CVEs

391,070 total · page 6532 of 7,822

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2014-4765	IBM Maximo Asset Management	0.00	—	0.01	Oct 2, 2014	IBM Maximo Asset Management 7.1 through 7.1.1.13 and 7.5 through 7.5.0.6, Maximo Asset Management 7.5.0 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, and Maximo Asset Management 7.1 and 7.2 for Tivoli IT Asset Management for IT and certain other products…
CVE-2014-3097	IBM Tivoli Federated Identity Manager	0.00	—	0.03	Oct 2, 2014	Open redirect vulnerability in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0-TIV-TFIM-IF0015, 6.2.1 before 6.2.1-TIV-TFIM-IF0007, and 6.2.2 before 6.2.2-TIV-TFIM-IF0011 allows remote attackers to redirect users to arbitrary web sites and conduct phishing…
CVE-2014-3060	IBM Websphere Datapower Xc10 Appliance	0.00	—	0.02	Oct 2, 2014	Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network and capturing a session cookie.
CVE-2014-3059	IBM Websphere Datapower Xc10 Appliance	0.00	—	0.02	Oct 2, 2014	Unspecified vulnerability in the Administrative Console on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network.
CVE-2014-2642	Microfocus System Management Homepage	0.00	—	0.02	Oct 2, 2014	HP System Management Homepage (SMH) before 7.4 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
CVE-2014-2641	Microfocus System Management Homepage	0.00	—	0.01	Oct 2, 2014	Cross-site request forgery (CSRF) vulnerability in HP System Management Homepage (SMH) before 7.4 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
CVE-2014-2640	Microfocus System Management Homepage	0.00	—	0.04	Oct 2, 2014	Cross-site scripting (XSS) vulnerability in HP System Management Homepage (SMH) before 7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-0811	Postfix Postfix	0.00	—	0.02	Oct 1, 2014	Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used…
CVE-2011-4624	Codeasily Grand Flagallery	0.00	—	0.07	Oct 1, 2014	Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.
CVE-2003-1598	WordPress WordPress	0.00	—	0.03	Oct 1, 2014	SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable.
CVE-2014-6855	Imop Long	0.00	—	0.00	Oct 1, 2014	The Long (aka com.imop.longjiang.android) application 1.0.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6854	Eyexam Eyexam	0.00	—	0.00	Oct 1, 2014	The EyeXam (aka com.globaleyeventures.eyexam) application 1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6853	Foxitsoftware MobilePDF	0.00	—	0.00	Oct 1, 2014	The Foxit MobilePDF - PDF Reader (aka com.foxit.mobile.pdf.lite) application 2.2.0.0616 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6852	Automon Ledline.gr Official	0.00	—	0.00	Oct 1, 2014	The LedLine.gr Official (aka com.automon.ledline.gr) application 1.4.0.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6851	New Beginnings CFC New Beginnings CFC	0.00	—	0.00	Oct 1, 2014	The New Beginnings CFC (aka com.goodbarber.nbcfc) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-3395	Cisco Systems, Inc. Webex Meetings Server	0.00	—	0.02	Sep 30, 2014	Cisco WebEx Meetings Server (WMS) 2.5 allows remote attackers to trigger the download of arbitrary files via a crafted URL, aka Bug ID CSCup10343.
