|
290281
|
- |
|
openssl
mariadb
fedoraproject
debian
opensuse
suse
|
openssl
mariadb
fedora
debian_linux
opensuse
linux_enterprise_server
linux_enterprise_software_development_kit
linux_enterprise_desktop
linux_enterprise_workstation_extension
|
The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls, which allows …
|
CWE-476
NULL Pointer Dereference
|
CVE-2014-0198
|
2024-11-21 11:01 |
2014-05-6 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
290282
|
- |
|
php
|
php
|
sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a …
|
CWE-269
Improper Privilege Management
|
CVE-2014-0185
|
2024-11-21 11:01 |
2014-05-6 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
290283
|
- |
|
redhat
|
openshift
|
openshift-origin-broker-util, as used in Red Hat OpenShift Enterprise 1.2.7 and 2.0.5, uses world-readable permissions for the mcollective client.cfg configuration file, which allows local users to o…
|
CWE-310
Cryptographic Issues
|
CVE-2014-0164
|
2024-11-21 11:01 |
2014-05-6 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
290284
|
- |
|
redhat
|
jboss_web_framework_kit
|
Multiple cross-site scripting (XSS) vulnerabilities in Red Hat JBoss Web Framework Kit 2.5.0 allow remote attackers to inject arbitrary web script or HTML via a (1) parameter or (2) id name.
|
CWE-79
Cross-site Scripting
|
CVE-2014-0149
|
2024-11-21 11:01 |
2014-05-6 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
290285
|
- |
|
redhat
virt-who_project
|
enterprise_linux_desktop
enterprise_linux_workstation
enterprise_linux_server
virt-who
|
virt-who uses world-readable permissions for /etc/sysconfig/virt-who, which allows local users to obtain password for hypervisors by reading the file.
|
CWE-310
Cryptographic Issues
|
CVE-2014-0189
|
2024-11-21 11:01 |
2014-05-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
290286
|
- |
|
igniterealtime
|
smack
|
The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses vi…
|
CWE-345
Insufficient Verification of Data Authenticity
|
CVE-2014-0364
|
2024-11-21 11:01 |
2014-04-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
290287
|
- |
|
igniterealtime
|
smack
|
The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows…
|
CWE-295
Improper Certificate Validation
|
CVE-2014-0363
|
2024-11-21 11:01 |
2014-04-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
290288
|
- |
|
apache
|
commons_beanutils
struts
|
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the …
|
CWE-20
Improper Input Validation
|
CVE-2014-0114
|
2024-11-21 11:01 |
2014-04-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
290289
|
- |
|
f5
|
nginx
|
The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11, when running on a 32-bit platform, allows remote attackers to execute arbitrary code via a crafted request.
|
CWE-119
Incorrect Access of Indexable Resource ('Range Error')
|
CVE-2014-0088
|
2024-11-21 11:01 |
2014-04-29 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
290290
|
- |
|
apache
|
struts
|
CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" th…
|
CWE-264
Permissions, Privileges, and Access Controls
|
CVE-2014-0113
|
2024-11-21 11:01 |
2014-04-29 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
