CVE-2014-8563: Synacor Zimbra Collaboration before 8.0.9 allows plaintext command injection during STARTTLS.
Synacor Zimbra Collaboration before 8.0.9 allows plaintext command injection during STARTTLS.
Published Jan 27, 2020 · Updated Aug 6, 2024
CVE archive
January 2014
Browse CVE records published in January 2014, with severity, affected products, CWE, KEV, and source-backed vulnerability context.
Showing 50 of 895 matching CVEs · Page 8 of 18.
CVE-2014-8540: The groups API in GitLab 6.x and 7.x before 7.4.3 allows remote authenticated guest users to modify ownersh...
The groups API in GitLab 6.x and 7.x before 7.4.3 allows remote authenticated guest users to modify ownership of arbitrary groups by leveraging improper permission checks.
Published Jan 5, 2018 · Updated Aug 6, 2024
CVE-2014-8362: Vivint Sky Control Panel 1.1.1.9926 allows remote attackers to enable and disable the alarm system and modi...
Vivint Sky Control Panel 1.1.1.9926 allows remote attackers to enable and disable the alarm system and modify other security settings via the Web-enabled interface.
Published Jan 23, 2017 · Updated Aug 6, 2024
CVE-2014-8516: Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute...
Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via unspecified vectors.
Published Jan 3, 2020 · Updated Aug 6, 2024
CVE-2014-8490: Cross-site scripting (XSS) vulnerability in TennisConnect COMPONENTS 9.927 allows remote attackers to injec...
Cross-site scripting (XSS) vulnerability in TennisConnect COMPONENTS 9.927 allows remote attackers to inject arbitrary web script or HTML via the pid parameter to index.cfm.
Published Jan 28, 2020 · Updated Aug 6, 2024
CVE-2014-8478: The web server on Siemens SCALANCE X-300 switches with firmware before 4.0 and SCALANCE X 408 switches with...
The web server on Siemens SCALANCE X-300 switches with firmware before 4.0 and SCALANCE X 408 switches with firmware before 4.0 allows remote attackers to cause a denial of service (reboot) via malformed HTTP requests.
Published Jan 21, 2015 · Updated Aug 6, 2024
CVE-2014-8395: Untrusted search path vulnerability in Corel Painter 2015 allows local users to execute arbitrary code and...
Untrusted search path vulnerability in Corel Painter 2015 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wacommt.dll file that is located in the same folder as the file being processed.
Published Jan 15, 2015 · Updated Aug 6, 2024
CVE-2014-8479: The FTP server on Siemens SCALANCE X-300 switches with firmware before 4.0 and SCALANCE X 408 switches with...
The FTP server on Siemens SCALANCE X-300 switches with firmware before 4.0 and SCALANCE X 408 switches with firmware before 4.0 allows remote authenticated users to cause a denial of service (reboot) via crafted FTP packets.
Published Jan 21, 2015 · Updated Aug 6, 2024
CVE-2014-8396: Untrusted search path vulnerability in Corel PDF Fusion allows local users to execute arbitrary code and co...
Untrusted search path vulnerability in Corel PDF Fusion allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse quserex.dll file that is located in the same folder as the file being processed.
Published Jan 15, 2015 · Updated Aug 6, 2024
CVE-2014-8386: Multiple stack-based buffer overflows in Advantech AdamView 4.3 and earlier allow remote attackers to execu...
Multiple stack-based buffer overflows in Advantech AdamView 4.3 and earlier allow remote attackers to execute arbitrary code via a crafted (1) display properties or (2) conditional bitmap parameter in a GNI file.
Published Jan 20, 2015 · Updated Aug 6, 2024
CVE-2014-8397: Untrusted search path vulnerability in Corel VideoStudio PRO X7 or FastFlick allows local users to execute...
Untrusted search path vulnerability in Corel VideoStudio PRO X7 or FastFlick allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse u32ZLib.dll file that is located in the same folder as the file being processed.
