CVEs published in September 2014
1,195 vulnerabilities, 83 critical, 4 exploited.
- plack project plackPlack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which...5.0 Medium
- apache poiImproper Input Validation in Apache POI4.3 Medium
- apache poiImproper Restriction of XML External Entity Reference in Apache POI4.3 Medium
- eximThe dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled,...6.8 Medium
- mikejolley download monitorCross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for...4.3 Medium
- phorumCross-site scripting (XSS) vulnerability in the group moderation screen in the control center ...4.3 Medium
- tibco spotfire serverUnspecified vulnerability in the Authentication Module in TIBCO Spotfire Server before 4.5.2, 5.0...7.5 High
- ibm db2IBM DB2 10.5 before FP4 on Linux and AIX creates temporary files during CDE table LOAD operations...2.1 Low
- ibm business process managerAn unspecified Ajax service in the Content Management toolkit in IBM Business Process Manager ...4.0 Medium
- ibm business process manager, websphere application server +1 moreIBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.x allow...4.0 Medium
- cisco ios xrCisco IOS XR 4.3(.2) and earlier, as used in Cisco Carrier Routing System (CRS), allows remote...7.1 High
- ibm db2The SQL engine in IBM DB2 9.5 through FP10, 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4,...3.5 Low
- ibm db2Stack-based buffer overflow in IBM DB2 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and...8.5 High
- ibm business process manager, websphere application server +1 moreCross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 8.5...3.5 Low
- procmail, canonical ubuntu linux +1 moreHeap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to...7.5 High
- eximexpand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to...4.6 Medium
- werdswords download shortcodeDirectory traversal vulnerability in force-download.php in the Download Shortcode plugin 0.2.3...5.0 Medium
- djangoproject django, canonical ubuntu linux, debian linux +3 more +5 moreDjango cross-site scripting (XSS) attack via user-supplied redirect URLs4.3 Medium
- djangoproject django, canonical ubuntu linux, fedoraproject fedora +2 more +4 moreDjango Denial-of-service possibility with strip_tags5.0 Medium
- djangoproject django, canonical ubuntu linux +1 moreDjango database denial-of-service with ModelMultipleChoiceField5.0 Medium
- djangoproject django, canonical ubuntu linux +1 moreDjango DoS in django.views.static.serve5.0 Medium
- djangoproject django, canonical ubuntu linux +1 moreDjango Cross-site Scripting Vulnerability4.3 Medium
- djangoproject djangoDjango WSGI Header Spoofing Vulnerability5.0 Medium
- qpw.famvanakkeren quick post widgetMultiple cross-site scripting (XSS) vulnerabilities in Quick Post Widget plugin 1.9.1 for...4.3 Medium
- mozilla firefoxMozilla Firefox before 31.1 on Android does not properly restrict copying of local files onto the...4.3 Medium
libwpdDebianlibwpd - security updateNo score- mcafee web gatewayThe Accounts tab in the administrative user interface in McAfee Web Gateway (MWG) before 7.3.2.9...4.0 Medium
- xrms crm project crmplugins/useradmin/fingeruser.php in XRMS CRM, possibly 1.99.2, allows remote authenticated users...6.5 Medium
- check mk project mkThe wato component in Check_MK before 1.2.4p4 and 1.2.5 before 1.2.5i4 uses the pickle Python...9.3 High
- check mk project mkCheck_MK before 1.2.4p4 and 1.2.5 before 1.2.5i4 allows remote authenticated users to write...4.9 Medium
- iii sierraInnovative Interfaces Sierra Library Services Platform 1.2_3 provides different responses for...5.0 Medium
- iii sierraCross-site scripting (XSS) vulnerability in Innovative Interfaces Sierra Library Services...4.3 Medium
- No product listedThe Android WebView in Android before 4.4 allows remote attackers to bypass the Same Origin...No score
- hl7 c-cdaCDA.xsl in HL7 C-CDA 1.1 and earlier does not anticipate the possibility of invalid C-CDA...4.3 Medium
- labanquepostaleThe La Banque Postale application before 3.2.6 for Android does not prevent the launching of an...4.3 Medium
- hl7 c-cdaCDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to discover potentially sensitive...4.3 Medium
- hl7 c-cdaCross-site scripting (XSS) vulnerability in CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote...4.3 Medium
- apereo .net cas client, java cas client, phpcas +2 more +4 moreJasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreUse-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 32.0, Firefox...9.3 High
- mozilla firefox, thunderbird +1 moreThe mozilla::dom::AudioEventTimeline function in the Web Audio API implementation in Mozilla...5.0 Medium
- mozilla firefox, thunderbird, opensuse evergreen +1 more +3 moreMozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 do...4.3 Medium
- mozilla firefox, thunderbird, opensuse evergreen +2 more +4 moreUse-after-free vulnerability in the mozilla::DOMSVGLength::GetTearOff function in Mozilla Firefox...10.0 High
- mozilla firefox, firefox esr, thunderbird +2 moreUnspecified vulnerability in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 24.x...10.0 High
- mozilla firefoxMultiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 32.0 allow...10.0 High
- mozilla firefox, thunderbird, opensuse evergreen +1 more +3 moreMultiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 32.0,...10.0 High