CVEs published in April 2014

645 vulnerabilities, 61 critical, 3 exploited.

• ajenti Ajenti Cross-site scripting (XSS) vulnerability CVE-2014-2260 Fix available 3.5 LowApril 30, 2014
• php-fusion PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted... CVE-2013-1807 Public exploit 5.0 MediumApril 30, 2014
• php-fusion Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote... CVE-2013-1806 Public exploit 6.5 MediumApril 30, 2014
• unity Ubuntu unity vulnerabilities USN-2184-2 Fix available No scoreApril 30, 2014
• vbulletin Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 5.1.1 Alpha 9 allow remote... CVE-2014-3135 4.3 MediumApril 30, 2014
• sap businessobjects Cross-site scripting (XSS) vulnerability in the InfoView application in SAP BusinessObjects... CVE-2014-3134 4.3 MediumApril 30, 2014
• sap netweaver java application server SAP Netweaver Java Application Server does not properly restrict access, which allows remote... CVE-2014-3133 5.0 MediumApril 30, 2014
• sap background processing SAP Background Processing does not properly restrict access, which allows remote authenticated... CVE-2014-3132 4.0 MediumApril 30, 2014
• sap profile maintenance SAP Profile Maintenance does not properly restrict access, which allows remote authenticated... CVE-2014-3131 4.0 MediumApril 30, 2014
• sap netweaver abap application server The ABAP Help documentation and translation tools (BC-DOC-HLP) in Basis in SAP Netweaver ABAP... CVE-2014-3130 4.6 MediumApril 30, 2014
• sap netweaver software lifecycle manager The Java Server Pages in the Software Lifecycle Manager (SLM) in SAP NetWeaver allows remote... CVE-2014-3129 5.0 MediumApril 30, 2014
• bluecoat content analysis system, content analysis system software +1 more The commandline interface in Blue Coat Content Analysis System (CAS) 1.1 before 1.1.4.2 allows... CVE-2014-2565 6.5 MediumApril 30, 2014
• fortinet fortiweb FortiGuard FortiWeb before 5.0.3 allows remote authenticated users to gain privileges via... CVE-2014-1957 6.5 MediumApril 30, 2014
• fortinet fortiweb CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to... CVE-2014-1956 5.0 MediumApril 30, 2014
• fortinet fortiweb Cross-site scripting (XSS) vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote... CVE-2014-1955 4.3 MediumApril 30, 2014
• fortinet fortiauthenticator FortiGuard FortiAuthenticator before 3.0 allows remote administrators to gain privileges via the... CVE-2013-6990 9.0 HighApril 30, 2014
• redhat enterprise mrg Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, uses the DES-based... CVE-2013-6445 Fix available 5.0 MediumApril 30, 2014
• tibco managed file transfer command center, managed file transfer internet server, slingshot +1 more +3 more TIBCO Managed File Transfer Internet Server before 7.2.2, Managed File Transfer Command Center... CVE-2014-2545 5.0 MediumApril 30, 2014
• cisco webex meetings server Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco WebEx Meetings... CVE-2014-2186 6.8 MediumApril 30, 2014
• mozilla firefox, fedoraproject fedora, oracle solaris +2 more Mozilla Firefox before 29.0 on Android allows remote attackers to spoof the address bar via... CVE-2014-1527 5.0 MediumApril 30, 2014
• mozilla firefox, fedoraproject fedora +1 more maintenservice_installer.exe in the Maintenance Service Installer in Mozilla Firefox before 29.0... CVE-2014-1520 6.9 MediumApril 30, 2014
• igniterealtime smack The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify... CVE-2014-0364 5.0 MediumApril 30, 2014
• igniterealtime smack The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not... CVE-2014-0363 5.8 MediumApril 30, 2014
• apache commons beanutils, struts +1 more Arbitrary code execution in Apache Commons BeanUtils CVE-2014-0114 Public exploitFix available EPSS 99.0% 7.5 HighApril 30, 2014
• debian dpkg dpkg 1.15.9, 1.16.x before 1.16.14, and 1.17.x before 1.17.9 expect the patch program to be... CVE-2014-3227 Fix available 6.4 MediumApril 30, 2014
