PUBLIÉES EN
novembre 2014
505 CVE, des plus récentes aux plus anciennes.
CVE-2014-7847iplookup/index.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote attackers to cause a denial of service (resource consumpti…
5.0 MOYENNE
CVE-2014-7846tag/tag_autocomplete.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not consider the moodle/tag:edit capability before adding a t…
4.0 MOYENNE
CVE-2014-7845Les installations de Moodle versions 2.4.11 à 2.7.2 sont affectées par l'utilisation d'un algorithme de génération de mots de passe faible pour les identifiants temporaires. Un att…
7.5 ÉLEVÉE
CVE-2014-7838Multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow remote…
6.8 MOYENNE
CVE-2014-7837mod/wiki/admin.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote authenticated users to remove wiki pages by leveraging del…
5.5 MOYENNE
CVE-2014-7836Multiple cross-site request forgery (CSRF) vulnerabilities in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow remote a…
6.8 MOYENNE
CVE-2014-7835webservice/upload.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not ensure that a file upload is for a private or draft area, which allows remote authenticated users…
2.1 FAIBLE
CVE-2014-7834mod/forum/externallib.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not verify group permissions, which allows remote authenticated users to access a forum via the f…
4.0 MOYENNE
CVE-2014-7833mod/data/edit.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 sets a certain group ID to zero upon a database-entry change, which allow…
4.0 MOYENNE
CVE-2014-7832mod/lti/launch.php in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 performs access control at the course level rather tha…
4.0 MOYENNE
CVE-2014-7831lib/classes/grades_external.php in Moodle 2.7.x before 2.7.3 does not consider the moodle/grade:viewhidden capability before displaying hidden grades, which allows remote authentic…
4.0 MOYENNE
CVE-2014-7830Cross-site scripting (XSS) vulnerability in mod/feedback/mapcourse.php in the Feedback module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7…
3.5 FAIBLE
CVE-2014-5326Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unsp…
4.3 MOYENNE
CVE-2014-5325The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allow remote attacke…
5.0 MOYENNE
CVE-2014-5314Cybozu Office (versions 9 et 10), Mailwise (4 et 5) et Dezie (8) sont affectés par une faille de corruption de mémoire. Un attaquant disposant d'un compte utilisateur valide peut e…
9.0 ÉLEVÉE
CVE-2014-6477Unspecified vulnerability in the JPublisher component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect con…
6.8 MOYENNE
CVE-2014-8714The dissect_write_structured_field function in epan/dissectors/packet-tn5250.c in the TN5250 dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allows remote att…
5.0 MOYENNE
CVE-2014-8713Stack-based buffer overflow in the build_expert_data function in epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2…
5.0 MOYENNE
CVE-2014-8712The build_expert_data function in epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 does not properly initialize a…
5.0 MOYENNE
CVE-2014-8711Multiple integer overflows in epan/dissectors/packet-amqp.c in the AMQP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allow remote attackers to cause a deni…
5.0 MOYENNE
CVE-2014-8710The decompress_sigcomp_message function in epan/sigcomp-udvm.c in the SigComp UDVM dissector in Wireshark 1.10.x before 1.10.11 allows remote attackers to cause a denial of service…
5.0 MOYENNE
CVE-2014-8626Les versions de PHP antérieures à 5.2.7 utilisant l'extension XML-RPC sont concernées. Un attaquant distant peut provoquer le plantage de l'application ou potentiellement exécuter …
7.5 ÉLEVÉE
CVE-2014-6183IBM Security Network Protection 5.1 before 5.1.0.0 FP13, 5.1.1 before 5.1.1.0 FP8, 5.1.2 before 5.1.2.0 FP9, 5.1.2.1 before FP5, 5.2 before 5.2.0.0 FP5, and 5.3 before 5.3.0.0 FP1 …
4.0 MOYENNE
CVE-2014-4807Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated users to cause a denial of service (CPU consumption) via a '\0'…
4.0 MOYENNE
CVE-2014-8683Cross-site scripting (XSS) vulnerability in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script o…
4.3 MOYENNE
CVE-2014-8682Gogs (versions 0.3.1-9 jusqu'à 0.5.x avant la version 0.5.6.1105 Beta) présente des failles dans ses fonctions de recherche de dépôts et d'utilisateurs qui permettent à un attaquan…
7.5 ÉLEVÉE
