PUBLIÉES EN
octobre 2014
1 418 CVE, des plus récentes aux plus anciennes.
CVE-2014-6352Les anciennes versions de Microsoft Windows (de Vista à Windows 8.1 et Server 2008/2012) sont vulnérables à l'exécution de code à distance via une faille dans la gestion des objets…
KEV
7.8 ÉLEVÉE
CVE-2014-3677Les systèmes utilisant le chargeur d'amorçage Shim pour le démarrage sécurisé UEFI sont concernés. Un attaquant non authentifié disposant d'un accès réseau peut provoquer une corru…
7.5 ÉLEVÉE
CVE-2014-3676Les systèmes utilisant le chargeur d'amorçage Shim sont concernés s'ils sont configurés pour démarrer via un réseau en utilisant DHCPv6. Un attaquant peut envoyer une adresse IPv6 …
7.5 ÉLEVÉE
CVE-2014-3675Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 packet.
5.0 MOYENNE
CVE-2013-7407Cross-site request forgery (CSRF) vulnerability in the MRBS module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
6.8 MOYENNE
CVE-2014-4450The QuickType feature in the Keyboards subsystem in Apple iOS before 8.1 collects typing-prediction data from fields with an off autocomplete attribute, which makes it easier for a…
1.9 FAIBLE
CVE-2014-4449iCloud Data Access in Apple iOS before 8.1 does not verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive infor…
6.8 MOYENNE
CVE-2014-4448House Arrest in Apple iOS before 8.1 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information fro…
1.9 FAIBLE
CVE-2014-3111Multiple cross-site scripting (XSS) vulnerabilities in FOG 0.27 through 0.32 allow remote authenticated users to inject arbitrary web script or HTML via the (1) Printer Model field…
3.5 FAIBLE
CVE-2014-2531SQL injection vulnerability in xhr.php in InterWorx Web Control Panel (aka InterWorx Hosting Control Panel and InterWorx-CP) before 5.0.14 build 577 allows remote authenticated use…
6.5 MOYENNE
CVE-2014-8380Cross-site scripting (XSS) vulnerability in Splunk 6.1.1 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer Header in a "404 Not Found" response. …
4.3 MOYENNE
CVE-2014-8379Multiple cross-site scripting (XSS) vulnerabilities in the Marketo MA module before 7.x-1.5 for Drupal allow remote authenticated users with certain permissions to inject arbitrary…
3.5 FAIBLE
CVE-2014-8378Cross-site scripting (XSS) vulnerability in the TableField module 7.x-2.x before 7.x-2.3 allows remote authenticated users with the "administer content types" or "administer taxono…
3.5 FAIBLE
CVE-2014-8377Cross-site scripting (XSS) vulnerability in Webasyst Shop-Script 5.2.2.30933 allows remote attackers to inject arbitrary web script or HTML via the phone number field in a new cont…
4.3 MOYENNE
CVE-2014-8376Cross-site scripting (XSS) vulnerability in the context administration sub-panel in the Site Banner module before 7.x-4.1 for Drupal allows remote authenticated users with the "Adm…
3.5 FAIBLE
CVE-2014-7280Cross-site scripting (XSS) vulnerability in the Web UI before 2.3.4 Build #85 for Tenable Nessus 5.x allows remote web servers to inject arbitrary web script or HTML via the server…
4.3 MOYENNE
CVE-2014-5006Les versions de Zoho ManageEngine Desktop Central antérieures à la version 9 build 90055 sont vulnérables à une faille de traversée de répertoire. Un attaquant distant peut envoyer…
7.5 ÉLEVÉE
CVE-2014-5005Les versions de ManageEngine Desktop Central antérieures à la version 9 build 90055 sont vulnérables à une faille de traversée de répertoire. Un attaquant distant peut envoyer une …
7.5 ÉLEVÉE
CVE-2014-4577Absolute path traversal vulnerability in reviews.php in the WP AmASIN - The Amazon Affiliate Shop plugin 0.9.6 and earlier for WordPress allows remote attackers to read arbitrary f…
5.0 MOYENNE
CVE-2014-4517Cross-site scripting (XSS) vulnerability in getNetworkSites.php in the CBI Referral Manager plugin 1.2.1 and earlier for WordPress allows remote attackers to inject arbitrary web s…
4.3 MOYENNE
CVE-2014-4514Cross-site scripting (XSS) vulnerability in includes/api_tenpay/inc.tenpay_notify.php in the Alipay plugin 3.6.0 and earlier for WordPress allows remote attackers to inject arbitra…
4.3 MOYENNE
CVE-2014-8375SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administrators to execute arbitrary SQL commands via the selected_gr…
6.5 MOYENNE
CVE-2014-7140Les versions 10.x de Citrix NetScaler ADC et NetScaler Gateway (plus précisément celles antérieures aux versions 10.1-129.11 et 10.5-50.10) sont affectées via leurs interfaces de g…
7.5 ÉLEVÉE
CVE-2013-7406Le module MRBS pour Drupal est affecté par une faille qui permet à des attaquants distants d'exécuter des commandes SQL non autorisées sur la base de données. Un attaquant peut exp…
7.5 ÉLEVÉE
CVE-2012-5702Multiple cross-site scripting (XSS) vulnerabilities in dotProject before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via the (1) callback parameter in a col…
4.3 MOYENNE
CVE-2012-5243functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to read arbitrary database information via a crafted request.