CVE-2014-6850	Starkvilleelectric Sed Account	0.00	—	0.00	Sep 30, 2014	The SED Account (aka com.starkville.smartapps) application 1.153.0034 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6848	Synology Ds File	0.00	—	0.00	Sep 30, 2014	The DS file (aka com.synology.DSfile) application 4.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6847	Horoscopesanddreams Horoscopes And Dreams	0.00	—	0.00	Sep 30, 2014	The Horoscopes and Dreams (aka com.horoscopesanddreams) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6846	Intelitycorp Four Seasons Beverly Hills	0.00	—	0.00	Sep 30, 2014	The Four Seasons Beverly Hills (aka com.intelitycorp.FourSeasons.android.ice) application @7F050007 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted…
CVE-2014-6845	Mediafire Mediafire	0.00	—	0.00	Sep 30, 2014	The MediaFire (aka com.mediafire.android) application 1.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6844	Tabtale Abc Song	0.00	—	0.00	Sep 30, 2014	The ABC Song (aka com.tabtale.abcsingalong) application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6843	Orderingapps Sweatshop	0.00	—	0.00	Sep 30, 2014	The Sweatshop (aka com.orderingapps.sweatshop) application 2.96 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6842	Gannett Daily Advertiser Print	0.00	—	0.00	Sep 30, 2014	The Daily Advertiser Print (aka com.lafayettedailyadv.android.prod) application 6.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6841	Rtiindia Rti India	0.00	—	0.00	Sep 30, 2014	The RTI INDIA (aka com.vbulletin.build_890) application 3.8.21 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6840	Weddingselections My Wedding Planner	0.00	—	0.00	Sep 30, 2014	The My Wedding Planner (aka app.wedding) application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6839	Alma Corinthiana Alma Corinthiana	0.00	—	0.00	Sep 30, 2014	The Alma Corinthiana (aka com.alma.corinthiana) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6838	Groupama Groupama toujours la	0.00	—	0.00	Sep 30, 2014	The Groupama toujours la (aka com.groupama.toujoursla) application 1.3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6837	Hillside Project Hillside	0.00	—	0.00	Sep 30, 2014	The Hillside (aka com.hillside.hermanus) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-7190	Openfiler Openfiler	0.03	—	0.02	Sep 30, 2014	Multiple cross-site request forgery (CSRF) vulnerabilities in Openfiler 2.99.1 allow remote attackers to hijack the authentication of administrators for requests that (1) shutdown or (2) reboot the server via a request to admin/system_shutdown.html.
CVE-2014-6619	Restaurantmis Restaurant Script	0.03	—	0.03	Sep 30, 2014	Multiple cross-site scripting (XSS) vulnerabilities in register-exec.php in Restaurant Script (PizzaInn_Project) 1.0.0 allow remote attackers to inject arbitrary web script or HTML via the (1) fname, (2) lname, or (3) login parameter.
CVE-2014-6618	Your Online Shop Project Your Online Shop	0.00	—	0.02	Sep 30, 2014	Cross-site scripting (XSS) vulnerability in Your Online Shop allows remote attackers to inject arbitrary web script or HTML via the products_id parameter.
CVE-2014-6055	Libvncserver Libvncserver	0.00	—	0.08	Sep 30, 2014	Multiple stack-based buffer overflows in the File Transfer feature in rfbserver.c in LibVNCServer 0.9.9 and earlier allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a (1) long file or (2) directory name or the (3)…
CVE-2014-6051	Libvncserver Libvncserver	0.00	—	0.08	Sep 30, 2014	Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer…
CVE-2014-4728	TP-Link Tl Wdr4300 Firmware	0.00	—	0.02	Sep 30, 2014	The web server in the TP-LINK N750 Wireless Dual Band Gigabit Router (TL-WDR4300) with firmware before 140916 allows remote attackers to cause a denial of service (crash) via a long header in a GET request.
CVE-2014-4727	TP-Link Tl Wdr4300 Firmware	0.00	—	0.02	Sep 30, 2014	Cross-site scripting (XSS) vulnerability in the DHCP clients page in the TP-LINK N750 Wireless Dual Band Gigabit Router (TL-WDR4300) with firmware before 140916 allows remote attackers to inject arbitrary web script or HTML via the hostname in a DHCP request.
CVE-2014-4330	Perl Foundation Perl	0.00	—	0.01	Sep 30, 2014	The Dumper method in Data::Dumper before 2.154, as used in Perl 5.20.1 and earlier, allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an Array-Reference with many nested Array-References, which triggers a large number of recursive…
CVE-2014-7199	MediaWiki Mediawiki	0.00	—	0.02	Sep 30, 2014	Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.19, 1.22.x before 1.22.11, and 1.23.x before 1.23.4 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file.
CVE-2014-6273	Debian Advanced Package Tool	0.00	—	0.02	Sep 30, 2014	Buffer overflow in the HTTP transport code in apt-get in APT 1.0.1 and earlier allows man-in-the-middle attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted URL.
CVE-2014-6269	Haproxy Haproxy	0.00	—	0.04	Sep 30, 2014	Multiple integer overflows in the http_request_forward_body function in proto_http.c in HAProxy 1.5-dev23 before 1.5.4 allow remote attackers to cause a denial of service (crash) via a large stream of data, which triggers a buffer overflow and an out-of-bounds read.