CVE-2014-8681Gogs (versions 0.3.1-9 à 0.5.6.x) est affecté par une faille d'injection SQL dans son système de suivi des tickets. Un attaquant distant peut exécuter des commandes de base de donn…
7.5 ÉLEVÉE
CVE-2014-8539Cross-site scripting (XSS) vulnerability in Simple Email Form 1.8.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the mod_simpleemailform_field2_1 …
4.3 MOYENNE
CVE-2014-8469Cross-site scripting (XSS) vulnerability in Guests/Boots in AdminCP in Moxi9 PHPFox before 4 Beta allows remote attackers to inject arbitrary web script or HTML via the User-Agent …
4.3 MOYENNE
CVE-2014-8090The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and …
5.0 MOYENNE
CVE-2014-7871SQL injection vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users to execute arbitrary SQL commands via a …
6.5 MOYENNE
CVE-2014-7137Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) contactid parameter in an add…
6.5 MOYENNE
CVE-2014-5395Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R007B100D03SP01C03, E5180s-22 be…
6.8 MOYENNE
CVE-2014-8388Les versions d'Advantech WebAccess antérieures à la version 8.0 sont vulnérables à un dépassement de tampon déclenché par un paramètre d'adresse IP spécialement conçu. Un attaquant…
7.2 ÉLEVÉE
CVE-2014-8000Cisco Unified Communications Manager IM and Presence Service 9.1(1) produces different returned messages for URL requests depending on whether a username exists, which allows remot…
5.0 MOYENNE
CVE-2014-7195Spotfire Web Player Engine in TIBCO Spotfire Web Player 6.0.x before 6.0.2 and 6.5.x before 6.5.2, Spotfire Deployment Kit 6.0.x before 6.0.2 and 6.5.x before 6.5.2, and Silver Fab…
4.0 MOYENNE
CVE-2014-7194TIBCO Managed File Transfer Internet Server before 7.2.4, Managed File Transfer Command Center before 7.2.4, Slingshot before 1.9.3, and Vault before 1.1.1 allow remote attackers t…
6.4 MOYENNE
CVE-2014-9027Multiple cross-site request forgery (CSRF) vulnerabilities in ZTE ZXDSL 831CII allow remote attackers to hijack the authentication of administrators for requests that disable modem…
6.8 MOYENNE
CVE-2014-9026The Ubercart module 7.x-3.x before 7.x-3.7 for Drupal does not properly protect the per-user order history view, which allows remote authenticated users with the "view own orders" …
4.0 MOYENNE
CVE-2014-9025The default checkout completion rule in the commerce_order module in the Drupal Commerce module 7.x-1.x before 7.x-1.10 for Drupal uses the email address as the username for new ac…
5.0 MOYENNE
CVE-2014-9024Les sites Drupal utilisant le module Protected Pages (versions antérieures à 7.x-2.4) sont vulnérables à une faille de traversée de répertoire (path traversal). Un attaquant distan…
7.5 ÉLEVÉE
CVE-2014-9023The Twilio module 7.x-1.x before 7.x-1.9 for Drupal does not properly restrict access to the Twilio administration pages, which allows remote authenticated users to read and modify…
5.5 MOYENNE
CVE-2014-9022The Webform Component Roles module 6.x-1.x before 6.x-1.8 and 7.x-1.x before 7.x-1.8 for Drupal allows remote attackers to bypass the "disabled" restriction and modify read-only co…
6.4 MOYENNE
CVE-2014-9021Multiple cross-site scripting (XSS) vulnerabilities in ZTE ZXDSL 831 allow remote attackers to inject arbitrary web script or HTML via the (1) tr69cAcsURL, (2) tr69cAcsUser, (3) tr…
4.3 MOYENNE
CVE-2014-9020Cross-site scripting (XSS) vulnerability in the Quick Stats page (psilan.cgi) in ZTE ZXDSL 831 and 831CII allows remote attackers to inject arbitrary web script or HTML via the dom…
4.3 MOYENNE
CVE-2014-9019Multiple cross-site request forgery (CSRF) vulnerabilities in ZTE ZXDSL 831CII allow remote attackers to hijack the authentication of administrators for requests that (1) change th…
6.8 MOYENNE
CVE-2014-8769tcpdump 3.8 through 4.6.2 might allow remote attackers to obtain sensitive information from memory or cause a denial of service (packet loss or segmentation fault) via a crafted Ad…
6.4 MOYENNE
CVE-2014-8768Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow remote attackers to cause a denial of service (segmentation fau…
5.0 MOYENNE
CVE-2014-8767Integer underflow in the olsr_print function in tcpdump 3.9.6 through 4.6.2, when in verbose mode, allows remote attackers to cause a denial of service (crash) via a crafted length…
5.0 MOYENNE
CVE-2014-8493ZTE ZXHN H108L with firmware 4.0.0d_ZRQ_GR4 allows remote attackers to modify the CWMP configuration via a crafted request to Forms/access_cwmp_1.
5.0 MOYENNE