PUBLIÉES EN
novembre 2014
505 CVE, des plus récentes aux plus anciennes.
CVE-2014-3646arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2 does not have an exit handler for the INVVPID instruction, which allows guest OS users to cause a denial …
5.5 MOYENNE
CVE-2014-3645arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.12 does not have an exit handler for the INVEPT instruction, which allows guest OS users to cause a denial of s…
2.1 FAIBLE
CVE-2014-3611Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through 3.17.2 allows guest OS users to cause a denial of se…
4.7 MOYENNE
CVE-2014-3610The WRMSR processing functionality in the KVM subsystem in the Linux kernel through 3.17.2 does not properly handle the writing of a non-canonical address to a model-specific regis…
5.5 MOYENNE
CVE-2014-7819Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.…
5.0 MOYENNE
CVE-2014-7818Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7,…
4.3 MOYENNE
CVE-2014-6300Cross-site scripting (XSS) vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1 allows remote atta…
4.3 MOYENNE
CVE-2014-6161Cross-site scripting (XSS) vulnerability in IBM Tivoli Netcool/Impact 6.1.1 before 6.1.1.1-TIV-NCI-IF0001 allows remote authenticated users to inject arbitrary web script or HTML v…
3.5 FAIBLE
CVE-2014-6159IBM DB2 9.7 before FP10, 9.8 through FP5, 10.1 through FT4, and 10.5 through FP4 on Linux, UNIX, and Windows, when immediate AUTO_REVAL is enabled, allows remote authenticated user…
3.5 FAIBLE
CVE-2014-6146IBM Sterling B2B Integrator 5.2.x through 5.2.4, when the Connect:Direct Server Adapter is configured, does not properly process the logging configuration, which allows local users…
1.9 FAIBLE
CVE-2014-6097IBM DB2 9.7 before FP10 and 9.8 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to cause a denial of service (daemon crash) via a crafted ALTER TABLE stat…
4.0 MOYENNE
CVE-2014-8580Citrix NetScaler Application Delivery Controller and NetScaler Gateway 10.5.50.10 before 10.5-52.11, 10.1.122.17 before 10.1-129.11, and 10.1-120.1316.e before 10.1-129.1105.e, whe…
4.9 MOYENNE
CVE-2014-8510The AdminUI in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) before 6.0 HF build 1244 allows remote authenticated users to read arbitrary files via vectors related t…
4.0 MOYENNE
CVE-2014-6623Cross-site request forgery (CSRF) vulnerability in the Insight module in Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 allows remote attackers to hijack the authenti…
4.3 MOYENNE
CVE-2014-6620Cross-site scripting (XSS) vulnerability in Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 allows remote attackers to inject arbitrary web script or HTML via unspecif…
4.3 MOYENNE
CVE-2014-5038Eucalyptus 3.0.0 through 4.0.1, when the log level is set to DEBUG or lower, logs user and system passwords, which allows local users to obtain sensitive information by reading the…
2.1 FAIBLE
CVE-2014-5037Eucalyptus 4.0.0 through 4.0.1, when the log level is set to INFO, logs user and system passwords, which allows local users to obtain sensitive information by reading cloud-request…
2.1 FAIBLE
CVE-2014-3693Les versions de LibreOffice antérieures à 4.2.7 et 4.3.3 sont concernées si la fonctionnalité Impress Remote est active. Un attaquant non authentifié disposant d'un accès réseau au…
7.5 ÉLEVÉE
CVE-2014-3640The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in th…
2.1 FAIBLE
CVE-2014-8672Cross-site scripting (XSS) vulnerability in the RewardingYourself application for Android and BlackBerry OS allows remote attackers to inject arbitrary web script or HTML via a cra…
4.3 MOYENNE
CVE-2014-8671Cross-site scripting (XSS) vulnerability in the GWT Mobile PhoneGap Showcase application for Android allows remote attackers to inject arbitrary web script or HTML via a crafted Bl…
4.3 MOYENNE
CVE-2014-7990Cisco IOS XE 3.5E and earlier on WS-C3850, WS-C3860, and AIR-CT5760 devices does not properly parse the "request system shell" challenge response, which allows local users to obtai…
6.8 MOYENNE
CVE-2014-7989Cisco Unified Computing System on B-Series blade servers allows local users to gain shell privileges via a crafted (1) ping6 or (2) traceroute6 command, aka Bug ID CSCuq38176.
6.8 MOYENNE
CVE-2014-7988The Unified Messaging Service (UMS) in Cisco Unity Connection 10.5 and earlier allows remote authenticated users to obtain sensitive information by reading log files, aka Bug ID CS…
4.0 MOYENNE
CVE-2014-5430Untrusted search path vulnerability in ABB RobotStudio 5.6x before 5.61.02 and Test Signal Viewer 1.5 allows local users to gain privileges via a Trojan horse DLL that is accessed …
6.9 MOYENNE
CVE-2014-4627Les versions 4.x d'EMC RSA Web Threat Detection antérieures à la version 4.6.1.1 sont vulnérables à une faille d'injection SQL. Un attaquant disposant d'identifiants d'utilisateur …
8.8 ÉLEVÉE
CVE-2014-3439ConsoleServlet in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allows remote attackers to write to arbitrary files via unspecified vectors.
