CVEs

391,232 total · page 6522 of 7,825

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2014-4439	Apple Inc. Mail	0.00	—	0.02	Oct 18, 2014	Mail in Apple OS X before 10.10 does not properly recognize the removal of a recipient address from a message, which makes it easier for remote attackers to obtain sensitive information in opportunistic circumstances by reading a message intended exclusively for other recipients.
CVE-2014-4438	Apple Inc. OS X	0.00	—	0.00	Oct 18, 2014	Race condition in LoginWindow in Apple OS X before 10.10 allows physically proximate attackers to obtain access by leveraging an unattended workstation on which screen locking had been attempted.
CVE-2014-4437	Apple Inc. OS X	0.00	—	0.01	Oct 18, 2014	LaunchServices in Apple OS X before 10.10 allows attackers to bypass intended sandbox restrictions via an application that specifies a crafted handler for the Content-Type field of an object.
CVE-2014-4436	Apple Inc. OS X	0.00	—	0.01	Oct 18, 2014	IOHIDFamily in Apple OS X before 10.10 allows attackers to cause denial of service (out-of-bounds read operation) via a crafted application.
CVE-2014-4435	Apple Inc. OS X	0.00	—	0.00	Oct 18, 2014	The "iCloud Find My Mac" feature in Apple OS X before 10.10 does not properly enforce rate limiting of lost-mode PIN entry, which makes it easier for physically proximate attackers to obtain access via a brute-force attack involving a series of reboots.
CVE-2014-4434	Apple Inc. OS X	0.00	—	0.00	Oct 18, 2014	The kernel in Apple OS X before 10.10 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted filename on an HFS filesystem.
CVE-2014-4433	Apple Inc. OS X	0.00	—	0.01	Oct 18, 2014	Heap-based buffer overflow in the kernel in Apple OS X before 10.10 allows physically proximate attackers to execute arbitrary code via crafted resource forks in an HFS filesystem.
CVE-2014-4432	Apple Inc. OS X	0.00	—	0.00	Oct 18, 2014	fdesetup in Apple OS X before 10.10 does not properly display the encryption status in between a setting-update action and a reboot action, which might make it easier for physically proximate attackers to obtain cleartext data by leveraging ignorance of the reboot requirement.
CVE-2014-4431	Apple Inc. OS X	0.00	—	0.00	Oct 18, 2014	Dock in Apple OS X before 10.10 does not properly manage the screen-lock state, which allows physically proximate attackers to view windows by leveraging an unattended workstation.
CVE-2014-4430	Apple Inc. OS X	0.00	—	0.00	Oct 18, 2014	CoreStorage in Apple OS X before 10.10 retains a volume's encryption keys upon an eject action in the unlocked state, which makes it easier for physically proximate attackers to obtain cleartext data via a remount.
CVE-2014-4428	Apple Inc. OS X	0.00	—	0.01	Oct 18, 2014	Bluetooth in Apple OS X before 10.10 does not require encryption for HID Low Energy devices, which allows remote attackers to spoof a device by leveraging previous pairing.
CVE-2014-4427	Apple Inc. OS X	0.00	—	0.01	Oct 18, 2014	App Sandbox in Apple OS X before 10.10 allows attackers to bypass a sandbox protection mechanism via the accessibility API.
CVE-2014-4426	Apple Inc. AFP File Server	0.00	—	0.01	Oct 18, 2014	AFP File Server in Apple OS X before 10.10 allows remote attackers to discover the network addresses of all interfaces via an unspecified command to one interface.
CVE-2014-4425	Apple Inc. OS X	0.00	—	0.00	Oct 18, 2014	CFPreferences in Apple OS X before 10.10 does not properly enforce the "require password after sleep or screen saver begins" setting, which makes it easier for physically proximate attackers to obtain access by leveraging an unattended workstation.
CVE-2014-4417	Apple Inc. Safari	0.00	—	0.02	Oct 18, 2014	Safari in Apple OS X before 10.10 allows remote attackers to cause a denial of service (universal Push Notification outage) via a web site that triggers an uncaught SafariNotificationAgent exception by providing a crafted Push Notification.
