE-2014-3219 | High | 7.8 | 2018-02-09 | fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fishd.log.%s, (2) /tmp/.pac-cache.$USER, (3) /tmp/.yum-cache… |
CVE-2014-8985 | High | 7.5 | 2018-02-08 | Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "… |
CVE-2014-4145 | High | 7.5 | 2018-02-08 | Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "… |
CVE-2014-4112 | High | 7.5 | 2018-02-08 | Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "… |
CVE-2014-4066 | High | 7.5 | 2018-02-08 | Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "… |
CVE-2014-5282 | High | 8.1 | 2018-02-06 | Docker before 1.3 does not properly validate image IDs, which allows remote attackers to redirect to another image through the loading of untrusted images via… |
CVE-2014-5280 | High | 8.8 | 2018-02-06 | boot2docker 1.2 and earlier allows attackers to conduct cross-site request forgery (CSRF) attacks by leveraging Docker daemons enabling TCP connections without… |
CVE-2014-5279 | High | 8.8 | 2018-02-06 | The Docker daemon managed by boot2docker 1.2 and earlier improperly enables unauthenticated TCP connections by default, which makes it easier for remote attack… |
CVE-2014-1835 | High | 7.8 | 2018-02-02 | The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to steal the login credentials by watching the process table. |
CVE-2014-1834 | High | 7.8 | 2018-02-02 | The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to inject arbitrary code by adding a semi-colon in their use… |
CVE-2014-9504 | High | 7.5 | 2018-02-01 | The OG Subgroups module, when used with the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal, allows remote attackers to access child groups via vectors r… |
CVE-2014-9503 | Medium | 6.5 | 2018-02-01 | The Discussions sub module in the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal allows remote authenticated users with "access content" permissions to… |
CVE-2014-9502 | High | 8.8 | 2018-02-01 | Multiple cross-site request forgery (CSRF) vulnerabilities in unspecified sub modules in the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal allow remote… |
CVE-2014-3752 | Medium | 6.7 | 2018-02-01 | The MiniIcpt.sys driver in G Data TotalProtection 2014 24.0.2.1 and earlier allows local users with administrator rights to execute arbitrary code with SYSTEM… |
CVE-2014-3519 | Medium | 6.5 | 2018-02-01 | The open_by_handle_at function in vzkernel before 042stab090.5 in the OpenVZ modification for the Linux kernel 2.6.32, when using simfs, might allow local cont… |
CVE-2014-3244 | Critical | 9.8 | 2018-02-01 | XML external entity (XXE) vulnerability in the RSSDashlet dashlet in SugarCRM before 6.5.17 allows remote attackers to read arbitrary files or potentially exec… |
CVE-2014-3005 | Critical | 9.8 | 2018-02-01 | XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote a… |
CVE-2014-1632 | High | 8.1 | 2018-01-31 | htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter. |
CVE-2014-1631 | High | 7.5 | 2018-01-31 | Eventum before 2.3.5 allows remote attackers to reinstall the application via direct request to /setup/index.php. |
CVE-2014-4705 | High | 7.5 | 2018-01-30 | Multiple heap-based buffer overflows in the eSap software platform in Huawei Campus S9300, S7700, S9700, S5300, S5700, S6300, and S6700 series switches; AR150… |
CVE-2014-4919 | Medium | 5.4 | 2018-01-19 | OXID eShop Professional Edition before 4.7.13 and 4.8.x before 4.8.7, Enterprise Edition before 5.0.13 and 5.1.x before 5.1.7, and Community Edition before 4.7… |
CVE-2014-2017 | Medium | 6.1 | 2018-01-18 | CRLF injection vulnerability in OXID eShop Professional Edition before 4.7.11 and 4.8.x before 4.8.4, Enterprise Edition before 5.0.11 and 5.1.x before 5.1.4… |
CVE-2014-9485 | Medium | 5.5 | 2018-01-16 | Directory traversal vulnerability in the do_extract_currentfile function in miniunz.c in miniunzip in minizip before 1.1-5 might allow remote attackers to writ… |
CVE-2014-9482 | Medium | 6.5 | 2018-01-16 | Use-after-free vulnerability in dwarfdump in libdwarf 20130126 through 20140805 might allow remote attackers to cause a denial of service (program crash) via a… |
CVE-2014-6071 | Medium | 6.1 | 2018-01-16 | jQuery 1.4.2 allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to use of the text method inside after. |
CVE-2014-6027 | Medium | 6.1 | 2018-01-16 | Multiple cross-site scripting (XSS) vulnerabilities in TorrentFlux 2.4 allow (1) remote attackers to inject arbitrary web script or HTML by leveraging failure… |
CVE-2014-8166 | High | 8.8 | 2018-01-12 | The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names, which might allow remote attackers to execute arbit… |
CVE-2014-7952 | High | 7.8 | 2018-01-12 | The backup mechanism in the adb tool in Android might allow attackers to inject additional applications (APKs) and execute arbitrary code by leveraging failure… |
CVE-2014-6437 | Critical | 9.8 | 2018-01-12 | Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices allow remote attackers to obtain sensitive device configuration information via vectors involving t… |
CVE-2014-6436 | Critical | 9.8 | 2018-01-12 | Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices improperly manage sessions, which allows remote attackers to bypass authentication in opportunistic… |
