CVE-2014-2061

The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by reading the HTML source code, related to the default value...

jenkins: remote code execution flaw (SECURITY-150)

Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel...

jenkins: session hijacking issue in Winstone (SECURITY-106)

The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vectors...

jenkins: interface vulnerable to clickjacking attacks (SECURITY-80)

Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

jenkins: directory traversal flaw (SECURITY-131)

Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ permission to read arbitrary files via unspecified vectors...

PYSEC-2014-44

Cross-site scripting XSS vulnerability in safehtml.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with permissions to edit content to inject arbitrary web script or HTML via unspecified vectors...

PYSEC-2014-46

Cross-site scripting XSS vulnerability in widgettraversal.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

UBUNTU-CVE-2014-0179

libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of service read block and hang via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the 1 virConnectCompareCPU or 2 virConnectBaselineCPU API method, relate...

DEBIAN-CVE-2014-0207

The cdfreadshortsector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service assertion failure and application exit via a crafted CDF file...

UBUNTU-CVE-2014-3480

The cdfcountchain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to cause a denial of service application crash via a crafted CDF file...

KMail 1.x GnuPG Arbitrary Content Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/22759/info KMail is prone to a vulnerability that may allow an attacker to add arbitrary content into a message without the end user knowing. An attacker may be able to exploit this issue to add arbitrary content into a...

mysql: unspecified DoS related to Partition (CPU April 2014)

Unspecified vulnerability in Oracle MySQL Server 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Partition...

PT-2014-1424 · Php +7 · Php +7

Name of the Vulnerable Software and Affected Versions: File versions prior to 5.19 PHP versions prior to 5.4.30 PHP versions 5.5.x prior to 5.5.14 Description: The issue is related to the cdf read property info function, which does not properly validate a stream offset. This allows remote attacke...

PT-2014-3529 · Ovirt · Ovirt Engine Reports

Name of the Vulnerable Software and Affected Versions: ovirt-engine-reports versions prior to 3.3.3 Description: The setup script stores the reports database password in cleartext, allowing local users to obtain sensitive information by reading an unspecified file. Recommendations: For versions...

CVE-2013-2111

The IMAP functionality in Dovecot before 2.2.2 allows remote attackers to cause a denial of service infinite loop and CPU consumption via invalid APPEND parameters...

DEBIAN-CVE-2013-6454

Cross-site scripting XSS vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via a -o-link attribute...

PT-2014-3474 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.4.2 Description: The issue allows remote attackers to hijack web sessions. This is achieved via the session id cookie. Recommendations: For versions prior to 1.4.2, update to version 1.4.2 or later to resolve the...

wireshark: buffer overflow in MPEG file parser (wnpa-sec-2014-04)

Buffer overflow in the mpegread function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a denial of service application crash via a large record in MPEG data...

mysql: unspecified vulnerability related to InnoDB affecting integrity (CPU Jan 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect integrity via unknown vectors related to InnoDB...

PT-2014-4293 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 3.12.8 Description: The issue allows remote attackers to obtain sensitive information from kernel memory. This is achieved by establishing an IRC DCC session where incorrect packet data is transmitted during the...