|
277881
|
7.0 |
HIGH
Local
|
xcfa_project
debian
|
xcfa
debian_linux
|
xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files. Note: A different vulnerability than CVE-2014-5254.
|
CWE-362
Race Condition
|
CVE-2014-5255
|
2024-11-21 11:11 |
2019-11-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
277882
|
4.7 |
MEDIUM
Local
|
xcfa_project
|
xcfa
|
xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files.
|
CWE-362
Race Condition
|
CVE-2014-5254
|
2024-11-21 11:11 |
2019-11-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
277883
|
5.5 |
MEDIUM
Local
|
trusted_boot_project
redhat
fedoraproject
|
trusted_boot
enterprise_linux
fedora
|
Trusted Boot (tboot) before 1.8.2 has a 'loader.c' Security Bypass Vulnerability
|
CWE-20
Improper Input Validation
|
CVE-2014-5118
|
2024-11-21 11:11 |
2019-11-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
277884
|
9.8 |
CRITICAL
Network
|
hospira
|
mednet
|
Hospira MedNet software version 5.8 and prior uses vulnerable versions of the JBoss Enterprise Application Platform software that may allow unauthenticated users to execute arbitrary code on the targ…
|
CWE-94
Code Injection
|
CVE-2014-5401
|
2024-11-21 11:11 |
2019-03-27 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
277885
|
6.1 |
MEDIUM
Network
|
wordfence
|
wordfence_security
|
Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php.
|
CWE-79
Cross-site Scripting
|
CVE-2014-4932
|
2024-11-21 11:11 |
2018-08-29 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
277886
|
7.8 |
HIGH
Local
|
opensuse
mdadm_project
|
opensuse
mdadm
|
The mdcheck script of the mdadm package for openSUSE 13.2 prior to version 3.3.1-5.14.1 does not properly sanitize device names, which allows local attackers to execute arbitrary commands as root.
|
CWE-77
Command Injection
|
CVE-2014-5220
|
2024-11-21 11:11 |
2018-06-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
277887
|
9.8 |
CRITICAL
Network
|
tinywebgallery
|
wordpress_flash_uploader
|
The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters in image_magic_path.
|
CWE-77
Command Injection
|
CVE-2014-5014
|
2024-11-21 11:11 |
2018-04-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
277888
|
8.8 |
HIGH
Network
|
wpsecurityauditlog
|
wp_security_audit_log
|
Cross-site request forgery (CSRF) vulnerability in WP Security Audit Log plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of unspecified victims via unknown vect…
|
CWE-352
Origin Validation Error
|
CVE-2014-5072
|
2024-11-21 11:11 |
2018-04-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
277889
|
8.8 |
HIGH
Network
|
fresh-media
|
brute_force_login_protection
|
Cross-site request forgery (CSRF) vulnerability in the Brute Force Login Protection module 1.3 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests tha…
|
CWE-352
Origin Validation Error
|
CVE-2014-5034
|
2024-11-21 11:11 |
2018-04-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
277890
|
9.8 |
CRITICAL
Network
|
drupal
|
storage_api
|
The Storage API module 7.x before 7.x-1.6 for Drupal might allow remote attackers to execute arbitrary code by leveraging failure to update .htaccess file contents after SA-CORE-2013-003.
|
CWE-20
Improper Input Validation
|
CVE-2014-5170
|
2024-11-21 11:11 |
2018-03-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
