33558 matches found
CVE-2014-3875
The addto parameter to fup in Frams' Fast File EXchange FEX, aka fex before fex-2014053 allows remote attackers to conduct cross-site scripting XSS attacks...
CVE-2014-3875
The CVE-2014-3875 entry documents a cross-site scripting (XSS) vulnerability in Frams’ Fast File Exchange (F*EX, fex) prior to fex-2014053, where the addto parameter of fup can be exploited to inject HTML/headers. Debian DLA-68-1 confirms this issue and lists fixes for the fex package (versions a...
[SECURITY] [DLA 2010-1] bsdiff security update
Package : bsdiff Version : 4.3-15+deb8u1 CVE ID : CVE-2014-9862 An issue in bsdiff, a tool to generate/apply a patch between two binary files, has been found. Using a crafted patch file an integer signedness error in bspatch could be used for a heap based buffer overflow and possibly execution of...
CVE-2014-6311
generatedoygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp directory which allows attackers to gain elevated privileges...
CVE-2014-6311
generatedoygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp directory which allows attackers to gain elevated privileges...
CVE-2014-6311
generatedoygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp directory which allows attackers to gain elevated privileges...
CVE-2014-2214
POSH (Posh portal / Portaneo) 3.0–3.2.1 suffers XSS vulnerabilities that allow remote attackers to inject arbitrary scripts/HTML via the login.php error parameter or portal/openrssarticle.php id parameter. Affected versions, entry CVE-2014-2214, are described in NVD with CVSS metrics (2.0: 4.3, M...
CVE-2014-2213
CVE-2014-2213 : Open redirect vulnerability in POSH 3.0–3.2.1’s password reset functionality. An attacker can craft a redirect parameter to portal/scr_sendmd5.php to send users to arbitrary sites, enabling phishing. No exploitation details are provided in the documents; remediation/patch details ...
CVE-2014-1238
This CVE (CVE-2014-1238) is a Cross-Site Scripting (XSS) in Gael/Q-Pulse 0.6 and earlier, affecting the UI path ui/common/managedlistdialog.aspx. The vulnerability arises from unvalidated input being inserted into a JavaScript variable named $RootTree, exploitable via a crafted URL (e.g., LookupL...
CVE-2014-6311
generatedoygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp directory which allows attackers to gain elevated privileges...
CVE-2014-6311
generatedoygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp directory which allows attackers to gain elevated privileges...
CVE-2014-6311
The CVE-2014-6311 entry describes a privilege-escalation flaw in ace prior to 6.2.7+dfsg-2 where generate_doygen.pl creates predictable file names in /tmp. The documented impact is elevated privileges for attackers who can leverage these predictable names. Affected component: ace (script generate...
CVE-2014-6310
CVE-2014-6310 describes a buffer overflow in CHICKEN (versions 4.9.0 and 4.9.0.1) that may allow remote attackers to execute arbitrary code via the 'select' function. The connected documents confirm the affected product and the vulnerable vector, but do not provide specific exploit details, PoCs,...
CVE-2014-3585
The CVE-2014-3585 entry concerns the Red Hat redhat-upgrade-tool, which does not verify GPG signatures when upgrading versions. This is described as enabling potential forgery or MitM-style abuse, with mitigations discussed in multiple sources. The impact is characterized as high (critical/remote...
CVE-2014-5255
xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files. Note: A different vulnerability than CVE-2014-5254...
CVE-2014-5255
xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files. Note: A different vulnerability than CVE-2014-5254...
CVE-2014-2901
wolfssl before 3.2.0 does not properly issue certificates for a server's hostname...
DEBIAN-CVE-2014-2902
wolfssl before 3.2.0 does not properly authorize CA certificate for signing other certificates...