CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2014(Bypass)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2014-8655 264 1 Bypass +Info 2014-11-06 2017-09-07
5.0
None Remote Low Not required Partial None None
The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows remote attackers to bypass authentication and obtain sensitive information via an (a) admin or a (b) root value in the userData cookie in a request to (1) CmgwWirelessSecurity.xml, (2) DocsisConfigFile.xml, or (3) CmgwBasicSetup.xml in xml/ or (4) basicDDNS.html, (5) basicLanUsers.html, or (6) rootDesc.xml.
2 CVE-2014-5300 287 1 Exec Code Bypass 2014-10-08 2018-10-09
5.0
None Remote Low Not required None Partial None
Adaptive Computing Moab before 7.2.9 and 8 before 8.0.0 allows remote attackers to bypass the signature check, impersonate arbitrary users, and execute commands via a message without a signature.
3 CVE-2014-5246 264 1 Bypass 2014-08-22 2017-09-07
10.0
None Remote Low Not required Complete Complete Complete
The Shenzhen Tenda Technology Tenda A5s router with firmware 3.02.05_CN allows remote attackers to bypass authentication and gain administrator access by setting the admin:language cookie to zh-cn.
4 CVE-2014-4014 264 1 Bypass 2014-06-23 2018-12-18
6.2
None Local High Not required Complete Complete Complete
The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that namespaces are inapplicable to inodes, which allows local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root.
5 CVE-2014-3139 287 1 Bypass 2014-05-02 2014-05-02
7.5
None Remote Low Not required Partial Partial Partial
recoveryconsole/bpl/snmpd.php in Unitrends Enterprise Backup 7.3.0 allows remote attackers to bypass authentication by setting the auth parameter to a certain string.
6 CVE-2014-2044 94 1 Exec Code Bypass 2014-10-06 2018-10-09
7.5
None Remote Low Not required Partial Partial Partial
Incomplete blacklist vulnerability in ajax/upload.php in ownCloud before 5.0, when running on Windows, allows remote authenticated users to bypass intended access restrictions, upload files with arbitrary names, and execute arbitrary code via an Alternate Data Stream (ADS) syntax in the filename parameter, as demonstrated using .htaccess::$DATA to upload a PHP program.
7 CVE-2013-7137 287 1 +Priv Bypass 2014-01-25 2018-10-09
7.5
None Remote Low Not required Partial Partial Partial
The "remember me" functionality in login.php in Burden before 1.8.1 allows remote attackers to bypass authentication and gain privileges by setting the burden_user_rememberme cookie to 1.
8 CVE-2013-6796 264 1 Bypass 2014-10-26 2017-08-28
5.0
None Remote Low Not required None Partial None
The SMTP server in DeepOfix 3.3 and earlier allows remote attackers to bypass authentication via an empty password, which triggers an LDAP anonymous bind.
9 CVE-2013-6720 22 1 Dir. Trav. Bypass 2014-03-06 2017-08-28
5.5
None Remote Low Single system Partial Partial None
Directory traversal vulnerability in download.php in the Passive Capture Application (PCA) web console in IBM Tealeaf CX 7.x, 8.x through 8.6, 8.7 before FP2, and 8.8 before FP2 allows remote authenticated users to bypass intended access restrictions via a .. (dot dot) in the log parameter, as demonstrated using a crafted request for a customer-support file, as demonstrated by a log file.
10 CVE-2013-6117 287 1 Bypass +Info 2014-07-11 2014-07-14
7.5
None Remote Low Not required Partial Partial Partial
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.
11 CVE-2014-9419 200 Bypass +Info 2014-12-25 2018-01-04
2.1
None Local Low Not required Partial None None
The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel through 3.18.1 does not ensure that Thread Local Storage (TLS) descriptors are loaded before proceeding with other steps, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application that reads a TLS base address.
12 CVE-2014-9304 264 Bypass 2014-12-07 2015-10-28
7.5
None Remote Low Not required Partial Partial Partial
Plex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrative actions via multiple crafted X-Plex-Url headers to system/proxy, which are inconsistently processed by the request handler in the backend web server.
13 CVE-2014-9278 287 Bypass 2014-12-06 2017-09-07
4.0
None Remote Low Single system None Partial None
The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which might bypass intended authentication requirements that would force a local login.
14 CVE-2014-9217 287 Bypass 2014-12-08 2017-09-07
5.0
None Remote Low Not required None Partial None
Graylog2 before 0.92 allows remote attackers to bypass LDAP authentication via crafted wildcards.
15 CVE-2014-9184 287 Bypass 2014-12-02 2014-12-03
5.0
None Remote Low Not required None Partial None
ZTE ZXDSL 831CII allows remote attackers to bypass authentication via a direct request to (1) main.cgi, (2) adminpasswd.cgi, (3) userpasswd.cgi, (4) upload.cgi, (5) conprocess.cgi, or (6) connect.cgi.
