CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 2 and 2.99)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1651 CVE-2014-4460 200 +Info 2014-11-18 2017-08-28
2.1
 None Local Low Not required Partial None None
CFNetwork in Apple iOS before 8.1.1 and OS X before 10.10.1 does not properly clear the browsing cache upon a transition out of private-browsing mode, which makes it easier for physically proximate attackers to obtain sensitive information by reading cache files.
1652 CVE-2014-4455 264 Bypass 2014-11-18 2017-08-28
2.1
 None Local Low Not required None Partial None
dyld in Apple iOS before 8.1.1 and Apple TV before 7.0.2 does not properly handle overlapping segments in Mach-O executable files, which allows local users to bypass intended code-signing restrictions via a crafted file.
1653 CVE-2014-4446 264 Bypass 2014-10-17 2017-08-28
2.1
 None Remote High Single system Partial None None
Mail Service in Apple OS X Server before 4.0 does not enforce SACL changes until after a service restart, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging a change made by an administrator.
1654 CVE-2014-4440 200 +Info 2014-10-17 2017-08-28
2.6
 None Remote High Not required Partial None None
The MCX Desktop Config Profiles implementation in Apple OS X before 10.10 retains web-proxy settings from uninstalled mobile-configuration profiles, which allows remote attackers to obtain sensitive information in opportunistic circumstances by leveraging access to an unintended proxy server.
1655 CVE-2014-4431 264 2014-10-17 2017-08-28
2.1
 None Local Low Not required Partial None None
Dock in Apple OS X before 10.10 does not properly manage the screen-lock state, which allows physically proximate attackers to view windows by leveraging an unattended workstation.
1656 CVE-2014-4403 200 Bypass +Info 2014-09-19 2017-08-28
2.1
 None Local Low Not required Partial None None
The kernel in Apple OS X before 10.9.5 allows local users to obtain sensitive address information and bypass the ASLR protection mechanism by leveraging predictability of the location of the CPU Global Descriptor Table.
1657 CVE-2014-4367 264 2014-09-18 2017-08-28
2.1
 None Local Low Not required None Partial None
Apple iOS before 8 enables Voice Dial during all upgrade actions, which makes it easier for physically proximate attackers to launch unintended calls by speaking a telephone number.
1658 CVE-2014-4364 310 2014-09-18 2017-08-28
2.9
 None Local Network Medium Not required Partial None None
The 802.1X subsystem in Apple iOS before 8 and Apple TV before 7 does not require strong authentication methods, which allows remote attackers to calculate credentials by offering LEAP authentication from a crafted Wi-Fi AP and then performing a cryptographic attack against the MS-CHAPv1 hash.
1659 CVE-2014-4357 200 +Info 2014-09-18 2017-08-28
2.1
 None Local Low Not required Partial None None
Accounts Framework in Apple iOS before 8 and Apple TV before 7 allows attackers to obtain sensitive information by reading log data that was not intended to be present in a log.
1660 CVE-2014-4356 200 +Info 2014-09-18 2017-08-28
2.1
 None Local Low Not required Partial None None
Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen, which allows physically proximate attackers to obtain sensitive information by reading this screen.
1661 CVE-2014-4352 310 +Info 2014-09-18 2017-08-28
2.1
 None Local Low Not required Partial None None
Address Book in Apple iOS before 8 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.
1662 CVE-2014-4330 119 DoS Overflow 2014-09-30 2018-10-09
2.1
 None Local Low Not required None None Partial
The Dumper method in Data::Dumper before 2.154, as used in Perl 5.20.1 and earlier, allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an Array-Reference with many nested Array-References, which triggers a large number of recursive calls to the DD_dump function.
1663 CVE-2014-4303 79 XSS 2014-06-18 2016-09-06
2.1
 None Remote High Single system None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the Touch theme 7.x-1.x before 7.x-1.9 for Drupal allow remote authenticated users with the Administer themes permission to inject arbitrary web script or HTML via vectors related to the (1) Twitter and (2) Facebook username settings.
1664 CVE-2014-4243 2014-07-17 2018-10-09
2.8
 None Remote Medium Multiple systems None None Partial
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via vectors related to ENFED.
1665 CVE-2014-4222 2014-07-17 2018-10-09
2.1
 None Remote High Single system Partial None None
Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 11.1.1.7.0 and 12.1.2.0 allows remote authenticated users to affect confidentiality via vectors related to plugin 1.1.
1666 CVE-2014-4208 2014-07-17 2018-10-09
2.6
 None Remote High Not required None Partial None
Unspecified vulnerability in the Java SE component in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4220.
1667 CVE-2014-4039 264 +Info 2014-06-17 2017-01-06
2.1
 None Local Low Not required Partial None None
ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz, which allows local users to obtain sensitive information by reading files in this archive, as demonstrated by /var/log/messages and /etc/yaboot.conf.
