PUBLIÉES EN
octobre 2014
1 418 CVE, des plus récentes aux plus anciennes.
CVE-2014-6037ManageEngine EventLog Analyzer (versions 9.0 build 9002 et 8.2 build 8020) présente une vulnérabilité dans son système de téléchargement de fichiers. Un attaquant distant non authe…
7.5 ÉLEVÉE
CVE-2014-6133IBM API Management 3.x before 3.0.1.0 allows local users to obtain sensitive ciphertext information via unspecified vectors.
2.1 FAIBLE
CVE-2014-6099The Change Password feature in IBM Sterling B2B Integrator 5.2.x through 5.2.4 does not have a lockout protection mechanism for invalid login requests, which makes it easier for re…
5.0 MOYENNE
CVE-2014-4812The installer in IBM Security AppScan Source 8.x and 9.x through 9.0.1 has an open network port for a debug service, which allows remote attackers to obtain sensitive information b…
1.8 FAIBLE
CVE-2014-2987Multiple cross-site request forgery (CSRF) vulnerabilities in EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroup…
6.8 MOYENNE
CVE-2013-1641Les versions de QuiXplorer antérieures à la 2.5.5 sont affectées par une faille dans la fonctionnalité de téléchargement de fichiers zip. Un attaquant distant et non authentifié pe…
7.8 ÉLEVÉE
CVE-2014-3137Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrict…
6.8 MOYENNE
CVE-2014-0476The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is …
3.7 FAIBLE
CVE-2013-4594The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous users to use the payment of other anonym…
4.3 MOYENNE
CVE-2014-5075The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server hostname matches a domain name in the subject…
6.8 MOYENNE
CVE-2014-1929python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection through positional arguments." NOTE: this vul…
4.4 MOYENNE
CVE-2014-1928The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in u…
4.6 MOYENNE
CVE-2014-1927Les applications Python utilisant la bibliothèque `python-gnupg` (version 0.3.5) sont concernées. Un attaquant peut exécuter des commandes arbitraires sur votre serveur en envoyant…
7.5 ÉLEVÉE
CVE-2014-3636D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of service (prevention of new connections and connection drop) by queuing th…
1.9 FAIBLE
CVE-2014-6611The BlackBerry World app before 5.0.0.262 on BlackBerry 10 OS 10.2.0, before 5.0.0.263 on BlackBerry 10 OS 10.2.1, and before 5.1.0.53 on BlackBerry 10 OS 10.3.0 does not properly …
4.3 MOYENNE
CVE-2014-6152Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Integrated Portal (TIP) 2.2.x allow remote authenticated users to inject arbitrary web script or HTML via unspecif…
3.5 FAIBLE
CVE-2014-6151CRLF injection vulnerability in IBM Tivoli Integrated Portal (TIP) 2.2.x allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting atta…
3.5 FAIBLE
CVE-2014-4624EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x through 7.0.2-43 do not require authentication for Java API calls, which allows remote attackers to disco…
5.0 MOYENNE
CVE-2014-4623EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store (ADS) GEN4(S) and Avamar Virtual Edition (AVE), when Password Hardening before 2.0.0.4 is enabled, uses UNIX DES crypt for p…
4.3 MOYENNE
CVE-2014-4620The EMC NetWorker Module for MEDITECH (aka NMMEDI) 3.0 build 87 through 90, when EMC RecoverPoint and Plink are used, stores cleartext RecoverPoint Appliance credentials in nsrmedi…
2.1 FAIBLE
CVE-2014-3409The Ethernet Connectivity Fault Management (CFM) handling feature in Cisco IOS 12.2(33)SRE9a and earlier and IOS XE 3.13S and earlier allows remote attackers to cause a denial of s…
6.1 MOYENNE
CVE-2014-8760ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption.
5.0 MOYENNE
CVE-2014-7180Electric Cloud ElectricCommander before 4.2.6 and 5.x before 5.0.3 uses world-writable permissions for (1) eccert.pl and (2) ecconfigure.pl, which allows local users to execute arb…
4.6 MOYENNE
CVE-2014-6251Stack-based buffer overflow in CPUMiner before 2.4.1 allows remote attackers to have an unspecified impact by sending a mining.subscribe response with a large nonce2 length, then t…
6.0 MOYENNE
CVE-2014-6230WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the IP blacklist via a crafted X-Forwarded-For header.
