CVE-2014-9154

The Notify module 7.x-1.x before 7.x-1.1 for Drupal does not properly restrict access to 1 new or 2 modified nodes or 3 their fields, which allows remote authenticated users to obtain node titles, teasers, and fields by reading a notification email...

CVE-2014-6275

FusionForge before 5.3.2 use scripts that run under the shared Apache user, which is also used by project homepages by default. If project webpages are hosted on the same server than FusionForge, it can allow users to incorrectly access on-disk private data in FusionForge...

CVE-2014-3447

BSS Continuity CMS 4.2.22640.0 has a Remote Denial Of Service vulnerability...

CVE-2014-9211

ClickDesk version 4.3 and below has persistent cross site scripting...

CVE-2014-10385

The memphis-documents-library plugin before 3.0 for WordPress has XSS via $REQUEST...

CVE-2014-5500

Synacor Zimbra Collaboration before 8.0.8 has XSS...

CVE-2014-9448

Buffer overflow in Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 allows remote attackers to execute arbitrary code or cause a denial of service crash via a long string in a WAX file...

CVE-2014-8942

Lexiglot through 2014-11-20 allows CSRF...

CVE-2014-8522

The MySQL database in McAfee Network Data Loss Prevention NDLP before 9.3 does not require a password, which makes it easier for remote attackers to obtain access...

CVE-2014-8943

Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svnurl parameter...

CVE-2014-5380

Grand MA 300 allows retrieval of the access PIN from sniffed data...

CVE-2014-3963

ownCloud Server before 6.0.1 does not properly check permissions, which allows remote authenticated users to access arbitrary preview pictures via unspecified vectors...

CVE-2014-3787

SAP NetWeaver 7.20 and earlier allows remote attackers to read arbitrary SAP Central User Administration SAP CUA tables via unspecified vectors...

CVE-2014-10384

The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion...

CVE-2014-10075

The karo gem 2.3.8 for Ruby allows Remote command injection via the host field...

CVE-2014-5093

Status2k does not remove the install directory allowing credential reset...

CVE-2014-10376

The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection...

CVE-2014-1860

Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities...

CVE-2014-10389

The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication...

CVE-2014-2850

The network interface configuration page netinterface in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter...