arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space.
Max CVSS
7.8
EPSS Score
0.04%
Published
2014-12-17
Updated
2023-01-17
lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds read or write.
Max CVSS
4.6
EPSS Score
0.04%
Published
2014-12-08
Updated
2018-10-30
Buffer overflow in the ppp_hdlc function in print-ppp.c in tcpdump 4.6.2 and earlier allows remote attackers to cause a denial of service (crash) cia a crafted PPP packet.
Max CVSS
5.0
EPSS Score
15.80%
Published
2014-12-05
Updated
2018-10-09
Heap-based buffer overflow in PCRE 8.36 and earlier allows remote attackers to cause a denial of service (crash) or have other unspecified impact via a crafted regular expression, related to an assertion that allows zero repeats.
Max CVSS
5.0
EPSS Score
2.90%
Published
2014-12-16
Updated
2022-08-04
The acceleration support for the "REP MOVS" instruction in Xen 4.4.x, 3.2.x, and earlier lacks properly bounds checking for memory mapped I/O (MMIO) emulated in the hypervisor, which allows local HVM guests to cause a denial of service (host crash) via unspecified vectors.
Max CVSS
4.9
EPSS Score
0.06%
Published
2014-12-01
Updated
2018-10-30
tcpdump 3.8 through 4.6.2 might allow remote attackers to obtain sensitive information from memory or cause a denial of service (packet loss or segmentation fault) via a crafted Ad hoc On-Demand Distance Vector (AODV) packet, which triggers an out-of-bounds memory access.
Max CVSS
6.4
EPSS Score
7.30%
Published
2014-11-20
Updated
2018-10-09
Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow remote attackers to cause a denial of service (segmentation fault and crash) via a crafted length value in a Geonet frame.
Max CVSS
5.0
EPSS Score
7.30%
Published
2014-11-20
Updated
2018-10-30
Integer underflow in the olsr_print function in tcpdump 3.9.6 through 4.6.2, when in verbose mode, allows remote attackers to cause a denial of service (crash) via a crafted length value in an OLSR frame.
Max CVSS
5.0
EPSS Score
6.41%
Published
2014-11-20
Updated
2018-10-30
The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.
Max CVSS
9.4
EPSS Score
1.71%
Published
2014-11-14
Updated
2019-07-09
The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs.
Max CVSS
5.0
EPSS Score
1.11%
Published
2014-11-13
Updated
2018-10-30
The VMware driver in OpenStack Compute (Nova) before 2014.1.4 allows remote authenticated users to cause a denial of service (disk consumption) by deleting an instance in the resize state.
Max CVSS
4.0
EPSS Score
0.32%
Published
2014-10-31
Updated
2019-04-22
Heap-based buffer overflow in the jp2_decode function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 file.
Max CVSS
7.5
EPSS Score
23.25%
Published
2014-12-24
Updated
2018-01-05
Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file.
Max CVSS
6.8
EPSS Score
15.61%
Published
2014-12-24
Updated
2018-01-05
The (1) qemuDomainMigratePerform and (2) qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors.
Max CVSS
2.1
EPSS Score
0.04%
Published
2014-12-19
Updated
2023-02-13
The storageVolUpload function in storage/storage_driver.c in libvirt before 1.2.11 does not check a certain return value, which allows local users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted offset value in a "virsh vol-upload" command.
Max CVSS
2.1
EPSS Score
0.04%
Published
2014-12-19
Updated
2023-02-13
The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request for a URI that triggers a lookup for a virtual transaction name that does not exist.
Max CVSS
5.0
EPSS Score
1.29%
Published
2014-12-18
Updated
2017-01-03
The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document, aka an XML Entity Expansion (XEE) attack.
Max CVSS
5.0
EPSS Score
9.45%
Published
2014-11-03
Updated
2018-10-30
VDSM allows remote attackers to cause a denial of service (connection blocking) by keeping an SSL connection open.
Max CVSS
5.0
EPSS Score
0.39%
Published
2014-10-22
Updated
2014-10-23
Cross-site scripting (XSS) vulnerability in JBoss RichFaces, as used in JBoss Portal 6.1.1, allows remote attackers to inject arbitrary web script or HTML via crafted URL, which is not properly handled in a CSS file.
Max CVSS
4.3
EPSS Score
0.14%
Published
2014-12-11
Updated
2017-01-03
The host_from_stream_offset function in arch_init.c in QEMU, when loading RAM during migration, allows remote attackers to execute arbitrary code via a crafted (1) offset or (2) length value in savevm data.
Max CVSS
7.5
EPSS Score
7.88%
Published
2014-12-12
Updated
2023-02-13
DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.
Max CVSS
6.4
EPSS Score
1.07%
Published
2014-11-25
Updated
2015-04-23
The virDomainGetXMLDesc API in Libvirt before 1.2.11 allows remote read-only users to obtain the VNC password by using the VIR_DOMAIN_XML_MIGRATABLE flag, which triggers the use of the VIR_DOMAIN_XML_SECURE flag.
Max CVSS
5.0
EPSS Score
0.57%
Published
2014-11-13
Updated
2017-01-03
OpenStack Neutron before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (crash) via a crafted dns_nameservers value in the DNS configuration.
Max CVSS
4.0
EPSS Score
1.04%
Published
2014-11-24
Updated
2023-02-13

CVE-2014-7816

Public exploit
Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read arbitrary files via a .. (dot dot) in a resource URI.
Max CVSS
5.0
EPSS Score
4.58%
Published
2014-12-01
Updated
2015-03-04
The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value.
Max CVSS
5.0
EPSS Score
89.07%
Published
2014-11-14
Updated
2023-02-13
293 vulnerabilities found
1 2 3 4 5 6 7 8 9 10 11 12
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!