Filtered by vendor Subscriptions
Total 323514 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2014-3622 1 Php 1 Php 2024-11-21 9.8 Critical
Use-after-free vulnerability in the add_post_var function in the Posthandler component in PHP 5.6.x before 5.6.1 might allow remote attackers to execute arbitrary code by leveraging a third-party filter extension that accesses a certain ksep value.
CVE-2014-3607 1 Ldaptive 2 Ldaptive, Vt-ldap 2024-11-21 N/A
DefaultHostnameVerifier in Ldaptive (formerly vt-ldap) does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2014-3603 1 Shibboleth 2 Identity Provider, Opensaml Java 2024-11-21 N/A
The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2014-3599 1 Redhat 1 Hornetq 2024-11-21 6.5 Medium
HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy
CVE-2014-3592 1 Redhat 1 Openshift Origin 2024-11-21 6.1 Medium
OpenShift Origin: Improperly validated team names could allow stored XSS attacks
CVE-2014-3591 2 Debian, Gnupg 3 Debian Linux, Gnupg, Libgcrypt 2024-11-21 4.2 Medium
Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.
CVE-2014-3590 1 Redhat 2 Satellite, Satellite Capsule 2024-11-21 6.5 Medium
Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content.
CVE-2014-3585 1 Redhat 3 Enterprise Linux, Redhat-upgrade-tool, Rhel Extras Other 2024-11-21 9.8 Critical
redhat-upgrade-tool: Does not check GPG signatures when upgrading versions
CVE-2014-3539 1 Rope Project 1 Rope 2024-11-21 9.8 Critical
base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.
CVE-2014-3536 1 Redhat 1 Cloudforms Management Engine 2024-11-21 5.5 Medium
CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registration
CVE-2014-3519 1 Openvz 1 Vzkernel 2024-11-21 N/A
The open_by_handle_at function in vzkernel before 042stab090.5 in the OpenVZ modification for the Linux kernel 2.6.32, when using simfs, might allow local container users with CAP_DAC_READ_SEARCH capability to bypass an intended container protection mechanism and access arbitrary files on a filesystem via vectors related to use of the file_handle structure.
CVE-2014-3495 2 Debian, Opensuse 3 Debian Linux, Duplicity, Opensuse 2024-11-21 7.5 High
duplicity 0.6.24 has improper verification of SSL certificates
CVE-2014-3484 1 Musl-libc 1 Musl 2024-11-21 9.8 Critical
Multiple stack-based buffer overflows in the __dn_expand function in network/dn_expand.c in musl libc 1.1x before 1.1.2 and 0.9.13 through 1.0.3 allow remote attackers to (1) have unspecified impact via an invalid name length in a DNS response or (2) cause a denial of service (crash) via an invalid name length in a DNS response, related to an infinite loop with no output.
CVE-2014-3471 1 Qemu 1 Qemu 2024-11-21 N/A
Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU instance crash) via hotplug and hotunplug operations of Virtio block devices.
CVE-2014-3449 1 Bss Continuity Cms Project 1 Bss Continuty Cms 2024-11-21 9.8 Critical
BSS Continuity CMS 4.2.22640.0 has an Authentication Bypass vulnerability
CVE-2014-3448 1 Bss Continuity Cms Project 1 Bss Continuty Cms 2024-11-21 9.8 Critical
BSS Continuity CMS 4.2.22640.0 has a Remote Code Execution vulnerability due to unauthenticated file upload
CVE-2014-3447 1 Bss Continuity Cms Project 1 Bss Continuty Cms 2024-11-21 7.5 High
BSS Continuity CMS 4.2.22640.0 has a Remote Denial Of Service vulnerability
CVE-2014-3445 1 Handsomeweb 1 Sos Webpages 2024-11-21 9.8 Critical
backup.php in HandsomeWeb SOS Webpages before 1.1.12 does not require knowledge of the cleartext password, which allows remote attackers to bypass authentication by leveraging knowledge of the administrator password hash.
CVE-2014-3413 1 Juniper 1 Junos Space 2024-11-21 N/A
The MySQL server in Juniper Networks Junos Space before 13.3R1.8 has an unspecified account with a hardcoded password, which allows remote attackers to obtain sensitive information and consequently obtain administrative control by leveraging database access.
CVE-2014-3244 1 Sugarcrm 1 Sugarcrm 2024-11-21 N/A
XML external entity (XXE) vulnerability in the RSSDashlet dashlet in SugarCRM before 6.5.17 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.