• debian dpkg dpkg 1.15.9 on Debian squeeze introduces support for the "C-style encoded filenames" feature... CVE-2014-3127 Fix available 7.1 HighApril 30, 2014
• canonical ubuntu linux The Ubuntu Date and Time Indicator (aka indicator-datetime) 13.10.0+13.10.x before 13.10.0+13.10... CVE-2013-7374 Fix available 4.6 MediumApril 30, 2014
• google android Android before 4.4 does not properly arrange for seeding of the OpenSSL PRNG, which makes it... CVE-2013-7373 7.5 HighApril 29, 2014
• apache harmony, google android +1 more The engineNextBytes function in classlib/modules/security/src/main/java/common/org/apache/harmony... CVE-2013-7372 5.0 MediumApril 29, 2014
• php-fusion Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion before 7.02.06 allow remote... CVE-2013-1804 Public exploit 4.3 MediumApril 29, 2014
• f5 nginx The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11, when... CVE-2014-0088 7.5 HighApril 29, 2014
• ubercart Session fixation vulnerability in the Ubercart module 6.x-2.x before 6.x-2.13 and 7.x-3.x before... CVE-2013-7302 6.8 MediumApril 29, 2014
• malcolm nooning pirpc The PlRPC module, possibly 0.2020 and earlier, for Perl uses the Storable module, which allows... CVE-2013-7284 Fix available 6.8 MediumApril 29, 2014
• gnome display manager GNOME Display Manager (gdm) 3.4.1 and earlier, when disable-user-list is set to true, allows... CVE-2013-7273 Fix available 2.1 LowApril 29, 2014
• neo4j Neo4J vulnerable to Cross-Site Request Forgery CVE-2013-7259 Fix available 6.8 MediumApril 29, 2014
• simplemachines simple machines forum Simple Machines Forum (SMF) 2.0.6, 1.1.19, and earlier allows remote attackers to impersonate... CVE-2013-7236 7.5 HighApril 29, 2014
• simplemachines simple machines forum Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to... CVE-2013-7235 7.5 HighApril 29, 2014
• simplemachines simple machines forum Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to conduct... CVE-2013-7234 4.3 MediumApril 29, 2014
• gnome gnome-shell The automatic screen lock functionality in GNOME Shell (aka gnome-shell) before 3.10 does not... CVE-2013-7221 Fix available 4.6 MediumApril 29, 2014
• gnome gnome-shell js/ui/screenShield.js in GNOME Shell (aka gnome-shell) before 3.8 allows physically proximate... CVE-2013-7220 Fix available 4.6 MediumApril 29, 2014
• phusion juvia Juvia uses the same secret key for all installations, which allows remote attackers to have... CVE-2013-7134 7.5 HighApril 29, 2014
• basespace ruby sdk project ruby sdk Exposure of Sensitive Information in bio-basespace-sdk CVE-2013-7111 5.0 MediumApril 29, 2014
• organic groups project groups The Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated... CVE-2013-7068 4.9 MediumApril 29, 2014
• entity reference project entityreference The Entity reference module 7.x-1.x before 7.x-1.1-rc1 for Drupal allows remote attackers to read... CVE-2013-7066 4.3 MediumApril 29, 2014
• organic groups project groups The Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal allows remote attackers to... CVE-2013-7065 5.8 MediumApril 29, 2014
• freelance-it-consultant eu cookie compliance Cross-site scripting (XSS) vulnerability in the EU Cookie Compliance module 7.x-1.x before 7.x-1... CVE-2013-7064 2.1 LowApril 29, 2014
• invitation project invitation The Invitation module 7.x-2.x for Drupal does not properly check permissions, which allows remote... CVE-2013-7063 5.0 MediumApril 29, 2014
• unity Ubuntu unity vulnerabilities USN-2184-1 Fix available No scoreApril 29, 2014
• cisco unified communications manager The Call Detail Records (CDR) Management component in Cisco Unified Communications Manager ... CVE-2014-2185 4.0 MediumApril 29, 2014
• cisco unified communications manager The IP Manager Assistant (IPMA) component in Cisco Unified Communications Manager (Unified CM)... CVE-2014-2184 5.0 MediumApril 29, 2014
• Show olderLoading…