Published Jan 15, 2015 · Updated Aug 6, 2024
CVE-2014-8398: Multiple untrusted search path vulnerabilities in Corel FastFlick allow local users to execute arbitrary co...
Multiple untrusted search path vulnerabilities in Corel FastFlick allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) igfxcmrt32.dll, (2) ipl.dll, (3) MSPStyleLib.dll, (4) uFioUtil.dll, (5) uhDSPlay.dll, (6) uipl.dll, (7) uvipl.dll, (8) VC1DecDll.dll, or (9) VC1DecDll_SSE3.dll file that is located in the same folder as the file being processed.
Published Jan 15, 2015 · Updated Aug 6, 2024
CVE-2014-8335: (1) wp-dbmanager.php and (2) database-manage.php in the WP-DBManager (aka Database Manager) plugin before 2...
(1) wp-dbmanager.php and (2) database-manage.php in the WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.
Published Jan 5, 2018 · Updated Aug 6, 2024
CVE-2014-8370: VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, VMware Fusion 6.x before 6.0.5, and...
VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, VMware Fusion 6.x before 6.0.5, and VMware ESXi 5.0 through 5.5 allow host OS users to gain host OS privileges or cause a denial of service (arbitrary write to a file) by modifying a configuration file.
Published Jan 29, 2015 · Updated Aug 6, 2024
CVE-2014-8394: Multiple untrusted search path vulnerabilities in Corel CAD 2014 allow local users to execute arbitrary cod...
Multiple untrusted search path vulnerabilities in Corel CAD 2014 allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) FxManagedCommands_3.08_9.tx or (2) TD_Mgd_3.08_9.dll file in the current working directory.
Published Jan 15, 2015 · Updated Aug 6, 2024
CVE-2014-8336: The "Sql Run Query" panel in WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows r...
The "Sql Run Query" panel in WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote attackers to read arbitrary files by leveraging failure to sufficiently limit queries, as demonstrated by use of LOAD_FILE in an INSERT statement.
Published Jan 5, 2018 · Updated Aug 6, 2024
CVE-2014-8338: Cross-site scripting (XSS) vulnerability in vwrooms/js/jsor-jcarousel/examples/special_textscroller.php in...
Cross-site scripting (XSS) vulnerability in vwrooms/js/jsor-jcarousel/examples/special_textscroller.php in the VideoWhisper Webcam plugins for Drupal 7.x allows remote attackers to inject arbitrary web script or HTML via a URL to a crafted SVG file in the feed parameter.
Published Jan 31, 2020 · Updated Aug 6, 2024
CVE-2014-8337: Unrestricted file upload vulnerability in includes/classes/uploadify-v2.1.4/uploadify.php in HelpDEZk 1.0.1...
Unrestricted file upload vulnerability in includes/classes/uploadify-v2.1.4/uploadify.php in HelpDEZk 1.0.1 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the directory specified by the folder parameter.
Published Jan 3, 2020 · Updated Aug 6, 2024
CVE-2014-8157: Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers...
Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow.
Published Jan 26, 2015 · Updated Aug 6, 2024
CVE-2014-8322: Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows...
Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute arbitrary code via a crafted length parameter value.
Published Jan 31, 2020 · Updated Aug 6, 2024
CVE-2014-8154: The Gst.MapInfo function in Vala 0.26.0 and 0.26.1 uses an incorrect buffer length declaration for the Gstr...
The Gst.MapInfo function in Vala 0.26.0 and 0.26.1 uses an incorrect buffer length declaration for the Gstreamer bindings, which allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, which trigger a heap-based buffer overflow.
Published Jan 27, 2015 · Updated Aug 6, 2024
CVE-2014-8161: PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9....
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.
Published Jan 27, 2020 · Updated Aug 6, 2024
CVE-2014-8151: The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 through 7.39.0, when us...
The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL (aka SecureTransport) back-end for TLS, does not check if a cached TLS session validated the certificate when reusing the session, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
Published Jan 15, 2015 · Updated Aug 6, 2024
CVE-2014-8158: Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 and earlier allow remote attackers to...
Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 and earlier allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image.
Published Jan 26, 2015 · Updated Aug 6, 2024
CVE-2014-8182: An off-by-one error leading to a crash was discovered in openldap 2.4 when processing DNS SRV messages.
An off-by-one error leading to a crash was discovered in openldap 2.4 when processing DNS SRV messages. If slapd was configured to use the dnssrv backend, an attacker could crash the service with crafted DNS responses.
Published Jan 2, 2020 · Updated Aug 6, 2024
CVE-2014-8143: Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Co...
Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allows remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain privileges, by leveraging delegation of authority for user-account or computer-account creation.
Published Jan 17, 2015 · Updated Aug 6, 2024
CVE-2014-8152: Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming X...
Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document.
Published Jan 21, 2015 · Updated Aug 6, 2024
CVE-2014-8139: Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attack...
Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.
Published Jan 31, 2020 · Updated Aug 6, 2024
CVE-2014-8321: Stack-based buffer overflow in the gps_tracker function in airodump-ng.c in Aircrack-ng before 1.2 RC 1 all...
Stack-based buffer overflow in the gps_tracker function in airodump-ng.c in Aircrack-ng before 1.2 RC 1 allows local users to execute arbitrary code or gain privileges via unspecified vectors.
Published Jan 31, 2020 · Updated Aug 6, 2024
CVE-2014-8148: The default D-Bus access control rule in Midgard2 10.05.7.1 allows local users to send arbitrary method cal...
The default D-Bus access control rule in Midgard2 10.05.7.1 allows local users to send arbitrary method calls or signals to any process on the system bus and possibly execute arbitrary code with root privileges.
Published Jan 26, 2015 · Updated Aug 6, 2024
CVE-2014-8275: OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints o...
OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c.
Published Jan 9, 2015 · Updated Aug 6, 2024
CVE-2014-8153: The L3 agent in OpenStack Neutron 2014.2.x before 2014.2.2, when using radvd 2.0+, allows remote authentica...
The L3 agent in OpenStack Neutron 2014.2.x before 2014.2.2, when using radvd 2.0+, allows remote authenticated users to cause a denial of service (blocked router update processing) by creating eight routers and assigning an ipv6 non-provider subnet to each.
Published Jan 15, 2015 · Updated Aug 6, 2024
CVE-2014-8131: The qemu implementation of virConnectGetAllDomainStats in libvirt before 1.2.11 does not properly handle lo...
The qemu implementation of virConnectGetAllDomainStats in libvirt before 1.2.11 does not properly handle locks when a domain is skipped due to ACL restrictions, which allows a remote authenticated users to cause a denial of service (deadlock or segmentation fault and crash) via a request to access the users does not have privileges to access.
Published Jan 6, 2015 · Updated Aug 6, 2024
CVE-2014-8150: CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows rem...
CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL.
Published Jan 15, 2015 · Updated Aug 6, 2024
CVE-2014-8141: Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote att...
Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.
Published Jan 31, 2020 · Updated Aug 6, 2024
CVE-2014-8140: Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote at...
Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.
Published Jan 31, 2020 · Updated Aug 6, 2024
CVE-2014-8020: Cisco Unified Communication Domain Manager Platform Software allows remote attackers to cause a denial of s...
Cisco Unified Communication Domain Manager Platform Software allows remote attackers to cause a denial of service (CPU consumption, and performance degradation or service outage) via a flood of malformed TCP packets and UDP packets, aka Bug ID CSCup25276.
Published Jan 10, 2015 · Updated Aug 6, 2024
CVE-2014-8166: The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names,...
The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names, which might allow remote attackers to execute arbitrary code via a crafted printer name.
Published Jan 12, 2018 · Updated Aug 6, 2024
CVE-2014-8126: The scheduler in HTCondor before 8.2.6 allows remote authenticated users to execute arbitrary code.
The scheduler in HTCondor before 8.2.6 allows remote authenticated users to execute arbitrary code.