CVE-2014-4391	Apple Inc. OS X	0.00	—	0.03	Oct 18, 2014	The Code Signing feature in Apple OS X before 10.10 does not properly handle incomplete resource envelopes in signed bundles, which allows remote attackers to bypass intended app-author restrictions by omitting an execution-related resource.
CVE-2014-4351	Apple Inc. Quicktime	0.00	—	0.04	Oct 18, 2014	Buffer overflow in QuickTime in Apple OS X before 10.10 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted audio samples in an m4a file.
CVE-2014-3573	Red Hat Enterprise Virtualization	0.00	—	0.02	Oct 18, 2014	The oVirt Engine backend module, as used in Red Hat Enterprise Virtualization Manager before 3.4.2, uses an "insecure DocumentBuilderFactory," which allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML/RSDL document, related…
CVE-2014-6283	Sybase Adaptive Server Enterprise	0.00	—	0.01	Oct 17, 2014	SAP Adaptive Server Enterprise (ASE) 15.7 before SP122 or SP63, 15.5 before ESD#5.4, and 15.0.3 before ESD#4.4 does not properly restrict access, which allows remote authenticated database users to (1) overwrite the master encryption key or (2) trigger a buffer overflow via a…
CVE-2014-2279	Seeddms Seeddms	0.00	—	0.05	Oct 17, 2014	Multiple directory traversal vulnerabilities in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allow (1) remote authenticated users with access to the LogManagement functionality to read arbitrary files via a .. (dot dot) in the logname parameter to out/out.LogManagement.php…
CVE-2014-2278	Seeddms Seeddms	0.00	—	0.04	Oct 17, 2014	Unrestricted file upload vulnerability in op/op.AddFile2.php in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows remote attackers to execute arbitrary code by uploading a file with an executable extension specified by the partitionIndex parameter and leveraging…
CVE-2014-2995	WordPress Twitget	0.03	—	0.04	Oct 17, 2014	Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors, as demonstrated by the twitget_consumer_key parameter to…
CVE-2014-2559	WordPress Twitget	0.03	—	0.03	Oct 17, 2014	Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change unspecified plugin options via a request to…
CVE-2014-8756	Panasonic NcrCtl4.NcrNet.1	0.00	—	0.04	Oct 17, 2014	The NcrCtl4.NcrNet.1 control in Panasonic Network Camera Recorder before 4.04R03 allows remote attackers to execute arbitrary code via a crafted GetVOLHeader method call, which writes null bytes to an arbitrary address.
CVE-2014-8755	Panasonic Network Camera View	0.00	—	0.03	Oct 17, 2014	Panasonic Network Camera View 3 and 4 allows remote attackers to execute arbitrary code via a crafted page, which triggers an invalid pointer dereference, related to "the ability to nullify an arbitrary address in memory."
CVE-2014-8074	Foxitsoftware PDF SDK	0.00	—	0.04	Oct 17, 2014	Buffer overflow in the SetLogFile method in Foxit.FoxitPDFSDKProCtrl.5 in Foxit PDF SDK ActiveX 2.3 through 5.0.1820 before 5.0.2.924 allows remote attackers to execute arbitrary code via a long string, related to global variables.
CVE-2014-7960	OpenStack Swift	0.00	—	0.03	Oct 17, 2014	OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max_meta_count and other metadata constraints via multiple crafted requests which exceed the limit when combined.
CVE-2014-2068	Jenkins Project Jenkins	0.00	—	0.01	Oct 17, 2014	The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users with the ADMINISTER permission to obtain sensitive information via vectors related to heapDump.
CVE-2014-2066	Jenkins Project Jenkins	0.00	—	0.02	Oct 17, 2014	Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors involving the "override" of Jenkins cookies.
CVE-2014-2065	Jenkins Project Jenkins	0.00	—	0.02	Oct 17, 2014	Cross-site scripting (XSS) vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to inject arbitrary web script or HTML via the iconSize cookie.
CVE-2014-2064	Jenkins Project Jenkins	0.00	—	0.03	Oct 17, 2014	The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to determine whether a user exists via vectors related to failed login attempts.
CVE-2014-2063	Jenkins Project Jenkins	0.00	—	0.02	Oct 17, 2014	Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
CVE-2014-2062	Jenkins Project Jenkins	0.00	—	0.02	Oct 17, 2014	Jenkins before 1.551 and LTS before 1.532.2 does not invalidate the API token when a user is deleted, which allows remote authenticated users to retain access via the token.