CVE-2014-5444	Yorba Geary	0.00	—	0.01	Sep 30, 2014	Geary before 0.6.3 does not present the user with a warning when a TLS certificate error is detected, which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted certificate.
CVE-2014-5267	Drupal Drupal	0.00	—	0.04	Sep 30, 2014	modules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31 allows remote attackers to have unspecified impact via a crafted DOCTYPE declaration in an XRDS document.
CVE-2014-3558	Red Hat Hibernate Validator	0.00	—	0.03	Sep 30, 2014	ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager (JSM) restrictions and execute restricted reflection calls via a crafted…
CVE-2014-0170	JBoss Teiid	0.00	—	0.02	Sep 30, 2014	Teiid before 8.4.3 and before 8.7 and Red Hat JBoss Data Virtualization 6.0.0 before patch 3 allows remote attackers to read arbitrary files via a crafted request to a REST endpoint, related to an XML External Entity (XXE) issue.
CVE-2012-6316	TP-Link Tl Wr841n	0.00	—	0.01	Sep 30, 2014	Multiple cross-site scripting (XSS) vulnerabilities in the TP-LINK TL-WR841N router with firmware 3.13.9 Build 120201 Rel.54965n and earlier allow remote administrators to inject arbitrary web script or HTML via the (1) username or (2) pwd parameter to userRpm/NoipDdnsRpm.htm.
CVE-2012-5507	Zope Zope	0.00	—	0.01	Sep 30, 2014	AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.
CVE-2012-5506	Plone (software) Plone	0.00	—	0.02	Sep 30, 2014	python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (infinite loop) via an RSS feed request for a folder the user does not have permission to access.
CVE-2012-5505	Plone (software) Plone	0.00	—	0.01	Sep 30, 2014	atat.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a request for a view without a name.
CVE-2012-5504	Plone (software) Plone	0.00	—	0.01	Sep 30, 2014	Cross-site scripting (XSS) vulnerability in widget_traversal.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-5503	Plone (software) Plone	0.00	—	0.02	Sep 30, 2014	ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors.

CVE-2014-4765Oct 2, 2014
IBM
Maximo Asset Management
risk 0.00cvss —epss 0.01
IBM Maximo Asset Management 7.1 through 7.1.1.13 and 7.5 through 7.5.0.6, Maximo Asset Management 7.5.0 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, and Maximo Asset Management 7.1 and 7.2 for Tivoli IT Asset Management for IT and certain other products…
CVE-2014-3097Oct 2, 2014
IBM
Tivoli Federated Identity Manager
risk 0.00cvss —epss 0.03
Open redirect vulnerability in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0-TIV-TFIM-IF0015, 6.2.1 before 6.2.1-TIV-TFIM-IF0007, and 6.2.2 before 6.2.2-TIV-TFIM-IF0011 allows remote attackers to redirect users to arbitrary web sites and conduct phishing…
CVE-2014-3060Oct 2, 2014
IBM
Websphere Datapower Xc10 Appliance
risk 0.00cvss —epss 0.02
Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network and capturing a session cookie.
CVE-2014-3059Oct 2, 2014
IBM
Websphere Datapower Xc10 Appliance
risk 0.00cvss —epss 0.02
Unspecified vulnerability in the Administrative Console on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network.
CVE-2014-2642Oct 2, 2014
Microfocus
System Management Homepage
risk 0.00cvss —epss 0.02
HP System Management Homepage (SMH) before 7.4 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
CVE-2014-2641Oct 2, 2014
Microfocus
System Management Homepage
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in HP System Management Homepage (SMH) before 7.4 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
CVE-2014-2640Oct 2, 2014
Microfocus
System Management Homepage
risk 0.00cvss —epss 0.04
Cross-site scripting (XSS) vulnerability in HP System Management Homepage (SMH) before 7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-0811Oct 1, 2014
Postfix
Postfix
risk 0.00cvss —epss 0.02
Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used…
CVE-2011-4624Oct 1, 2014
Codeasily
Grand Flagallery
risk 0.00cvss —epss 0.07
Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.
CVE-2003-1598Oct 1, 2014
WordPress
WordPress
risk 0.00cvss —epss 0.03
SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable.