16 CVE-2014-9150 362 Bypass 2014-11-29 2014-12-17
6.4
None Remote Low Not required None Partial Partial
Race condition in the MoveFileEx call hook feature in Adobe Reader and Acrobat 11.x before 11.0.09 on Windows allows attackers to bypass a sandbox protection mechanism, and consequently write to files in arbitrary locations, via an NTFS junction attack, a similar issue to CVE-2014-0568.
17 CVE-2014-9135 264 Bypass 2014-12-19 2017-09-07
4.3
None Remote Medium Not required None Partial None
The PackageInstaller module in Huawei P7-L10 smartphones before V100R001C00B136 allows remote attackers to spoof the origin website and bypass the website whitelist protection mechanism via a crafted package.
18 CVE-2014-9117 284 Bypass 2014-12-06 2017-09-07
5.0
None Remote Low Not required None Partial None
MantisBT before 1.2.18 uses the public_key parameter value as the key to the CAPTCHA answer, which allows remote attackers to bypass the CAPTCHA protection mechanism by leveraging knowledge of a CAPTCHA answer for a public_key parameter value, as demonstrated by E4652 for the public_key value 0.
19 CVE-2014-9024 264 Bypass 2014-11-20 2014-11-20
7.5
None Remote Low Not required Partial Partial Partial
The Protected Pages module 7.x-2.x before 7.x-2.4 for Drupal allows remote attackers to bypass the password protection via a crafted path.
20 CVE-2014-9022 264 Bypass 2014-11-20 2014-11-20
6.4
None Remote Low Not required None Partial Partial
The Webform Component Roles module 6.x-1.x before 6.x-1.8 and 7.x-1.x before 7.x-1.8 for Drupal allows remote attackers to bypass the "disabled" restriction and modify read-only components via a crafted form.
21 CVE-2014-8989 264 Bypass 2014-11-29 2017-01-02
4.6
User Local Low Not required Partial Partial Partial
The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other category, aka a "negative groups" issue, related to kernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c.
22 CVE-2014-8988 264 Bypass 2014-11-24 2017-09-07
4.0
None Remote Low Single system Partial None None
MantisBT before 1.2.18 allows remote authenticated users to bypass the $g_download_attachments_threshold and $g_view_attachments_threshold restrictions and read attachments for private projects by leveraging access to a project that does not restrict access to attachments and a request to the download URL.
23 CVE-2014-8773 352 Bypass CSRF 2014-12-03 2014-12-05
6.8
None Remote Medium Not required Partial Partial Partial
MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism by (1) omitting the CSRF token or via a (2) long string in the CSRF token parameter.
24 CVE-2014-8764 287 Bypass 2014-10-22 2016-07-15
5.0
None Remote Low Not required None Partial None
DokuWiki 2014-05-05a and earlier, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a user name and password starting with a null (\0) character, which triggers an anonymous bind.
25 CVE-2014-8763 287 Bypass 2014-10-22 2016-07-15
5.0
None Remote Low Not required None Partial None
DokuWiki before 2014-05-05b, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a password starting with a null (\0) character and a valid user name, which triggers an unauthenticated bind.
26 CVE-2014-8736 200 Bypass +Info 2014-11-12 2014-11-13
5.0
None Remote Low Not required Partial None None
The Open Atrium Core module for Drupal before 7.x-2.22 allows remote attackers to bypass access restrictions and read file attachments that have been removed from a node by leveraging a previous revision of the node.
27 CVE-2014-8632 284 Bypass 2014-12-11 2016-12-21
4.3
None Remote Medium Not required Partial None None
The structured-clone implementation in Mozilla Firefox before 34.0 and SeaMonkey before 2.31 does not properly interact with XrayWrapper property filtering, which allows remote attackers to bypass intended DOM object restrictions by leveraging property availability after XrayWrapper removal.
28 CVE-2014-8631 284 Bypass 2014-12-11 2016-12-21
4.3
None Remote Medium Not required Partial None None
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 34.0 and SeaMonkey before 2.31 supports native-interface passing, which allows remote attackers to bypass intended DOM object restrictions via a call to an unspecified method.
29 CVE-2014-8558 264 Bypass 2014-11-25 2014-11-26
6.5
None Remote Low Single system Partial Partial Partial
JExperts Channel Platform 5.0.33_CCB allows remote authenticated users to bypass access restrictions via crafted action and key parameters.
30 CVE-2014-8535 Bypass 2014-10-29 2014-10-30
4.6
None Local Low Not required Partial Partial Partial
McAfee Network Data Loss Prevention (NDLP) before 9.2.2 allows local users to bypass intended restriction on unspecified functionality via unknown vectors.
31 CVE-2014-8472 287 Bypass 2014-11-04 2017-09-07
6.8
None Remote Medium Not required Partial Partial Partial
CA Cloud Service Management (CSM) before Summer 2014 does not properly verify authentication tokens from an Identity Provider, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors.
32 CVE-2014-8453 264 Bypass 2014-12-10 2014-12-11
5.0
None Remote Low Not required None Partial None
Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allow remote attackers to bypass the Same Origin Policy via unspecified vectors.
33 CVE-2014-8424 287 Bypass 2014-11-28 2014-11-28
7.8
None Remote Low Not required Complete None None
ARRIS VAP2500 before FW08.41 does not properly validate passwords, which allows remote attackers to bypass authentication.