CVE-2014-2061	Jenkins Project Jenkins	0.00	—	0.02	Oct 17, 2014	The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by reading the HTML source code, related to the default value.
CVE-2014-2060	Jenkins Project Jenkins	0.00	—	0.02	Oct 17, 2014	The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vectors.
CVE-2014-2058	Jenkins Project Jenkins	0.00	—	0.02	Oct 17, 2014	BuildTrigger in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to bypass access restrictions and execute arbitrary jobs by configuring a job to trigger another job. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7330.
CVE-2013-7330	Jenkins Project Jenkins	0.00	—	0.02	Oct 17, 2014	Jenkins before 1.502 allows remote authenticated users to configure an otherwise restricted project via vectors related to post-build actions.
CVE-2014-8320	Drupal Custom Search	0.00	—	0.01	Oct 17, 2014	Cross-site scripting (XSS) vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the "Label text" field to the results…
CVE-2014-8319	osuthorpe Easy Social	0.00	—	0.01	Oct 17, 2014	Cross-site scripting (XSS) vulnerability in the easy_social_admin_summary function in the Easy Social module 7.x-2.x before 7.x-2.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a block title.
CVE-2014-8318	Webform Project Webform	0.00	—	0.01	Oct 17, 2014	Cross-site scripting (XSS) vulnerability in the Webform module 6.x-3.x before 6.x-3.20, 7.x-3.x before 7.x-3.20, and 7.x-4.x before 7.x-4.0-beta2 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a field label title,…
CVE-2014-8317	Webform Validation Project Webform Validation	0.00	—	0.01	Oct 17, 2014	Cross-site scripting (XSS) vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name text.
CVE-2014-8316	SAP Businessobjects Explorer	0.00	—	0.03	Oct 16, 2014	XML External Entity (XXE) vulnerability in polestar_xml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 allows remote attackers to read arbitrary files via the xmlParameter parameter in an explorationSpaceUpdate request.
CVE-2014-8315	SAP Businessobjects Explorer	0.00	—	0.02	Oct 16, 2014	polestar_xml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 replies with different timing depending on if a connection can be made, which allows remote attackers to conduct port scanning attacks via a host name and port in the cms parameter.
CVE-2014-8314	SAP Hana	0.00	—	0.02	Oct 16, 2014	Multiple cross-site scripting (XSS) vulnerabilities in SAP HANA Developer Edition Revision 70 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) epm/admin/DataGen.xsjs or (2) epm/services/multiply.xsjs in the democontent.
CVE-2014-8313	SAP Hana	0.00	—	0.02	Oct 16, 2014	Eval injection in ide/core/base/server/net.xsjs in the Developer Workbench in SAP HANA allows remote attackers to execute arbitrary XSJX code via unspecified vectors.
CVE-2014-8312	SAP Netweaver Abap	0.00	—	0.02	Oct 16, 2014	Business Warehouse (BW) in SAP Netweaver AS ABAP 7.31 allows remote authenticated users to obtain sensitive information via a request to the RSDU_CCMS_GET_PROFILE_PARAM RFC function.
CVE-2014-8311	SAP Businessobjects	0.00	—	0.02	Oct 16, 2014	SAP BusinessObjects Edge 4.0 allows remote attackers to obtain sensitive information via an InfoStore query to a CORBA listener.
CVE-2014-8310	SAP Businessobjects	0.00	—	0.03	Oct 16, 2014	The CMS CORBA listener in SAP BusinessObjects BI Edge 4.0 allows remote attackers to cause a denial of service (server shutdown) via crafted OSCAFactory::Session ORB message.
CVE-2014-8309	SAP Businessobjects	0.00	—	0.02	Oct 16, 2014	SAP BusinessObjects 4.0 and BusinessObjects XI (BOXI) R2 and 3.1 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to enumerate valid usernames via SecEnterprise…
CVE-2014-8308	SAP Businessobjects	0.00	—	0.02	Oct 16, 2014	Cross-site scripting (XSS) vulnerability in the Send to Inbox functionality in SAP BusinessObjects BI EDGE 4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2014-4439Oct 18, 2014
Apple Inc.
