PUBLIÉES EN
octobre 2014
1 418 CVE, des plus récentes aux plus anciennes.
CVE-2014-8578Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administ…
3.5 FAIBLE
CVE-2014-3475Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows r…
3.5 FAIBLE
CVE-2014-3474Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 befo…
3.5 FAIBLE
CVE-2014-3473Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2…
4.3 MOYENNE
CVE-2014-8577Multiple cross-site scripting (XSS) vulnerabilities in Croogo before 2.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) data[Contact][title] parameter …
4.3 MOYENNE
CVE-2014-8509Le logiciel exécutant le service BitTorrent bootstrap-dht est sensible à une erreur de mémoire lors du traitement de paquets spécialement conçus. Un attaquant non authentifié dispo…
7.5 ÉLEVÉE
CVE-2014-8495Citrix XenMobile MDX Toolkit before 9.0.4, when used to wrap iOS 8 applications, does not properly encrypt cached application data, which allows context-dependent attackers to obta…
5.0 MOYENNE
CVE-2014-8399The default configuration in systemd-shim 8 enables the Abandon debugging clause, which allows local users to cause a denial of service via unspecified vectors.
2.1 FAIBLE
CVE-2014-8334The WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) $backu…
6.5 MOYENNE
CVE-2014-8333The VMware driver in OpenStack Compute (Nova) before 2014.1.4 allows remote authenticated users to cause a denial of service (disk consumption) by deleting an instance in the resiz…
4.0 MOYENNE
CVE-2014-8082lib/functions/database.class.php in TestLink before 1.9.13 allows remote attackers to obtain sensitive information via unspecified vectors, which reveals the installation path in a…
5.0 MOYENNE
CVE-2014-8081Les versions de TestLink antérieures à la 1.9.13 sont affectées par une faille dans la manière dont le logiciel gère certains paramètres de résultat. Un attaquant distant peut envo…
7.5 ÉLEVÉE
CVE-2014-7987Cross-site scripting (XSS) vulnerability in EspoCRM before 2.6.0 allows remote attackers to inject arbitrary web script or HTML via the desc parameter in an errors action to instal…
4.3 MOYENNE
CVE-2014-7986install/index.php in EspoCRM before 2.6.0 allows remote attackers to re-install the application via a 1 value in the installProcess parameter.
5.0 MOYENNE
CVE-2014-7985Les versions d'EspoCRM antérieures à la 2.6.0 sont sensibles à une faille de traversée de répertoire dans le script d'installation. Un attaquant distant non authentifié peut l'expl…
10.0 ÉLEVÉE
CVE-2014-7177XML External Entity vulnerability in Enalean Tuleap 7.2 and earlier allows remote authenticated users to read arbitrary files via a crafted xml document in a create action to plugi…
4.0 MOYENNE
CVE-2014-3708OpenStack Compute (Nova) before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (CPU consumption) via an IP filter in a list ac…
4.0 MOYENNE
CVE-2014-2336Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 and FortiAnalyzer before 5.0.7 allow remote attackers to inject …
4.3 MOYENNE
CVE-2014-2335Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 allow remote attackers to inject arbitrary web script or HTML vi…
4.3 MOYENNE
CVE-2014-2334Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML v…
4.3 MOYENNE
CVE-2013-0334Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a differ…
5.0 MOYENNE
CVE-2014-6150Cross-site scripting (XSS) vulnerability in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.2.1.0 through 7.2.1.6 and 7.2.2.0 through 7.2.2.2 allows remote authentica…
3.5 FAIBLE
CVE-2014-6148IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.2.0.0 through 7.2.0.10, 7.2.1.0 through 7.2.1.6, and 7.2.2.0 through 7.2.2.2 does not require TADDM authentication for…
3.5 FAIBLE
CVE-2014-6101Cross-site scripting (XSS) vulnerability in the redirect-login feature in IBM Business Process Manager (BPM) Advanced 7.5 through 8.5.5 allows remote attackers to inject arbitrary …
4.3 MOYENNE
CVE-2014-3375Multiple cross-site scripting (XSS) vulnerabilities in the CCM Service interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary we…
4.3 MOYENNE
CVE-2014-3374Multiple cross-site scripting (XSS) vulnerabilities in the CCM admin interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary web …
