CVE-2014-3164

CVE-2014-3164 affects Android code in cmds/servicemanager/service_manager.c prior to commit 7d42a3c31ba78a418f9bdde0e0ab951469f321b5. The vulnerability allows a denial of service via a NULL pointer dereference or an out-of-bounds write, related to binder passed lengths. Connected documents (NVD e...

CVE-2014-7242

CVE-2014-7242 affects Mitsui Sumitomo Insurance SumaHo apps on Android: SumaHo 3.0.0 and earlier and the SumaHo “driving capability” diagnosis result transmission app v1.2.2 and earlier. The root cause is failure to verify SSL/TLS server certificates, enabling MITM attackers to spoof servers and ...

CVE-2014-8357

backupsettings.html in the web administrative portal in Zhone zNID GPON 2426A before S3.0.501 places a session key in a URL, which allows remote attackers to obtain arbitrary user passwords via the sessionKey parameter in a getConfig action to backupsettings.conf...

CVE-2014-8357

CVE-2014-8357 affects Zhone zNID GPON 2426A prior to S3.0.501. The web admin backupsettings.html exposes a sessionKey in the URL, enabling a remote attacker to retrieve all user passwords from backupsettings.conf via a getConfig action. This is supported by multiple connected sources noting an in...

CVE-2014-9118

CVE-2014-9118 affects Zhone zNID GPON 2426A (and related 24xx/42xx/26xx/28xx series) prior to S3.0.501. The issue is a command-injection vulnerability in the web admin portal: remote attackers can execute arbitrary commands via shell metacharacters in the ipAddr parameter to zhnping.cmd. Root cau...

CVE-2014-2277

The maketemporaryfilename function in perltidy 20120701-1 and earlier allows local users to obtain sensitive information or write to arbitrary files via a symlink attack, related to use of the tmpnam function...

CVE-2014-2664

The CVE affects X2Engine X2CRM before 4.0. Affected component: ProfileController::actionUploadPhoto in protected/controllers/ProfileController.php. Root cause: unrestricted file upload allows uploading a file with an executable extension, enabling remote code execution when the file is accessed d...

CVE-2014-2277

The CVE-2014-2277 issue affects perltidy up to version 20120701-1, where the make_temporary_filename function can be exploited by local users to read sensitive data or replace arbitrary files via a symlink attack tied to the use of tmpnam. This is the explicit vulnerability detail in the provided...

CVE-2014-8324

network.c in Aircrack-ng before 1.2 Beta 3 allows remote attackers to cause a denial of service segmentation fault via a response with a crafted length parameter...

Xxe

The getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity XXE attack. NOTE: Related to CVE-2014-2053...

CVE-2014-9677

Cross-site scripting XSS vulnerability in FlexPaperViewer.swf in Flexpaper before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the Swfile parameter...

CVE-2014-8323

buddy-ng.c in Aircrack-ng before 1.2 Beta 3 allows remote attackers to cause a denial of service segmentation fault via a response with a crafted length parameter...

CVE-2014-9489

The CVE-2014-9489 issue affects the gollum-grit_adapter (part of Gollum) and the gollum-lib gem, where if any wiki document contains the string "master", remote authenticated users can execute arbitrary code through the -O/--open-files-in-pager flags. Root cause is the grit_adapter’s search funct...

CVE-2014-9733

CVE-2014-9733 concerns nw.js. The connected documents indicate that NW.js before 0.11.5 can simulate user input events within a normal frame, enabling a remote attacker to cause an unknown impact via unknown vectors. The CNVD entry explicitly notes a vulnerability in nw.js prior to 0.11.5 and men...

CVE-2014-9677

CVE-2014-9677 is an XSS in FlexPaperViewer.swf (Flexpaper) prior to 2.3.1. The vulnerability arises in the FlexPaperViewer.swf component via the Swfile parameter, allowing remote attackers to inject arbitrary web script/HTML. Connected CNVD entry confirms FlexPaper before 2.3.1 as affected; CNVD-...

CVE-2014-8324

network.c in Aircrack-ng before 1.2 Beta 3 allows remote attackers to cause a denial of service segmentation fault via a response with a crafted length parameter...

CVE-2014-8324

CVE-2014-8324 affects the Aircrack-ng project where network.c is vulnerable in releases before 1.2 Beta 3 . Exploitation is described as enabling a remote attacker to cause a denial of service (segmentation fault) by sending a response with a crafted length parameter. The root cause is related to...

CVE-2014-9677

Cross-site scripting XSS vulnerability in FlexPaperViewer.swf in Flexpaper before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the Swfile parameter...

CVE-2014-9678

The vulnerability CVE-2014-9678 affects FlexPaperViewer.swf in Flexpaper up to version 2.3.1. A remote attacker can abuse the Swfile parameter to perform content-spoofing, as described by multiple sources (CVE-2014-9678 and related CNVD/CVE entries). The root cause is insecure handling of the Swf...

CVE-2014-9697

Huawei USG9560/9520/9580 devices (before V300R001C01SPC300) are affected by CVE-2014-9697, where remote attackers can trigger a memory leak leading to memory exhaustion, DoS, reboot, and MPU switchover via a crafted web page. The issue is due to memory leakage in the MPU when servicing crafted re...