Published Jan 31, 2020 · Updated Aug 6, 2024
CVE-2014-8033: The play/modules component in Cisco WebEx Meetings Server allows remote attackers to obtain administrator a...
The play/modules component in Cisco WebEx Meetings Server allows remote attackers to obtain administrator access via crafted API requests, aka Bug ID CSCuj40421.
Published Jan 9, 2015 · Updated Aug 6, 2024
CVE-2014-8085: Unrestricted file upload vulnerability in the CWebContact::doModel method in oc-includes/osclass/controller...
Unrestricted file upload vulnerability in the CWebContact::doModel method in oc-includes/osclass/controller/contact.php in OSClass before 3.4.3 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in an unspecified directory.
Published Jan 5, 2015 · Updated Aug 6, 2024
CVE-2014-8034: Cisco WebEx Meetings Server 1.5 presents the same CAPTCHA challenge for each login attempt, which makes it...
Cisco WebEx Meetings Server 1.5 presents the same CAPTCHA challenge for each login attempt, which makes it easier for remote attackers to obtain access via a brute-force approach of guessing usernames, aka Bug ID CSCuj40321.
Published Jan 15, 2015 · Updated Aug 6, 2024
CVE-2014-8084: Directory traversal vulnerability in oc-includes/osclass/controller/ajax.php in OSClass before 3.4.3 allows...
Directory traversal vulnerability in oc-includes/osclass/controller/ajax.php in OSClass before 3.4.3 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ajaxfile parameter in a custom action.
Published Jan 5, 2015 · Updated Aug 6, 2024
CVE-2014-8031: Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server allows remote attackers to h...
Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj40456.
Published Jan 9, 2015 · Updated Aug 6, 2024
CVE-2014-8032: The OutlookAction LI in Cisco WebEx Meetings Server allows remote authenticated users to obtain sensitive e...
The OutlookAction LI in Cisco WebEx Meetings Server allows remote authenticated users to obtain sensitive encrypted-password information via unspecified vectors, aka Bug IDs CSCuj40453 and CSCuj40449.
Published Jan 9, 2015 · Updated Aug 6, 2024
CVE-2014-8030: Cross-site scripting (XSS) vulnerability in sendPwMail.do in Cisco WebEx Meetings Server allows remote atta...
Cross-site scripting (XSS) vulnerability in sendPwMail.do in Cisco WebEx Meetings Server allows remote attackers to inject arbitrary web script or HTML via the email parameter, aka Bug ID CSCuj40381.
Published Jan 9, 2015 · Updated Aug 6, 2024
CVE-2014-8028: Multiple cross-site scripting (XSS) vulnerabilities in the web framework in Cisco Secure Access Control Sys...
Multiple cross-site scripting (XSS) vulnerabilities in the web framework in Cisco Secure Access Control System (ACS) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuq79019.
Published Jan 9, 2015 · Updated Aug 6, 2024
CVE-2014-8035: The web framework in Cisco WebEx Meetings Server produces different returned messages for URL requests depe...
The web framework in Cisco WebEx Meetings Server produces different returned messages for URL requests depending on whether a username exists, which allows remote attackers to enumerate user accounts via a series of requests, aka Bug ID CSCuj40247.
Published Jan 10, 2015 · Updated Aug 6, 2024
CVE-2014-8022: Multiple cross-site scripting (XSS) vulnerabilities in Cisco Identity Services Engine allow remote attacker...
Multiple cross-site scripting (XSS) vulnerabilities in Cisco Identity Services Engine allow remote attackers to inject arbitrary web script or HTML via input to unspecified web pages, aka Bug IDs CSCur69835 and CSCur69776.
Published Jan 15, 2015 · Updated Aug 6, 2024
CVE-2014-8029: Open redirect vulnerability in the web interface in Cisco Secure Access Control System (ACS) allows remote...
Open redirect vulnerability in the web interface in Cisco Secure Access Control System (ACS) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter, aka Bug ID CSCuq74150.
Published Jan 9, 2015 · Updated Aug 6, 2024