CVE-2014-1858

CVE-2014-1858 affects NumPy’s f2py (init .py) prior to 1.8.1. It allows local users to write to arbitrary files via a symlink attack on a temporary file, potentially enabling file overwrite on the system. This is documented in the CVE record and corroborated by multiple advisories and a GHSA entr...

CVE-2014-1859

1 core/tests/testmemmap.py, 2 core/tests/testmultiarray.py, 3 f2py/f2py2e.py, and 4 lib/tests/testio.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file...

CVE-2014-4972

CVE-2014-4972 concerns the WordPress Gravity Upload Ajax plugin, affected through version 1.1 and earlier. The vulnerability is an unrestricted/arbitrary file upload in the plugin, allowing a remote attacker to upload a file with an executable extension and then access it via a direct request to ...

CVE-2014-5334

FreeNAS before 9.3-M3 has a blank admin password, which allows remote attackers to gain root privileges by leveraging a WebGui login...

CVE-2014-7222

CVE-2014-7222 : Concrete details exist in the connected documents. TeamSpeak Client 3.0.14 and earlier is affected by a buffer overflow in the Chat/Server tab, triggered by crafted data (two backslashes, a digit, another backslash, and a “z” within a series of nested BBCode tags). Root cause is a...

CVE-2014-2071

Aruba ClearPass Policy Manager (CPPM) versions 6.1.x, 6.2.x prior to 6.2.5.61640, and 6.3.x prior to 6.3.0.61712 are affected. When CPPM is configured to use tunneled and non-tunneled EAP methods within a single policy construct, remote authenticated users can escalate privileges by advertising i...

CVE-2014-5509

clipedit in the Clipboard module for Perl allows local users to delete arbitrary files via a symlink attack on /tmp/clipedit$$...

CVE-2014-5071

The CVE describes a SQL injection in the checkPassword function of Microsemi Symmetricom s350i, version 2.70.15. Remote attackers could trigger arbitrary SQL commands via username-related vectors. Connected sources corroborate the affected product (s350i) and version; explicit exploit details, im...

CVE-2014-5509

CVE-2014-5509 affects the Perl Clipboard module: clipedit allows local users to delete arbitrary files via a symlink attack on /tmp/clipedit$$. The issue targets a local-privilege/impact vector with a partial integrity impact and partial availability impact per CVSS data. Exploitation details or ...

CVE-2014-5334

CVE-2014-5334 affects FreeNAS prior to 9.3-M3, where the WebGUI can be accessed with a blank admin password. This allows remote attackers to gain root privileges via the WebGUI login. The description explicitly states the administrator password may be blank, enabling web-based authentication bypa...

CVE-2014-3607

CVE-2014-3607 affects Ldaptive (formerly vt-ldap) and its DefaultHostnameVerifier, which fails to ensure the server hostname matches a domain name in the X.509 certificate’s CN. This allows remote attackers to perform a MITM spoofing attack by using an arbitrary valid certificate. The issue is ob...

CVE-2014-7221

CVE-2014-7221 affects TeamSpeak Client 3.0.14 and earlier. The vulnerability is a denial-of-service caused by a buffer overflow triggered when a user connects to a channel and sends crafted data in the Chat/Server tab containing [img]//http:// substrings, leading to an application crash. Affected...

CVE-2014-5394

CVE-2014-5394 affects Huawei Campus switches (S-series S9300/S9300E/S7700/S9700/S5700/S6700/S5300/S6300/S2300/S2700/S3300/S3700 and related models) where the SSH maintenance terminal can disclose usernames. The underlying issue is information disclosure via SSH responses that allow remote attacke...

CVE-2014-10069

CVE-2014-10069 (Hitron CVE-30360) affects Hitron CVE-30360 devices. The vulnerability arises from a DES key 578A958E3DD933FC shared across installations, allowing attackers to decrypt a backup configuration file (evidenced by a password hash in um_auth_account_password). CVSS metrics: CVSS2 base ...

Debian: Security Advisory (DLA-833-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2014-8579

TRENDnet TEW-823DRU devices running firmware before 1.00b36 are affected by a hardcoded root password (kcodeskcodes), which enables remote attackers to gain root access via FTP. Affected product: TRENDnet TEW-823DRU router. Root cause: hardcoded credential in firmware. Impact: unauthenticated rem...

CVE-2014-8335

The CVE-2014-8335 entry relates to the WP-DBManager (aka Database Manager) WordPress plugin, affected in versions prior to 2.7.2. The vulnerability affects the files wp-dbmanager.php and database-manage.php, where credentials are placed on the mysqldump command line, enabling local users to obtai...

CVE-2014-8336

The WP-DBManager WordPress plugin (pre-2.7.2) contains a vulnerability in the Sql Run Query panel that allows remote read of arbitrary files by exploiting insufficient query restriction, demonstrated via LOAD_FILE in an INSERT statement. Affected product: WP-DBManager plugin for WordPress. Impact...

CVE-2014-8336

The "Sql Run Query" panel in WP-DBManager aka Database Manager plugin before 2.7.2 for WordPress allows remote attackers to read arbitrary files by leveraging failure to sufficiently limit queries, as demonstrated by use of LOADFILE in an INSERT statement...

CVE-2014-8540

The CVE covers GitLab’s groups API in versions 6.x and 7.x up to 7.4.3, where remote authenticated guest users could modify ownership of arbitrary groups due to improper permission checks. Impact is ownership modification without authorization; CVSS vectors indicate low attack complexity with par...