Skip to content

Browse Docs Sources Guide

Search/Get API key

Every CVE
Archive
2014
December

CVEs published in December 2014

653 vulnerabilities, 63 critical, 0 exploited.

Known exploitedIn KEVPublic exploitFix available

openvas manager, fedoraproject fedora, opensuse +2 moreSQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote...CVE-2014-9220Fix available7.5 HighDecember 3, 2014
thomsonreuters fixed assets csThe installer in Thomson Reuters Fixed Assets CS 13.1.4 and earlier uses weak permissions for...CVE-2014-9141Public exploit7.2 HighDecember 3, 2014
sunhater kcfinderCross-site scripting (XSS) vulnerability in index.php in SunHater KCFinder 3.11 and earlier...CVE-2014-39884.3 MediumDecember 3, 2014
graphviz, debian linux +1 moreFormat string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows...CVE-2014-9157Fix available7.5 HighDecember 3, 2014
redhat tcpdumpBuffer overflow in the ppp_hdlc function in print-ppp.c in tcpdump 4.6.2 and earlier allows...CVE-2014-9140Fix available5.0 MediumDecember 3, 2014
zte zxdslZTE ZXDSL 831CII allows remote attackers to bypass authentication via a direct request to (1)...CVE-2014-91845.0 MediumDecember 2, 2014
zte zxdslZTE ZXDSL 831CII has a default password of admin for the admin account, which allows remote...CVE-2014-918310.0 HighDecember 2, 2014
anchorcms anchor cmsmodels/comment.php in Anchor CMS 0.9.2 and earlier allows remote attackers to inject arbitrary...CVE-2014-91824.3 MediumDecember 2, 2014
plex media serverMultiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote...CVE-2014-9181Public exploit5.0 MediumDecember 2, 2014
eleanor-cms eleanor cmsOpen redirect vulnerability in go.php in Eleanor CMS allows remote attackers to redirect users to...CVE-2014-91805.0 MediumDecember 2, 2014
supportezzy ticket system project ticket systemCross-site scripting (XSS) vulnerability in the SupportEzzy Ticket System plugin 1.2.5 for...CVE-2014-9179Public exploit4.0 MediumDecember 2, 2014
smartypantsplugins sp project \& document managerMultiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project...CVE-2014-9178Public exploit7.5 HighDecember 2, 2014
svnlabs html5 mp3 player with playlist freeThe HTML5 MP3 Player with Playlist Free plugin before 2.7 for WordPress allows remote attackers...CVE-2014-91775.0 MediumDecember 2, 2014
instasqueeze sexy squeeze pagesCross-site scripting (XSS) vulnerability in the InstaSqueeze Sexy Squeeze Pages plugin for...CVE-2014-91764.3 MediumDecember 2, 2014
wpdatatablesSQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for...CVE-2014-9175Public exploit7.5 HighDecember 2, 2014
yoast google analyticsCross-site scripting (XSS) vulnerability in the Google Analytics by Yoast (google-analytics-for...CVE-2014-91744.3 MediumDecember 2, 2014
google doc embedder project doc embedderSQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for...CVE-2014-9173Public exploit7.5 HighDecember 2, 2014
cchgroup prosystem fx engagementCCH Wolters Kluwer ProSystem fx Engagement (aka PFX Engagement) 7.1 and earlier uses weak...CVE-2014-9113Public exploit7.2 HighDecember 2, 2014
kennziffer ke questionnaireThe ke_questionnaire extension 2.5.2 and earlier for TYPO3 uses predictable names for the...CVE-2014-88745.0 MediumDecember 2, 2014
gleamtech filevistaGleamTech FileVista before 6.1 allows remote authenticated users to create arbitrary files and...CVE-2014-87896.5 MediumDecember 2, 2014
gleamtech filevistaGleamTech FileVista before 6.1 allows remote authenticated users to obtain sensitive information...CVE-2014-87884.0 MediumDecember 2, 2014
ad-manager project ad-managerOpen redirect vulnerability in track-click.php in the Ad-Manager plugin 1.1.2 for WordPress...CVE-2014-87545.8 MediumDecember 2, 2014
subex roc fraud management systemSQL injection vulnerability in the login page (login/login) in Subex ROC Fraud Management (aka...CVE-2014-8728Public exploit7.5 HighDecember 2, 2014
enalean tuleapproject/register.php in Tuleap before 7.7, when sys_create_project_in_one_step is disabled,...CVE-2014-8791Public exploitEPSS 14.8%6.0 MediumDecember 2, 2014
ossechost-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without...CVE-2014-5284Public exploit7.2 HighDecember 2, 2014
