PUBLIÉES EN
novembre 2014
505 CVE, des plus récentes aux plus anciennes.
CVE-2014-4463Apple iOS before 8.1.1 allows physically proximate attackers to bypass the lock-screen protection mechanism, and view or transmit a Photo Library photo, via the FaceTime "Leave a M…
2.1 FAIBLE
CVE-2014-4462WebKit, as used in Apple iOS before 8.1.1 and Apple TV before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and applicati…
5.8 MOYENNE
CVE-2014-4461Les versions d'Apple iOS antérieures à 8.1.1 et les versions d'Apple TV antérieures à 7.0.2 sont affectées par une erreur de validation de la mémoire dans le noyau. Un attaquant pe…
9.3 ÉLEVÉE
CVE-2014-4460CFNetwork in Apple iOS before 8.1.1 and OS X before 10.10.1 does not properly clear the browsing cache upon a transition out of private-browsing mode, which makes it easier for phy…
2.1 FAIBLE
CVE-2014-4459Use-after-free vulnerability in WebKit, as used in Apple OS X before 10.10.1, allows remote attackers to execute arbitrary code via crafted page objects in an HTML document.
6.8 MOYENNE
CVE-2014-4458The "System Profiler About This Mac" component in Apple OS X before 10.10.1 includes extraneous cookie data in system-model requests, which might allow remote attackers to obtain s…
5.0 MOYENNE
CVE-2014-4457Les versions d'Apple iOS antérieures à la 8.1.1 sont affectées par une faille dans les profils de bac à sable (sandbox) utilisés par le debugserver. Un attaquant peut contourner le…
7.5 ÉLEVÉE
CVE-2014-4455dyld in Apple iOS before 8.1.1 and Apple TV before 7.0.2 does not properly handle overlapping segments in Mach-O executable files, which allows local users to bypass intended code-…
2.1 FAIBLE
CVE-2014-4453Apple iOS before 8.1.1 and OS X before 10.10.1 include location data during establishment of a Spotlight Suggestions server connection by Spotlight or Safari, which might allow rem…
5.0 MOYENNE
CVE-2014-4452WebKit, as used in Apple iOS before 8.1.1 and Apple TV before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and applicati…
5.4 MOYENNE
CVE-2014-4451Les appareils Apple iOS exécutant des versions antérieures à 8.1.1 sont affectés par une faille qui ne permet pas d'appliquer correctement la limite de tentatives de saisie du code…
7.2 ÉLEVÉE
CVE-2014-7992The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensitive credential information from process memory via a session …
5.0 MOYENNE
CVE-2014-6110IBM Security Identity Manager 6.x before 6.0.0.3 IF14 does not properly perform logout actions, which allows remote attackers to access sessions by leveraging an unattended worksta…
2.1 FAIBLE
CVE-2014-6107IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to obtain sensitive cookie information by sniffing the network during an HTTP session.
4.3 MOYENNE
CVE-2014-6105IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
4.3 MOYENNE
CVE-2014-6098IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to discover cleartext passwords via a crafted request.
5.0 MOYENNE
CVE-2014-6096Cross-site scripting (XSS) vulnerability in IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
4.3 MOYENNE
CVE-2014-6095Directory traversal vulnerability in IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to read arbitrary files via unspecified vectors.
5.0 MOYENNE
CVE-2014-0059JBoss SX and PicketBox, as used in Red Hat JBoss Enterprise Application Platform (EAP) before 6.2.3, use world-readable permissions on audit.log, which allows local users to obtain…
2.1 FAIBLE
CVE-2012-6665Directory traversal vulnerability in index.php in phpMoneyBooks 1.0.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, a different vulnerab…
4.3 MOYENNE
CVE-2012-1669Directory traversal vulnerability in index.php in phpMoneyBooks before 1.0.3 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module p…
4.3 MOYENNE
CVE-2014-8955Cross-site scripting (XSS) vulnerability in the Contact Form Clean and Simple (clean-and-simple-contact-form-by-meg-nicholas) plugin 4.4.0 and earlier for WordPress allows remote a…
4.3 MOYENNE
CVE-2014-8954Multiple cross-site scripting (XSS) vulnerabilities in phpSound 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) Title or (2) Description fields in a…
4.3 MOYENNE
CVE-2014-8953Multiple cross-site request forgery (CSRF) vulnerabilities in Php Scriptlerim Who's Who script allow remote attackers to hijack the authentication of administrators or requests tha…
6.8 MOYENNE
CVE-2014-8732Cross-site scripting (XSS) vulnerability in phpMemcachedAdmin 1.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
4.3 MOYENNE
CVE-2014-8727Multiple directory traversal vulnerabilities in F5 BIG-IP before 10.2.2 allow local users with the "Resource Administrator" or "Administrator" role to enumerate and delete arbitrar…
6.2 MOYENNE
CVE-2014-8596PHP-Fusion 7.02.07 est vulnérable aux injections SQL via le panneau d'administration. Un attaquant disposant d'un accès réseau peut envoyer des requêtes spécialement conçues vers l…
7.5 ÉLEVÉE
CVE-2014-8517Le client `tnftp` dans plusieurs anciennes versions de NetBSD est susceptible de permettre l'exécution de commandes à distance. Un attaquant non authentifié peut exécuter des comma…
7.5 ÉLEVÉE
CVE-2014-8499Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allow remot…
6.5 MOYENNE
CVE-2014-8498SQL injection vulnerability in BulkEditSearchResult.cc in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build …
6.5 MOYENNE
CVE-2014-5277Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade atta…
5.0 MOYENNE
CVE-2014-3629XML external entity (XXE) vulnerability in the XML Exchange module in Apache Qpid 0.30 allows remote attackers to cause outgoing HTTP connections via a crafted message.
