CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In November 2014

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
451 CVE-2014-0583 119 Overflow 2014-11-11 2018-12-13
7.5
 None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to complete a transition from Low Integrity to Medium Integrity via unspecified vectors.
452 CVE-2014-0582 119 Exec Code Overflow 2014-11-11 2018-12-13
10.0
 None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0589.
453 CVE-2014-0581 DoS Exec Code Mem. Corr. 2014-11-11 2018-12-13
10.0
 None Remote Low Not required Complete Complete Complete
Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0576, CVE-2014-8440, and CVE-2014-8441.
454 CVE-2014-0577 94 Exec Code 2014-11-11 2018-12-13
10.0
 None Remote Low Not required Complete Complete Complete
Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2014-0584, CVE-2014-0585, CVE-2014-0586, and CVE-2014-0590.
455 CVE-2014-0576 DoS Exec Code Mem. Corr. 2014-11-11 2018-12-13
10.0
 None Remote Low Not required Complete Complete Complete
Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0581, CVE-2014-8440, and CVE-2014-8441.
456 CVE-2014-0574 94 Exec Code 2014-11-11 2018-12-13
10.0
 None Remote Low Not required Complete Complete Complete
Double free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors.
457 CVE-2014-0573 Exec Code 2014-11-11 2018-12-13
10.0
 None Remote Low Not required Complete Complete Complete
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0588 and CVE-2014-8438.
458 CVE-2014-0490 20 Exec Code 2014-11-03 2020-01-08
7.5
 None Remote Low Not required Partial Partial Partial
The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remote attackers to execute arbitrary code via a crafted package.
459 CVE-2014-0489 20 Exec Code 2014-11-03 2020-01-08
7.5
 None Remote Low Not required Partial Partial Partial
APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package.
460 CVE-2014-0488 20 2014-11-03 2020-01-08
6.8
 None Remote Medium Not required Partial Partial Partial
APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data.
461 CVE-2014-0487 2014-11-03 2020-01-08
7.5
 None Remote Low Not required Partial Partial Partial
APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unspecified impact and attack vectors.
462 CVE-2014-0250 189 Overflow 2014-11-16 2020-03-06
7.5
 None Remote Low Not required Partial Partial Partial
Multiple integer overflows in client/X11/xf_graphics.c in FreeRDP allow remote attackers to have an unspecified impact via the width and height to the (1) xf_Pointer_New or (2) xf_Bitmap_Decompress function, which causes an incorrect amount of memory to be allocated.
463 CVE-2014-0233 94 Exec Code 2014-11-16 2019-12-17
6.5
 None Remote Low ??? Partial Partial Partial
Red Hat OpenShift Enterprise 2.0 and 2.1 and OpenShift Origin allow remote authenticated users to execute arbitrary commands via shell metacharacters in a directory name that is referenced by a cartridge using the file: URI scheme.
464 CVE-2014-0228 284 +Info 2014-11-16 2018-10-09
3.5
 None Remote Medium ??? Partial None None
Apache Hive before 0.13.1, when in SQL standards based authorization mode, does not properly check the file permissions for (1) import and (2) export statements, which allows remote authenticated users to obtain sensitive information via a crafted URI.
465 CVE-2014-0223 189 DoS Exec Code Overflow 2014-11-04 2020-11-02
4.6
 None Local Low Not required Partial Partial Partial
Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a large image size, which triggers a buffer overflow or out-of-bounds read.
466 CVE-2014-0222 189 DoS Overflow 2014-11-04 2020-11-02
7.5
 None Remote Low Not required Partial Partial Partial
Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image.
467 CVE-2014-0204 269 +Priv 2014-11-03 2020-06-02
6.5
 None Remote Low ??? Partial Partial Partial
OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with the same ID.
468 CVE-2014-0182 119 Exec Code Overflow 2014-11-04 2020-11-02
7.5
 None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted config length in a savevm image.
