Total
210374 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2014-7464 | 1 Magicstamp | 1 Magic Stamp | 2014-11-21 | 5.4 MEDIUM | N/A |
| The Magic Stamp (aka vn.avagame.apotatem) application 2.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. | |||||
| CVE-2014-7465 | 1 Pocketmags | 1 Pc Advisor | 2014-11-21 | 5.4 MEDIUM | N/A |
| The PC Advisor (aka com.triactivemedia.pcadvisor) application @7F08017A for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. | |||||
| CVE-2014-7462 | 1 Teamlava | 1 Fashion Story\ | 2014-11-21 | 5.4 MEDIUM | N/A |
| The Fashion Story: Neon 90's (aka com.teamlava.fashionstory39) application 1.5.6.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. | |||||
| CVE-2014-7195 | 1 Tibco | 3 Silver Fabric Enabler, Spotfire Deployment Kit, Spotfire Web Player | 2014-11-21 | 4.0 MEDIUM | N/A |
| Spotfire Web Player Engine in TIBCO Spotfire Web Player 6.0.x before 6.0.2 and 6.5.x before 6.5.2, Spotfire Deployment Kit 6.0.x before 6.0.2 and 6.5.x before 6.5.2, and Silver Fabric Enabler for Spotfire Web Player before 1.6.1 allows remote authenticated users to obtain sensitive information via unspecified vectors. | |||||
| CVE-2014-7194 | 1 Tibco | 4 Managed File Transfer Command Center, Managed File Transfer Internet Server, Slingshot and 1 more | 2014-11-21 | 6.4 MEDIUM | N/A |
| TIBCO Managed File Transfer Internet Server before 7.2.4, Managed File Transfer Command Center before 7.2.4, Slingshot before 1.9.3, and Vault before 1.1.1 allow remote attackers to obtain sensitive information or modify data by leveraging agent access. | |||||
| CVE-2014-9025 | 1 Commerceguys | 1 Commerce | 2014-11-21 | 5.0 MEDIUM | N/A |
| The default checkout completion rule in the commerce_order module in the Drupal Commerce module 7.x-1.x before 7.x-1.10 for Drupal uses the email address as the username for new accounts created at checkout, which allows remote attackers to obtain sensitive information via unspecified vectors. | |||||
| CVE-2014-9026 | 1 Ubercart | 1 Ubercart | 2014-11-20 | 4.0 MEDIUM | N/A |
| The Ubercart module 7.x-3.x before 7.x-3.7 for Drupal does not properly protect the per-user order history view, which allows remote authenticated users with the "view own orders" permission to obtain sensitive information via unspecified vectors. | |||||
| CVE-2014-9022 | 1 Web Component Roles Project | 1 Web Component Roles | 2014-11-20 | 6.4 MEDIUM | N/A |
| The Webform Component Roles module 6.x-1.x before 6.x-1.8 and 7.x-1.x before 7.x-1.8 for Drupal allows remote attackers to bypass the "disabled" restriction and modify read-only components via a crafted form. | |||||
| CVE-2014-9024 | 1 Protected Pages Project | 1 Protected Pages | 2014-11-20 | 7.5 HIGH | N/A |
| The Protected Pages module 7.x-2.x before 7.x-2.4 for Drupal allows remote attackers to bypass the password protection via a crafted path. | |||||
| CVE-2014-9001 | 1 Incrediblepbx | 1 Incredible Pbx 11 | 2014-11-20 | 6.5 MEDIUM | N/A |
| reminders/index.php in Incredible PBX 11 2.0.6.5.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) APPTMIN, (2) APPTHR, (3) APPTDA, (4) APPTMO, (5) APPTYR, or (6) APPTPHONE parameters. | |||||
| CVE-2014-9000 | 1 Mulesoft | 1 Mule Enterprise Management Console | 2014-11-20 | 6.5 MEDIUM | N/A |
| Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain administrator privileges and execute arbitrary code via a crafted request that adds a new user. NOTE: this issue was originally reported for ESB Runtime 3.5.1, but it originates in MMC. | |||||
| CVE-2014-2382 | 1 Faronics | 1 Deep Freeze | 2014-11-20 | 7.2 HIGH | N/A |
| The DfDiskLo.sys driver in Faronics Deep Freeze Standard and Enterprise 8.10 and earlier allows local administrators to cause a denial of service (crash) and execute arbitrary code via a crafted IOCTL request that writes to arbitrary memory locations, related to the IofCallDriver function. | |||||
| CVE-2014-3697 | 1 Pidgin | 1 Pidgin | 2014-11-19 | 6.4 MEDIUM | N/A |
| Absolute path traversal vulnerability in the untar_block function in win32/untar.c in Pidgin before 2.10.10 on Windows allows remote attackers to write to arbitrary files via a drive name in a tar archive of a smiley theme. | |||||
| CVE-2012-2301 | 1 Ubercart | 1 Ubercart | 2014-11-19 | 6.0 MEDIUM | N/A |
| The Ubercart module 6.x-2.x before 6.x-2.8 for Drupal allows remote authenticated users with the "administer product classes" permission to execute arbitrary PHP code via unspecified vectors. | |||||
| CVE-2014-6625 | 1 Arubanetworks | 1 Clearpass | 2014-11-19 | 9.0 HIGH | N/A |
| The Policy Manager in Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 allows remote authenticated users to gain privileges via unspecified vectors. | |||||
| CVE-2014-6627 | 1 Arubanetworks | 1 Clearpass | 2014-11-19 | 9.0 HIGH | N/A |
| Aruba Networks ClearPass before 6.3.5 and 6.4.x before 6.4.1 allows remote attackers to execute arbitrary commands via unspecified vectors, a different vulnerability than CVE-2014-5342. | |||||
| CVE-2014-6626 | 1 Arubanetworks | 1 Clearpass | 2014-11-19 | 10.0 HIGH | N/A |
| Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 does not properly restrict access to unspecified administrative functions, which allows remote attackers to bypass authentication and execute administrative actions via unknown vectors. | |||||
| CVE-2014-6622 | 1 Arubanetworks | 1 Clearpass | 2014-11-19 | 5.0 MEDIUM | N/A |
| Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 allows remote attackers to determine the validity of filenames via unspecified vectors. | |||||
| CVE-2014-6621 | 1 Arubanetworks | 1 Clearpass | 2014-11-19 | 5.0 MEDIUM | N/A |
| Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 does not disable the troubleshooting and diagnostics page in production systems, which allows remote attackers to obtain version numbers, module configuration, and other sensitive information by reading the page. | |||||
| CVE-2014-5342 | 1 Arubanetworks | 1 Clearpass | 2014-11-19 | 10.0 HIGH | N/A |
| Aruba Networks ClearPass before 6.3.5 and 6.4.x before 6.4.1 allows remote attackers to execute arbitrary commands via unspecified vectors, a different vulnerability than CVE-2014-6627. | |||||