CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In October 2014

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
101 CVE-2014-8071 79 XSS 2014-10-23 2017-09-08
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in OpenMRS 2.1 Standalone Edition allow remote attackers to inject arbitrary web script or HTML via the (1) givenName, (2) familyName, (3) address1, or (4) address2 parameter to registrationapp/registerPatient.page; the (5) comment parameter to allergyui/allergy.page; the (6) w10 parameter to htmlformentryui/htmlform/enterHtmlForm/submit.action; the (7) HTTP Referer Header to login.htm; the (8) returnUrl parameter to htmlformentryui/htmlform/enterHtmlFormWithStandardUi.page or (9) coreapps/mergeVisits.page; or the (10) visitId parameter to htmlformentryui/htmlform/enterHtmlFormWithSimpleUi.page.
102 CVE-2014-8070 2014-10-14 2014-10-21
6.8
 None Remote Medium Not required Partial Partial Partial
Open redirect vulnerability in YOOtheme Pagekit CMS 0.8.7 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to index.php/user/logout.
103 CVE-2014-8069 79 XSS 2014-10-14 2014-10-21
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in YOOtheme Pagekit CMS 0.8.7 allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP Referer header to index.php/user or (2) PATH_INFO to index.php.
104 CVE-2014-8068 200 +Info 2014-10-09 2017-09-08
5.0
 None Remote Low Not required Partial None None
Adobe Digital Editions (DE) 4 does not use encryption for transmission of data to adelogs.adobe.com, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by book-navigation information.
105 CVE-2014-7987 79 XSS 2014-10-31 2018-10-09
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in EspoCRM before 2.6.0 allows remote attackers to inject arbitrary web script or HTML via the desc parameter in an errors action to install/index.php.
106 CVE-2014-7986 264 2014-10-31 2018-10-09
5.0
 None Remote Low Not required None None Partial
install/index.php in EspoCRM before 2.6.0 allows remote attackers to re-install the application via a 1 value in the installProcess parameter.
107 CVE-2014-7985 22 Dir. Trav. 2014-10-31 2018-10-09
10.0
 None Remote Low Not required Complete Complete Complete
Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter to install/index.php.
108 CVE-2014-7984 264 Bypass 2014-10-08 2014-10-10
7.5
 None Remote Low Not required Partial Partial Partial
Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to authenticate and bypass intended restrictions via vectors involving GMail authentication.
109 CVE-2014-7983 79 XSS 2014-10-08 2014-10-10
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in com_contact in Joomla! CMS 3.1.2 through 3.2.x before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
110 CVE-2014-7982 79 XSS 2014-10-08 2014-10-10
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
111 CVE-2014-7981 89 Exec Code Sql 2014-10-08 2014-10-10
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Joomla! CMS 3.1.x and 3.2.x before 3.2.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
112 CVE-2014-7980 79 XSS 2014-10-08 2014-10-09
3.5
 None Remote Medium ??? None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in template.php in Zen theme 7.x-3.x before 7.x-3.3 and 7.x-5.x before 7.x-5.5 for Drupal allow remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via the skip_link_text setting and unspecified other theme settings.
113 CVE-2014-7979 79 XSS 2014-10-08 2017-09-08
3.5
 None Remote Medium ??? None Partial None
Cross-site scripting (XSS) vulnerability in the SimpleCorp theme 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to theme settings.
114 CVE-2014-7978 79 XSS 2014-10-08 2017-09-08
3.5
 None Remote Medium ??? None Partial None
Cross-site scripting (XSS) vulnerability in the BlueMasters theme 7.x-2.x before 7.x-2.1 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to theme settings.
115 CVE-2014-7975 DoS 2014-10-13 2020-08-14
4.9
 None Local Low Not required None None Complete
The do_umount function in fs/namespace.c in the Linux kernel through 3.17 does not require the CAP_SYS_ADMIN capability for do_remount_sb calls that change the root filesystem to read-only, which allows local users to cause a denial of service (loss of writability) by making certain unshare system calls, clearing the / MNT_LOCKED flag, and making an MNT_FORCE umount system call.
116 CVE-2014-7970 400 DoS 2014-10-13 2020-08-14
4.9
 None Local Low Not required None None Complete
The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which allows local users to cause a denial of service (mount-tree loop) via . (dot) values in both arguments to the pivot_root system call.
117 CVE-2014-7968 310 DoS 2014-10-22 2014-10-23
5.0
 None Remote Low Not required None None Partial
VDSM allows remote attackers to cause a denial of service (connection blocking) by keeping an SSL connection open.
118 CVE-2014-7967 DoS 2014-10-08 2014-10-08
7.5
 None Remote Low Not required Partial Partial Partial
Multiple unspecified vulnerabilities in Google V8 before 3.28.71.15, as used in Google Chrome before 38.0.2125.101, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
119 CVE-2014-7960 399 Bypass 2014-10-17 2017-09-08
4.0
 None Remote Low ??? None Partial None
OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max_meta_count and other metadata constraints via multiple crafted requests which exceed the limit when combined.
120 CVE-2014-7877 DoS 2014-10-30 2017-09-08
4.9
 None Local Low Not required None None Complete
Unspecified vulnerability in the kernel in HP HP-UX B.11.31 allows local users to cause a denial of service via unknown vectors.
121 CVE-2014-7874 352 CSRF 2014-10-19 2017-09-08
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in HP System Management Homepage (SMH) before 3.2.3 on HP-UX B.11.23, and before 3.2.8 on HP-UX B.11.31, allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
122 CVE-2014-7870 79 XSS 2014-10-06 2014-10-07
3.5
 None Remote Medium ??? None Partial None
Cross-site scripting (XSS) vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows remote authenticated users with the "administer custom search" permission to inject arbitrary web script or HTML via the "Label text" field to admin/config/search/custom_search/results.
123 CVE-2014-7869 79 XSS 2014-10-06 2014-10-07
3.5
 None Remote Medium ??? None Partial None
Cross-site scripting (XSS) vulnerability in the configuration UI in the Context Form Alteration module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "administer contexts" permission to inject arbitrary web script or HTML via unspecified vectors.
124 CVE-2014-7861 20 DoS Exec Code 2014-10-05 2014-10-10
9.3
 None Remote Medium Not required Complete Complete Complete
The IOHIDSecurePromptClient function in Apple OS X does not properly validate pointer values, which allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via a crafted web site.
125 CVE-2014-7804 310 +Info 2014-10-21 2014-11-14
5.4
 None Local Network Medium Not required Partial Partial Partial
The Gangsta Auto Thief III (aka com.apptreestudios.gdup3) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
126 CVE-2014-7803 310 +Info 2014-10-21 2014-11-14
5.4
 None Local Network Medium Not required Partial Partial Partial
The Woodward Bail (aka com.onesolutionapps.woodwardbailandroid) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
127 CVE-2014-7802 310 +Info 2014-10-21 2014-11-14
5.4
 None Local Network Medium Not required Partial Partial Partial
The Top Roller Coasters Europe 2 (aka com.appaapps.top10tallesteuropeanrollercoasters2) application @7F050001 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
128 CVE-2014-7800 310 +Info 2014-10-21 2014-11-14
5.4
 None Local Network Medium Not required Partial Partial Partial
The Daily Green (aka it.opentt.blog.dailygreen) application 2014.07 dlygrn for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
129 CVE-2014-7799 310 +Info 2014-10-21 2014-11-14
5.4
 None Local Network Medium Not required Partial Partial Partial
The Squishy birds (aka com.tatmob.squishybirds) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
130 CVE-2014-7798 310 +Info 2014-10-21 2014-11-14
5.4
 None Local Network Medium Not required Partial Partial Partial
The Coca-Cola FM Brasil (aka com.enyetech.radio.coca_cola.fm_br) application 2.0.41709 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
131 CVE-2014-7797 310 +Info 2014-10-21 2014-11-14
5.4
 None Local Network Medium Not required Partial Partial Partial
The Thai food (aka com.foods.thaifood) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
132 CVE-2014-7796 310 +Info 2014-10-21 2014-11-22
5.4
 None Local Network Medium Not required Partial Partial Partial
The House365 Radio (aka com.nobexinc.wls_27853803.rc) application 3.2.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
133 CVE-2014-7795 310 +Info 2014-10-21 2014-11-14
5.4
 None Local Network Medium Not required Partial Partial Partial
The Harpers Bazaar Art (aka com.itp.harpersart) application @7F080181 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
134 CVE-2014-7794 310 +Info 2014-10-21 2014-11-14
5.4
 None Local Network Medium Not required Partial Partial Partial
The Knights of the Void (aka me.narr8.android.serial.knights_of_the_void) application 2.1.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
135 CVE-2014-7793 310 +Info 2014-10-21 2014-11-14
5.4
 None Local Network Medium Not required Partial Partial Partial
The CB - Calciatori Brutti (aka com.calciatori.brutti) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
136 CVE-2014-7791 310 +Info 2014-10-21 2014-11-14
5.4
 None Local Network Medium Not required Partial Partial Partial
The Backyard Wrestling (aka com.wBackyardWrestling) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
137 CVE-2014-7789 310 +Info 2014-10-21 2014-11-14
5.4
 None Local Network Medium Not required Partial Partial Partial
The Zillion Muslims (aka com.zillionmuslims.src) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
138 CVE-2014-7788 310 +Info 2014-10-21 2014-11-14
5.4
 None Local Network Medium Not required Partial Partial Partial
The Best Free Giveaways (aka com.wIphone5GiveAways) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
139 CVE-2014-7787 310 +Info 2014-10-21 2014-11-14
5.4
 None Local Network Medium Not required Partial Partial Partial
The iShuttle (aka com.synapse.ishuttle_user) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
140 CVE-2014-7786 310 +Info 2014-10-21 2014-11-14
5.4
 None Local Network Medium Not required Partial Partial Partial
The English Football Magazine (aka com.magzter.englishfootball) application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
141 CVE-2014-7785 310 +Info 2014-10-21 2014-11-14
5.4
 None Local Network Medium Not required Partial Partial Partial
The AAAA Discount Bail (aka com.onesolutionapps.aaaadiscountbailandroid) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
142 CVE-2014-7784 310 +Info 2014-10-21 2014-11-14
5.4
 None Local Network Medium Not required Partial Partial Partial
The Schon! Magazine (aka com.magzter.schonmagazine) application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
143 CVE-2014-7783 310 +Info 2014-10-21 2014-11-14
5.4
 None Local Network Medium Not required Partial Partial Partial
The Bill G. Bennett (aka com.billgbennett) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
144 CVE-2014-7782 310 +Info 2014-10-21 2015-02-04
5.4
 None Local Network Medium Not required Partial Partial Partial
The Macedonia Hacienda Hotel (aka appinventor.ai_orolimpio999.HotelMacedonia) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
145 CVE-2014-7781 310 +Info 2014-10-21 2014-11-14
5.4
 None Local Network Medium Not required Partial Partial Partial
The Marijuana Handbook Lite - Weed (aka com.fallacystudios.marijuanahandbooklite) application 3.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
146 CVE-2014-7780 310 +Info 2014-10-21 2014-11-14
5.4
 None Local Network Medium Not required Partial Partial Partial
The Pakistan Cricket News (aka com.conduit.app_cf18df8bdf454eb0a836e2d29886bc40.app) application 1.21.38.6504 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
147 CVE-2014-7779 310 +Info 2014-10-21 2014-11-14
5.4
 None Local Network Medium Not required Partial Partial Partial
The Kuran'in Bilimsel Mucizeleri (aka com.wKurannBilimselMucizeleri) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
148 CVE-2014-7778 310 +Info 2014-10-21 2014-11-14
5.4
 None Local Network Medium Not required Partial Partial Partial
The Epc World (aka com.magzter.epcworld) application 3.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
149 CVE-2014-7777 310 +Info 2014-10-21 2014-11-19
5.4
 None Local Network Medium Not required Partial Partial Partial
The Slingshot Forum (aka com.tapatalk.theslingshotforumcom) application 3.9.14 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
150 CVE-2014-7776 310 +Info 2014-10-21 2014-11-14
5.4
 None Local Network Medium Not required Partial Partial Partial
The Kavita KS (aka com.snaplion.kavitaks) application 2.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Total number of vulnerabilities : 1414   Page : 1 2 3 (This Page)4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.