CVE-2014-9854

CVE-2014-9854 affects ImageMagick, specifically the tiff coder (coders/tiff.c). The vulnerability allows remote attackers to cause an application crash (DoS) via vectors related to image identification. The supplied connected documents confirm the existence of this CVE within ImageMagick and desc...

CVE-2014-8723

GetSimple CMS 3.3.4 is affected. A information-disclosure vulnerability allows remote attackers to obtain the installation path by visiting direct URLs plugins/anonymous_data.php or plugins/InnovationPlugin.php, exposing sensitive info in error messages. The issue is documented across multiple so...

CVE-2014-8706

CVE-2014-8706 affects Pluck CMS 4.7.2 and is an information disclosure issue. The vulnerability occurs when a remote attacker can cause PHPSESSID to be treated as an array or altered with non-alphanumeric characters, or manipulate the image parameter to an array or string, which results in an err...

CVE-2014-8708

Pluck CMS 4.7.2 is affected. A remote attacker can execute arbitrary code via the blog form feature, as reported by multiple sources (NVD/CNVD equivalents). Root cause details are not explicitly described in the provided documents beyond the blog form vector. No remediation or patch information i...

CVE-2014-8707

Summary: CVE-2014-8707 is a cross-site scripting (XSS) vulnerability in TinyMCE within Pluck CMS version 4.7.2. The flaw allows remote authenticated users to inject arbitrary script/HTML via the TinyMCE “edit HTML source” option. The connected CNVD entry for Pluck CMS confirms a TinyMCE XSS issue...

CVE-2014-8702

Wonder CMS 2014 allows remote attackers to obtain sensitive information by logging into the application with an array for the password, which reveals the installation path in an error message...

CVE-2014-9852

ImageMagick vulnerability CVE-2014-9852 affects the ImageMagick code path distribute-cache.c, where objects are re-used after being destroyed. This can allow remote attackers to trigger unspecified impact via unspecified vectors. The initial entry notes a remote-exploit scenario with unspecified ...

CVE-2014-8705

PHP remote file inclusion vulnerability in editInplace.php in Wonder CMS 2014 allows remote attackers to execute arbitrary PHP code via a URL in the hook parameter...

CVE-2014-8701

CVE-2014-8701 affects Wonder CMS 2014. A remote attacker can view /files/password to obtain sensitive information, exposing unsalted MD5 hashes. Connected records corroborate information disclosure in Wonder CMS 2014, with impact described as partial confidentiality (CVSS2/3 data: base scores 5.0...

CVE-2014-8722

GetSimple CMS 3.3.4 is affected by CVE-2014-8722, enabling information disclosure via direct requests to (1) data/users/.xml, (2) backups/users/.xml.bak, (3) data/other/authorization.xml, and (4) data/other/appid.xml. Root cause is exposed sensitive data without proper access control. Public expl...

CVE-2014-9921

CVE-2014-9921 affects McAfee Cloud Analysis and Deconstructive Services (CADS) versions 1.0.0.3x, 1.0.0.4d and earlier. A configuration error allows remote unauthenticated users to view, add, and remove users, constituting an information-disclosure vulnerability. The core issue is improper access...

CVE-2014-9920

CVE-2014-9920 affects McAfee Application Control (MAC) 6.x before specific hotfixes (9726 for 6.0.0, 9068 for 6.0.1, 692 for 6.1.0, 399 for 6.1.1, 426 for 6.1.2, 357 for 6.1.3 and earlier). A malformed Windows binary can be created that is treated as non-executable and bypasses the whitelisting p...

CVE-2014-8688

Telegram Messenger for iOS (2.6) and Android (1.8.2) is affected by an information-disclosure vulnerability where secret chat messages are stored in cleartext in process memory and in a .db file. The root cause is not detailed beyond the messages being accessible in plaintext within memory and st...

Ubuntu: Security Advisory (USN-3229-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Update : cacti (openSUSE-2017-325)

This update for cacti fixes the following vulnerabilities : - CVE-2014-4000: PHP Object Injection Vulnerabilities boo1022564 It also updates cacti to version 1.0.4 to include the latest upstream bugfixes and improvements. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text a...

Ubuntu 12.04 LTS : python-imaging vulnerabilities (USN-3229-1)

It was discovered that the Python Imaging Library incorrectly handled certain compressed text chunks in PNG images. A remote attacker could possibly use this issue to cause the Python Imaging Library to crash, resulting in a denial of service. CVE-2014-9601 Cris Neckar discovered that the Python...

USN-3230-1 pillow vulnerabilities

It was discovered that Pillow incorrectly handled certain compressed text chunks in PNG images. A remote attacker could possibly use this issue to cause Pillow to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. CVE-2014-9601 Cris Neckar discovered that Pillow...

USN-3230-1: Pillow vulnerabilities

It was discovered that Pillow incorrectly handled certain compressed text chunks in PNG images. A remote attacker could possibly use this issue to cause Pillow to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. CVE-2014-9601 Cris Neckar discovered that Pillow...

CVE-2014-3926

CVE-2014-3926 is an XSS vulnerability in lg.cgi used by Cougar LG 1.9 (LG Looking Glass web apps). The issue arises from accepting the addr parameter without proper sanitization, enabling remote attackers to inject arbitrary web script or HTML. Connected documents (e.g., CNVD-2017-03337) describe...

CVE-2014-9645

The addprobe function in modutils/modprobe.c in BusyBox before 1.23.0 allows local users to bypass intended restrictions on loading kernel modules via a / slash character in a module name, as demonstrated by an "ifconfig /usbserial up" command or a "mount -t /sndpcm none /" command...