5.0 MOYENNE
CVE-2012-5242Directory traversal vulnerability in functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot)…
6.8 MOYENNE
CVE-2014-7804The Gangsta Auto Thief III (aka com.apptreestudios.gdup3) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers …
5.4 MOYENNE
CVE-2014-7803The Woodward Bail (aka com.onesolutionapps.woodwardbailandroid) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle atta…
5.4 MOYENNE
CVE-2014-7802The Top Roller Coasters Europe 2 (aka com.appaapps.top10tallesteuropeanrollercoasters2) application @7F050001 for Android does not verify X.509 certificates from SSL servers, which…
5.4 MOYENNE
CVE-2014-7800The Daily Green (aka it.opentt.blog.dailygreen) application 2014.07 dlygrn for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers…
5.4 MOYENNE
CVE-2014-7799The Squishy birds (aka com.tatmob.squishybirds) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof…
5.4 MOYENNE
CVE-2014-7798The Coca-Cola FM Brasil (aka com.enyetech.radio.coca_cola.fm_br) application 2.0.41709 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-midd…
5.4 MOYENNE
CVE-2014-7797The Thai food (aka com.foods.thaifood) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers an…
5.4 MOYENNE
CVE-2014-7796The House365 Radio (aka com.nobexinc.wls_27853803.rc) application 3.2.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to…
5.4 MOYENNE
CVE-2014-7795The Harpers Bazaar Art (aka com.itp.harpersart) application @7F080181 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to s…
5.4 MOYENNE
CVE-2014-7794The Knights of the Void (aka me.narr8.android.serial.knights_of_the_void) application 2.1.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the…
5.4 MOYENNE
CVE-2014-7793The CB - Calciatori Brutti (aka com.calciatori.brutti) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to …
5.4 MOYENNE
CVE-2014-7791The Backyard Wrestling (aka com.wBackyardWrestling) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spo…
5.4 MOYENNE
CVE-2014-7789The Zillion Muslims (aka com.zillionmuslims.src) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof …
5.4 MOYENNE
CVE-2014-7788The Best Free Giveaways (aka com.wIphone5GiveAways) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spo…
5.4 MOYENNE
CVE-2014-7787The iShuttle (aka com.synapse.ishuttle_user) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof serv…
5.4 MOYENNE
CVE-2014-7786The English Football Magazine (aka com.magzter.englishfootball) application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle atta…
5.4 MOYENNE
CVE-2014-7785The AAAA Discount Bail (aka com.onesolutionapps.aaaadiscountbailandroid) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-mi…
5.4 MOYENNE
CVE-2014-7784The Schon! Magazine (aka com.magzter.schonmagazine) application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spo…
5.4 MOYENNE
CVE-2014-7783The Bill G. Bennett (aka com.billgbennett) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof server…
5.4 MOYENNE
CVE-2014-7782The Macedonia Hacienda Hotel (aka appinventor.ai_orolimpio999.HotelMacedonia) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-t…
5.4 MOYENNE
CVE-2014-7781The Marijuana Handbook Lite - Weed (aka com.fallacystudios.marijuanahandbooklite) application 3.2 for Android does not verify X.509 certificates from SSL servers, which allows man-…
5.4 MOYENNE
CVE-2014-7780The Pakistan Cricket News (aka com.conduit.app_cf18df8bdf454eb0a836e2d29886bc40.app) application 1.21.38.6504 for Android does not verify X.509 certificates from SSL servers, which…
5.4 MOYENNE
CVE-2014-7779The Kuran'in Bilimsel Mucizeleri (aka com.wKurannBilimselMucizeleri) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle…
5.4 MOYENNE