redhat packstackOpenStack PackStack 2012.2.1, when the Open vSwitch (OVS) monolithic plug-in is not used, does...CVE-2014-3703Fix available5.0 MediumDecember 2, 2014
ibm javaIBM Java Runtime Environment (JRE) 7 R1 before SR1 FP1 (7.1.1.1), 7 before SR7 FP1 (7.0.7.1), 6...CVE-2014-30686.4 MediumDecember 2, 2014
fedup project fedupfedup 0.9.0 in Fedora 19, 20, and 21 uses a temporary directory with a static name for its...CVE-2013-64942.1 LowDecember 2, 2014
gnu cpio, debian linux +1 moreHeap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote...CVE-2014-9112Fix available5.0 MediumDecember 2, 2014
mozilla firefox, seamonkey, thunderbird +2 moreMozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey...CVE-2014-1594Fix available6.8 MediumDecember 2, 2014
mozilla firefox, seamonkey, thunderbird +2 moreStack-based buffer overflow in the mozilla::FileBlockCache::Read function in Mozilla Firefox...CVE-2014-1593Fix available6.8 MediumDecember 2, 2014
mozilla firefox, seamonkey, thunderbird +2 moreUse-after-free vulnerability in the nsHtml5TreeOperation function in xul.dll in Mozilla Firefox...CVE-2014-1592Fix available6.8 MediumDecember 2, 2014
mozilla firefox, seamonkey +1 moreMozilla Firefox 33.0 and SeaMonkey before 2.31 include path strings in CSP violation reports,...CVE-2014-1591Fix available4.3 MediumDecember 2, 2014
mozilla firefox, seamonkey, thunderbird +2 moreThe XMLHttpRequest.prototype.send method in Mozilla Firefox before 34.0, Firefox ESR 31.x before...CVE-2014-1590Fix available4.3 MediumDecember 2, 2014
mozilla firefox, seamonkey +1 moreMozilla Firefox before 34.0 and SeaMonkey before 2.31 provide stylesheets with an incorrect...CVE-2014-1589Fix available6.8 MediumDecember 2, 2014
mozilla firefox, seamonkey +1 moreMultiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 34.0 and...CVE-2014-1588Fix available6.8 MediumDecember 2, 2014
mozilla firefox, seamonkey, thunderbird +2 moreMultiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 34.0,...CVE-2014-1587Fix available6.8 MediumDecember 2, 2014
teeworlds MageiaUpdated teeworlds packages fix security vulnerabilityMGASA-2014-0502Fix availableNo scoreDecember 1, 2014
gnome gnome-shell, redhat enterprise linux desktop, enterprise linux hpc node +2 more +4 moreGNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the...CVE-2014-7300Fix available7.2 HighDecember 1, 2014
filefield project filefieldThe FileField module 6.x-3.x before 6.x-3.13 for Drupal does not properly check permissions to...CVE-2014-91564.0 MediumDecember 1, 2014
avatar uploader project uploaderDirectory traversal vulnerability in the Avatar Uploader module 6.x-1.x before 6.x-1.2 and 7.x-1...CVE-2014-91554.0 MediumDecember 1, 2014
notify project notifyThe Notify module 7.x-1.x before 7.x-1.1 for Drupal does not properly restrict access to (1) new...CVE-2014-91544.0 MediumDecember 1, 2014
services project servicesCross-site scripting (XSS) vulnerability in the Services module 7.x-3.x before 7.x-3.10 for...CVE-2014-91534.3 MediumDecember 1, 2014
services project servicesThe _user_resource_create function in the Services module 7.x-3.x before 7.x-3.10 for Drupal uses...CVE-2014-91527.5 HighDecember 1, 2014
services project servicesThe Services module 7.x-3.x before 7.x-3.10 for Drupal does not properly limit the rate of...CVE-2014-91517.5 HighDecember 1, 2014
fasttoggle project fasttoggleThe Fasttoggle module 7.x-1.3 and 7.x-1.4 for Drupal allows remote attackers to block or unblock...CVE-2014-52685.8 MediumDecember 1, 2014
ait-pro bulletproof securityServer-side request forgery (SSRF) vulnerability in admin/htaccess/bpsunlock.php in the...CVE-2014-87495.0 MediumDecember 1, 2014
redhat undertowImproper Limitation of a Pathname to a Restricted Directory in JBoss UndertowCVE-2014-7816Public exploitFix availableEPSS 25.1%5.0 MediumDecember 1, 2014
springshare libcalMultiple cross-site scripting (XSS) vulnerabilities in api_events.php in Springshare LibCal 2.0...CVE-2014-72914.3 MediumDecember 1, 2014
open-xchange app suiteServer-side request forgery (SSRF) vulnerability in the documentconverter component in Open...CVE-2014-52374.3 MediumDecember 1, 2014
Show moreLoading…

Docs Sources Guide Browse Privacy Terms

esc

PagesAll vulnerabilities Browse Docs Sources Guide Get API key

MoveEnter Open