CVE-2014-5092: Status2k allows Remote Command Execution in admin/options/editpl.php.
Status2k allows Remote Command Execution in admin/options/editpl.php.
Published Jan 10, 2020 · Updated Aug 6, 2024
CVE archive
January 2014
Browse CVE records published in January 2014, with severity, affected products, CWE, KEV, and source-backed vulnerability context.
Showing 50 of 895 matching CVEs · Page 12 of 18.
CVE-2014-5040: HP Helion Eucalyptus 4.1.x before 4.1.2 and HPE Helion Eucalyptus 4.2.x before 4.2.1 allow remote authentic...
HP Helion Eucalyptus 4.1.x before 4.1.2 and HPE Helion Eucalyptus 4.2.x before 4.2.1 allow remote authenticated users to bypass intended access restrictions and modify arbitrary (1) access key credentials by leveraging knowledge of a key ID or (2) signing certificates by leveraging knowledge of a certificate ID.
Published Jan 5, 2016 · Updated Aug 6, 2024
CVE-2014-4994: lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a sy...
lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file, related to time-based filenames.
Published Jan 10, 2018 · Updated Aug 6, 2024
CVE-2014-5001: lib/ksymfony1.rb in the kcapifony gem 2.1.6 for Ruby places database user passwords on the (1) mysqldump, (...
lib/ksymfony1.rb in the kcapifony gem 2.1.6 for Ruby places database user passwords on the (1) mysqldump, (2) pg_dump, (3) mysql, and (4) psql command lines, which allows local users to obtain sensitive information by listing the processes.
Published Jan 10, 2018 · Updated Aug 6, 2024
CVE-2014-4993: (1) lib/backup/cli/utility.rb in the backup-agoddard gem 3.0.28 and (2) lib/backup/cli/utility.rb in the ba...
(1) lib/backup/cli/utility.rb in the backup-agoddard gem 3.0.28 and (2) lib/backup/cli/utility.rb in the backup_checksum gem 3.0.23 for Ruby place credentials on the openssl command line, which allows local users to obtain sensitive information by listing the process.
Published Jan 10, 2018 · Updated Aug 6, 2024
CVE-2014-5068: Directory traversal vulnerability in the web application in Symmetricom s350i 2.70.15 allows remote attacke...
Directory traversal vulnerability in the web application in Symmetricom s350i 2.70.15 allows remote attackers to read arbitrary files via a (1) ../ (dot dot slash) or (2) ..\ (dot dot forward slash) before a file name.
Published Jan 11, 2018 · Updated Aug 6, 2024
CVE-2014-4999: vendor/plugins/dataset/lib/dataset/database/mysql.rb in the kajam gem 1.0.3.rc2 for Ruby places the mysql u...
vendor/plugins/dataset/lib/dataset/database/mysql.rb in the kajam gem 1.0.3.rc2 for Ruby places the mysql user password on the (1) mysqldump command line in the capture function and (2) mysql command line in the restore function, which allows local users to obtain sensitive information by listing the process.
Published Jan 10, 2018 · Updated Aug 6, 2024
CVE-2014-4995: Race condition in lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to o...
Race condition in lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to obtain sensitive information by reading the MySQL root password from a temporary file before it is removed.
Published Jan 10, 2018 · Updated Aug 6, 2024
CVE-2014-5081: sphider prior to 1.3.6, sphider-pro prior to 3.2, and sphider-plus prior to 3.2 allow authentication bypass
sphider prior to 1.3.6, sphider-pro prior to 3.2, and sphider-plus prior to 3.2 allow authentication bypass
Published Jan 10, 2020 · Updated Aug 6, 2024
CVE-2014-5012: DOMPDF before 0.6.2 allows denial of service.
DOMPDF before 0.6.2 allows denial of service.
Published Jan 10, 2020 · Updated Aug 6, 2024
CVE-2014-5000: The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl comma...
The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process.
Published Jan 10, 2018 · Updated Aug 6, 2024
CVE-2014-5011: DOMPDF before 0.6.2 allows Information Disclosure.
