CVEs

355,873 total · page 5841 of 7,118

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2014-6235	TYPO3 ke DomPDF	0.03	—	0.06	Sep 11, 2014	Unspecified vulnerability in the ke DomPDF extension before 0.0.5 for TYPO3 allows remote attackers to execute arbitrary code via unknown vectors.
CVE-2014-6234	TYPO3 jh_opengraphprotocol	0.00	—	0.01	Sep 11, 2014	Cross-site scripting (XSS) vulnerability in the Open Graph protocol (jh_opengraphprotocol) extension before 1.0.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-6233	TYPO3 Flat Manager	0.00	—	0.01	Sep 11, 2014	SQL injection vulnerability in the Flat Manager (flatmgr) extension before 2.7.10 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2014-6232	TYPO3 eu_ldap	0.00	—	0.01	Sep 11, 2014	Unspecified vulnerability in the LDAP (eu_ldap) extension before 2.8.18 for TYPO3 allows remote authenticated users to obtain sensitive information via unknown vectors.
CVE-2014-6231	TYPO3 cwt_feedit	0.00	—	0.03	Sep 11, 2014	Unspecified vulnerability in the CWT Frontend Edit (cwt_feedit) extension before 1.2.5 for TYPO3 allows remote authenticated users to execute arbitrary code via unknown vectors.
CVE-2014-6070	Adiscon Loganalyzer	0.03	—	0.04	Sep 11, 2014	Multiple cross-site scripting (XSS) vulnerabilities in Adiscon LogAnalyzer before 3.6.6 allow remote attackers to inject arbitrary web script or HTML via the hostname in (1) index.php or (2) detail.php.
CVE-2014-5519	Phpwiki Phpwiki	0.08	—	0.65	Sep 11, 2014	The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the edit[content] parameter to index.php/HeIp. NOTE: some of these details are obtained from third party information.
CVE-2014-2223	Plogger Plogger	0.04	—	0.10	Sep 11, 2014	Unrestricted file upload vulnerability in plog-admin/plog-upload.php in Plogger 1.0 RC1 and earlier allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file and a non-zero length PNG file, then accessing the PHP file via a…
CVE-2012-4240	Intermesh Groupoffice	0.03	—	0.01	Sep 11, 2014	SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter.
CVE-2012-0984	XOOPS Xoops	0.03	—	0.04	Sep 11, 2014	Multiple cross-site scripting (XSS) vulnerabilities in XOOPS before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via the (1) to_userid parameter to modules/pm/pmlite.php or the (2) current_file, (3) imgcat_id, or (4) target parameter to…
CVE-2011-4887	Imperva Securesphere Web Application Firewall	0.00	—	0.01	Sep 11, 2014	Cross-site scripting (XSS) vulnerability in the Violations Table in the management GUI in the MX Management Server in Imperva SecureSphere Web Application Firewall (WAF) 9.0 allows remote attackers to inject arbitrary web script or HTML via the username field.
CVE-2014-5878	I Um Ium	0.00	—	0.00	Sep 11, 2014	The ium (aka net.ium.mobile.android) application 3.3.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5877	Mini Group Tv Guide	0.00	—	0.00	Sep 11, 2014	The TV Guide (aka net.micene.minigroup.palimpsests.lite) application 5.4.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5876	WD My Cloud	0.00	—	0.00	Sep 11, 2014	The WD My Cloud (aka com.wdc.wd2go) application 4.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5875	Sylpheo Sylphone	0.00	—	0.00	Sep 11, 2014	The Sylphone (aka com.sylpheo.prospectosyl) application 5.3.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5874	Splashid Splashid	0.00	—	0.00	Sep 11, 2014	The SplashID (aka com.splashidandroid) application 7.2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5873	Sears Sears	0.00	—	0.00	Sep 11, 2014	The Sears (aka com.sears.android) application 6.2.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5872	Safenet Safenetmobile Pass	0.00	—	0.00	Sep 11, 2014	The SafeNetMobile Pass (aka securecomputing.devices.android.controller) application 8.3.7.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5871	Piwik Piwik Mobile 2	0.00	—	0.00	Sep 11, 2014	The Piwik Mobile 2 (aka org.piwik.mobile2) application 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5870	Kmart Kmart	0.00	—	0.00	Sep 11, 2014	The Kmart (aka com.kmart.android) application 6.2.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5869	Cnn Cnnmoney Portfolio	0.00	—	0.00	Sep 11, 2014	The CNNMoney Portfolio (aka com.cnn.cnnmoney) application 1.03 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5868	Cisco Systems, Inc. Cisco Technical Support	0.00	—	0.00	Sep 11, 2014	The Cisco Technical Support (aka com.cisco.swtg_android) application 3.7.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5867	Sparkpay Capital One Spark	0.00	—	0.00	Sep 11, 2014	The Capital One Spark Pay (aka com.capitalone.sparkpay) application 0.9.81 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5866	Dmv.ca.gov Ca Dmv	0.00	—	0.00	Sep 11, 2014	The CA DMV (aka gov.ca.dmv) application 2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5865	Ask.com Ask.com	0.00	—	0.00	Sep 11, 2014	The Ask.com (aka com.ask.android) application 2.2.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5864	Bankgirot Swish payments	0.00	—	0.00	Sep 11, 2014	The Swish payments (aka se.bankgirot.swish) application 2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5863	Mpang.gp mpang.gp	0.00	—	0.00	Sep 11, 2014	The mpang.gp (aka air.com.cjenm.mpang.gp) application 4.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-2624	Microfocus OpenView Network Node Manager	0.08	—	0.65	Sep 11, 2014	Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.0x, 9.1x, and 9.2x allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2264.
CVE-2014-4865	Cacheguard Cacheguardos	0.03	—	0.01	Sep 10, 2014	Cross-site request forgery (CSRF) vulnerability in gui/password-wadmin.apl in CacheGuard OS 5.7.7 allows remote attackers to hijack the authentication of arbitrary users.
CVE-2014-0351	Fortinet Fortios	0.00	—	0.01	Sep 10, 2014	The FortiManager protocol service in Fortinet FortiOS before 4.3.16 and 5.x before 5.0.8 on FortiGate devices does not prevent use of anonymous ciphersuites, which makes it easier for man-in-the-middle attackers to obtain sensitive information or interfere with communications by…
CVE-2014-6074	IBM Urbancode Deploy	0.00	—	0.01	Sep 10, 2014	IBM UrbanCode Deploy 6.1.0.2 before IF1 allows remote authenticated users to read keystore secret keys via a direct request to a UI page.
CVE-2014-5862	Zhwnl Ecalendar2	0.00	—	0.00	Sep 10, 2014	The ecalendar2 (aka cn.etouch.ecalendar2) application 4.5.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5861	BoyAhoy BoyAhoy - Gay Chat	0.00	—	0.00	Sep 10, 2014	The BoyAhoy - Gay Chat (aka com.boyahoy.android) application 4.3.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5860	Aximediasoft Slide Show Creator	0.00	—	0.00	Sep 10, 2014	The Slide Show Creator (aka com.amem) application 4.4.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5859	Animoca Star Girl: Colors of Spring	0.00	—	0.00	Sep 10, 2014	The Star Girl: Colors of Spring (aka com.animoca.google.starGirlSpring) application 3.4.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5858	Candy Blast Project Candy Blast	0.00	—	0.00	Sep 10, 2014	The Candy Blast (aka com.appgame7.candyblast) application 1.1.001 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5857	Avantar White \& Yellow Pages	0.00	—	0.00	Sep 10, 2014	The White & Yellow Pages (aka com.avantar.wny) application 5.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5313	Movabletype Movabletype	0.00	—	0.01	Sep 10, 2014	Cross-site scripting (XSS) vulnerability in the management page in Six Apart Movable Type before 5.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-4864	Netgear Prosafe Plus Configuration Utility	0.00	—	0.01	Sep 10, 2014	The NETGEAR ProSafe Plus Configuration Utility creates configuration backup files containing cleartext passwords, which might allow remote attackers to obtain sensitive information by reading a file.
CVE-2014-4789	IBM Initiate Master Data Service	0.00	—	0.01	Sep 10, 2014	Session fixation vulnerability in IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1.093013 allows remote attackers to hijack web sessions via unspecified vectors.