CVE-2014-6855Oct 1, 2014
Imop
Long
risk 0.00cvss —epss 0.00
The Long (aka com.imop.longjiang.android) application 1.0.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6854Oct 1, 2014
Eyexam
Eyexam
risk 0.00cvss —epss 0.00
The EyeXam (aka com.globaleyeventures.eyexam) application 1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6853Oct 1, 2014
Foxitsoftware
MobilePDF
risk 0.00cvss —epss 0.00
The Foxit MobilePDF - PDF Reader (aka com.foxit.mobile.pdf.lite) application 2.2.0.0616 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6852Oct 1, 2014
Automon
Ledline.gr Official
risk 0.00cvss —epss 0.00
The LedLine.gr Official (aka com.automon.ledline.gr) application 1.4.0.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6851Oct 1, 2014
New Beginnings CFC
New Beginnings CFC
risk 0.00cvss —epss 0.00
The New Beginnings CFC (aka com.goodbarber.nbcfc) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-3395Sep 30, 2014
Cisco Systems, Inc.
Webex Meetings Server
risk 0.00cvss —epss 0.02
Cisco WebEx Meetings Server (WMS) 2.5 allows remote attackers to trigger the download of arbitrary files via a crafted URL, aka Bug ID CSCup10343.
CVE-2014-6850Sep 30, 2014
Starkvilleelectric
Sed Account
risk 0.00cvss —epss 0.00
The SED Account (aka com.starkville.smartapps) application 1.153.0034 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6848Sep 30, 2014
Synology
Ds File
risk 0.00cvss —epss 0.00
The DS file (aka com.synology.DSfile) application 4.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6847Sep 30, 2014
Horoscopesanddreams
Horoscopes And Dreams
risk 0.00cvss —epss 0.00
The Horoscopes and Dreams (aka com.horoscopesanddreams) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6846Sep 30, 2014
Intelitycorp
Four Seasons Beverly Hills
risk 0.00cvss —epss 0.00
The Four Seasons Beverly Hills (aka com.intelitycorp.FourSeasons.android.ice) application @7F050007 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted…
CVE-2014-6845Sep 30, 2014
Mediafire
Mediafire
risk 0.00cvss —epss 0.00
The MediaFire (aka com.mediafire.android) application 1.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6844Sep 30, 2014
Tabtale
Abc Song
risk 0.00cvss —epss 0.00
The ABC Song (aka com.tabtale.abcsingalong) application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6843Sep 30, 2014
Orderingapps
Sweatshop
risk 0.00cvss —epss 0.00
The Sweatshop (aka com.orderingapps.sweatshop) application 2.96 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6842Sep 30, 2014
Gannett
Daily Advertiser Print
risk 0.00cvss —epss 0.00
The Daily Advertiser Print (aka com.lafayettedailyadv.android.prod) application 6.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6841Sep 30, 2014
Rtiindia
Rti India
risk 0.00cvss —epss 0.00
The RTI INDIA (aka com.vbulletin.build_890) application 3.8.21 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6840Sep 30, 2014
Weddingselections
My Wedding Planner
risk 0.00cvss —epss 0.00
The My Wedding Planner (aka app.wedding) application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6839Sep 30, 2014
Alma Corinthiana
Alma Corinthiana
risk 0.00cvss —epss 0.00
The Alma Corinthiana (aka com.alma.corinthiana) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6838Sep 30, 2014
Groupama
Groupama toujours la
risk 0.00cvss —epss 0.00
The Groupama toujours la (aka com.groupama.toujoursla) application 1.3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6837Sep 30, 2014
Hillside Project
Hillside
risk 0.00cvss —epss 0.00
The Hillside (aka com.hillside.hermanus) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-7190Sep 30, 2014
Openfiler
Openfiler
risk 0.03cvss —epss 0.02
Multiple cross-site request forgery (CSRF) vulnerabilities in Openfiler 2.99.1 allow remote attackers to hijack the authentication of administrators for requests that (1) shutdown or (2) reboot the server via a request to admin/system_shutdown.html.
CVE-2014-6619Sep 30, 2014
Restaurantmis
Restaurant Script
risk 0.03cvss —epss 0.03
Multiple cross-site scripting (XSS) vulnerabilities in register-exec.php in Restaurant Script (PizzaInn_Project) 1.0.0 allow remote attackers to inject arbitrary web script or HTML via the (1) fname, (2) lname, or (3) login parameter.
CVE-2014-6618Sep 30, 2014
Your Online Shop Project
Your Online Shop
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in Your Online Shop allows remote attackers to inject arbitrary web script or HTML via the products_id parameter.