DOMPDF before 0.6.2 allows Information Disclosure.
Published Jan 10, 2020 · Updated Aug 6, 2024
CVE-2014-5039: Cross-site scripting (XSS) vulnerability in Eucalyptus Management Console (EMC) 4.0.x before 4.0.2 allows r...
Cross-site scripting (XSS) vulnerability in Eucalyptus Management Console (EMC) 4.0.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Published Jan 31, 2020 · Updated Aug 6, 2024
CVE-2014-5007: Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC)...
Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build 90055 allows remote attackers to write to and execute arbitrary files as SYSTEM via a .. (dot dot) in the filename parameter.
Published Jan 17, 2020 · Updated Aug 6, 2024
CVE-2014-4984: Déjà Vu Crescendo Sales CRM has remote SQL Injection
Déjà Vu Crescendo Sales CRM has remote SQL Injection
Published Jan 10, 2020 · Updated Aug 6, 2024
CVE-2014-4982: LPAR2RRD ≤ 4.53 and ≤ 3.5 has arbitrary command injection on the application server.
LPAR2RRD ≤ 4.53 and ≤ 3.5 has arbitrary command injection on the application server.
Published Jan 10, 2020 · Updated Aug 6, 2024
CVE-2014-4972: Unrestricted file upload vulnerability in the Gravity Upload Ajax plugin 1.1 and earlier for WordPress allo...
Unrestricted file upload vulnerability in the Gravity Upload Ajax plugin 1.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under wp-content/uploads/gravity_forms.
Published Jan 8, 2018 · Updated Aug 6, 2024
CVE-2014-4991: (1) lib/dataset/database/mysql.rb and (2) lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3...
(1) lib/dataset/database/mysql.rb and (2) lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3.2.1 for Ruby place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.
Published Jan 10, 2018 · Updated Aug 6, 2024
CVE-2014-4997: lib/commands/setup.rb in the point-cli gem 0.0.1 for Ruby places credentials on the curl command line, whic...
lib/commands/setup.rb in the point-cli gem 0.0.1 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process.
Published Jan 10, 2018 · Updated Aug 6, 2024
CVE-2014-4996: lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to write to arbitrary...
lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to write to arbitrary files via a symlink attack on /tmp/my.cnf.#{target_host}.
Published Jan 10, 2018 · Updated Aug 6, 2024
CVE-2014-4992: lib/cap-strap/helpers.rb in the cap-strap gem 0.1.5 for Ruby places credentials on the useradd command line...
lib/cap-strap/helpers.rb in the cap-strap gem 0.1.5 for Ruby places credentials on the useradd command line, which allows local users to obtain sensitive information by listing the process.
Published Jan 10, 2018 · Updated Aug 6, 2024
CVE-2014-4919: OXID eShop Professional Edition before 4.7.13 and 4.8.x before 4.8.7, Enterprise Edition before 5.0.13 and...
OXID eShop Professional Edition before 4.7.13 and 4.8.x before 4.8.7, Enterprise Edition before 5.0.13 and 5.1.x before 5.1.7, and Community Edition before 4.7.13 and 4.8.x before 4.8.7 allow remote attackers to assign users to arbitrary dynamical user groups.
Published Jan 19, 2018 · Updated Aug 6, 2024
CVE-2014-4860: Multiple integer overflows in the Pre-EFI Initialization (PEI) boot phase in the Capsule Update feature in...
Multiple integer overflows in the Pre-EFI Initialization (PEI) boot phase in the Capsule Update feature in the UEFI implementation in EDK2 allow physically proximate attackers to bypass intended access restrictions by providing crafted data that is not properly handled during the coalescing phase.
Published Jan 31, 2020 · Updated Aug 6, 2024
CVE-2014-4835: IBM ServerGuide before 9.63, UpdateXpress System Packs Installer (UXSPI) before 9.63, and ToolsCenter Suite...
IBM ServerGuide before 9.63, UpdateXpress System Packs Installer (UXSPI) before 9.63, and ToolsCenter Suite before 9.63 place credentials in logs, which allows local users to obtain sensitive information by reading a file.
