CVE-2014-3622

creationtimestamp| type| source ---|---|--- 2020-02-19 16:52:08+00:00| seen| https://t.me/cibsecurity/9926...

CVE-2014-2228

The XStream extension in HP Fortify SCA before 2.2 RC3 allows remote attackers to execute arbitrary code via unsafe deserialization of XML messages...

CVE-2014-2727

The STARTTLS implementation in MailMarshal before 7.2 allows plaintext command injection...

CVE-2014-2727

The STARTTLS implementation in MailMarshal before 7.2 allows plaintext command injection...

CVE-2014-2727

The CVE-2014-2727 issue affects MailMarshal’s STARTTLS before version 7.2, enabling plaintext command injection via the STARTTLS implementation. Public sources identify this as a network‑vector vulnerability with high impact and a high score (NVD CVSS v2/v3). The root cause is the STARTTLS handli...

CVE-2014-2228

The CVE-2014-2228 issue affects the XStream extension in HP Fortify SCA prior to version 2.2 RC3, where unsafe deserialization of XML messages allows remote attackers to execute arbitrary code. The affected component is the XStream extension, with the root cause described as unsafe XML deserializ...

CVE-2014-3622

CVE-2014-3622 describes a use-after-free in PHP 5.6.x prior to 5.6.1 affecting the Posthandler component (add_post_var). The underlying issue could let remote attackers execute arbitrary code through a third-party filter extension that accesses a specific ksep value. Practical impact is remote co...

CVE-2014-3622

Use-after-free vulnerability in the addpostvar function in the Posthandler component in PHP 5.6.x before 5.6.1 might allow remote attackers to execute arbitrary code by leveraging a third-party filter extension that accesses a certain ksep value...

CVE-2014-3879

CVE-2014-3879 affects OpenPAM in FreeBSD’s PAM policy parser. When an include directive references a non-existent policy, the library may keep a partially loaded configuration, enabling a context-dependent bypass of authentication (login without a password or with an incorrect one). Affected: Ope...

CVE-2014-3879

OpenPAM Nummularia 9.2 through 10.0 does not properly handle the error reported when an include directive refers to a policy that does not exist, which causes the loaded policy chain to no be discarded and allows context-dependent attackers to bypass authentication via a login 1 without a passwor...

DEBIAN-CVE-2014-4966

Ansible before 1.6.7 does not prevent inventory data with "" and "lookup" substrings, and does not prevent remote data with "" substrings, which allows remote attackers to execute arbitrary code via 1 crafted lookup'pipe' calls or 2 crafted Jinja2 data...

CVE-2014-4966

Ansible before 1.6.7 does not prevent inventory data with "" and "lookup" substrings, and does not prevent remote data with "" substrings, which allows remote attackers to execute arbitrary code via 1 crafted lookup'pipe' calls or 2 crafted Jinja2 data...

CVE-2014-4967

Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as demonstrated by a fact with 1 a trailing " src=" clause, 2 a trailing " temp=" clause, or 3 a...

CVE-2014-4967

Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as demonstrated by a fact with 1 a trailing " src=" clause, 2 a trailing " temp=" clause, or 3 a...

CVE-2014-4967

CVE-2014-4967 affects Ansible up to version 1.6.7, enabling remote code execution via crafted facts (trailing src=, temp=, or validate= clauses). Root cause: argument injection in facts processed by Ansible. Impact: remote code execution with code or shell commands executed on the managed host. R...

CVE-2014-4966

Ansible before 1.6.7 does not prevent inventory data with "" and "lookup" substrings, and does not prevent remote data with "" substrings, which allows remote attackers to execute arbitrary code via 1 crafted lookup'pipe' calls or 2 crafted Jinja2 data...

CVE-2014-4966

Ansible before 1.6.7 does not prevent inventory data with "" and "lookup" substrings, and does not prevent remote data with "" substrings, which allows remote attackers to execute arbitrary code via 1 crafted lookup'pipe' calls or 2 crafted Jinja2 data...

CVE-2014-4966

CVE-2014-4966 affects Ansible before 1.6.7: it allows remote code execution via crafted inventory data or remote data that contain Jinja2 substrings (e.g., lookup('pipe')). The root cause is inadequate sanitization of {{ and lookup substrings in inventory/remote data, enabling arbitrary code exec...

CVE-2014-4981

LPAR2RRD in 3.5 and earlier allows remote attackers to execute arbitrary commands due to insufficient input sanitization of the web GUI parameters...

CVE-2014-8089

SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte...