CVEs published in November 2014
542 vulnerabilities, 135 critical, 10 exploited.
- flac libflacStack-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers...7.5 High
- wordpress, debian linux, mageia project mageia +2 morewp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4...4.3 Medium
- wordpresswp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x...6.4 Medium
- wordpress, debian linux, mageia project mageia +2 moreWordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow...6.8 Medium
- wordpress, debian linux +1 moreCross-site scripting (XSS) vulnerability in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x...4.3 Medium
- wordpress, debian linux +1 moreCross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3...4.3 Medium
- wordpresswp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3,...5.0 Medium
- wordpressCross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2,...6.8 Medium
- wordpressCross-site scripting (XSS) vulnerability in the media-playlists feature in WordPress before 3.9.x...4.3 Medium
- wordpressCross-site scripting (XSS) vulnerability in the wptexturize function in WordPress before 3.7.5, 3...4.3 Medium
- cisco ios xrCisco IOS XR allows remote attackers to cause a denial of service (LISP process reload) by...5.0 Medium
- cisco openh264Use-after-free vulnerability in decode_slice.cpp in Cisco OpenH264 1.2.0 and earlier allows...7.5 High
- cisco openh264Buffer overflow in decode.cpp in Cisco OpenH264 1.2.0 and earlier allows remote attackers to...7.5 High
- manageengine oputilsThe ConfigSaveServlet servlet in ManageEngine OpUtils before build 71024 allows remote attackers...7.8 High
- jexperts channel platformJExperts Channel Platform 5.0.33_CCB allows remote authenticated users to bypass access...6.5 Medium
- sonicwall analyzer, global management system, uma em5000 +2 moreThe ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2,...9.0 High
- arubanetworks airwaveThe web interface in Aruba Networks AirWave before 7.7.14 and 8.x before 8.0.5 allows remote...9.0 High
- arubanetworks clearpass policy managerSQL injection vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) 6.2.x, 6.3.x before...7.5 High
- redhat resteasyXML External Entity Reference in RESTEasy6.4 Medium
- canonical ubuntu linuxmountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount...7.2 High
- liferay portalCross-site scripting (XSS) vulnerability in Liferay Portal Enterprise Edition (EE) 6.2 SP8 and...3.5 Low
- jqueryui jquery ui, redhat enterprise linux desktop, enterprise linux hpc node +2 more +4 morejquery-ui Tooltip widget vulnerable to XSS4.3 Medium
- pypa pip, oracle solaris +1 morepip lack of randomness in build directory2.1 Low
- mantisbtMantisBT before 1.2.18 allows remote authenticated users to bypass the ...4.0 Medium
- mantisbtCross-site scripting (XSS) vulnerability in the selection list in the filters in the...3.5 Low
- digium asterisk, certified asterisk +1 moreThe DB dialplan function in Asterisk Open Source 1.8.x before 1.8.32, 11.x before 11.1.4.1, 12.x...9.0 High
- digium asterisk, certified asterisk +1 moreConfBridge in Asterisk 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and...6.5 Medium
- digium asteriskUse-after-free vulnerability in the PJSIP channel driver in Asterisk Open Source 12.x before 12.7...5.0 Medium
- digium asteriskRace condition in the chan_pjsip channel driver in Asterisk Open Source 12.x before 12.7.1 and 13...5.0 Medium
- digium asterisk, certified asterisk +1 moreConfBridge in Asterisk 11.x before 11.14.1 and Certified Asterisk 11.6 before 11.6-cert8 does not...5.0 Medium
- digium asteriskThe res_pjsip_acl module in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 does...7.5 High
- digium asterisk, certified asterisk +1 moreThe (1) VoIP channel drivers, (2) DUNDi, and (3) Asterisk Manager Interface (AMI) in Asterisk...5.0 Medium
- openstack neutron, redhat openstack, fedoraproject fedora +2 moreOpenStack Neutron before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users...4.0 Medium
- moodleMoodle allows attackers to trigger the generation of arbitrary messages5.0 Medium
- moodleMoodle does not provide charset information in HTTP headers4.3 Medium
- moodleMoodle exposes hidden grades to students4.0 Medium
- directwebremoting direct web remotingImproper Neutralization of Input During Web Page Generation in Direct Web Remoting4.3 Medium
- directwebremoting direct web remotingExposure of Sensitive Information to an Unauthorized Actor in Direct Web Remoting5.0 Medium
- cybozu dezie, mailwise, office +2 moreBuffer overflow in Cybozu Office 9 and 10 before 10.1.0, Mailwise 4 and 5 before 5.1.4, and Dezie...9.0 High
tomcat-nativeDebiantomcat-native - security updateNo score- jqueryui jquery ui, apache drill, debian linux +3 more +5 moreCross-site Scripting in jquery-ui6.1 Medium
- oracle database serverUnspecified vulnerability in the JPublisher component in Oracle Database Server 11.1.0.7, 11.2.0...6.8 Medium
- phpStack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in...7.5 High
- ibm security network protection firmware, security network protection xgs 5000, security network protection xgs 5100 +2 moreIBM Security Network Protection 5.1 before 5.1.0.0 FP13, 5.1.1 before 5.1.1.0 FP8, 5.1.2 before 5...4.0 Medium
- ibm sterling selling and fulfillment foundationSterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows...4.0 Medium
- polarsslMemory leak in PolarSSL before 1.2.12 and 1.3.x before 1.3.9 allows remote attackers to cause a...7.8 High
- polarsslPolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote...5.0 Medium
- moodleMoodle allows attacks to obtain sensitive information5.0 Medium
- moodleMoodle allows attackers to cause a denial of service5.0 Medium
- moodleMoodle does not consider the moodle/tag:edit capability before adding a tag4.0 Medium
- Show moreLoading…