CVE-2014-9470

Cross-site scripting XSS vulnerability in the loadForm function in Frontend/Modules/Search/Actions/Index.php in Fork CMS before 3.8.4 allows remote attackers to inject arbitrary web script or HTML via the qwidget parameter to en/search...

CVE-2014-9470

Fork CMS prior to 3.8.4 is affected by a cross-site scripting (XSS) vulnerability in the loadForm() function (Frontend/Modules/Search/Actions/Index.php) where the q_widget parameter to /en/search can inject arbitrary script/HTML. The issue arises from insufficient input filtering and is exploitab...

CVE-2014-2225

CVE-2014-2225 is a CSRF vulnerability in Ubiquiti Networks UniFi Controller prior to 3.2.1. The flaw enables remote attackers to hijack administrator sessions by issuing forged requests to multiple API endpoints (e.g., api/add/admin, api/set/setting/guest_access, api/cmd/stamgr, api/cmd/cfgmgr, e...

renego.cl Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1087113 Security Researcher geeknik Helped patch 8826 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting renego.cl website and its...

CVE-2014-5091

A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, which could let a malicious user execute arbitrary PHP code...

BELL-CVE-2014-5278 CVE-2014-5278 does not affect BellSoft software

Bulletin has no description...

CVE-2014-5087

Sphider Search Engine prior to version 1.3.6 is vulnerable to remote code execution due to exec() calls in admin/spiderfuncs.php. This CVE (CVE-2014-5087) affects Sphider implementations before 1.3.6 and could let an unauthenticated remote attacker execute arbitrary code, with impact on confident...

CVE-2014-5091

Status2K 2.5 Server Monitoring Software is affected by CVE-2014-5091 via the multies parameter to includes/functions.php, which could allow an attacker to execute arbitrary PHP code. Affected component: the server monitoring software’s PHP code path, specifically includes/functions.php, with the ...

CVE-2014-5091

A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, which could let a malicious user execute arbitrary PHP code...

CVE-2014-5288

A CSRF Vulnerability exists in Kemp Load Master before 7.0-18a via unspecified vectors in administrative pages...

CVE-2014-5278

CVE-2014-5278 describes a vulnerability in Docker prior to 1.2 where container names may collide with and override container IDs. The initial description explicitly states the issue; connected sources reiterate the same vulnerability. No exploit vectors, affected products, or remediation steps ar...

CVE-2014-5288

Kemp Load Master is affected by a CSRF vulnerability (CVE-2014-5288) in the web administrative interface prior to version 7.0-18a. Public writeups and exploit listings (e.g., 7.1.16 era) describe additional issues (RCE, XSS, DoS) in Kemp Load Master, indicating multiple vulnerabilities around the...

CVE-2014-5468

CVE-2014-5468 is a Railo Remote File Include vulnerability affecting Railo 4.2.1 and earlier. A specially crafted request to thumbnail.cfm can cause the server to include a malicious PNG, enabling an attacker to download arbitrary PNGs and, via directory traversal, append ColdFusion markup to the...

CVE-2014-6413

A Cross-site Scripting XSS vulnerability exists in WatchGuard XTM 11.8.3 via the pollname parameter in the firewall/policy script...

CVE-2014-6413

WatchGuard XTM 11.8.3 is affected by CVE-2014-6413, a Cross-site Scripting (XSS) flaw exploitable via the poll_name parameter in the firewall/policy script. Affects the product as described in NVD entries; CVSS base scores: 4.3 (NVD CVSS2) and 6.1 (CVSS3.1) with network attack vector, low attack ...

CVE-2014-7224

CVE-2014-7224 is an Android code‑execution vulnerability affecting versions prior to 4.4.0, tied to the addJavascriptInterface method and the accessibility/accessibilityTraversal objects. A remote attacker could potentially execute arbitrary code; NVD assigns high severity (CVSS v3.1: 8.8, vector...

CVE-2014-9530

CVE-2014-9530 affects nw.js prior to 0.11.3. The vulnerability occurs when calling nw methods from normal frames; the description provides no explicit impact, only that the impact is unspecified. The entry includes CVSS scores (2.0: 7.5 - HIGH; 3.1: 9.8 - CRITICAL) indicating serious severity, wi...

CVE-2014-9530

A vulnerability exists in nw.js before 0.11.3 when calling nw methods from normal frames, which has an unspecified impact...

Code injection

The session.lua library in CGILua 5.1.x uses the same ID for each session, which allows remote attackers to hijack arbitrary sessions. NOTE: this vulnerability was SPLIT from CVE-2014-2875...

Design/Logic Flaw

The session.lua library in CGILua 5.2 alpha 1 and 5.2 alpha 2 uses weak session IDs generated based on OS time, which allows remote attackers to hijack arbitrary sessions via a brute force attack. NOTE: CVE-2014-10399 and CVE-2014-10400 were SPLIT from this ID...