CVE-2014-4788	IBM Initiate Master Data Service	0.00	—	0.01	Sep 10, 2014	IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1.093013 does not have an off autocomplete attribute for authentication fields, which makes it easier for remote attackers to obtain access by leveraging an…
CVE-2014-4787	IBM Initiate Master Data Service	0.00	—	0.01	Sep 10, 2014	Cross-site scripting (XSS) vulnerability in IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1.093013 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-4786	IBM Initiate Master Data Service	0.00	—	0.01	Sep 10, 2014	IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1.093013 does not properly restrict use of FRAME elements, which allows remote authenticated users to conduct phishing attacks, and bypass intended access…
CVE-2014-4785	IBM Initiate Master Data Service	0.00	—	0.01	Sep 10, 2014	Cross-site request forgery (CSRF) vulnerability in IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1.093013 allows remote authenticated users to hijack the authentication of arbitrary users for requests…
CVE-2014-4784	IBM Initiate Master Data Service	0.00	—	0.01	Sep 10, 2014	IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1.093013 does not properly restrict use of FRAME elements, which allows remote attackers to conduct phishing attacks, and bypass intended access…
CVE-2014-4783	IBM Initiate Master Data Service	0.00	—	0.01	Sep 10, 2014	Cross-site request forgery (CSRF) vulnerability in IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1.093013 allows remote attackers to hijack the authentication of arbitrary users for requests that insert…
CVE-2014-4756	IBM Rational License Key Server	0.00	—	0.01	Sep 10, 2014	The Administration and Reporting Tool in IBM Rational License Key Server (RLKS) 8.1.4.x before 8.1.4.4 allows remote authenticated users to hijack sessions via unspecified vectors.
CVE-2014-3348	Cisco Systems, Inc. Unified Computing System	0.00	—	0.03	Sep 10, 2014	The SSH module in the Integrated Management Controller (IMC) before 2.3.1 in Cisco Unified Computing System on E-Series blade servers allows remote attackers to cause a denial of service (IMC hang) via a crafted SSH packet, aka Bug ID CSCuo69206.
CVE-2014-3343	Cisco Systems, Inc. iOS Xr	0.00	—	0.02	Sep 10, 2014	Cisco IOS XR 5.1 allows remote attackers to cause a denial of service (DHCPv6 daemon crash) via a malformed DHCPv6 packet, aka Bug ID CSCuo59052.
CVE-2014-3179	Google Chrome	0.00	—	0.01	Sep 10, 2014	Multiple unspecified vulnerabilities in Google Chrome before 37.0.2062.120 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

CVE-2014-6235Sep 11, 2014
TYPO3
ke DomPDF
risk 0.03cvss —epss 0.06
Unspecified vulnerability in the ke DomPDF extension before 0.0.5 for TYPO3 allows remote attackers to execute arbitrary code via unknown vectors.
CVE-2014-6234Sep 11, 2014
TYPO3
jh_opengraphprotocol
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Open Graph protocol (jh_opengraphprotocol) extension before 1.0.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-6233Sep 11, 2014
TYPO3
Flat Manager
risk 0.00cvss —epss 0.01
SQL injection vulnerability in the Flat Manager (flatmgr) extension before 2.7.10 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2014-6232Sep 11, 2014
TYPO3
eu_ldap
risk 0.00cvss —epss 0.01
Unspecified vulnerability in the LDAP (eu_ldap) extension before 2.8.18 for TYPO3 allows remote authenticated users to obtain sensitive information via unknown vectors.
CVE-2014-6231Sep 11, 2014
TYPO3
cwt_feedit
risk 0.00cvss —epss 0.03
Unspecified vulnerability in the CWT Frontend Edit (cwt_feedit) extension before 1.2.5 for TYPO3 allows remote authenticated users to execute arbitrary code via unknown vectors.
CVE-2014-6070Sep 11, 2014
Adiscon
Loganalyzer
risk 0.03cvss —epss 0.04
Multiple cross-site scripting (XSS) vulnerabilities in Adiscon LogAnalyzer before 3.6.6 allow remote attackers to inject arbitrary web script or HTML via the hostname in (1) index.php or (2) detail.php.
CVE-2014-5519Sep 11, 2014
Phpwiki
Phpwiki
risk 0.08cvss —epss 0.65
The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the edit[content] parameter to index.php/HeIp. NOTE: some of these details are obtained from third party information.
CVE-2014-2223Sep 11, 2014
Plogger
Plogger
risk 0.04cvss —epss 0.10
Unrestricted file upload vulnerability in plog-admin/plog-upload.php in Plogger 1.0 RC1 and earlier allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file and a non-zero length PNG file, then accessing the PHP file via a…
CVE-2012-4240Sep 11, 2014
Intermesh
Groupoffice
risk 0.03cvss —epss 0.01
SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter.
