2014 CVEs (page 8)
Page 8 of 91 — CVEs published in 2014, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2014-1858 | Medium | 5.5 | 2018-01-08 | __init__.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file. |
CVE-2014-10069 | High | 7.5 | 2018-01-07 | Hitron CVE-30360 devices use a 578A958E3DD933FC DES key that is shared across different customers' installations, which makes it easier for attackers to obtain… |
CVE-2014-8579 | Critical | 9.8 | 2018-01-05 | TRENDnet TEW-823DRU devices with firmware before 1.00b36 have a hardcoded password of kcodeskcodes for the root account, which makes it easier for remote attac… |
CVE-2014-8540 | Medium | 6.5 | 2018-01-05 | The groups API in GitLab 6.x and 7.x before 7.4.3 allows remote authenticated guest users to modify ownership of arbitrary groups by leveraging improper permis… |
CVE-2014-8336 | Medium | 6.5 | 2018-01-05 | The "Sql Run Query" panel in WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote attackers to read arbitrary files by leveragin… |
CVE-2014-8335 | High | 7.8 | 2018-01-05 | (1) wp-dbmanager.php and (2) database-manage.php in the WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress place credentials on the mysqldum… |
CVE-2014-7862 | Critical | 9.8 | 2018-01-04 | The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator account… |
CVE-2014-9515 | Critical | 9.8 | 2017-12-29 | Dozer improperly uses a reflection-based approach to type conversion, which might allow remote attackers to execute arbitrary code via a crafted serialized obj… |
CVE-2014-8119 | High | 7.5 | 2017-12-29 | The find_ifcfg_path function in netcf before 0.2.7 might allow attackers to cause a denial of service (application crash) via vectors involving augeas path exp… |
CVE-2014-4978 | Medium | 5.5 | 2017-12-29 | The rs_filter_graph function in librawstudio/rs-filter.c in rawstudio might allow local users to truncate arbitrary files via a symlink attack on (1) /tmp/rs-f… |
CVE-2014-3630 | Critical | 9.8 | 2017-12-29 | XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to re… |
CVE-2014-0121 | Critical | 9.8 | 2017-12-29 | The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k parameter. |
CVE-2014-0120 | High | 8.8 | 2017-12-29 | Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for re… |
CVE-2014-3651 | High | 7.5 | 2017-12-29 | JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/q… |
CVE-2014-4914 | Critical | 9.8 | 2017-12-29 | The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection… |
CVE-2014-8389 | Critical | 9.8 | 2017-12-28 | cgi-bin/mft/wireless_mft.cgi in AirLive BU-2015 with firmware 1.03.18 16.06.2014, AirLive BU-3026 with firmware 1.43 21.08.2014, AirLive MD-3025 with firmware… |
CVE-2014-8358 | High | 7.8 | 2017-12-11 | Huawei EC156, EC176, and EC177 USB Modem products with software before UTPS-V200R003B015D02SP07C1014 (23.015.02.07.1014) and before V200R003B015D02SP08C1014 (2… |
CVE-2014-3250 | Medium | 6.5 | 2017-12-11 | The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain s… |
CVE-2014-3150 | High | 8.8 | 2017-11-15 | Livebox 1.1 allows remote authenticated users to upload arbitrary configuration files, download the configuration file, or obtain sensitive information via cra… |
CVE-2014-2845 | Medium | 5.9 | 2017-11-15 | Cyberduck before 4.4.4 on Windows does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof FTP-SSL servers via a… |
CVE-2014-0219 | Medium | 5.5 | 2017-11-15 | Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service (shutdown) by sending a shu… |
CVE-2014-4000 | High | 8.8 | 2017-11-15 | Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object, re… |
CVE-2014-0073 | Critical | 9.8 | 2017-10-30 | The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser… |
CVE-2014-0072 | High | 7.5 | 2017-10-30 | ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer plugi… |
CVE-2014-0115 | High | 7.5 | 2017-10-30 | Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the file para… |
CVE-2014-3624 | Critical | 9.8 | 2017-10-30 | Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to properly tunnel remap requests using CO… |