Mail
risk 0.00cvss —epss 0.02
Mail in Apple OS X before 10.10 does not properly recognize the removal of a recipient address from a message, which makes it easier for remote attackers to obtain sensitive information in opportunistic circumstances by reading a message intended exclusively for other recipients.
CVE-2014-4438Oct 18, 2014
Apple Inc.
OS X
risk 0.00cvss —epss 0.00
Race condition in LoginWindow in Apple OS X before 10.10 allows physically proximate attackers to obtain access by leveraging an unattended workstation on which screen locking had been attempted.
CVE-2014-4437Oct 18, 2014
Apple Inc.
OS X
risk 0.00cvss —epss 0.01
LaunchServices in Apple OS X before 10.10 allows attackers to bypass intended sandbox restrictions via an application that specifies a crafted handler for the Content-Type field of an object.
CVE-2014-4436Oct 18, 2014
Apple Inc.
OS X
risk 0.00cvss —epss 0.01
IOHIDFamily in Apple OS X before 10.10 allows attackers to cause denial of service (out-of-bounds read operation) via a crafted application.
CVE-2014-4435Oct 18, 2014
Apple Inc.
OS X
risk 0.00cvss —epss 0.00
The "iCloud Find My Mac" feature in Apple OS X before 10.10 does not properly enforce rate limiting of lost-mode PIN entry, which makes it easier for physically proximate attackers to obtain access via a brute-force attack involving a series of reboots.
CVE-2014-4434Oct 18, 2014
Apple Inc.
OS X
risk 0.00cvss —epss 0.00
The kernel in Apple OS X before 10.10 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted filename on an HFS filesystem.
CVE-2014-4433Oct 18, 2014
Apple Inc.
OS X
risk 0.00cvss —epss 0.01
Heap-based buffer overflow in the kernel in Apple OS X before 10.10 allows physically proximate attackers to execute arbitrary code via crafted resource forks in an HFS filesystem.
CVE-2014-4432Oct 18, 2014
Apple Inc.
OS X
risk 0.00cvss —epss 0.00
fdesetup in Apple OS X before 10.10 does not properly display the encryption status in between a setting-update action and a reboot action, which might make it easier for physically proximate attackers to obtain cleartext data by leveraging ignorance of the reboot requirement.
CVE-2014-4431Oct 18, 2014
Apple Inc.
OS X
risk 0.00cvss —epss 0.00
Dock in Apple OS X before 10.10 does not properly manage the screen-lock state, which allows physically proximate attackers to view windows by leveraging an unattended workstation.
CVE-2014-4430Oct 18, 2014
Apple Inc.
OS X
risk 0.00cvss —epss 0.00
CoreStorage in Apple OS X before 10.10 retains a volume's encryption keys upon an eject action in the unlocked state, which makes it easier for physically proximate attackers to obtain cleartext data via a remount.
CVE-2014-4428Oct 18, 2014
Apple Inc.
OS X
risk 0.00cvss —epss 0.01
Bluetooth in Apple OS X before 10.10 does not require encryption for HID Low Energy devices, which allows remote attackers to spoof a device by leveraging previous pairing.
CVE-2014-4427Oct 18, 2014
Apple Inc.
OS X
risk 0.00cvss —epss 0.01
App Sandbox in Apple OS X before 10.10 allows attackers to bypass a sandbox protection mechanism via the accessibility API.
CVE-2014-4426Oct 18, 2014
Apple Inc.
AFP File Server
risk 0.00cvss —epss 0.01
AFP File Server in Apple OS X before 10.10 allows remote attackers to discover the network addresses of all interfaces via an unspecified command to one interface.
CVE-2014-4425Oct 18, 2014
Apple Inc.
OS X
risk 0.00cvss —epss 0.00
CFPreferences in Apple OS X before 10.10 does not properly enforce the "require password after sleep or screen saver begins" setting, which makes it easier for physically proximate attackers to obtain access by leveraging an unattended workstation.
CVE-2014-4417Oct 18, 2014
Apple Inc.
Safari
risk 0.00cvss —epss 0.02
Safari in Apple OS X before 10.10 allows remote attackers to cause a denial of service (universal Push Notification outage) via a web site that triggers an uncaught SafariNotificationAgent exception by providing a crafted Push Notification.
CVE-2014-4391Oct 18, 2014
Apple Inc.