469 CVE-2014-0059 200 +Info 2014-11-17 2016-10-01
2.1
 None Local Low Not required Partial None None
JBoss SX and PicketBox, as used in Red Hat JBoss Enterprise Application Platform (EAP) before 6.2.3, use world-readable permissions on audit.log, which allows local users to obtain sensitive information by reading this file.
470 CVE-2013-7057 352 1 CSRF 2014-11-04 2017-08-29
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in Axway SecureTransport 5.1 SP2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that upload arbitrary files via a crafted request to api/v1.0/files/.
471 CVE-2013-6399 94 Exec Code 2014-11-04 2020-11-02
7.5
 None Remote Low Not required Partial Partial Partial
Array index error in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image.
472 CVE-2013-4542 119 Exec Code Overflow 2014-11-04 2020-11-02
7.5
 None Remote Low Not required Partial Partial Partial
The virtio_scsi_load_request function in hw/scsi/scsi-bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, which triggers an out-of-bounds array access.
473 CVE-2013-4541 119 Exec Code Overflow 2014-11-04 2020-11-02
7.5
 None Remote Low Not required Partial Partial Partial
The usb_device_post_load function in hw/usb/bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, related to a negative setup_len or setup_index value.
474 CVE-2013-4540 119 Exec Code Overflow 2014-11-04 2020-11-02
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in scoop_gpio_handler_update in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a large (1) prev_level, (2) gpio_level, or (3) gpio_dir value in a savevm image.
475 CVE-2013-4539 119 Exec Code Overflow 2014-11-04 2020-11-02
7.5
 None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image.
476 CVE-2013-4538 119 DoS Exec Code Overflow Mem. Corr. 2014-11-04 2020-11-02
7.5
 None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c in QEMU before 1.7.2 allow remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image.
477 CVE-2013-4537 94 Exec Code 2014-11-04 2020-11-02
7.5
 None Remote Low Not required Partial Partial Partial
The ssi_sd_transfer function in hw/sd/ssi-sd.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted arglen value in a savevm image.
478 CVE-2013-4534 119 DoS Exec Code Overflow 2014-11-04 2020-11-02
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in hw/intc/openpic.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements.
479 CVE-2013-4533 119 DoS Exec Code Overflow 2014-11-04 2020-11-02
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image.
480 CVE-2013-4531 119 DoS Exec Code Overflow 2014-11-04 2020-11-02
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in target-arm/machine.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a negative value in cpreg_vmstate_array_len in a savevm image.
481 CVE-2013-4530 119 DoS Exec Code Overflow 2014-11-04 2020-11-02
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in hw/ssi/pl022.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image.
482 CVE-2013-4529 119 DoS Exec Code Overflow 2014-11-04 2020-11-02
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in hw/pci/pcie_aer.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image.
483 CVE-2013-4527 119 Exec Code Overflow 2014-11-04 2020-11-02
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via vectors related to the number of timers.
484 CVE-2013-4526 119 DoS Exec Code Overflow 2014-11-04 2020-11-02
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in hw/ide/ahci.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via vectors related to migrating ports.
485 CVE-2013-4151 94 Exec Code 2014-11-04 2014-11-05
7.5
 None Remote Low Not required Partial Partial Partial
The virtio_load function in virtio/virtio.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image, which triggers an out-of-bounds write.
486 CVE-2013-4150 119 DoS Exec Code Overflow 2014-11-04 2014-11-05
7.5
 None Remote Low Not required Partial Partial Partial
The virtio_net_load function in hw/net/virtio-net.c in QEMU 1.5.0 through 1.7.x before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors in which the value of curr_queues is greater than max_queues, which triggers an out-of-bounds write.
487 CVE-2013-4149 119 Exec Code Overflow 2014-11-04 2014-11-05
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in virtio_net_load function in net/virtio-net.c in QEMU 1.3.0 through 1.7.x before 1.7.2 might allow remote attackers to execute arbitrary code via a large MAC table.
488 CVE-2013-4148 189 Exec Code Overflow 2014-11-04 2014-11-05
7.5
 None Remote Low Not required Partial Partial Partial
Integer signedness error in the virtio_net_load function in hw/net/virtio-net.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image, which triggers a buffer overflow.