CVE-2014-3526 | High | 7.5 | 2017-10-30 | Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving iden… |
CVE-2014-3600 | Critical | 9.8 | 2017-10-27 | XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath… |
CVE-2014-3579 | Critical | 9.8 | 2017-10-27 | XML external entity (XXE) vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via vectors involving an… |
CVE-2014-2023 | Critical | 9.8 | 2017-10-26 | Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin allow remote attackers to execute arbitrary… |
CVE-2014-1203 | Critical | 9.8 | 2017-10-24 | The get_login_ip_config_file function in Eyou Mail System before 3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the doma… |
CVE-2014-0691 | High | 7.3 | 2017-10-24 | Cisco WebEx Meetings Server before 1.1 uses meeting IDs with insufficient entropy, which makes it easier for remote attackers to bypass authentication and join… |
CVE-2014-3744 | High | 7.5 | 2017-10-23 | Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in a… |
CVE-2014-3741 | Critical | 9.8 | 2017-10-23 | The printDirect function in lib/printer.js in the node-printer module 0.0.1 and earlier for Node.js allows remote attackers to execute arbitrary commands via u… |
CVE-2014-8491 | Medium | 5.3 | 2017-10-18 | The Grand Flagallery plugin before 4.25 for WordPress allows remote attackers to obtain the installation path via a request to (1) flagallery-skins/banner_widg… |
CVE-2014-7813 | Medium | 6.5 | 2017-10-18 | Red Hat CloudForms 3 Management Engine (CFME) allows remote authenticated users to cause a denial of service (resource consumption) via vectors involving calls… |
CVE-2014-7242 | Medium | 5.9 | 2017-10-18 | The SumaHo application 3.0.0 and earlier for Android and the SumaHo "driving capability" diagnosis result transmission application 1.2.2 and earlier for Androi… |
CVE-2014-3709 | High | 8.8 | 2017-10-18 | The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request f… |
CVE-2014-3706 | Medium | 5.9 | 2017-10-18 | ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certif… |
CVE-2014-3531 | Medium | 5.4 | 2017-10-18 | Multiple cross-site scripting (XSS) vulnerabilities in Foreman before 1.5.2 allow remote authenticated users to inject arbitrary web script or HTML via the ope… |
CVE-2014-3164 | High | 7.5 | 2017-10-18 | cmds/servicemanager/service_manager.c in Android before commit 7d42a3c31ba78a418f9bdde0e0ab951469f321b5 allows attackers to cause a denial of service (NULL poi… |
CVE-2014-9118 | High | 8.8 | 2017-10-17 | The web administrative portal in Zhone zNID GPON 2426A before S3.0.501 allows remote attackers to execute arbitrary commands via shell metacharacters in the ip… |
CVE-2014-8357 | High | 8.8 | 2017-10-17 | backupsettings.html in the web administrative portal in Zhone zNID GPON 2426A before S3.0.501 places a session key in a URL, which allows remote attackers to o… |
CVE-2014-2664 | High | 8.8 | 2017-10-17 | Unrestricted file upload vulnerability in the ProfileController::actionUploadPhoto method in protected/controllers/ProfileController.php in X2Engine X2CRM befo… |
CVE-2014-2277 | High | 7.1 | 2017-10-17 | The make_temporary_filename function in perltidy 20120701-1 and earlier allows local users to obtain sensitive information or write to arbitrary files via a sy… |
CVE-2014-9733 | Critical | 9.8 | 2017-10-17 | nw.js before 0.11.5 can simulate user input events in a normal frame, which allows remote attackers to have unspecified impact via unknown vectors. |
CVE-2014-9697 | High | 7.5 | 2017-10-17 | Huawei USG9560/9520/9580 before V300R001C01SPC300 allows remote attackers to cause a memory leak or denial of service (memory exhaustion, reboot and MPU switch… |
CVE-2014-9678 | Medium | 6.1 | 2017-10-17 | FlexPaperViewer.swf in Flexpaper before 2.3.1 allows remote attackers to conduct content-spoofing attacks via the Swfile parameter. |
CVE-2014-9677 | Medium | 6.1 | 2017-10-17 | Cross-site scripting (XSS) vulnerability in FlexPaperViewer.swf in Flexpaper before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via th… |
CVE-2014-9489 | High | 8.8 | 2017-10-17 | The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem dependency in gollum-lib before 4.0.1 when the string "master" is in… |
CVE-2014-9487 | Critical | 9.8 | 2017-10-17 | The getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote attackers to read arbitrary files, cause a denial of service, or possi… |
CVE-2014-8324 | High | 7.5 | 2017-10-17 | network.c in Aircrack-ng before 1.2 Beta 3 allows remote attackers to cause a denial of service (segmentation fault) via a response with a crafted length param… |
CVE-2014-8323 | High | 7.5 | 2017-10-17 | buddy-ng.c in Aircrack-ng before 1.2 Beta 3 allows remote attackers to cause a denial of service (segmentation fault) via a response with a crafted length para… |
CVE-2014-0208 | Medium | 5.4 | 2017-10-16 | Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remote authenticated users to inject arbitr… |
CVE-2014-9148 | Critical | 9.8 | 2017-10-16 | Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install and Update" or (2) Backup super administrator func… |
CVE-2014-9147 | High | 7.5 | 2017-10-16 | Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database backup file in .backup/. |
CVE-2014-8621 | Critical | 9.8 | 2017-10-16 | SQL injection vulnerability in the Store Locator plugin 2.3 through 3.11 for WordPress allows remote attackers to execute arbitrary SQL commands via the sl_cus… |
CVE-2014-8087 | Medium | 6.1 | 2017-10-16 | Cross-site scripting (XSS) vulnerability in the post highlights plugin before 2.6.1 for WordPress allows remote attackers to inject arbitrary web script or HTM… |
CVE-2014-7851 | High | 7.5 | 2017-10-16 | oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of ano… |
CVE-2014-3702 | Critical | 9.1 | 2017-10-16 | Directory traversal vulnerability in eNovance eDeploy allows remote attackers to create arbitrary directories and files and consequently cause a denial of serv… |
CVE-2014-0029 | Medium | 6.1 | 2017-10-16 | Multiple cross-site scripting (XSS) vulnerabilities in the SAM web application in Red Hat katello-headpin allow remote attackers to inject arbitrary web script… |
CVE-2014-9092 | Medium | 6.5 | 2017-10-10 | libjpeg-turbo before 1.3.1 allows remote attackers to cause a denial of service (crash) via a crafted JPEG file, related to the Exif marker. |
CVE-2014-9474 | Critical | 9.8 | 2017-10-10 | Buffer overflow in the mpfr_strtofr function in GNU MPFR before 3.1.2-p11 allows context-dependent attackers to have unspecified impact via vectors related to… |
CVE-2014-0030 | Critical | 9.8 | 2017-10-10 | The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors. |
CVE-2014-8957 | Medium | 5.4 | 2017-10-06 | Cross-site scripting (XSS) vulnerability in OpenKM before 6.4.19 allows remote authenticated users to inject arbitrary web script or HTML via the Tasks paramet… |
CVE-2014-2903 | Medium | 5.9 | 2017-10-06 | CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to spoof servers via a crafted server certificate not authori… |
CVE-2014-0047 | High | 7.8 | 2017-10-06 | Docker before 1.5 allows local users to have unspecified impact via vectors involving unsafe /tmp usage. |
CVE-2014-8758 | Medium | 6.1 | 2017-10-06 | Cross-site scripting (XSS) vulnerability in Best Gallery Albums Plugin before 3.0.70for WordPress allows remote attackers to inject arbitrary web script or HTM… |
CVE-2014-8492 | Medium | 6.1 | 2017-10-06 | Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPress allow remote atta… |
CVE-2014-7240 | Medium | 6.1 | 2017-10-06 | Cross-site scripting (XSS) vulnerability in the Easy Contact Form Solution plugin before 1.7 for WordPress allows remote attackers to inject arbitrary web scri… |
CVE-2014-0043 | Medium | 5.3 | 2017-10-03 | In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of particular classes in th… |
CVE-2014-2029 | High | 8.1 | 2017-09-29 | The automatic version check functionality in the tools in Percona Toolkit 2.1 allows man-in-the-middle attackers to obtain sensitive information or execute arb… |
CVE-2014-9686 | Medium | 5.9 | 2017-09-28 | The Googlemaps plugin 3.2 and earlier for Joomla! allows remote attackers with control of a sub-domain belonging to a victim domain to cause a denial of servic… |