OS X
risk 0.00cvss —epss 0.03
The Code Signing feature in Apple OS X before 10.10 does not properly handle incomplete resource envelopes in signed bundles, which allows remote attackers to bypass intended app-author restrictions by omitting an execution-related resource.
CVE-2014-4351Oct 18, 2014
Apple Inc.
Quicktime
risk 0.00cvss —epss 0.04
Buffer overflow in QuickTime in Apple OS X before 10.10 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted audio samples in an m4a file.
CVE-2014-3573Oct 18, 2014
Red Hat
Enterprise Virtualization
risk 0.00cvss —epss 0.02
The oVirt Engine backend module, as used in Red Hat Enterprise Virtualization Manager before 3.4.2, uses an "insecure DocumentBuilderFactory," which allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML/RSDL document, related…
CVE-2014-6283Oct 17, 2014
Sybase
Adaptive Server Enterprise
risk 0.00cvss —epss 0.01
SAP Adaptive Server Enterprise (ASE) 15.7 before SP122 or SP63, 15.5 before ESD#5.4, and 15.0.3 before ESD#4.4 does not properly restrict access, which allows remote authenticated database users to (1) overwrite the master encryption key or (2) trigger a buffer overflow via a…
CVE-2014-2279Oct 17, 2014
Seeddms
Seeddms
risk 0.00cvss —epss 0.05
Multiple directory traversal vulnerabilities in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allow (1) remote authenticated users with access to the LogManagement functionality to read arbitrary files via a .. (dot dot) in the logname parameter to out/out.LogManagement.php…
CVE-2014-2278Oct 17, 2014
Seeddms
Seeddms
risk 0.00cvss —epss 0.04
Unrestricted file upload vulnerability in op/op.AddFile2.php in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows remote attackers to execute arbitrary code by uploading a file with an executable extension specified by the partitionIndex parameter and leveraging…
CVE-2014-2995Oct 17, 2014
WordPress
Twitget
risk 0.03cvss —epss 0.04
Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors, as demonstrated by the twitget_consumer_key parameter to…
CVE-2014-2559Oct 17, 2014
WordPress
Twitget
risk 0.03cvss —epss 0.03
Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change unspecified plugin options via a request to…
CVE-2014-8756Oct 17, 2014
Panasonic
NcrCtl4.NcrNet.1
risk 0.00cvss —epss 0.04
The NcrCtl4.NcrNet.1 control in Panasonic Network Camera Recorder before 4.04R03 allows remote attackers to execute arbitrary code via a crafted GetVOLHeader method call, which writes null bytes to an arbitrary address.
CVE-2014-8755Oct 17, 2014
Panasonic
Network Camera View
risk 0.00cvss —epss 0.03
Panasonic Network Camera View 3 and 4 allows remote attackers to execute arbitrary code via a crafted page, which triggers an invalid pointer dereference, related to "the ability to nullify an arbitrary address in memory."
CVE-2014-8074Oct 17, 2014
Foxitsoftware
PDF SDK
risk 0.00cvss —epss 0.04
Buffer overflow in the SetLogFile method in Foxit.FoxitPDFSDKProCtrl.5 in Foxit PDF SDK ActiveX 2.3 through 5.0.1820 before 5.0.2.924 allows remote attackers to execute arbitrary code via a long string, related to global variables.
CVE-2014-7960Oct 17, 2014
OpenStack
Swift
risk 0.00cvss —epss 0.03
OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max_meta_count and other metadata constraints via multiple crafted requests which exceed the limit when combined.
CVE-2014-2068Oct 17, 2014
Jenkins Project
Jenkins
risk 0.00cvss —epss 0.01
The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users with the ADMINISTER permission to obtain sensitive information via vectors related to heapDump.
CVE-2014-2066Oct 17, 2014
Jenkins Project
Jenkins
risk 0.00cvss —epss 0.02
Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors involving the "override" of Jenkins cookies.
CVE-2014-2065Oct 17, 2014
Jenkins Project
Jenkins
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to inject arbitrary web script or HTML via the iconSize cookie.
CVE-2014-2064Oct 17, 2014
Jenkins Project
Jenkins
risk 0.00cvss —epss 0.03
The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to determine whether a user exists via vectors related to failed login attempts.
