CVE-2014-8516

CVE-2014-8516 concerns Visual Mining NetCharts Server. The connected sources describe an unrestricted file upload vulnerability in the NetCharts Server web interface that allows remote attackers to execute arbitrary code by uploading a file with an executable extension and then accessing it via u...

CVE-2014-8337

CVE-2014-8337 affects HelpDEZk 1.0.1 and earlier due to an unrestricted upload of files with dangerous extensions in /includes/classes/uploadify-v2.1.4/uploadify.php . The vulnerability arises from lack of validation of file extensions, enabling a remote attacker to upload arbitrary files and the...

CVE-2014-5516

Cross-site request forgery CSRF vulnerability in the Storefront Application in DS Data Systems KonaKart before 7.3.0.0 allows remote attackers to hijack the authentication of administrators for requests that change a user email address via an unspecified GET request...

CVE-2014-5516

KonaKart Storefront Application (DS Data Systems) prior to 7.3.0.0 is vulnerable to CSRF protection bypass that allows an attacker to hijack an administrator’s session by issuing a manipulated GET request to change a user email address. The issue is documented in CVE-2014-5516, with a remediation...

CVE-2014-5140

CVE-2014-5140 affects Loaded Commerce 7. The vulnerability is in the bindReplace function of the query factory (includes/classes/database.php), which does not properly handle colon characters. This enables SQL injection via the First name and Last name fields in the address book when used by remo...

CVE-2014-10398

The CVE-2014-10398 entry describes multiple XSS vulnerabilities in Bank Soft Systems (BSS) RBS BS-Client’s bsi.dll (Private Client/ Retail Client, versions 2.5, 2.4 and earlier). The issue allows remote attackers to inject arbitrary script/HTML via parameters DICTIONARY, FILTERIDENT, FROMSCHEME, ...

CVE-2014-4196

The CVE-2014-4196 entry describes an XSS vulnerability in Bank Soft Systems (BSS) RBS BS-Client 3.17.9, exploitable via the colorstyle parameter in bsi.dll. The impact is as described by the NVD entry; no exploit code or in-the-wild details are provided in the connected documents. Remediation det...

CVE-2014-8182

CVE-2014-8182 concerns OpenLDAP 2.4 slapd when processing DNS SRV messages. An off-by-one error can cause a crash if the dnssrv backend is used, allowing a remote attacker to crash the service with crafted DNS responses. The available connected sources confirm the affected software (OpenLDAP 2.4/...

CVE-2014-6275

CVE-2014-6275 affects FusionForge prior to version 5.3.2. The vulnerability arises because FusionForge uses scripts that run under the shared Apache user, which is also used by project homepages by default. When project webpages reside on the same server as FusionForge, this can allow users to ac...

CVE-2014-0048

creationtimestamp| type| source ---|---|--- 2020-01-02 20:49:14+00:00| seen| https://t.me/cibsecurity/8951...

CVE-2014-0104

creationtimestamp| type| source ---|---|--- 2020-01-02 20:49:13+00:00| seen| https://t.me/cibsecurity/8950...

CVE-2014-3590

Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content...

CVE-2014-0169

In JBoss EAP 6 a security domain is configured to use a cache that is shared between all applications that are in the security domain. This could allow an authenticated user in one application to access protected resources in another application without proper authorization. Although this is an...

CVE-2014-0011

Multiple heap-based buffer overflows in the ZRLEDECODE function in common/rfb/zrleDecode.h in TigerVNC before 1.3.1, when NDEBUG is enabled, allow remote VNC servers to cause a denial of service vncviewer crash and possibly execute arbitrary code via vectors related to screen image rendering...

CVE-2014-0245

The CVE-2014-0245 issue affects GateIn WSRP’s GTNSubjectCreatingInterceptor in gatein-wsrp, where non-thread-safe handling under high concurrency can allow an unauthenticated remote attacker to disclose privileged information when WS-Security is enabled for the WSRP Consumer, for a specific endpo...

CVE-2014-0011

TigerVNC versions prior to 1.3.1 are affected by CVE-2014-0011 due to multiple heap-based buffer overflows in the ZRLE_DECODE function (common/rfb/zrleDecode.h). When NDEBUG is enabled, a remote VNC server could crash the vncviewer and potentially execute arbitrary code via image-rendering vector...

CVE-2014-0011

Multiple heap-based buffer overflows in the ZRLEDECODE function in common/rfb/zrleDecode.h in TigerVNC before 1.3.1, when NDEBUG is enabled, allow remote VNC servers to cause a denial of service vncviewer crash and possibly execute arbitrary code via vectors related to screen image rendering...

CVE-2014-0169

CVE-2014-0169 affects JBoss EAP 6: a security domain uses a cache shared across all applications in the domain, enabling an authenticated user from one application to access resources in another without proper authorization. Root cause cited as lack of clear documentation on cache isolation betwe...

CVE-2014-4553

CVE-2014-4553 concerns Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin for WordPress (2014). The vulnerability is described as allowing remote attackers to execute arbitrary web script or HTML via unspecified parameters. The connected documents confirm the affected ...

CVE-2014-0161

ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name CN or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an...