CVE-2012-0984Sep 11, 2014
XOOPS
Xoops
risk 0.03cvss —epss 0.04
Multiple cross-site scripting (XSS) vulnerabilities in XOOPS before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via the (1) to_userid parameter to modules/pm/pmlite.php or the (2) current_file, (3) imgcat_id, or (4) target parameter to…
CVE-2011-4887Sep 11, 2014
Imperva
Securesphere Web Application Firewall
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Violations Table in the management GUI in the MX Management Server in Imperva SecureSphere Web Application Firewall (WAF) 9.0 allows remote attackers to inject arbitrary web script or HTML via the username field.
CVE-2014-5878Sep 11, 2014
I Um
Ium
risk 0.00cvss —epss 0.00
The ium (aka net.ium.mobile.android) application 3.3.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5877Sep 11, 2014
Mini Group
Tv Guide
risk 0.00cvss —epss 0.00
The TV Guide (aka net.micene.minigroup.palimpsests.lite) application 5.4.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5876Sep 11, 2014
WD
My Cloud
risk 0.00cvss —epss 0.00
The WD My Cloud (aka com.wdc.wd2go) application 4.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5875Sep 11, 2014
Sylpheo
Sylphone
risk 0.00cvss —epss 0.00
The Sylphone (aka com.sylpheo.prospectosyl) application 5.3.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5874Sep 11, 2014
Splashid
Splashid
risk 0.00cvss —epss 0.00
The SplashID (aka com.splashidandroid) application 7.2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5873Sep 11, 2014
Sears
Sears
risk 0.00cvss —epss 0.00
The Sears (aka com.sears.android) application 6.2.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5872Sep 11, 2014
Safenet
Safenetmobile Pass
risk 0.00cvss —epss 0.00
The SafeNetMobile Pass (aka securecomputing.devices.android.controller) application 8.3.7.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5871Sep 11, 2014
Piwik
Piwik Mobile 2
risk 0.00cvss —epss 0.00
The Piwik Mobile 2 (aka org.piwik.mobile2) application 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5870Sep 11, 2014
Kmart
Kmart
risk 0.00cvss —epss 0.00
The Kmart (aka com.kmart.android) application 6.2.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5869Sep 11, 2014
Cnn
Cnnmoney Portfolio
risk 0.00cvss —epss 0.00
The CNNMoney Portfolio (aka com.cnn.cnnmoney) application 1.03 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5868Sep 11, 2014
Cisco Systems, Inc.
Cisco Technical Support
risk 0.00cvss —epss 0.00
The Cisco Technical Support (aka com.cisco.swtg_android) application 3.7.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5867Sep 11, 2014
Sparkpay
Capital One Spark
risk 0.00cvss —epss 0.00
The Capital One Spark Pay (aka com.capitalone.sparkpay) application 0.9.81 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5866Sep 11, 2014
Dmv.ca.gov
Ca Dmv
risk 0.00cvss —epss 0.00
The CA DMV (aka gov.ca.dmv) application 2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5865Sep 11, 2014
Ask.com
Ask.com
risk 0.00cvss —epss 0.00
The Ask.com (aka com.ask.android) application 2.2.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5864Sep 11, 2014
Bankgirot
Swish payments
risk 0.00cvss —epss 0.00
The Swish payments (aka se.bankgirot.swish) application 2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5863Sep 11, 2014
Mpang.gp
mpang.gp
risk 0.00cvss —epss 0.00
The mpang.gp (aka air.com.cjenm.mpang.gp) application 4.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-2624Sep 11, 2014
Microfocus
OpenView Network Node Manager
risk 0.08cvss —epss 0.65
Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.0x, 9.1x, and 9.2x allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2264.
CVE-2014-4865Sep 10, 2014
Cacheguard
Cacheguardos
risk 0.03cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in gui/password-wadmin.apl in CacheGuard OS 5.7.7 allows remote attackers to hijack the authentication of arbitrary users.
CVE-2014-0351Sep 10, 2014
Fortinet
Fortios
risk 0.00cvss —epss 0.01
The FortiManager protocol service in Fortinet FortiOS before 4.3.16 and 5.x before 5.0.8 on FortiGate devices does not prevent use of anonymous ciphersuites, which makes it easier for man-in-the-middle attackers to obtain sensitive information or interfere with communications by…
CVE-2014-6074Sep 10, 2014
IBM
Urbancode Deploy
risk 0.00cvss —epss 0.01
IBM UrbanCode Deploy 6.1.0.2 before IF1 allows remote authenticated users to read keystore secret keys via a direct request to a UI page.