1668 CVE-2014-4027 264 +Info 2014-06-23 2017-01-06
2.3
 None Local Network Medium Single system Partial None None
The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from ramdisk_mcp memory by leveraging access to a SCSI initiator.
1669 CVE-2014-4022 200 +Info 2014-07-09 2018-10-30
2.7
 None Local Network Low Single system Partial None None
The alloc_domain_struct function in arch/arm/domain.c in Xen 4.4.x, when running on an ARM platform, does not properly initialize the structure containing the grant table pages for a domain, which allows local guest administrators to obtain sensitive information via the GNTTABOP_setup_table subhypercall.
1670 CVE-2014-4021 119 Overflow +Info 2014-06-18 2018-10-30
2.7
 None Local Network Low Single system Partial None None
Xen 3.2.x through 4.4.x does not properly clean memory pages recovered from guests, which allows local guest OS users to obtain sensitive information via unspecified vectors.
1671 CVE-2014-3970 DoS 2014-06-11 2017-01-06
2.9
 None Local Network Medium Not required None None Partial
The pa_rtp_recv function in modules/rtp/rtp.c in the module-rtp-recv module in PulseAudio 5.0 and earlier allows remote attackers to cause a denial of service (assertion failure and abort) via an empty UDP packet.
1672 CVE-2014-3966 79 XSS 2014-06-06 2017-12-28
2.6
 None Remote High Not required None Partial None
Cross-site scripting (XSS) vulnerability in Special:PasswordReset in MediaWiki before 1.19.16, 1.21.x before 1.21.10, and 1.22.x before 1.22.7, when wgRawHtml is enabled, allows remote attackers to inject arbitrary web script or HTML via an invalid username.
1673 CVE-2014-3886 79 XSS 2014-07-20 2014-07-22
2.6
 None Remote High Not required None Partial None
Cross-site scripting (XSS) vulnerability in Webmin before 1.690, when referrer checking is disabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this might overlap CVE-2014-3924.
1674 CVE-2014-3873 20 +Info 2014-06-10 2014-06-24
2.1
 None Local Low Not required Partial None None
The ktrace utility in the FreeBSD kernel 8.4 before p11, 9.1 before p14, 9.2 before p7, and 9.3-BETA1 before p1 uses an incorrect page fault kernel trace entry size, which allows local users to obtain sensitive information from kernel memory via a kernel process trace.
1675 CVE-2014-3851 200 +Info 2014-08-07 2014-08-07
2.1
 None Local Low Not required Partial None None
usr/lib/cgi-bin/create_passwd_file.py in Pyplate 0.08 uses world-readable permissions for passwd.db, which allows local users to obtain the administrator password by reading this file.
1676 CVE-2014-3800 264 2014-08-07 2014-08-07
2.1
 None Local Low Not required Partial None None
XBMC 13.0 uses world-readable permissions for .xbmc/userdata/sources.xml, which allows local users to obtain user names and passwords by reading this file.
1677 CVE-2014-3737 79 XSS 2014-07-02 2018-10-09
2.6
 None Remote High Not required None Partial None
Cross-site scripting (XSS) vulnerability in templates/defaultheader.php in Lamp Design Storesprite before 7 - 19-06-14, when using the currency selection dropdown, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to brand.php, related to the currencyUrl function.
1678 CVE-2014-3672 400 DoS 2016-05-25 2017-09-07
2.1
 None Local Low Not required None None Partial
The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of service (host disk consumption) by writing to stdout or stderr.
1679 CVE-2014-3647 264 DoS 2014-11-10 2016-10-14
2.1
 None Local Low Not required None None Partial
arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through 3.17.2 does not properly perform RIP changes, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application.
1680 CVE-2014-3646 264 DoS 2014-11-10 2015-03-25
2.1
 None Local Low Not required None None Partial
arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2 does not have an exit handler for the INVVPID instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application.
1681 CVE-2014-3645 20 DoS 2014-11-10 2015-03-17
2.1
 None Local Low Not required None None Partial
arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.12 does not have an exit handler for the INVEPT instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application.
1682 CVE-2014-3640 476 DoS 2014-11-07 2017-11-03
2.1
 None Local Low Not required None None Partial
The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket.
1683 CVE-2014-3639 399 DoS 2014-09-22 2018-10-30
2.1
 None Local Low Not required None None Partial
The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections, which allows local users to cause a denial of service (incomplete connection consumption and prevention of new connections) via a large number of incomplete connections.