Published Jan 17, 2015 · Updated Aug 6, 2024
CVE-2014-4859: Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in the UEFI i...
Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in the UEFI implementation in EDK2 allows physically proximate attackers to bypass intended access restrictions via crafted data.
Published Jan 31, 2020 · Updated Aug 6, 2024
CVE-2014-4705: Multiple heap-based buffer overflows in the eSap software platform in Huawei Campus S9300, S7700, S9700, S5...
Multiple heap-based buffer overflows in the eSap software platform in Huawei Campus S9300, S7700, S9700, S5300, S5700, S6300, and S6700 series switches; AR150, AR160, AR200, AR1200, AR2200, AR3200, AR530, NetEngine16EX, SRG1300, SRG2300, and SRG3300 series routers; and WLAN AC6005, AC6605, and ACU2 access controllers allow remote attackers to cause a denial of service (device restart) via a crafted length field in a packet.
Published Jan 30, 2018 · Updated Aug 6, 2024
CVE-2014-4637: Open redirect vulnerability in EMC Documentum Web Development Kit (WDK) before 6.8 allows remote attackers...
Open redirect vulnerability in EMC Documentum Web Development Kit (WDK) before 6.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter.
Published Jan 7, 2015 · Updated Aug 6, 2024
CVE-2014-4638: EMC Documentum Web Development Kit (WDK) before 6.8 allows remote attackers to conduct frame-injection atta...
EMC Documentum Web Development Kit (WDK) before 6.8 allows remote attackers to conduct frame-injection attacks and obtain sensitive information via unspecified vectors.
Published Jan 7, 2015 · Updated Aug 6, 2024
CVE-2014-4610: Integer overflow in the get_len function in libavutil/lzo.c in FFmpeg before 0.10.14, 1.1.x before 1.1.12,...
Integer overflow in the get_len function in libavutil/lzo.c in FFmpeg before 0.10.14, 1.1.x before 1.1.12, 1.2.x before 1.2.7, 2.0.x before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.4 allows remote attackers to execute arbitrary code via a crafted Literal Run.
Published Jan 14, 2020 · Updated Aug 6, 2024
CVE-2014-4636: Cross-site request forgery (CSRF) vulnerability in EMC Documentum Web Development Kit (WDK) before 6.8 allo...
Cross-site request forgery (CSRF) vulnerability in EMC Documentum Web Development Kit (WDK) before 6.8 allows remote attackers to hijack the authentication of arbitrary users for requests that perform Docbase operations.
Published Jan 7, 2015 · Updated Aug 6, 2024
CVE-2014-4635: Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum Web Development Kit (WDK) before 6.8...
Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum Web Development Kit (WDK) before 6.8 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Published Jan 7, 2015 · Updated Aug 6, 2024
CVE-2014-4561: The ultimate-weather plugin 1.0 for WordPress has XSS
The ultimate-weather plugin 1.0 for WordPress has XSS
Published Jan 10, 2020 · Updated Aug 6, 2024
CVE-2014-4486: IOAcceleratorFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does no...
IOAcceleratorFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly handle resource lists and IOService userclient types, which allows attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via a crafted app.
Published Jan 30, 2015 · Updated Aug 6, 2024
CVE-2014-4489: IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not proper...
IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly initialize event queues, which allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.
Published Jan 30, 2015 · Updated Aug 6, 2024
CVE-2014-4609: Integer overflow in the get_len function in libavutil/lzo.c in Libav before 0.8.13, 9.x before 9.14, and 10...
Integer overflow in the get_len function in libavutil/lzo.c in Libav before 0.8.13, 9.x before 9.14, and 10.x before 10.2 allows remote attackers to execute arbitrary code via a crafted Literal Run.
Published Jan 14, 2020 · Updated Aug 6, 2024
CVE-2014-4639: EMC Documentum Web Development Kit (WDK) before 6.8 does not properly generate random numbers for a certain...
EMC Documentum Web Development Kit (WDK) before 6.8 does not properly generate random numbers for a certain parameter related to Webtop components, which makes it easier for remote attackers to conduct phishing attacks via brute-force attempts to predict the parameter value.