CVE-2014-5862Sep 10, 2014
Zhwnl
Ecalendar2
risk 0.00cvss —epss 0.00
The ecalendar2 (aka cn.etouch.ecalendar2) application 4.5.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5861Sep 10, 2014
BoyAhoy
BoyAhoy - Gay Chat
risk 0.00cvss —epss 0.00
The BoyAhoy - Gay Chat (aka com.boyahoy.android) application 4.3.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5860Sep 10, 2014
Aximediasoft
Slide Show Creator
risk 0.00cvss —epss 0.00
The Slide Show Creator (aka com.amem) application 4.4.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5859Sep 10, 2014
Animoca
Star Girl: Colors of Spring
risk 0.00cvss —epss 0.00
The Star Girl: Colors of Spring (aka com.animoca.google.starGirlSpring) application 3.4.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5858Sep 10, 2014
Candy Blast Project
Candy Blast
risk 0.00cvss —epss 0.00
The Candy Blast (aka com.appgame7.candyblast) application 1.1.001 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5857Sep 10, 2014
Avantar
White \& Yellow Pages
risk 0.00cvss —epss 0.00
The White & Yellow Pages (aka com.avantar.wny) application 5.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5313Sep 10, 2014
Movabletype
Movabletype
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the management page in Six Apart Movable Type before 5.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-4864Sep 10, 2014
Netgear
Prosafe Plus Configuration Utility
risk 0.00cvss —epss 0.01
The NETGEAR ProSafe Plus Configuration Utility creates configuration backup files containing cleartext passwords, which might allow remote attackers to obtain sensitive information by reading a file.
CVE-2014-4789Sep 10, 2014
IBM
Initiate Master Data Service
risk 0.00cvss —epss 0.01
Session fixation vulnerability in IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1.093013 allows remote attackers to hijack web sessions via unspecified vectors.
CVE-2014-4788Sep 10, 2014
IBM
Initiate Master Data Service
risk 0.00cvss —epss 0.01
IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1.093013 does not have an off autocomplete attribute for authentication fields, which makes it easier for remote attackers to obtain access by leveraging an…
CVE-2014-4787Sep 10, 2014
IBM
Initiate Master Data Service
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1.093013 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-4786Sep 10, 2014
IBM
Initiate Master Data Service
risk 0.00cvss —epss 0.01
IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1.093013 does not properly restrict use of FRAME elements, which allows remote authenticated users to conduct phishing attacks, and bypass intended access…
CVE-2014-4785Sep 10, 2014
IBM
Initiate Master Data Service
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1.093013 allows remote authenticated users to hijack the authentication of arbitrary users for requests…
CVE-2014-4784Sep 10, 2014
IBM
Initiate Master Data Service
risk 0.00cvss —epss 0.01
IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1.093013 does not properly restrict use of FRAME elements, which allows remote attackers to conduct phishing attacks, and bypass intended access…
CVE-2014-4783Sep 10, 2014
IBM
Initiate Master Data Service
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1.093013 allows remote attackers to hijack the authentication of arbitrary users for requests that insert…
CVE-2014-4756Sep 10, 2014
IBM
Rational License Key Server
risk 0.00cvss —epss 0.01
The Administration and Reporting Tool in IBM Rational License Key Server (RLKS) 8.1.4.x before 8.1.4.4 allows remote authenticated users to hijack sessions via unspecified vectors.
CVE-2014-3348Sep 10, 2014
Cisco Systems, Inc.
Unified Computing System
risk 0.00cvss —epss 0.03
The SSH module in the Integrated Management Controller (IMC) before 2.3.1 in Cisco Unified Computing System on E-Series blade servers allows remote attackers to cause a denial of service (IMC hang) via a crafted SSH packet, aka Bug ID CSCuo69206.
CVE-2014-3343Sep 10, 2014
Cisco Systems, Inc.
iOS Xr
risk 0.00cvss —epss 0.02
Cisco IOS XR 5.1 allows remote attackers to cause a denial of service (DHCPv6 daemon crash) via a malformed DHCPv6 packet, aka Bug ID CSCuo59052.
CVE-2014-3179Sep 10, 2014
Google
Chrome
risk 0.00cvss —epss 0.01
Multiple unspecified vulnerabilities in Google Chrome before 37.0.2062.120 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.