CVE-2014-1776

CVE-2014-1776 is a memory‑safety flaw in Microsoft Internet Explorer (versions 6–11) described as a use‑after‑free in CMarkup::IsConnectedToPrimaryMarkup. Exploitation leads to remote code execution or memory corruption, with evidence of in‑the‑wild activity in April 2014. The vulnerability affec...

CVE-2014-0780

CVE-2014-0780 affects InduSoft Web Studio NTWebServer in version 7.1 prior to SP2 Patch 4. The NTWebServer directory traversal flaw lets remote attackers read APP password files and can lead to remote code execution. Exploitation is described as remote and not requiring authentication, enabling u...

CVE-2014-2601

HP iLO 2 (Integrated Lights-Out 2) remote DoS vulnerability (CVE-2014-2601) affects version 2.23 and earlier. A remote attacker can cause service denial via crafted HTTPS traffic (as shown by a vulnerability scanner tool). Notably, CVSS base score is 7.8 (HIGH) with network access, no authenticat...

CVE-2013-5948

CVE-2013-5948 documents concrete details: Affected devices are ASUS RT-AC68U and other RT-series routers with firmware before 3.0.0.4.374.5047. The issue resides in the Network Analysis tab (Main_Analysis_Content.asp), where remote authenticated users can cause arbitrary commands to run via shell...

CVE-2014-0160

CVE-2014-0160 (Heartbleed) is an information-disclosure vulnerability in OpenSSL’s TLS/DTLS heartbeat implementation. Affected: OpenSSL 1.0.1 before 1.0.1g. Root cause: improper handling of the Heartbeat extension (d1_both.c, t1_lib.c) leading to a buffer over-read, enabling an attacker to read m...

CVE-2014-1761

CVE-2014-1761 is a memory-corruption vulnerability in Microsoft Word triggered by crafted RTF data, allowing remote code execution or memory-corruption denial of service. Affected products include Word 2003 SP3, 2007 SP3, 2010 SP1/SP2, 2013 and 2013 RT, Word Viewer, Office Compatibility Pack SP3,...

CVE-2014-2120

CVE-2014-2120 affects Cisco ASA WebVPN login page, with a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary script/HTML via an unspecified parameter (Bug ID CSCun19025). Multiple sources (Cisco advisory, NVD/NIST CVE entry, CISCO-SA, OpenVAS) consistently d...

CVE-2014-2321

CVE-2014-2321 affects ZTE F460 and F660 cable modems where the web_shell_cmd.gch backdoor allows remote attackers to obtain administrative access by sending commands (e.g., using set TelnetCfg) to enable TELNET with specified credentials. The Mozi IoT analysis additionally notes that the backdoor...

CVE-2013-7331

CVE-2013-7331 is an information-disclosure vulnerability in the Microsoft XMLDOM ActiveX control used by Internet Explorer on Windows (XMLDOM object). The flaw allows an attacker to determine the existence of local pathnames, UNC shares, intranet hostnames, and intranet IP addresses by inspecting...

CVE-2014-0502

CVE-2014-0502 is a double‑free vulnerability in Adobe Flash Player and related components that allows remote code execution. Affected products include Flash Player prior to 11.7.700.269 and 11.8.x up to 12.0.x before 12.0.0.70 on Windows/macOS, and before 11.2.202.341 on Linux, as well as Adobe A...

CVE-2014-0322

The CVE-2014-0322 issue is a Use-After-Free in Internet Explorer 9–10 triggered by crafted JavaScript/CMarkup and the onpropertychange attribute of a script element, exploited in the wild in early 2014. Affected product: Microsoft Internet Explorer 9 and 10 . Root cause: use-after-free condition ...

CVE-2014-0497

CVE-2014-0497 is an Adobe Flash Player integer underflow vulnerability affecting multiple platforms (Windows/macOS/Linux) that enables remote code execution via unspecified vectors. The initial description confirms the affected version ranges (pre-11.7.700.261/11.8.x–12.x pre-12.0.0.44 on Windows...

CVE-2014-0496

CVE-2014-0496 is a use-after-free vulnerability in Adobe Reader and Acrobat (X and XI) on Windows and macOS. Affected products are Adobe Reader X (v10.0.x) prior to 10.1.8 and Adobe Acrobat X 10.1.8 and earlier, and Adobe Reader XI 11.x prior to 11.0.06 and Adobe Acrobat XI 11.x prior to 11.0.06....

CVE-2013-7091

CVE-2013-7091 affects Zimbra Collaboration Server 7.2.2 and 8.0.2 via a directory traversal/LFI vulnerability in the skin files (I18nMsg, AjxMsg, ZMsg, ZmMsg, etc.) that can read arbitrary server files by manipulating the skin parameter. The underlying issue is improper sanitization allowing a ‘....

CVE-2013-3900

CVE-2013-3900 describes a remote code execution in the WinVerifyTrust Authenticode verification for PE files. An attacker could modify a signed executable to execute code without invalidating the signature, potentially gaining full control of the system. Microsoft republished this CVE in the Secu...

CVE-2013-5065

NDProxy.sys in the Windows kernel is affected by a local privilege escalation flaw (CVE-2013-5065) caused by improper input validation in the NDPROXY driver. A crafted IOCTL path allows a local attacker to exploit a NULL pointer dereference to escalate privileges on affected systems. Public explo...

CVE-2013-6282

The CVE-2013-6282 issue affects the Linux kernel on ARM v6k/v7 where get_user and put_user do not validate certain addresses, enabling an unprivileged user to read/write arbitrary kernel memory. Exploitation was reported in the wild on Android devices in late 2013. Affected kernel versions includ...

CVE-2013-5223

CVE-2013-5223 reports multiple cross-site scripting (XSS) vulnerabilities in the D-Link DSL-2760U Gateway (Rev. E1). The issue allows remote authenticated users to inject arbitrary web script or HTML via a long list of parameters (including ntpServer1, ddnsmngr.cmd username, todmngr.tod, urlfilte...

CVE-2013-3918

CVE-2013-3918 is an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control (icardie.dll) used by Internet Explorer. The flaw exists when the ActiveX control is instantiated via a crafted webpage, enabling remote code execution with the current user’s privileges...

CVE-2013-3906

CVE-2013-3906 is a memory corruption vulnerability in Microsoft Windows Graphics Component (TIFF handling) that could allow remote code execution. It affected GDI+ in Windows Vista SP2/Server 2008 SP2 and Office suites (Office 2003 SP3, 2007 SP3, 2010 SP1/SP2, Office Compatibility Pack SP3) and L...