34 CVE-2014-8413 264 Bypass 2014-11-24 2019-07-16
7.5
None Remote Low Not required Partial Partial Partial
The res_pjsip_acl module in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 does not properly create and load ACLs defined in pjsip.conf at startup, which allows remote attackers to bypass intended PJSIP ACL rules.
35 CVE-2014-8412 264 Bypass 2014-11-24 2019-07-16
5.0
None Remote Low Not required None Partial None
The (1) VoIP channel drivers, (2) DUNDi, and (3) Asterisk Manager Interface (AMI) in Asterisk Open Source 1.8.x before 1.8.32.1, 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8.28 before 1.8.28-cert3 and 11.6 before 11.6-cert8 allows remote attackers to bypass the ACL restrictions via a packet with a source IP that does not share the address family as the first ACL entry.
36 CVE-2014-8350 94 Exec Code Bypass 2014-11-03 2017-09-07
7.5
None Remote Low Not required Partial Partial Partial
Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code as demonstrated by "{literal}<{/literal}script language=php>" in a template.
37 CVE-2014-8134 264 Bypass 2014-12-12 2017-01-02
2.1
None Local Low Not required Partial None None
The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel through 3.18 uses an improper paravirt_enabled setting for KVM guest kernels, which makes it easier for guest OS users to bypass the ASLR protection mechanism via a crafted application that reads a 16-bit value.
38 CVE-2014-8133 264 Bypass 2014-12-17 2016-12-23
2.1
None Local Low Not required None Partial None
arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local users to bypass the ASLR protection mechanism, via a crafted application that makes a set_thread_area system call and later reads a 16-bit value.
39 CVE-2014-8109 264 Bypass 2014-12-29 2016-12-30
4.3
None Remote Medium Not required None Partial None
mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.
40 CVE-2014-8088 287 Bypass 2014-10-22 2017-11-03
5.0
None Remote Low Not required None Partial None
The (1) Zend_Ldap class in Zend before 1.12.9 and (2) Zend\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote attackers to bypass authentication via a password starting with a null byte, which triggers an unauthenticated bind.
41 CVE-2014-8006 287 Bypass 2014-12-16 2014-12-17
4.3
None Remote Medium Not required None Partial None
The Disaster Recovery (DRA) feature on the Cisco ISB8320-E High-Definition IP-Only DVR allows remote attackers to bypass authentication by establishing a TELNET session during a recovery boot, aka Bug ID CSCup85422.
42 CVE-2014-7984 264 Bypass 2014-10-08 2014-10-09
7.5
None Remote Low Not required Partial Partial Partial
Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to authenticate and bypass intended restrictions via vectors involving GMail authentication.
43 CVE-2014-7960 399 Bypass 2014-10-17 2017-09-07
4.0
None Remote Low Single system None Partial None
OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max_meta_count and other metadata constraints via multiple crafted requests which exceed the limit when combined.
44 CVE-2014-7905 284 Bypass 2014-11-19 2017-09-07
5.0
None Remote Low Not required None Partial None
Google Chrome before 39.0.2171.65 on Android does not prevent navigation to a URL in cases where an intent for the URL lacks CATEGORY_BROWSABLE, which allows remote attackers to bypass intended access restrictions via a crafted web site.
45 CVE-2014-7879 287 Exec Code Bypass 2014-12-10 2019-10-09
8.5
None Remote Medium Single system Complete Complete Complete
HP HP-UX B.11.11, B.11.23, and B.11.31, when the PAM configuration includes libpam_updbe, allows remote authenticated users to bypass authentication, and consequently execute arbitrary code, via unspecified vectors.
46 CVE-2014-7846 264 Bypass 2014-11-24 2015-09-03
4.0
None Remote Low Single system Partial None None
tag/tag_autocomplete.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not consider the moodle/tag:edit capability before adding a tag, which allows remote authenticated users to bypass intended access restrictions via an AJAX request.
47 CVE-2014-7832 264 Bypass 2014-11-24 2015-10-05
4.0
None Remote Low Single system Partial None None
mod/lti/launch.php in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 performs access control at the course level rather than at the activity level, which allows remote authenticated users to bypass the mod/lti:view capability requirement by viewing an activity instance.
48 CVE-2014-7828 264 Bypass 2014-11-19 2017-09-07
3.5
None Remote Medium Single system None Partial None
FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind.
49 CVE-2014-7825 119 DoS Overflow Bypass 2014-11-10 2018-01-04
4.9
None Local Low Not required None None Complete
kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the perf subsystem, which allows local users to cause a denial of service (out-of-bounds read and OOPS) or bypass the ASLR protection mechanism via a crafted application.
50 CVE-2014-7809 352 Bypass CSRF 2014-12-10 2018-10-09
6.8
None Remote Medium Not required Partial Partial Partial
Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable <s:token/> values, which allows remote attackers to bypass the CSRF protection mechanism.
Total number of vulnerabilities : 457   Page : 1 (This Page)2 3 4 5 6 7 8 9 10
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.