6.1 MOYENNE
CVE-2014-3438Multiple cross-site scripting (XSS) vulnerabilities in console interface scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allow remote attackers to inject arb…
4.3 MOYENNE
CVE-2014-3437Les versions de Symantec Endpoint Protection Manager (SEPM) 12.1 antérieures à la RU5 sont vulnérables à une faille d'entité externe XML (XXE) dans la console de gestion. Un attaqu…
7.5 ÉLEVÉE
CVE-2014-2179The Cisco RV router firmware on RV220W devices, before 1.0.5.9 on RV120W devices, and before 1.0.4.14 on RV180 and RV180W devices allows remote attackers to upload files to arbitra…
5.0 MOYENNE
CVE-2014-2178Cross-site request forgery (CSRF) vulnerability in the administrative web interface in the Cisco RV router firmware on RV220W devices, before 1.0.5.9 on RV120W devices, and before …
6.8 MOYENNE
CVE-2014-2177Les routeurs Cisco RV120W, RV180, RV180W et RV220W sont affectés par une faille dans l'interface d'administration des diagnostics réseau. Un attaquant disposant d'identifiants de c…
9.0 ÉLEVÉE
CVE-2014-6030Multiple SQL injection vulnerabilities in ClassApps SelectSurvey.NET before 4.125.002 allow (1) remote attackers to execute arbitrary SQL commands via the SurveyID parameter to sur…
6.5 MOYENNE
CVE-2014-5451Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attackers to inject arbitrary web script or H…
4.3 MOYENNE
CVE-2014-5258Directory traversal vulnerability in showTempFile.php in webEdition CMS before 6.3.9.0 Beta allows remote authenticated users to read arbitrary files via a .. (dot dot) in the file…
4.0 MOYENNE
CVE-2014-8670Open redirect vulnerability in go.php in vBulletin 4.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url paramete…
5.8 MOYENNE
CVE-2014-8669Les systèmes utilisant le module SAP CRM Promotion Guidelines sont susceptibles d'être victimes d'une exécution de code à distance. Un attaquant non authentifié disposant d'un accè…
10.0 ÉLEVÉE
CVE-2014-8668Les systèmes SAP Contract Accounting sont vulnérables à une faille d'injection SQL qui permet à un attaquant distant d'exécuter des commandes de base de données arbitraires. Un att…
7.5 ÉLEVÉE
CVE-2014-8667Cross-site scripting (XSS) vulnerability in SAP HANA Web-based Development Workbench allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
4.3 MOYENNE
CVE-2014-8666The User & Server configuration, InfoView refresh, user rights (BI-BIP-ADM) component in SAP Business Intellignece allows remote attackers to obtain audit event details via unspeci…
5.0 MOYENNE
CVE-2014-8665The SAP Business Intelligence Development Workbench allows remote attackers to obtain sensitive information by reading unspecified files.
5.0 MOYENNE
CVE-2014-8664Le composant Product Safety de SAP Environment, Health, and Safety Management est affecté par une faille d'injection SQL. Un attaquant distant peut exécuter des commandes de base d…
7.5 ÉLEVÉE
CVE-2014-8663Les systèmes SAP NetWeaver Business Warehouse utilisant le composant Data Basis (BW-WHM-DBA) sont affectés par une faille d'injection SQL. Un attaquant distant non authentifié peut…
7.5 ÉLEVÉE
CVE-2014-8662Le processus SAP Payroll est affecté par une faille dans la manière dont le système gère les sessions utilisateur. Un attaquant distant non authentifié peut exploiter cette vulnéra…
7.8 ÉLEVÉE
CVE-2014-8661Les systèmes SAP CRM Internet Sales sont affectés par une faille qui permet à un attaquant distant d'exécuter des commandes arbitraires sur le serveur sous-jacent. Comme cette vuln…
10.0 ÉLEVÉE
CVE-2014-8660SAP Document Management Services est affecté par une faille qui permet à un utilisateur local d'exécuter des commandes arbitraires sur le système. Un attaquant ayant déjà accès au …
7.2 ÉLEVÉE
CVE-2014-8659Directory traversal vulnerability in SAP Environment, Health, and Safety allows remote attackers to read arbitrary files via unspecified vectors.
5.0 MOYENNE
CVE-2014-8658Cross-site scripting (XSS) vulnerability in RefinedWiki Original Theme 3.x before 3.5.13 and 4.x before 4.0.12 for Confluence allows remote authenticated users with permissions to …
4.0 MOYENNE
CVE-2014-8657The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows remote attackers to cause a denial of service (disconnect all…
5.0 MOYENNE
CVE-2014-8656Les passerelles sans fil Compal Broadband Networks CH6640E et CG6640E utilisant le firmware 3.5.11.7-NOSH sont livrées avec des mots de passe statiques par défaut pour les comptes …
10.0 ÉLEVÉE