CVE-2014-8878 | Medium | 5.9 | 2017-09-28 | KDE KMail does not encrypt attachments in emails when "automatic encryption" is enabled, which allows remote attackers to obtain sensitive information by sniff… |
CVE-2014-8889 | Medium | 5.3 | 2017-09-26 | Dropbox SDK for Android before 1.6.2 might allow remote attackers to obtain sensitive information via crafted malware or via a drive-by download attack. |
CVE-2014-8170 | High | 8.8 | 2017-09-26 | ovirt_safe_delete_config in ovirtfunctions.py and other unspecified locations in ovirt-node 3.0.0-474-gb852fd7 as packaged in Red Hat Enterprise Virtualization… |
CVE-2014-8156 | High | 7.8 | 2017-09-26 | The D-Bus security policy files in /etc/dbus-1/system.d/*.conf in fso-gsmd 0.12.0-3, fso-frameworkd 0.9.5.9+git20110512-4, and fso-usaged 0.12.0-2 as packaged… |
CVE-2014-0997 | High | 7.5 | 2017-09-26 | WiFiMonitor in Android 4.4.4 as used in the Nexus 5 and 4, Android 4.2.2 as used in the LG D806, Android 4.2.2 as used in the Samsung SM-T310, Android 4.1.2 as… |
CVE-2014-9758 | Medium | 6.1 | 2017-09-20 | Cross-site scripting (XSS) vulnerability in Magento E-Commerce Platform 1.9.0.1. |
CVE-2014-8686 | Critical | 9.8 | 2017-09-19 | CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt… |
CVE-2014-8684 | Critical | 9.8 | 2017-09-19 | CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently condu… |
CVE-2014-9619 | High | 7.2 | 2017-09-19 | Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2… |
CVE-2014-9618 | Critical | 9.8 | 2017-09-19 | The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and sub… |
CVE-2014-9616 | High | 7.5 | 2017-09-19 | Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to obtain sensitive information by making a request that redirects… |
CVE-2014-9611 | Critical | 9.8 | 2017-09-19 | Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create arbitrary accounts and policies via a request to webadmin/nslam/index.php. |
CVE-2014-9610 | Medium | 5.3 | 2017-09-19 | Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and remove IP addresses from the quaranti… |
CVE-2014-8174 | Critical | 9.8 | 2017-09-19 | eDeploy makes it easier for remote attackers to execute arbitrary code by leveraging use of HTTP to download files. |
CVE-2014-6191 | Medium | 5.4 | 2017-09-19 | Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0 SP2, 6.0.4, and 6.0.5 allows remote attackers to inject arbitrary web scrip… |
CVE-2014-5362 | High | 7.2 | 2017-09-19 | The admin interface in Landesk Management Suite 9.6 and earlier allows remote attackers to conduct remote file inclusion attacks involving ASPX pages from thir… |
CVE-2014-6106 | High | 8.8 | 2017-09-18 | Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager 5.1, 6.0, and 7.0 allows remote attackers to hijack the authentication of user… |
CVE-2014-9463 | High | 8.8 | 2017-09-15 | functions_vbseo_hook.php in the VBSEO module for vBulletin allows remote authenticated users to execute arbitrary code via the HTTP Referer header to visitorme… |
CVE-2014-7808 | High | 7.5 | 2017-09-15 | Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict… |
CVE-2014-9635 | Medium | 5.3 | 2017-09-12 | Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makes it easier for re… |
CVE-2014-9634 | Medium | 5.3 | 2017-09-12 | Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture… |
CVE-2014-9624 | High | 7.5 | 2017-09-12 | CAPTCHA bypass vulnerability in MantisBT before 1.2.19. |
CVE-2014-9565 | High | 8.8 | 2017-09-07 | Cross-site request forgery (CSRF) vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware 3.4.0000 and earlier. |
CVE-2014-6438 | High | 7.5 | 2017-09-06 | The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service (catastrophic regular expression backtr… |
CVE-2014-8677 | Medium | 5.3 | 2017-08-31 | The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a… |
CVE-2014-8676 | Medium | 5.3 | 2017-08-31 | Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitr… |
CVE-2014-8675 | High | 7.5 | 2017-08-31 | Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which allows remote attackers to obtain a calend… |