CVE-2014-1409

MobileIron VSP before 5.9.1 and Sentry before 5.0 are affected by an authentication bypass via an XML file containing obfuscated passwords. The root cause is improper filtering of the j_username parameter in /mics/j_spring_security_check, enabling blind XPath injection to read XML config data. Ex...

CVE-2014-9908

CVE-2014-9908 corresponds to a Denial of Service vulnerability in Google Android affecting Android 4.4.4, 5.0.2, and 5.1.1. According to the description, a malicious actor could block Bluetooth access on the device (Android Bug ID A-28672558). The connected sources list the affected software vers...

CVE-2014-1598

centurystar 7.12 ActiveX Control has a Stack Buffer Overflow...

CVE-2014-1598

centurystar 7.12 ActiveX Control has a Stack Buffer Overflow...

CVE-2014-1598

The CVE-2014-1598 entry concerns the CenturyStar 7.12 ActiveX Control and is documented as a Stack Buffer Overflow vulnerability. The connected sources confirm the affected component (CenturyStar 7.12 ActiveX Control) and describe the root cause as a stack-based overflow. According to the NVD ent...

CVE-2014-5209

An Information Disclosure vulnerability exists in NTP 4.2.7p25 private mode 6/7 messages via a GETRESTRICT control message, which could let a malicious user obtain sensitive information...

CVE-2014-5209

The CVE-2014-5209 issue affects NTP 4.2.7p25 private (mode 6/7) messages via GET_RESTRICT, enabling information disclosure of sensitive data. Impact is limited to partial confidentiality; no exploit details are provided in the sources. No patched version is listed in the initial docs; a practical...

CVE-2014-8673

Multiple SQL vulnerabilities exist in planning.php, userlist.php, projets.php, usergroupes.php, and groupelist.php in Simple Online Planning SOPPlanningbefore 1.33...

CVE-2014-8673

SOPPlanning (Simple Online Planning) is affected by CVE-2014-8673 before v1.33. Multiple SQL injection vulnerabilities exist in planning.php, user_list.php, projets.php, user_groupes.php, and groupe_list.php due to insufficient input sanitization and unsafe SQL construction. Red‑team/Exploit refe...

CVE-2014-8674

Multiple Cross-Site Scripting XSS vulnerabilities exist in Simple Online Planning SOPlanning before 1.33 via the document.cookie in nbmois and mbligness and the debug GET parameter to export.php, which allows malicious users to execute arbitrary code...

CVE-2014-8674

SOPlanning (Simple Online Planning) is affected by multiple vulnerabilities in versions prior to 1.33. The CVE entries describe cross-site scripting via document.cookie in nb_mois and mb_ligness and through a debug GET parameter to export.php, enabling arbitrary code execution under XSS condition...

CVE-2014-9405

CVE-2014-9405 is an XSS in Freebox OS Web interface 3.0.2. The vulnerability is in the description field of a Download RSS item or Contacts, allowing injected script when a user views the feed or imported VCARD content. Root cause: insufficient input filtering in the web interface; impact describ...

CVE-2014-3743

Multiple cross-site scripting XSS vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 gfm codeblocks language or 2 javascript url's...

CVE-2014-3743

Multiple cross-site scripting XSS vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 gfm codeblocks language or 2 javascript url's. sanitize: true Even if this option is set, marked is vulnerable to...

CVE-2014-1850

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-3743. Reason: This candidate is a duplicate of CVE-2014-3743. Notes: All CVE users should reference CVE-2014-3743 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-3743. Reason: This candidate is a duplicate of CVE-2014-3743. Notes: All CVE users should reference CVE-2014-3743 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

UBUNTU-CVE-2014-1850

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-3743. Reason: This candidate is a duplicate of CVE-2014-3743. Notes: All CVE users should reference CVE-2014-3743 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usag...

CVE-2014-3743

CVE-2014-3743 affects the Node.js Marked module (before 0.3.1). The vulnerability is due to cross-site scripting in two vectors: gfm codeblocks (language) and javascript: URLs, allowing remote attackers to inject arbitrary script/HTML. The OSV and NVD records corroborate XSS in Marked prior to 0....

CVE-2014-1850

CVE-2014-1850 is rejected; reference CVE-2014-3743 as the valid entry.

CVE-2014-10398

Multiple cross-site scripting XSS vulnerabilities in bsi.dll in Bank Soft Systems BSS RBS BS-Client. Private Client aka RBS BS-Client. Retail Client 2.5, 2.4, and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 DICTIONARY, 2 FILTERIDENT, 3 FROMSCHEME, 4 FromPoint, ...