CVE-2014-5138

CVE-2014-5138 concerns the Sierra Library Services Platform (1.2_3) where the application mishandles multiple instances of the same query parameter, enabling an attacker to bypass parameter validation via crafted requests. The issue is tied to the Webpac Pro submodule in some configurations. Publ...

CVE-2014-4609

CVE-2014-4609 : Libav’s get_len in libavutil/lzo.c has an integer overflow when processing Literal Runs, allowing remote code execution. Affected are Libav releases before 0.8.13, 9.x before 9.14, and 10.x before 10.2. Impact includes remote code execution with potential impact on confidentiality...

CVE-2014-4610

CVE-2014-4610 concerns an integer overflow in FFmpeg’s libavutil/lzo.c get_len, which allows remote attackers to execute arbitrary code via a crafted Literal Run. Public references enumerate affected FFmpeg branches: before 0.10.14, 1.1.x before 1.1.12, 1.2.x before 1.2.7, 2.0.x before 2.0.5, 2.1...

CVE-2014-9211

CVE-2014-9211: A persistent cross-site scripting flaw reported in ClickDesk for versions 4.3 and earlier. The provided documents name ClickDesk

CVE-2014-9382

CVE-2014-9382 affects Freebox OS Web interface 3.0.2. A cross-site request forgery (CSRF) vulnerability allows creating a VPN user without proper authorization. The issue is demonstrated in vendor advisories and security summaries, including a POC that shows a VPN user creation request being trig...

CVE-2014-6039

ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. Fixed version 10 Build 10000...

CVE-2014-5381

The CVE-2014-5381 entry affects Grand MA 300 fingerprint readers (firmware 6.60) from Granding. The vulnerability stems from weak PIN verification, enabling brute-force attempts to recover a PIN via network/WIGAND traffic. Public PoCs and advisories describe the flaw and provide an example brute-...

CVE-2014-5380

Grand MA 300 allows retrieval of the access PIN from sniffed data...

CVE-2014-5380

CVE-2014-5380 concerns the Grand MA 300 fingerprint access control device, where a weak PIN verification flaw allows retrieval of the access PIN from sniffed data. Connected advisories describe affected versioning (Grand MA 300/ID with firmware 6.60) and provide concrete attack details, including...

CVE-2014-6039

CVE-2014-6039 affects ManageEngine EventLog Analyzer (v7–v9.9 build 9002). A information-disclosure path via the hostdetails servlet exposes usernames and passwords for managed Windows/AS/400 hosts; exploitation relies on prior CVE-2014-6038 flow to obtain host identifiers and then extract creden...

CVE-2014-6038

CVE-2014-6038 affects Zoho/ManageEngine EventLog Analyzer (v7–v9.9 build 9002). The cited issue is an information disclosure in the agentHandler servlet, enabling an unauthenticated remote attacker to obtain usernames, passwords or hashes from the managed hosts’ data. Some connected sources also ...

CVE-2014-6059

WordPress Advanced Access Manager Plugin before 2.8.2 has an Arbitrary File Overwrite Vulnerability...

CVE-2014-5092

Status2k allows Remote Command Execution in admin/options/editpl.php...

CVE-2014-4561

The ultimate-weather plugin 1.0 for WordPress has XSS...

CVE-2014-5093

Status2k Server Monitoring Software (CVE-2014-5093) is documented to not remove the install directory, enabling credential reset. Connected sources corroborate multiple vulnerabilities across CVEs CVE-2014-5088…CVE-2014-5094 (XSS, SQL Injection, command execution) affecting Status2k, with exploit...

CVE-2014-5092

CVE-2014-5092 affects the Status2k Server Monitoring Software . The initial description states that “Status2k allows Remote Command Execution in admin/options/editpl.php,” indicating a vulnerability in the web interface that enables an attacker to execute commands remotely via the affected PHP fi...

CVE-2014-4530

flog plugin 0.1 for WordPress has XSS...

CVE-2014-4561

CVE-2014-4561 affects the WordPress Ultimate Weather Plugin (

CVE-2014-4530

CVE-2014-4530 concerns the WordPress flog plugin (version 0.1). The vulnerability is a cross-site scripting (XSS) issue arising from insufficient input validation in the flog plugin, leading to unauthenticated, reflected XSS. Multiple connected sources (Red Hat, CNVD, NVD, CVE lists, and WP explo...

CVE-2014-4982

CVE-2014-4982 concerns a command-injection flaw in LPAR2RRD where insufficient input sanitization on the web GUI parameters allows arbitrary command execution on the application server. Affected versions are reported as ≤ 4.53 and ≤ 3.5. The underlying issue is rooted in input handling on the app...