489 CVE-2013-3737 200 +Info 2014-11-16 2015-02-10
5.0
 None Remote Low Not required Partial None None
The MobileUI (aka RT-Extension-MobileUI) extension before 1.04 in Request Tracker (RT) 4.0.0 before 4.0.13, when using the file-based session store (Apache::Session::File) and certain authentication extensions, allows remote attackers to reuse unauthorized sessions and obtain user preferences and caches via unspecified vectors.
490 CVE-2013-3678 +Priv 2014-11-19 2018-10-09
9.0
 None Remote Low ??? Complete Complete Complete
Multiple unspecified vulnerabilities in SAP Governance, Risk, and Compliance (GRC) allow remote authenticated users to gain privileges and execute arbitrary programs via a crafted (1) RFC or (2) SOAP-RFC request.
491 CVE-2013-0347 200 +Info 2014-11-16 2017-08-29
7.2
 None Local Low Not required Complete Complete Complete
The Gentoo init script for webfs uses world-readable permissions for /var/log/webfsd.log, which allows local users to have unspecified impact by reading the file.
492 CVE-2013-0336 20 DoS 2014-11-03 2017-08-29
5.0
 None Remote Low Not required None None Partial
The ipapwd_chpwop function in daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c in the directory server (dirsrv) in FreeIPA before 3.2.0 allows remote attackers to cause a denial of service (crash) via a connection request without a username/dn, related to the 389 directory server.
493 CVE-2012-6665 22 Dir. Trav. 2014-11-17 2014-11-18
4.3
 None Remote Medium Not required Partial None None
Directory traversal vulnerability in index.php in phpMoneyBooks 1.0.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, a different vulnerability than CVE-2012-1669. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this issue might have been fixed in 1.0.3.
494 CVE-2012-6662 79 XSS 2014-11-24 2018-07-14
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.
495 CVE-2012-6661 310 2014-11-03 2014-11-05
5.0
 None Remote Low Not required Partial None None
Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG), which makes it easier for remote attackers to guess the value via unspecified vectors. NOTE: this issue was SPLIT from CVE-2012-5508 due to different vulnerability types (ADT2).
496 CVE-2012-5508 200 +Info 2014-11-03 2014-11-05
5.0
 None Remote Low Not required Partial None None
The error pages in Plone before 4.2.3 and 4.3 before beta 1 allow remote attackers to obtain random numbers and derive the PRNG state for password resets via unspecified vectors. NOTE: this identifier was SPLIT per ADT2 due to different vulnerability types. CVE-2012-6661 was assigned for the PRNG reseeding issue in Zope.
497 CVE-2012-5500 352 CSRF 2014-11-03 2014-11-05
4.3
 None Remote Medium Not required None Partial None
The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titles of content items by leveraging a valid CSRF token in a crafted request.
498 CVE-2012-2301 94 Exec Code 2014-11-16 2014-11-19
6.0
 None Remote Medium ??? Partial Partial Partial
The Ubercart module 6.x-2.x before 6.x-2.8 for Drupal allows remote authenticated users with the "administer product classes" permission to execute arbitrary PHP code via unspecified vectors.
499 CVE-2012-1669 22 1 Dir. Trav. 2014-11-17 2014-11-18
4.3
 None Remote Medium Not required Partial None None
Directory traversal vulnerability in index.php in phpMoneyBooks before 1.0.3 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module parameter.
500 CVE-2010-5313 362 DoS 2014-11-30 2016-11-28
4.9
 None Local Low Not required None None Complete
Race condition in arch/x86/kvm/x86.c in the Linux kernel before 2.6.38 allows L2 guest OS users to cause a denial of service (L1 guest OS crash) via a crafted instruction that triggers an L2 emulation failure report, a similar issue to CVE-2014-7842.
Total number of vulnerabilities : 501   Page : 1 2 3 4 5 6 7 8 9 10 (This Page)11
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.