1684 CVE-2014-3638 399 DoS 2014-09-22 2018-10-30
2.1
 None Local Low Not required None None Partial
The bus_connections_check_reply function in config-parser.c in D-Bus before 1.6.24 and 1.8.x before 1.8.8 allows local users to cause a denial of service (CPU consumption) via a large number of method calls.
1685 CVE-2014-3637 17 DoS 2014-09-22 2018-10-30
2.1
 None Local Low Not required None None Partial
D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for processes that have terminated, which allows local users to cause a denial of service via a D-bus message containing a D-Bus connection file descriptor.
1686 CVE-2014-3615 200 +Info 2014-11-01 2017-11-03
2.1
 None Local Low Not required Partial None None
The VGA emulator in QEMU allows local guest users to read host memory by setting the display to a high resolution.
1687 CVE-2014-3608 399 DoS Bypass 2014-10-06 2018-11-16
2.7
 None Local Network Low Single system None None Partial
The VMWare driver in OpenStack Compute (Nova) before 2014.1.3 allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by putting the VM into the rescue state, suspending it, which puts into an ERROR state, and then deleting the image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2573.
1688 CVE-2014-3602 264 +Info 2014-11-13 2015-11-20
2.1
 None Local Low Not required Partial None None
Red Hat OpenShift Enterprise before 2.2 allows local users to obtain IP address and port number information for remote systems by reading /proc/net/tcp.
1689 CVE-2014-3586 264 +Info 2015-04-21 2015-10-13
2.1
 None Local Low Not required Partial None None
The default configuration for the Command Line Interface in Red Hat Enterprise Application Platform before 6.4.0 and WildFly (formerly JBoss Application Server) uses weak permissions for .jboss-cli-history, which allows local users to obtain sensitive information via unspecified vectors.
1690 CVE-2014-3561 200 +Info 2014-12-05 2017-08-28
2.1
 None Local Low Not required Partial None None
The rhevm-log-collector package in Red Hat Enterprise Virtualization 3.4 uses the PostgreSQL database password on the command line when calling sosreport, which allows local users to obtain sensitive information by listing the processes.
1691 CVE-2014-3533 20 DoS 2014-07-19 2018-10-30
2.1
 None Local Low Not required None None Partial
dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allows local users to cause a denial of service (disconnect) via a certain sequence of crafted messages that cause the dbus-daemon to forward a message containing an invalid file descriptor.
1692 CVE-2014-3532 20 DoS 2014-07-19 2018-10-30
2.1
 None Local Low Not required None None Partial
dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users to cause a denial of service (system-bus disconnect of other services or applications) by sending a message containing a file descriptor, then exceeding the maximum recursion depth before the initial message is forwarded.
1693 CVE-2014-3493 119 DoS Overflow Mem. Corr. 2014-06-23 2018-10-09
2.7
 None Local Network Low Single system None None Partial
The push_ascii function in smbd in Samba 3.6.x before 3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9 allows remote authenticated users to cause a denial of service (memory corruption and daemon crash) via an attempt to read a Unicode pathname without specifying use of Unicode, leading to a character-set conversion failure that triggers an invalid pointer dereference.
1694 CVE-2014-3477 DoS 2014-07-01 2015-04-14
2.1
 None Local Low Not required None None Partial
The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.
1695 CVE-2014-3471 416 DoS 2018-01-12 2018-01-31
2.1
 None Local Low Not required None None Partial
Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU instance crash) via hotplug and hotunplug operations of Virtio block devices.
1696 CVE-2014-3426 DoS 2014-05-08 2014-05-08
2.1
 None Local Low Not required None None Partial
NCSA Mosaic 2.1 through 2.7b5 allows local users to cause a denial of service ("remote control" outage) by creating a /tmp/Mosaic.pid file for every possible PID.
1697 CVE-2014-3425 DoS 2014-05-08 2014-05-08
2.1
 None Local Low Not required None None Partial
NCSA Mosaic 2.0 and earlier allows local users to cause a denial of service ("remote control" outage) by creating a /tmp/xmosaic.pid file for every possible PID.
1698 CVE-2014-3209 264 2014-11-15 2014-11-17
2.1
 None Local Low Not required Partial None None
The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow local users to obtain the private key by reading the file.
1699 CVE-2014-3123 79 XSS 2014-05-08 2014-05-09
2.1
 None Remote High Single system None Partial None
Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated users with the NextGEN Upload images, NextGEN Manage gallery, or NextGEN Manage others gallery permission to inject arbitrary web script or HTML via the "Alt & Title Text" field.
1700 CVE-2014-3099 +Info 2014-12-06 2017-08-28
2.1
 None Local Low Not required Partial None None
Unspecified vulnerability in the Security component in IBM Systems Director 6.3.0 through 6.3.5 allows local users to obtain sensitive information via unknown vectors.
Total number of vulnerabilities : 4392   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 (This Page)35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.