PUBLIÉES EN
septembre 2014
1 156 CVE, des plus récentes aux plus anciennes.
CVE-2012-5487Les versions de Plone CMS antérieures à 4.2.3 et 4.3 beta 1 sont affectées par une faille dans la logique de liste blanche du bac à sable (sandbox). Un attaquant disposant d'un com…
8.5 ÉLEVÉE
CVE-2012-5486ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) chara…
6.4 MOYENNE
CVE-2012-5485registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.
6.8 MOYENNE
CVE-2014-6836The DS photo+ (aka com.synology.dsphoto) application 3.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers …
5.4 MOYENNE
CVE-2014-6835The Herbal Guide (aka com.pocket.herbal.guide) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof se…
5.4 MOYENNE
CVE-2014-6834The Instaroid - Instagram Viewer (aka net.muik.instaroid) application 1.2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attacker…
5.4 MOYENNE
CVE-2014-6833The AuctionTrac Dealer (aka com.adesa.dealer.phone) application 2.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to s…
5.4 MOYENNE
CVE-2014-6832The Bersa Forum (aka com.gcspublishing.bersaforum) application 3.9.16 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to s…
5.4 MOYENNE
CVE-2014-6831The Hippo Studio (aka com.appgreen.hippostudio) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof s…
5.4 MOYENNE
CVE-2014-6830The Covet Fashion - Shopping Game (aka com.crowdstar.covetfashion) application 2.14.40 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-midd…
5.4 MOYENNE
CVE-2014-6829The Hook (aka com.hook.android) application 0.9.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obt…
5.4 MOYENNE
CVE-2014-6828The Gulf Credit Union (aka Fi_Mobile.Gulf) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof server…
5.4 MOYENNE
CVE-2014-6827The DK ONLINE Beta (aka com.sgmobile.dkonline) application 1.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof …
5.4 MOYENNE
CVE-2014-6826The Tic-Tac To The MAX FREE (aka com.tothemax) application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof se…
5.4 MOYENNE
CVE-2014-6825The Teatro Franco Parenti (aka com.mintlab.mx.teatroparenti) application 1.4.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attac…
5.4 MOYENNE
CVE-2014-6824The kamkomesan (aka com.anek.kamkomesan) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers …
5.4 MOYENNE
CVE-2014-6823The kuailecaidengmi (aka com.licai.kuailecaidengmi) application 1.7.12.15 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers …
5.4 MOYENNE
CVE-2014-6822The Nerdico (aka com.nerdico.danielepais) application 1.9 Stable for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof …
5.4 MOYENNE
CVE-2014-6821The voetbal (aka nl.jborsje.android.voetbal.az) application 4.7.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof…
5.4 MOYENNE
CVE-2014-6820The Amebra Ameba (aka jp.honeytrap15.amebra) application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof se…
5.4 MOYENNE
CVE-2014-6819The Lapp Group Catalogue (aka com.prinovis.LappKabel) application 1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to s…
5.4 MOYENNE
CVE-2014-6818The OHBM 20th Annual Meeting (aka com.coreapps.android.followme.ohbm2014) application 6.0.9.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-t…
5.4 MOYENNE
CVE-2014-6817The Cove (aka org.covechurch.app) application 1.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and o…
5.4 MOYENNE
CVE-2014-6816The WISDOM (aka lvtu99.com.nescmxiaoniuniu) application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof serve…
5.4 MOYENNE
CVE-2014-6815The Vouch! (aka com.voucherry.voucherry) application 2.1.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof server…
5.4 MOYENNE
CVE-2014-6814The Sentinels Randomizer (aka com.mikehipps.sentinelsrandomizer) application 1.1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle a…
5.4 MOYENNE
CVE-2014-6813The klassens (aka com.mcreda.klassens.apps) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof serve…
5.4 MOYENNE
CVE-2014-6812The Aloha Guide (aka com.aloha.guide.english) application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof ser…
5.4 MOYENNE