CVE-2014-2063Oct 17, 2014
Jenkins Project
Jenkins
risk 0.00cvss —epss 0.02
Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
CVE-2014-2062Oct 17, 2014
Jenkins Project
Jenkins
risk 0.00cvss —epss 0.02
Jenkins before 1.551 and LTS before 1.532.2 does not invalidate the API token when a user is deleted, which allows remote authenticated users to retain access via the token.
CVE-2014-2061Oct 17, 2014
Jenkins Project
Jenkins
risk 0.00cvss —epss 0.02
The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by reading the HTML source code, related to the default value.
CVE-2014-2060Oct 17, 2014
Jenkins Project
Jenkins
risk 0.00cvss —epss 0.02
The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vectors.
CVE-2014-2058Oct 17, 2014
Jenkins Project
Jenkins
risk 0.00cvss —epss 0.02
BuildTrigger in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to bypass access restrictions and execute arbitrary jobs by configuring a job to trigger another job. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7330.
CVE-2013-7330Oct 17, 2014
Jenkins Project
Jenkins
risk 0.00cvss —epss 0.02
Jenkins before 1.502 allows remote authenticated users to configure an otherwise restricted project via vectors related to post-build actions.
CVE-2014-8320Oct 17, 2014
Drupal
Custom Search
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the "Label text" field to the results…
CVE-2014-8319Oct 17, 2014
osuthorpe
Easy Social
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the easy_social_admin_summary function in the Easy Social module 7.x-2.x before 7.x-2.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a block title.
CVE-2014-8318Oct 17, 2014
Webform Project
Webform
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Webform module 6.x-3.x before 6.x-3.20, 7.x-3.x before 7.x-3.20, and 7.x-4.x before 7.x-4.0-beta2 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a field label title,…
CVE-2014-8317Oct 17, 2014
Webform Validation Project
Webform Validation
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name text.
CVE-2014-8316Oct 16, 2014
SAP
Businessobjects Explorer
risk 0.00cvss —epss 0.03
XML External Entity (XXE) vulnerability in polestar_xml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 allows remote attackers to read arbitrary files via the xmlParameter parameter in an explorationSpaceUpdate request.
CVE-2014-8315Oct 16, 2014
SAP
Businessobjects Explorer
risk 0.00cvss —epss 0.02
polestar_xml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 replies with different timing depending on if a connection can be made, which allows remote attackers to conduct port scanning attacks via a host name and port in the cms parameter.
CVE-2014-8314Oct 16, 2014
SAP
Hana
risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in SAP HANA Developer Edition Revision 70 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) epm/admin/DataGen.xsjs or (2) epm/services/multiply.xsjs in the democontent.
CVE-2014-8313Oct 16, 2014
SAP
Hana
risk 0.00cvss —epss 0.02
Eval injection in ide/core/base/server/net.xsjs in the Developer Workbench in SAP HANA allows remote attackers to execute arbitrary XSJX code via unspecified vectors.
CVE-2014-8312Oct 16, 2014
SAP
Netweaver Abap
risk 0.00cvss —epss 0.02
Business Warehouse (BW) in SAP Netweaver AS ABAP 7.31 allows remote authenticated users to obtain sensitive information via a request to the RSDU_CCMS_GET_PROFILE_PARAM RFC function.
CVE-2014-8311Oct 16, 2014
SAP
Businessobjects
risk 0.00cvss —epss 0.02
SAP BusinessObjects Edge 4.0 allows remote attackers to obtain sensitive information via an InfoStore query to a CORBA listener.
CVE-2014-8310Oct 16, 2014
SAP
Businessobjects
risk 0.00cvss —epss 0.03
The CMS CORBA listener in SAP BusinessObjects BI Edge 4.0 allows remote attackers to cause a denial of service (server shutdown) via crafted OSCAFactory::Session ORB message.
CVE-2014-8309Oct 16, 2014
SAP
Businessobjects
risk 0.00cvss —epss 0.02
SAP BusinessObjects 4.0 and BusinessObjects XI (BOXI) R2 and 3.1 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to enumerate valid usernames via SecEnterprise…
CVE-2014-8308Oct 16, 2014
SAP
Businessobjects
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the Send to Inbox functionality in SAP BusinessObjects BI EDGE 4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.