Published Jan 7, 2015 · Updated Aug 6, 2024
CVE-2014-4553: Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows re...
Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attackers to execute arbitrary web script or HTML via unspecified parameters.
Published Jan 2, 2020 · Updated Aug 6, 2024
CVE-2014-4530: flog plugin 0.1 for WordPress has XSS
flog plugin 0.1 for WordPress has XSS
Published Jan 10, 2020 · Updated Aug 6, 2024
CVE-2014-4493: The app-installation functionality in MobileInstallation in Apple iOS before 8.1.3 allows attackers to obta...
The app-installation functionality in MobileInstallation in Apple iOS before 8.1.3 allows attackers to obtain control of the local app container by leveraging access to an enterprise distribution certificate for signing a crafted app.
Published Jan 30, 2015 · Updated Aug 6, 2024
CVE-2014-4498: The CPU Software in Apple OS X before 10.10.2 allows physically proximate attackers to modify firmware duri...
The CPU Software in Apple OS X before 10.10.2 allows physically proximate attackers to modify firmware during the EFI update process by inserting a Thunderbolt device with crafted code in an Option ROM, aka the "Thunderstrike" issue.
Published Jan 30, 2015 · Updated Aug 6, 2024
CVE-2014-4467: WebKit, as used in Apple iOS before 8.1.3, does not properly determine scrollbar boundaries during the rend...
WebKit, as used in Apple iOS before 8.1.3, does not properly determine scrollbar boundaries during the rendering of FRAME elements, which allows remote attackers to spoof the UI via a crafted web site.
Published Jan 30, 2015 · Updated Aug 6, 2024
CVE-2014-4499: The App Store process in CommerceKit Framework in Apple OS X before 10.10.2 places Apple ID credentials in...
The App Store process in CommerceKit Framework in Apple OS X before 10.10.2 places Apple ID credentials in App Store logs, which allows local users to obtain sensitive information by reading a file.
Published Jan 30, 2015 · Updated Aug 6, 2024
CVE-2014-4495: The kernel in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not enforce...
The kernel in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not enforce the read-only attribute of a shared memory segment during use of a custom cache mode, which allows attackers to bypass intended access restrictions via a crafted app.
Published Jan 30, 2015 · Updated Aug 6, 2024
CVE-2014-4494: Springboard in Apple iOS before 8.1.3 does not properly validate signatures when determining whether to sol...
Springboard in Apple iOS before 8.1.3 does not properly validate signatures when determining whether to solicit an app trust decision from the user, which allows attackers to bypass intended first-launch restrictions by leveraging access to an enterprise distribution certificate for signing a crafted app.
Published Jan 30, 2015 · Updated Aug 6, 2024
CVE-2014-4476: WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0....
WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-4477 and CVE-2014-4479.
Published Jan 30, 2015 · Updated Aug 6, 2024
CVE-2014-4497: Integer signedness error in IOBluetoothFamily in the Bluetooth implementation in Apple OS X before 10.10 al...
Integer signedness error in IOBluetoothFamily in the Bluetooth implementation in Apple OS X before 10.10 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (write to kernel memory) via a crafted app.
Published Jan 30, 2015 · Updated Aug 6, 2024
CVE-2014-4492: libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify...
libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain values have the expected data type, which allows attackers to execute arbitrary code in an _networkd context via a crafted XPC message from a sandboxed app, as demonstrated by lack of verification of the XPC dictionary data type.
Published Jan 30, 2015 · Updated Aug 6, 2024
CVE-2014-4488: IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not proper...
IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly validate resource-queue metadata, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
Published Jan 30, 2015 · Updated Aug 6, 2024
CVE-2014-4487: Buffer overflow in IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7....
Buffer overflow in IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows attackers to execute arbitrary code in a privileged context via a crafted app.
Published Jan 30, 2015 · Updated Aug 6, 2024
CVE-2014-4479: WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0....
WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-4476 and CVE-2014-4477.
Published Jan 30, 2015 · Updated Aug 6, 2024