4.3 MOYENNE
CVE-2014-3373Multiple cross-site scripting (XSS) vulnerabilities in the CCM Dialed Number Analyzer interface in the Server in Cisco Unified Communications Manager allow remote attackers to inje…
4.3 MOYENNE
CVE-2014-3372Multiple cross-site scripting (XSS) vulnerabilities in the CCM reports interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary we…
4.3 MOYENNE
CVE-2014-3366SQL injection vulnerability in the administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to execute arbitrary SQL commands via a cr…
6.5 MOYENNE
CVE-2013-7409Les versions 5.6.2 à 5.8.1 d'ALLPlayer sont sensibles à un dépassement de tampon lors du traitement de fichiers de listes de lecture .m3u spécialement conçus. Un attaquant peut pro…
7.5 ÉLEVÉE
CVE-2014-3684The tm_adopt function in lib/Libifl/tm.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 5.0.x, 4.5.x, 4.2.x, and earlier does not validate that t…
6.8 MOYENNE
CVE-2014-3623Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML S…
5.0 MOYENNE
CVE-2014-3584The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted S…
5.0 MOYENNE
CVE-2014-3446La version 4.2.22640.0 de BSS Continuity CMS est affectée par une faille qui permet à un attaquant distant d'envoyer des commandes malveillantes à la base de données sous-jacente. …
7.5 ÉLEVÉE
CVE-2013-3304Directory traversal vulnerability in Dell EqualLogic PS4000 with firmware 6.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the default URI.
5.0 MOYENNE
CVE-2014-7877Unspecified vulnerability in the kernel in HP HP-UX B.11.31 allows local users to cause a denial of service via unknown vectors.
4.9 MOYENNE
CVE-2014-8538The Hijab Modern (aka com.Aisyaidea.HijabModern) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof …
5.4 MOYENNE
CVE-2014-8537McAfee Network Data Loss Prevention (NDLP) before 9.2.2 allows local users to obtain sensitive information by reading the logs.
2.1 FAIBLE
CVE-2014-8536McAfee Network Data Loss Prevention (NDLP) before 9.2.2 allows local users to obtain sensitive information by reading unspecified error messages.
2.1 FAIBLE
CVE-2014-8535McAfee Network Data Loss Prevention (NDLP) before 9.2.2 allows local users to bypass intended restriction on unspecified functionality via unknown vectors.
4.6 MOYENNE
CVE-2014-8534Unspecified vulnerability in the login form in McAfee Network Data Loss Prevention (NDLP) before 9.2.2 allows local users to cause a denial of service via a crafted value in the do…
2.1 FAIBLE
CVE-2014-8533Les versions de McAfee Network Data Loss Prevention (NDLP) antérieures à la version 9.3 sont vulnérables à l'exécution de code à distance via des paquets de redirection ICMP spécia…
7.5 ÉLEVÉE
CVE-2014-8532Unspecified vulnerability in McAfee Network Data Loss Prevention before (NDLP) before 9.3 allows local users to obtain sensitive information and impact integrity via unknown vector…
3.6 FAIBLE
CVE-2014-8531The TLS/SSL Server in McAfee Network Data Loss Prevention (NDLP) before 9.3 uses weak cipher algorithms, which makes it easier for remote authenticated users to execute arbitrary c…
6.5 MOYENNE
CVE-2014-8530Les versions de McAfee Network Data Loss Prevention (NDLP) antérieures à la version 9.3 sont affectées par une faille liée à la manière dont le système gère les connexions simultan…
7.5 ÉLEVÉE
CVE-2014-8529McAfee Network Data Loss Prevention (NDLP) before 9.3 stores the SSH key in cleartext, which allows local users to obtain sensitive information via unspecified vectors.
2.1 FAIBLE
CVE-2014-8528McAfee Network Data Loss Prevention (NDLP) before 9.3 logs session IDs, which allows local users to obtain sensitive information by reading the audit log.
2.1 FAIBLE
CVE-2014-8527McAfee Network Data Loss Prevention (NDLP) before 9.3 allows local users to obtain sensitive information and affect integrity via vectors related to a "plain text password."
3.6 FAIBLE
CVE-2014-8526McAfee Network Data Loss Prevention (NDLP) before 9.3 allows local users to obtain sensitive information by reading a Java stack trace.
2.1 FAIBLE
CVE-2014-8525McAfee Network Data Loss Prevention (NDLP) before 9.3 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers t…
5.0 MOYENNE