CVE-2014-10043

CVE-2014-10043 affects Android devices with Qualcomm Snapdragon Mobile/Wear platforms (e.g., MSM8909W, SD 210/212/205, SD 400/410/12/800). The issue is a buffer over-read when reading PlayReady rights string information from a command buffer (sent from non-secure side) if the rights string length...

CVE-2014-10063

CVE-2014-10063 affects Qualcomm-based Android devices (Qualcomm Snapdragon Mobile MDM9625 and SD 800). The fuse at secure boot was not blown correctly, per Android bulletin context. Impact is defined as a fault in the secure-fuse state; the issue is mitigated by the 2018-04-05 security patch leve...

Amazon Linux 2 : mod_wsgi (ALAS-2018-987)

Failure to handle errors when attempting to drop group privileges : modwsgi before 4.2.4 for Apache, when creating a daemon process group, does not properly handle when group privileges cannot be dropped, which might allow attackers to gain privileges via unspecified vectors. CVE-2014-8583 C...

CVE-2014-2294

Open Web Analytics (OWA) before 1.5.7 is vulnerable to PHP object injection via the owa_event parameter to queue.php. The root cause is unsafe unserialize() of a crafted serialized object (after decoding base64) in queue.php, enabling remote attackers to manipulate configuration or achieve arbitr...

D-Link DIR-815 Rev.B < 2.03 HTTP Command Injection Vulnerability

D-Link Router DIR-815 Rev.B is prone to an HTTP command injection vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2014-1686

MediaWiki 1.18.0 allows remote attackers to obtain the installation path via vectors related to thumbnail creation...

CVE-2014-1686

MediaWiki 1.18.0 allows remote attackers to obtain the installation path via vectors related to thumbnail creation...

glibc security, bug fix, and enhancement update

2.17-222 - Restore internal GLIBCPRIVATE symbols for use during upgrades 1523119 2.17-221 - CVE-2018-1000001: Fix realpath buffer underflow 1534635 - i386: Fix unwinding for 32-bit C++ application 1529982 - Reduce thread and dynamic loader stack usage 1527904 - x86-64: Use XSAVE/XSAVEC more often...

CVE-2014-1686

MediaWiki 1.18.0 allows remote attackers to obtain the installation path via vectors related to thumbnail creation...

CVE-2014-1686

CVE-2014-1686 affects MediaWiki 1.18.0 and allows remote disclosure of the installation path via thumbnail creation vectors. Provided sources consistently describe path disclosure with CVSS v2/v3 base scores around 5.0–5.3 (MEDIUM). Some OpenVAS entries indicate a vendor patch is available, but n...

CVE-2014-2069

CVE-2014-2069 is an absolute path traversal vulnerability in Eshtery CMS. The flaw exists in FileManager.aspx where an attacker can supply a full pathname via the file parameter to read arbitrary files on the system. This is caused by improper input handling in the CMS file operation. Public refe...

CVE-2016-9646

ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder-field method similar to the CGI-param API that led to Bugzilla's CVE-2014-1572, which can be abused to lead to commit metadata forgery...

CVE-2016-9646 Commit metadata forgery via CGI::FormBuilder context-dependent APIs

ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder-field method similar to the CGI-param API that led to Bugzilla's CVE-2014-1572, which can be abused to lead to commit metadata forgery...

CVE-2016-9646

ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder-field method similar to the CGI-param API that led to Bugzilla's CVE-2014-1572, which can be abused to lead to commit metadata forgery...

CVE-2014-9563

CRLF injection vulnerability in the web-based management WBM interface in Unify former Siemens OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 allows remote authenticated users to modify the root password and consequently access the debug port using the serial interface via th...

CVE-2014-8888

The remote administration interface in D-Link DIR-815 devices with firmware before 2.03.B02 allows remote attackers to execute arbitrary commands via vectors related to an "HTTP command injection issue."...

CVE-2014-8421

Unify former Siemens OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 allow remote attackers to gain super-user privileges by leveraging SSH access and incorrect ownership of 1 ConfigureCoreFile.sh, 2 Traceroute.sh, 3 apps.sh, 4 conversionjava2native.sh, 5 coreCompression.sh, 6...

CVE-2014-6169

CVE-2014-6169 affects IBM Forms Experience Builder 8.5.0 and 8.5.1. The issue is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The connected sources confirm the affected product versions and the XSS nature b...

CVE-2014-6120

CVE-2014-6120 affects IBM Rational AppScan Source (versions 8.0–8.0.2, 8.5–8.5.0.1) and Security AppScan Source (8.6–9.0.1, including 8.7.x and 8.8); allows remote attackers to execute arbitrary commands on the installation server via unspecified vectors. CVSS scores in the documents indicate cri...

CVE-2014-6412

CVE-2014-6412 affects WordPress prior to 4.4, where the password-recovery token generation is vulnerable due to weak randomness. This can enable remote attackers to brute-force or predict tokens, potentially compromising password resets. Reports across multiple feeds (NVD entry, Ubuntu/Debian adv...