CVE-2014-6055Sep 30, 2014
Libvncserver
Libvncserver
risk 0.00cvss —epss 0.08
Multiple stack-based buffer overflows in the File Transfer feature in rfbserver.c in LibVNCServer 0.9.9 and earlier allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a (1) long file or (2) directory name or the (3)…
CVE-2014-6051Sep 30, 2014
Libvncserver
Libvncserver
risk 0.00cvss —epss 0.08
Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer…
CVE-2014-4728Sep 30, 2014
TP-Link
Tl Wdr4300 Firmware
risk 0.00cvss —epss 0.02
The web server in the TP-LINK N750 Wireless Dual Band Gigabit Router (TL-WDR4300) with firmware before 140916 allows remote attackers to cause a denial of service (crash) via a long header in a GET request.
CVE-2014-4727Sep 30, 2014
TP-Link
Tl Wdr4300 Firmware
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the DHCP clients page in the TP-LINK N750 Wireless Dual Band Gigabit Router (TL-WDR4300) with firmware before 140916 allows remote attackers to inject arbitrary web script or HTML via the hostname in a DHCP request.
CVE-2014-4330Sep 30, 2014
Perl Foundation
Perl
risk 0.00cvss —epss 0.01
The Dumper method in Data::Dumper before 2.154, as used in Perl 5.20.1 and earlier, allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an Array-Reference with many nested Array-References, which triggers a large number of recursive…
CVE-2014-7199Sep 30, 2014
MediaWiki
Mediawiki
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.19, 1.22.x before 1.22.11, and 1.23.x before 1.23.4 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file.
CVE-2014-6273Sep 30, 2014
Debian
Advanced Package Tool
risk 0.00cvss —epss 0.02
Buffer overflow in the HTTP transport code in apt-get in APT 1.0.1 and earlier allows man-in-the-middle attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted URL.
CVE-2014-6269Sep 30, 2014
Haproxy
Haproxy
risk 0.00cvss —epss 0.04
Multiple integer overflows in the http_request_forward_body function in proto_http.c in HAProxy 1.5-dev23 before 1.5.4 allow remote attackers to cause a denial of service (crash) via a large stream of data, which triggers a buffer overflow and an out-of-bounds read.
CVE-2014-5444Sep 30, 2014
Yorba
Geary
risk 0.00cvss —epss 0.01
Geary before 0.6.3 does not present the user with a warning when a TLS certificate error is detected, which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted certificate.
CVE-2014-5267Sep 30, 2014
Drupal
Drupal
risk 0.00cvss —epss 0.04
modules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31 allows remote attackers to have unspecified impact via a crafted DOCTYPE declaration in an XRDS document.
CVE-2014-3558Sep 30, 2014
Red Hat
Hibernate Validator
risk 0.00cvss —epss 0.03
ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager (JSM) restrictions and execute restricted reflection calls via a crafted…
CVE-2014-0170Sep 30, 2014
JBoss
Teiid
risk 0.00cvss —epss 0.02
Teiid before 8.4.3 and before 8.7 and Red Hat JBoss Data Virtualization 6.0.0 before patch 3 allows remote attackers to read arbitrary files via a crafted request to a REST endpoint, related to an XML External Entity (XXE) issue.
CVE-2012-6316Sep 30, 2014
TP-Link
Tl Wr841n
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in the TP-LINK TL-WR841N router with firmware 3.13.9 Build 120201 Rel.54965n and earlier allow remote administrators to inject arbitrary web script or HTML via the (1) username or (2) pwd parameter to userRpm/NoipDdnsRpm.htm.
CVE-2012-5507Sep 30, 2014
Zope
Zope
risk 0.00cvss —epss 0.01
AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.
CVE-2012-5506Sep 30, 2014
Plone (software)
Plone
risk 0.00cvss —epss 0.02
python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (infinite loop) via an RSS feed request for a folder the user does not have permission to access.
CVE-2012-5505Sep 30, 2014
Plone (software)
Plone
risk 0.00cvss —epss 0.01
atat.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a request for a view without a name.
CVE-2012-5504Sep 30, 2014
Plone (software)
Plone
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in widget_traversal.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-5503Sep 30, 2014
Plone (software)
Plone
risk 0.00cvss —epss 0.02
ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors.