Security Vulnerabilities Published In November 2014

2014 : January February March April May June July August September October November December

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	# of Exploits	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
251	CVE-2014-7831	200		+Info	2014-11-24	2020-12-01	4.0	None	Remote	Low	???	Partial	None	None
lib/classes/grades_external.php in Moodle 2.7.x before 2.7.3 does not consider the moodle/grade:viewhidden capability before displaying hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role to access the get_grades web service.
252	CVE-2014-7830	79		XSS	2014-11-24	2020-12-01	3.5	None	Remote	Medium	???	None	Partial	None
Cross-site scripting (XSS) vulnerability in mod/feedback/mapcourse.php in the Feedback module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the mod/feedback:mapcourse capability to provide a searchcourse parameter.
253	CVE-2014-7829	22		Dir. Trav.	2014-11-18	2019-08-08	5.0	None	Remote	Low	Not required	Partial	None	None
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.
254	CVE-2014-7828	264		Bypass	2014-11-19	2017-09-08	3.5	None	Remote	Medium	???	None	Partial	None
FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind.
255	CVE-2014-7826	476		DoS +Priv	2014-11-10	2020-08-14	7.2	None	Local	Low	Not required	Complete	Complete	Complete
kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the ftrace subsystem, which allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via a crafted application.
256	CVE-2014-7825	125		DoS Bypass	2014-11-10	2020-08-14	7.2	None	Local	Low	Not required	Complete	Complete	Complete
kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the perf subsystem, which allows local users to cause a denial of service (out-of-bounds read and OOPS) or bypass the ASLR protection mechanism via a crafted application.
257	CVE-2014-7824	399		DoS	2014-11-18	2017-09-08	2.1	None	Local	Low	Not required	None	None	Partial
D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3636.1.
258	CVE-2014-7823	255			2014-11-13	2017-01-03	5.0	None	Remote	Low	Not required	Partial	None	None
The virDomainGetXMLDesc API in Libvirt before 1.2.11 allows remote read-only users to obtain the VNC password by using the VIR_DOMAIN_XML_MIGRATABLE flag, which triggers the use of the VIR_DOMAIN_XML_SECURE flag.
259	CVE-2014-7821	20		DoS	2014-11-24	2018-10-19	4.0	None	Remote	Low	???	None	None	Partial
OpenStack Neutron before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (crash) via a crafted dns_nameservers value in the DNS configuration.
260	CVE-2014-7819	22		Dir. Trav.	2014-11-08	2018-12-18	5.0	None	Remote	Low	Not required	Partial	None	None
Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
261	CVE-2014-7818	22		Dir. Trav.	2014-11-08	2019-08-08	4.3	None	Remote	Medium	Not required	Partial	None	None
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence.
262	CVE-2014-7817	20		Exec Code	2014-11-24	2018-10-30	4.6	None	Local	Low	Not required	Partial	Partial	Partial
The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((`...`))".
263	CVE-2014-7815	20		DoS	2014-11-14	2020-08-11	5.0	None	Remote	Low	Not required	None	None	Partial
The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value.
264	CVE-2014-7290	79		XSS	2014-11-19	2017-09-08	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site scripting (XSS) vulnerabilities in Atlas Systems Aeon 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the (1) Action or (2) Form parameter to aeon.dll.
265	CVE-2014-7248	79		XSS	2014-11-15	2014-11-17	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in IPA iLogScanner 4.0 allows remote attackers to inject arbitrary web script or HTML by triggering a crafted entry in a log file.
266	CVE-2014-7247	19		Exec Code	2014-11-26	2015-02-24	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Unspecified vulnerability in JustSystems Ichitaro 2008 through 2011; Ichitaro Government 6, 7, 2008, 2009, and 2010; Ichitaro Pro; Ichitaro Pro 2; Ichitaro 2011 Sou; Ichitaro 2012 Shou; Ichitaro 2013 Gen; and Ichitaro 2014 Tetsu allows remote attackers to execute arbitrary code via a crafted file.
267	CVE-2014-7246	20		DoS	2014-11-14	2015-02-10	3.5	None	Remote	Medium	???	None	None	Partial
The Core Server in OpenAM 9.5.3 through 9.5.5, 10.0.0 through 10.0.2, 10.1.0-Xpress, and 11.0.0 through 11.0.2, when deployed on a multi-server network, allows remote authenticated users to cause a denial of service (infinite loop) via a crafted cookie in a request.
268	CVE-2014-7228	310		Exec Code Bypass	2014-11-03	2016-05-09	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Akeeba Restore (restore.php), as used in Joomla! 2.5.4 through 2.5.25, 3.x through 3.2.5, and 3.3.0 through 3.3.4; Akeeba Backup for Joomla! Professional 3.0.0 through 4.0.2; Backup Professional for WordPress 1.0.b1 through 1.1.3; Solo 1.0.b1 through 1.1.2; Admin Tools Core and Professional 2.0.0 through 2.4.4; and CMS Update 1.0.a1 through 1.0.1, when performing a backup or update for an archive, does not delete parameters from $_GET and $_POST when it is cleansing $_REQUEST, but later accesses $_GET and $_POST using the getQueryParam function, which allows remote attackers to bypass encryption and execute arbitrary code via a command message that extracts a crafted archive.
269	CVE-2014-7207			DoS	2014-11-10	2014-12-24	4.9	None	Local	Low	Not required	Complete	None	None
A certain Debian patch to the IPv6 implementation in the Linux kernel 3.2.x through 3.2.63 does not properly validate arguments in ipv6_select_ident function calls, which allows local users to cause a denial of service (NULL pointer dereference and system crash) by leveraging (1) tun or (2) macvtap device access.
270	CVE-2014-7195	200		+Info	2014-11-21	2014-11-21	4.0	None	Remote	Low	???	Partial	None	None
Spotfire Web Player Engine in TIBCO Spotfire Web Player 6.0.x before 6.0.2 and 6.5.x before 6.5.2, Spotfire Deployment Kit 6.0.x before 6.0.2 and 6.5.x before 6.5.2, and Silver Fabric Enabler for Spotfire Web Player before 1.6.1 allows remote authenticated users to obtain sensitive information via unspecified vectors.
271	CVE-2014-7194	264		+Info	2014-11-21	2014-11-21	6.4	None	Remote	Low	Not required	Partial	Partial	None
TIBCO Managed File Transfer Internet Server before 7.2.4, Managed File Transfer Command Center before 7.2.4, Slingshot before 1.9.3, and Vault before 1.1.1 allow remote attackers to obtain sensitive information or modify data by leveraging agent access.
272	CVE-2014-7178	20		Exec Code	2014-11-28	2014-12-17	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function.
273	CVE-2014-7176	89	1	Exec Code Sql	2014-11-04	2017-09-08	6.5	None	Remote	Low	???	Partial	Partial	Partial
SQL injection vulnerability in Enalean Tuleap before 7.5.99.4 allows remote authenticated users to execute arbitrary SQL commands via the lobal_txt parameter to plugins/docman.
274	CVE-2014-7146	20		Exec Code	2014-11-18	2017-09-08	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted (1) description field or (2) issuelink attribute in an XML file, which is not properly handled when executing the preg_replace function with the e modifier.
275	CVE-2014-7142	20		DoS +Info	2014-11-26	2016-11-28	6.4	None	Remote	Low	Not required	Partial	None	Partial
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.
276	CVE-2014-7141	19		DoS +Info	2014-11-26	2016-11-28	6.4	None	Remote	Low	Not required	Partial	None	Partial
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.
277	CVE-2014-7137	89		Exec Code Sql	2014-11-21	2018-10-09	6.5	None	Remote	Low	???	Partial	Partial	Partial
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) contactid parameter in an addcontact action, (2) ligne parameter in a swapstatut action, or (3) project_ref parameter to projet/tasks/contact.php; (4) lineid parameter in a deletecontact action, (5) ligne parameter in a swapstatut action, or (6) ref parameter to projet/contact.php; (7) id parameter to compta/bank/fiche.php, (8) contact/info.php, (9) holiday/index.php, (10) product/stock/fiche.php, (11) product/stock/info.php, or (12) in an edit action to product/stock/fiche.php; (13) productid parameter in an addline action to product/stock/massstockmove.php; (14) project_ref parameter to projet/tasks/note.php; (15) ref parameter to element.php, (16) ganttview.php, (17) note.php, or (18) tasks.php in projet/; (19) sall or (20) sref parameter to comm/mailing/liste.php; (21) search_bon, (22) search_ligne, (23) search_societe, or (24) search_code parameter to compta/prelevement/liste.php; (25) search_label parameter to compta/sociales/index.php; (26) search_project parameter to projet/tasks/index.php; (27) search_societe parameter to compta/prelevement/demandes.php; (28) search_statut parameter to user/index.php; (29) socid parameter to compta/recap-compta.php, (30) societe/commerciaux.php, or (31) societe/rib.php; (32) sortorder, (33) sref, (34) sall, or (35) sortfield parameter to product/stock/liste.php; (36) statut parameter to adherents/liste.php or (37) compta/dons/liste.php; (38) tobuy or (39) tosell parameter to product/liste.php; (40) tobuy, (41) tosell, (42) search_categ, or (43) sref parameter to product/reassort.php; (44) type parameter to product/index.php; or the (a) sortorder or (b) sortfield parameter to (45) compta/paiement/cheque/liste.php, (46) compta/prelevement/bons.php, (47) compta/prelevement/rejets.php, (48) product/stats/commande.php, (49) product/stats/commande_fournisseur.php, (50) product/stats/contrat.php, (51) product/stats/facture.php, (52) product/stats/facture_fournisseur.php, (53) product/stats/propal.php, or (54) product/stock/replenishorders.php.
278	CVE-2014-6627	284		Exec Code	2014-11-19	2014-11-19	9.0	None	Remote	Low	???	Complete	Complete	Complete
Aruba Networks ClearPass before 6.3.5 and 6.4.x before 6.4.1 allows remote attackers to execute arbitrary commands via unspecified vectors, a different vulnerability than CVE-2014-5342.
279	CVE-2014-6626	284		Bypass	2014-11-19	2014-11-19	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 does not properly restrict access to unspecified administrative functions, which allows remote attackers to bypass authentication and execute administrative actions via unknown vectors.
280	CVE-2014-6625	284		+Priv	2014-11-19	2014-11-19	9.0	None	Remote	Low	???	Complete	Complete	Complete
The Policy Manager in Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 allows remote authenticated users to gain privileges via unspecified vectors.
281	CVE-2014-6624	200		+Info	2014-11-19	2017-09-08	6.8	None	Remote	Low	???	Complete	None	None
The Insight module in Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 allows remote authenticated users to read arbitrary files via unspecified vectors.
282	CVE-2014-6623	79		XSS CSRF	2014-11-07	2014-11-10	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site request forgery (CSRF) vulnerability in the Insight module in Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 allows remote attackers to hijack the authentication of a logged in user via unspecified vectors.
283	CVE-2014-6622	200		+Info	2014-11-19	2014-11-19	5.0	None	Remote	Low	Not required	Partial	None	None
Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 allows remote attackers to determine the validity of filenames via unspecified vectors.
284	CVE-2014-6621	200		+Info	2014-11-19	2014-11-19	5.0	None	Remote	Low	Not required	Partial	None	None
Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 does not disable the troubleshooting and diagnostics page in production systems, which allows remote attackers to obtain version numbers, module configuration, and other sensitive information by reading the page.
285	CVE-2014-6620	79		XSS	2014-11-07	2014-11-10	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
286	CVE-2014-6610	19		DoS	2014-11-26	2014-11-26	4.0	None	Remote	Low	???	None	None	Partial
Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res_fax_spandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dialplan application.
287	CVE-2014-6609	20		DoS	2014-11-26	2014-11-26	4.0	None	Remote	Low	???	None	None	Partial
The res_pjsip_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash) via crafted headers in a SIP SUBSCRIBE request for an event package.
288	CVE-2014-6477	200		+Info	2014-11-23	2017-09-08	6.8	None	Remote	Low	???	Complete	None	None
Unspecified vulnerability in the JPublisher component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors, a different vulnerability than CVE-2014-4290, CVE-2014-4291, CVE-2014-4292, CVE-2014-4293, CVE-2014-4296, CVE-2014-4297, CVE-2014-4310, and CVE-2014-6547. NOTE: this issue was originally mapped to CVE-2014-4301, but CVE-2014-4301 is for an unrelated vulnerability.
289	CVE-2014-6353	399		DoS Exec Code Mem. Corr.	2014-11-11	2018-10-12	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
290	CVE-2014-6351	399		DoS Exec Code Mem. Corr.	2014-11-11	2018-10-12	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
291	CVE-2014-6350	264		+Priv	2014-11-11	2018-10-12	4.3	None	Remote	Medium	Not required	None	Partial	None
Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2014-6349.
292	CVE-2014-6349	264		+Priv	2014-11-11	2018-10-12	4.3	None	Remote	Medium	Not required	None	Partial	None
Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2014-6350.
293	CVE-2014-6348	399		DoS Exec Code Mem. Corr.	2014-11-11	2018-10-12	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-6342.
294	CVE-2014-6347	399		DoS Exec Code Mem. Corr.	2014-11-11	2018-10-12	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
295	CVE-2014-6346	200		+Info	2014-11-11	2018-10-12	4.3	None	Remote	Medium	Not required	Partial	None	None
Microsoft Internet Explorer 8 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability."
296	CVE-2014-6345	200		+Info	2014-11-11	2018-10-12	4.3	None	Remote	Medium	Not required	Partial	None	None
Microsoft Internet Explorer 9 and 10 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability."
297	CVE-2014-6344	399		DoS Exec Code Mem. Corr.	2014-11-11	2018-10-12	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
298	CVE-2014-6343	399		DoS Exec Code Mem. Corr.	2014-11-11	2018-10-12	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
299	CVE-2014-6342	399		DoS Exec Code Mem. Corr.	2014-11-11	2018-10-12	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-6348.
300	CVE-2014-6341	399		DoS Exec Code Mem. Corr.	2014-11-11	2018-10-12	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-4143.

Total number of vulnerabilities : 501 Page : 1 2 3 4 5 6 (This Page)7 8 9 10 11