Total
9170 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2014-100039 | 1 Malwarebytes | 1 Malwarebytes Anti-exploit | 2015-01-14 | 2.1 LOW | N/A |
| mbae.sys in Malwarebytes Anti-Exploit before 1.05.1.2014 allows local users to cause a denial of service (crash) via a crafted size in an unspecified IOCTL call, which triggers an out-of-bounds read. NOTE: some of these details are obtained from third party information. | |||||
| CVE-2013-0122 | 1 Avast | 1 Avast\! Mobile Security | 2015-01-08 | 1.9 LOW | N/A |
| The avast! Mobile Security application before 2.0.4400 for Android allows attackers to cause a denial of service (application crash) via a crafted application that sends an intent to com.avast.android.mobilesecurity.app.scanner.DeleteFileActivity with zero arguments. | |||||
| CVE-2014-9509 | 1 Typo3 | 1 Typo3 | 2015-01-06 | 7.5 HIGH | N/A |
| The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set to all or cached, allows remote attackers to have an unspecified impact (possibly resource consumption) via a "Cache Poisoning" attack using a URL with arbitrary arguments, which triggers a reload of the page. | |||||
| CVE-2014-0748 | 1 Cray | 1 Cray Linux Environment | 2014-12-30 | 7.2 HIGH | N/A |
| apinit on Cray devices with CLE before 4.2.UP02 and 5.x before 5.1.UP00 does not use alpsauth data to validate the UID in a launch message, which allows local users to gain privileges via a modified aprun program, aka ID FN5912. | |||||
| CVE-2011-1798 | 1 Google | 1 Chrome | 2014-12-29 | 7.5 HIGH | N/A |
| rendering/svg/RenderSVGText.cpp in WebCore in WebKit in Google Chrome before 11.0.696.65 does not properly perform a cast of an unspecified variable during an attempt to handle a block child, which allows remote attackers to cause a denial of service (application crash) or possibly have unknown other impact via a crafted text element in an SVG document. | |||||
| CVE-2011-1793 | 1 Google | 1 Chrome | 2014-12-29 | 7.5 HIGH | N/A |
| rendering/svg/RenderSVGResourceFilter.cpp in WebCore in WebKit in Google Chrome before 11.0.696.65 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted SVG document that leads to a "stale pointer." | |||||
| CVE-2014-3971 | 1 Mongodb | 1 Mongodb | 2014-12-29 | 5.0 MEDIUM | N/A |
| The CmdAuthenticate::_authenticateX509 function in db/commands/authentication_commands.cpp in mongod in MongoDB 2.6.x before 2.6.2 allows remote attackers to cause a denial of service (daemon crash) by attempting authentication with an invalid X.509 client certificate. | |||||
| CVE-2011-4720 | 1 Hillstone Software | 1 Hs Tftp Server | 2014-12-29 | 5.0 MEDIUM | N/A |
| Hillstone HS TFTP Server 1.3.2 allows remote attackers to cause a denial of service (daemon crash) via a long filename in a (1) RRQ or (2) WRQ operation. | |||||
| CVE-2014-7994 | 1 Cisco | 6 Meraki Mr, Meraki Mr Firmware, Meraki Ms and 3 more | 2014-12-24 | 5.4 MEDIUM | N/A |
| Cisco-Meraki MS, MR, and MX devices with firmware before 2014-09-24 allow remote attackers to execute arbitrary commands by leveraging knowledge of a cross-device secret and a per-device secret, and sending a request to an unspecified HTTP handler on the local network, aka Cisco-Meraki defect ID 00301991. | |||||
| CVE-2014-7241 | 1 Tsutaya | 1 Tsutaya | 2014-12-19 | 6.8 MEDIUM | N/A |
| The TSUTAYA application 5.3 and earlier for Android allows remote attackers to execute arbitrary Java methods via a crafted HTML document. | |||||
| CVE-2014-3137 | 1 Bottlepy | 1 Bottle | 2014-12-18 | 6.8 MEDIUM | N/A |
| Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; (semi-colon) and a Content-Type that would not be accepted, as demonstrated in YouCompleteMe to execute arbitrary code. | |||||
| CVE-2011-4103 | 1 Djangoproject | 1 Piston | 2014-12-18 | 7.5 HIGH | N/A |
| emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method. | |||||
| CVE-2014-7178 | 1 Enalean | 1 Tuleap | 2014-12-16 | 9.3 HIGH | N/A |
| Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function. | |||||
| CVE-2014-8755 | 1 Panasonic | 1 Network Camera View | 2014-12-16 | 6.8 MEDIUM | N/A |
| Panasonic Network Camera View 3 and 4 allows remote attackers to execute arbitrary code via a crafted page, which triggers an invalid pointer dereference, related to "the ability to nullify an arbitrary address in memory." | |||||
| CVE-2014-6381 | 1 Juniper | 3 Mobile System Software, Ringmaster, Smartpass | 2014-12-16 | 2.9 LOW | N/A |
| Juniper WLC devices with WLAN Software releases 8.0.x before 8.0.4, 9.0.x before 9.0.2.11, 9.0.3.x before 9.0.3.5, and 9.1.x before 9.1.1, when "Proxy ARP" or "No Broadcast" features are enabled in a clustered setup, allows remote attackers to cause a denial of service (device disconnect) via unspecified vectors. | |||||
| CVE-2013-2078 | 1 Xen | 1 Xen | 2014-12-11 | 4.7 MEDIUM | N/A |
| Xen 4.0.2 through 4.0.4, 4.1.x, and 4.2.x allows local PV guest users to cause a denial of service (hypervisor crash) via certain bit combinations to the XSETBV instruction. | |||||
| CVE-2014-9351 | 1 Teeworlds | 1 Teeworlds | 2014-12-10 | 6.4 MEDIUM | N/A |
| engine/server/server.cpp in Teeworlds 0.6.x before 0.6.3 allows remote attackers to read memory and cause a denial of service (crash) via unspecified vectors. | |||||
| CVE-2014-8789 | 1 Gleamtech | 1 Filevista | 2014-12-05 | 6.5 MEDIUM | N/A |
| GleamTech FileVista before 6.1 allows remote authenticated users to create arbitrary files and possibly execute arbitrary code via a crafted path in a zip archive, which is not properly handled during extraction. | |||||
| CVE-2014-6609 | 1 Digium | 1 Asterisk | 2014-11-26 | 4.0 MEDIUM | N/A |
| The res_pjsip_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash) via crafted headers in a SIP SUBSCRIBE request for an event package. | |||||
| CVE-2013-7176 | 1 Fail2ban | 1 Fail2ban | 2014-11-18 | 5.0 MEDIUM | N/A |
| config/filter.d/postfix.conf in the postfix filter in Fail2ban before 0.8.11 allows remote attackers to trigger the blocking of an arbitrary IP address via a crafted e-mail address that matches an improperly designed regular expression. | |||||