CVE-2014-6810The RIMS 2014 Annual Conference (aka com.coreapps.android.followme.rims2014) application 6.0.7.4 for Android does not verify X.509 certificates from SSL servers, which allows man-i…
5.4 MOYENNE
CVE-2014-6808The Active 24 (aka com.zentity.app.active24) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof se…
5.4 MOYENNE
CVE-2014-6807The OLA School (aka com.conduit.app_00f9890a4f0145f2aae9d714e20b273a.app) application 1.2.7.132 for Android does not verify X.509 certificates from SSL servers, which allows man-in…
5.4 MOYENNE
CVE-2014-6806The Thanodi - Setswana Translator (aka com.thanodi.thanodi) application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attack…
5.4 MOYENNE
CVE-2014-6805The weibo (aka magic.weibo) application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain se…
5.4 MOYENNE
CVE-2014-6278Les versions de GNU Bash allant jusqu'à la 4.3 sont affectées par une faille dans la manière dont elles gèrent les définitions de fonctions au sein des variables d'environnement. U…
KEV
8.8 ÉLEVÉE
CVE-2013-3632Les serveurs OpenMediaVault sont affectés par une faille dans l'interface PHP du service Cron. Un utilisateur authentifié peut envoyer une requête spécialement conçue pour exécuter…
8.8 ÉLEVÉE
CVE-2013-3092Les routeurs Belkin N300 (F7D7301v1) sont sensibles à un contournement de l'authentification causé par une validation incorrecte des en-têtes HTTP. Un attaquant sur le même réseau …
8.3 ÉLEVÉE
CVE-2013-3089Cross-site request forgery (CSRF) vulnerability in apply.cgi in Belkin N300 (F7D7301v1) router allows remote attackers to hijack the authentication of administrators for requests t…
6.8 MOYENNE
CVE-2013-3086Cross-site request forgery (CSRF) vulnerability in util_system.html in Belkin N900 router allows remote attackers to hijack the authentication of administrators for requests that c…
6.8 MOYENNE
CVE-2013-3083Cross-site request forgery (CSRF) vulnerability in cgi-bin/system_setting.exe in Belkin F5D8236-4 v2 allows remote attackers to hijack the authentication of administrators for requ…
6.8 MOYENNE
CVE-2013-3068Cross-site request forgery (CSRF) vulnerability in apply.cgi in Linksys WRT310Nv2 2.0.0.1 allows remote attackers to hijack the authentication of administrators for requests that c…
6.8 MOYENNE
CVE-2013-3066Les routeurs Linksys EA6500 utilisant la version de firmware 1.1.28.147876 sont susceptibles de présenter une fuite d'informations. Un attaquant non authentifié ayant accès au rése…
7.1 ÉLEVÉE
CVE-2013-3065Cross-site scripting (XSS) vulnerability in the Parental Controls section in Linksys EA6500 with firmware 1.1.28.147876 allows remote authenticated users to inject arbitrary web sc…
3.5 FAIBLE
CVE-2013-3064Open redirect vulnerability in ui/dynamic/unsecured.html in Linksys EA6500 with firmware 1.1.28.147876 allows remote attackers to redirect users to arbitrary web sites and conduct …
6.8 MOYENNE
CVE-2013-2586XAMPP 1.8.1 does not properly restrict access to xampp/lang.php, which allows remote attackers to modify xampp/lang.tmp and execute cross-site scripting (XSS) attacks via the Write…
4.3 MOYENNE
CVE-2013-2100Les systèmes Gentoo Linux utilisant la version 2.1.12 de Portage sont concernés car le gestionnaire de paquets ne vérifie pas les certificats SSL lors des téléchargements via HTTPS…
9.3 ÉLEVÉE
CVE-2013-1874Untrusted search path vulnerability in csi in Chicken before 4.8.2 allows local users to execute arbitrary code via a Trojan horse .csirc in the current working directory.
4.4 MOYENNE
CVE-2012-6110bcron-exec in bcron before 0.10 does not close file descriptors associated with temporary files when running a cron job, which allows local users to modify job files and send spam …
2.1 FAIBLE
CVE-2012-6107Apache Axis2/C does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-i…
4.3 MOYENNE
CVE-2012-5621lib/engine/components/opal/opal-call.cpp in ekiga before 4.0.0 allows remote attackers to cause a denial of service (crash) via an OPAL connection with a party name that contains i…
5.0 MOYENNE
CVE-2012-5619The Sleuth Kit (TSK) 4.0.1 does not properly handle "." (dotfile) file system entries in FAT file systems and other file systems for which . is not a reserved name, which allows lo…
2.1 FAIBLE