4.3 MOYENNE
CVE-2014-8952Les passerelles de sécurité Check Point exécutant diverses versions (de R75.40VS à R77.10) sont concernées si des lames spécifiques — telles que les modules IPS, SSL VPN ou HTTPS I…
7.1 ÉLEVÉE
CVE-2014-8951Les passerelles de sécurité Check Point (versions R75 à R77.10) sont concernées si UserCheck est activé en parallèle de lames de sécurité spécifiques, telles que le filtrage d'URL …
7.1 ÉLEVÉE
CVE-2014-8950Les passerelles de sécurité Check Point exécutant R77 ou R77.10 sont concernées si les fonctionnalités de filtrage d'URL ou d'Identity Awareness sont activées. Un attaquant distant…
7.1 ÉLEVÉE
CVE-2014-3916The str_buf_cat function in string.c in Ruby 1.9.3, 2.0.0, and 2.1 allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string.
5.0 MOYENNE
CVE-2014-3248Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mco…
6.2 MOYENNE
CVE-2014-0250Les clients FreeRDP sont affectés par des erreurs de gestion de la mémoire lors du traitement de données graphiques provenant d'un serveur distant. Un attaquant contrôlant un serve…
7.5 ÉLEVÉE
CVE-2014-0228Apache Hive before 0.13.1, when in SQL standards based authorization mode, does not properly check the file permissions for (1) import and (2) export statements, which allows remot…
3.5 FAIBLE
CVE-2014-8949The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the i4w_trace param…
6.0 MOYENNE
CVE-2014-8948Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote attackers to hijack the authentication of administrator…
6.8 MOYENNE
CVE-2014-3756The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of an external file and cause a denial of service (hang and resource consumption) via a crafted…
5.0 MOYENNE
CVE-2014-3755The QSvg module in Qt, as used in the Mumble client 1.2.x before 1.2.6, allows remote attackers to cause a denial of service (hang and resource consumption) via a local file refere…
5.0 MOYENNE
CVE-2014-0233Red Hat OpenShift Enterprise 2.0 and 2.1 and OpenShift Origin allow remote authenticated users to execute arbitrary commands via shell metacharacters in a directory name that is re…
6.5 MOYENNE
CVE-2013-0347Les utilisateurs locaux sur les systèmes Gentoo exécutant le service webfs peuvent lire le fichier journal de webfsd en raison de permissions de fichiers trop permissives. Cela per…
7.2 ÉLEVÉE
CVE-2013-3737The MobileUI (aka RT-Extension-MobileUI) extension before 1.04 in Request Tracker (RT) 4.0.0 before 4.0.13, when using the file-based session store (Apache::Session::File) and cert…
5.0 MOYENNE
CVE-2012-2301The Ubercart module 6.x-2.x before 6.x-2.8 for Drupal allows remote authenticated users with the "administer product classes" permission to execute arbitrary PHP code via unspecifi…
6.0 MOYENNE
CVE-2014-3209The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow local users to obtain the private key by reading the file.
2.1 FAIBLE
CVE-2014-2667Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when exist_ok is set to true and multiple threads are used, might allow local users to bypas…
3.3 FAIBLE
CVE-2014-2268views/Index.php in the Install module in vTiger 6.0 before Security Patch 2 does not properly restrict access, which allows remote attackers to re-install the application via a req…
5.0 MOYENNE