4.3 MOYENNE
CVE-2014-3604Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 …
6.8 MOYENNE
CVE-2014-2021Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.2.2 and earlier, and 5.0.x through 5.0.5 allows remote authenticated users to inject arbitrary web scr…
3.5 FAIBLE
CVE-2014-8346Les appareils mobiles Samsung sont affectés par une faille dans la fonctionnalité « Remote Controls » qui permet à un attaquant distant de verrouiller l'écran d'un utilisateur à l'…
7.8 ÉLEVÉE
CVE-2014-7298adsetgroups in Centrify Server Suite 2008 through 2014.1 and Centrify DirectControl 3.x through 4.2.0 on Linux and UNIX allows local users to read arbitrary files with root privile…
4.9 MOYENNE
CVE-2014-8073Cross-site request forgery (CSRF) vulnerability in OpenMRS 2.1 Standalone Edition allows remote attackers to hijack the authentication of administrators for requests that add a new…
6.8 MOYENNE
CVE-2014-8072The administration module in OpenMRS 2.1 Standalone Edition allows remote authenticated users to obtain read access via a direct request to /admin.
4.0 MOYENNE
CVE-2014-8071Multiple cross-site scripting (XSS) vulnerabilities in OpenMRS 2.1 Standalone Edition allow remote attackers to inject arbitrary web script or HTML via the (1) givenName, (2) famil…
4.3 MOYENNE
CVE-2014-7292Open redirect vulnerability in the Click-Through feature in Newtelligence dasBlog 2.1 (2.1.8102.813), 2.2 (2.2.8279.16125), and 2.3 (2.3.9074.18820) allows remote attackers to redi…
5.8 MOYENNE
CVE-2014-7281Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN allows remote attackers to hijack the authentication of admin…
6.8 MOYENNE
CVE-2014-2230Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing …
5.8 MOYENNE
CVE-2014-0619Untrusted search path vulnerability in Hamster Free ZIP Archiver 2.0.1.7 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dl…
6.9 MOYENNE
CVE-2014-4766IBM Sametime Classic Meeting Server 8.0.x and 8.5.x allows remote attackers to obtain sensitive information by reading an exported Record and Playback (RAP) file.
5.0 MOYENNE
CVE-2014-3829Centreon 2.5.1 et Enterprise Server 2.2 sont affectés par une faille dans la page `displayServiceStatus.php`. Un attaquant distant non authentifié peut exécuter des commandes systè…
10.0 ÉLEVÉE
CVE-2014-3828Centreon 2.5.1 et Enterprise Server 2.2 sont affectés par plusieurs failles d'injection SQL dans divers fichiers PHP accessibles via le web. Un attaquant distant non authentifié pe…
10.0 ÉLEVÉE
CVE-2014-8764DokuWiki 2014-05-05a and earlier, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a user name and password starting with a…
5.0 MOYENNE
CVE-2014-8763DokuWiki before 2014-05-05b, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a password starting with a null (\0) characte…
5.0 MOYENNE
CVE-2014-8762The ajax_mediadiff function in DokuWiki before 2014-05-05a allows remote attackers to access arbitrary images via a crafted namespace in the ns parameter.
5.0 MOYENNE
CVE-2014-8761inc/template.php in DokuWiki before 2014-05-05a only checks for access to the root namespace, which allows remote attackers to access arbitrary images via a media file details ajax…
5.0 MOYENNE
CVE-2014-8381Multiple cross-site scripting (XSS) vulnerabilities in Megapolis.Portal Manager allow remote attackers to inject arbitrary web script or HTML via the (1) dateFrom or (2) dateTo par…
4.3 MOYENNE
CVE-2014-8325Les installations TYPO3 utilisant l'extension Calendar Base (versions antérieures à 1.5.9 ou 1.6.1) sont vulnérables à une attaque par déni de service. Un attaquant distant non aut…
7.8 ÉLEVÉE
CVE-2014-8088The (1) Zend_Ldap class in Zend before 1.12.9 and (2) Zend\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote attackers to bypass authentication via a pas…
5.0 MOYENNE
CVE-2014-7968VDSM allows remote attackers to cause a denial of service (connection blocking) by keeping an SSL connection open.
5.0 MOYENNE
CVE-2014-7183Multiple cross-site scripting (XSS) vulnerabilities in the search.php in LiteCart 1.1.2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) quer…
4.3 MOYENNE
CVE-2014-7182Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps plugin before 6.0.27 for WordPress allow remote attackers to inject arbitrary web script or HTML via the p…
4.3 MOYENNE
CVE-2014-6387gpc_api.php in MantisBT 1.2.17 and earlier allows remote attackers to bypass authenticated via a password starting will a null byte, which triggers an unauthenticated bind.
5.0 MOYENNE