CVE-2014-6435 | High | 7.5 | 2018-01-12 | cgi-bin/AZ_Retrain.cgi in Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices does not check for authentication, which allows remote attackers to cause… |
CVE-2014-3471 | Medium | 5.5 | 2018-01-12 | Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU instance crash) via h… |
CVE-2014-5070 | High | 8.8 | 2018-01-11 | Symmetricom s350i 2.70.15 allows remote authenticated users to gain privileges via vectors related to pushing unauthenticated users to the login page. |
CVE-2014-5068 | High | 7.5 | 2018-01-11 | Directory traversal vulnerability in the web application in Symmetricom s350i 2.70.15 allows remote attackers to read arbitrary files via a (1) ../ (dot dot sl… |
CVE-2014-0087 | High | 8.8 | 2018-01-11 | The check_privileges method in vmdb/app/controllers/application_controller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine (CFME), allows remot… |
CVE-2014-5004 | High | 7.8 | 2018-01-10 | lib/brbackup.rb in the brbackup gem 0.1.1 for Ruby places the database password on the mysql command line, which allows local users to obtain sensitive informa… |
CVE-2014-5003 | Medium | 5.5 | 2018-01-10 | chef/travis-cookbooks/ci_environment/perlbrew/recipes/default.rb in the ciborg gem 3.0.0 for Ruby allows local users to write to arbitrary files and gain privi… |
CVE-2014-5002 | High | 7.8 | 2018-01-10 | The lynx gem before 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing process… |
CVE-2014-5001 | High | 7.8 | 2018-01-10 | lib/ksymfony1.rb in the kcapifony gem 2.1.6 for Ruby places database user passwords on the (1) mysqldump, (2) pg_dump, (3) mysql, and (4) psql command lines, w… |
CVE-2014-5000 | High | 7.8 | 2018-01-10 | The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local users to obtain sensitiv… |
CVE-2014-4999 | High | 7.8 | 2018-01-10 | vendor/plugins/dataset/lib/dataset/database/mysql.rb in the kajam gem 1.0.3.rc2 for Ruby places the mysql user password on the (1) mysqldump command line in th… |
CVE-2014-4998 | High | 7.8 | 2018-01-10 | test/tc_database.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local users to obtain sens… |
CVE-2014-4997 | High | 7.8 | 2018-01-10 | lib/commands/setup.rb in the point-cli gem 0.0.1 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information… |
CVE-2014-4996 | Medium | 5.5 | 2018-01-10 | lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to write to arbitrary files via a symlink attack on /tmp/my.cnf.#{target_h… |
CVE-2014-4995 | High | 7.0 | 2018-01-10 | Race condition in lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to obtain sensitive information by reading the MySQL roo… |
CVE-2014-4994 | Medium | 5.5 | 2018-01-10 | lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file, related to time-ba… |
CVE-2014-4993 | High | 7.8 | 2018-01-10 | (1) lib/backup/cli/utility.rb in the backup-agoddard gem 3.0.28 and (2) lib/backup/cli/utility.rb in the backup_checksum gem 3.0.23 for Ruby place credentials… |
CVE-2014-4992 | High | 7.8 | 2018-01-10 | lib/cap-strap/helpers.rb in the cap-strap gem 0.1.5 for Ruby places credentials on the useradd command line, which allows local users to obtain sensitive infor… |
CVE-2014-4991 | High | 7.8 | 2018-01-10 | (1) lib/dataset/database/mysql.rb and (2) lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3.2.1 for Ruby place credentials on the mysqldump com… |
CVE-2014-7222 | Medium | 6.5 | 2018-01-08 | Buffer overflow in TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service (application crash) by connecting to a ch… |
CVE-2014-7221 | Medium | 6.5 | 2018-01-08 | TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service (buffer overflow and application crash) by connecting to a c… |
CVE-2014-5509 | Medium | 5.5 | 2018-01-08 | clipedit in the Clipboard module for Perl allows local users to delete arbitrary files via a symlink attack on /tmp/clipedit$$. |
CVE-2014-5394 | Medium | 5.9 | 2018-01-08 | Multiple Huawei Campus switches allow remote attackers to enumerate usernames via vectors involving use of SSH by the maintenance terminal. |
CVE-2014-5334 | Critical | 9.8 | 2018-01-08 | FreeNAS before 9.3-M3 has a blank admin password, which allows remote attackers to gain root privileges by leveraging a WebGui login. |
CVE-2014-5071 | Critical | 9.8 | 2018-01-08 | SQL injection vulnerability in the checkPassword function in Symmetricom s350i 2.70.15 allows remote attackers to execute arbitrary SQL commands via vectors in… |
CVE-2014-5069 | Medium | 6.1 | 2018-01-08 | Cross-site scripting (XSS) vulnerability in Symmetricom s350i 2.70.15 allows remote attackers to inject arbitrary web script or HTML via vectors involving syst… |
CVE-2014-4972 | Critical | 9.8 | 2018-01-08 | Unrestricted file upload vulnerability in the Gravity Upload Ajax plugin 1.1 and earlier for WordPress allows remote attackers to execute arbitrary code by upl… |
CVE-2014-3607 | Medium | 5.9 | 2018-01-08 | DefaultHostnameVerifier in Ldaptive (formerly vt-ldap) does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN… |
CVE-2014-2071 | High | 7.1 | 2018-01-08 | Aruba Networks ClearPass Policy Manager 6.1.x, 6.2.x before 6.2.5.61640 and 6.3.x before 6.3.0.61712, when configured to use tunneled and non-tunneled EAP meth… |
CVE-2014-1859 | Medium | 5.5 | 2018-01-08 | (1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to w… |