cpe:/a:mariadb:mariadb:5.5.34 cpe:/a:mysql:mysql:5.5.0 cpe:/a:mysql:mysql:5.5.1 cpe:/a:mysql:mysql:5.5.2 cpe:/a:mysql:mysql:5.5.3 cpe:/a:mysql:mysql:5.5.4 cpe:/a:mysql:mysql:5.5.5 cpe:/a:mysql:mysql:5.5.6 cpe:/a:mysql:mysql:5.5.7 cpe:/a:mysql:mysql:5.5.8 cpe:/a:mysql:mysql:5.5.9 cpe:/a:oracle:mysql:5.5.10 cpe:/a:oracle:mysql:5.5.11 cpe:/a:oracle:mysql:5.5.12 cpe:/a:oracle:mysql:5.5.13 cpe:/a:oracle:mysql:5.5.14 cpe:/a:oracle:mysql:5.5.15 cpe:/a:oracle:mysql:5.5.16 cpe:/a:oracle:mysql:5.5.17 cpe:/a:oracle:mysql:5.5.18 cpe:/a:oracle:mysql:5.5.19 cpe:/a:oracle:mysql:5.5.20 cpe:/a:oracle:mysql:5.5.21 cpe:/a:oracle:mysql:5.5.22 cpe:/a:oracle:mysql:5.5.23 cpe:/a:oracle:mysql:5.5.24 cpe:/a:oracle:mysql:5.5.25 cpe:/a:oracle:mysql:5.5.25:a cpe:/a:oracle:mysql:5.5.26 cpe:/a:oracle:mysql:5.5.27 cpe:/a:oracle:mysql:5.5.28 cpe:/a:oracle:mysql:5.5.29 cpe:/a:oracle:mysql:5.5.30 cpe:/a:oracle:mysql:5.5.31 cpe:/a:oracle:mysql:5.5.32 cpe:/a:oracle:mysql:5.5.33 cpe:/a:oracle:mysql:5.5.34 cpe:/a:oracle:mysql:5.5.35 cpe:/a:oracle:mysql:5.5.36 cpe:/a:oracle:mysql:5.6.0 cpe:/a:oracle:mysql:5.6.1 cpe:/a:oracle:mysql:5.6.2 cpe:/a:oracle:mysql:5.6.3 cpe:/a:oracle:mysql:5.6.4 cpe:/a:oracle:mysql:5.6.5 cpe:/a:oracle:mysql:5.6.6 cpe:/a:oracle:mysql:5.6.7 cpe:/a:oracle:mysql:5.6.8 cpe:/a:oracle:mysql:5.6.9 cpe:/a:oracle:mysql:5.6.10 cpe:/a:oracle:mysql:5.6.11 cpe:/a:oracle:mysql:5.6.12 cpe:/a:oracle:mysql:5.6.13 cpe:/a:oracle:mysql:5.6.14 cpe:/a:oracle:mysql:5.6.15 cpe:/a:oracle:mysql:5.6.16 cpe:/o:redhat:enterprise_linux:5 cpe:/o:redhat:enterprise_linux:5::client_workstation cpe:/o:redhat:enterprise_linux:5::server cpe:/o:redhat:enterprise_linux:6.0 cpe:/o:redhat:enterprise_linux_desktop:5.0 cpe:/o:redhat:enterprise_linux_desktop:6.0 cpe:/o:redhat:enterprise_linux_server:6.0 cpe:/o:redhat:enterprise_linux_workstation:6.0

CVE-2014-0001

2014-01-31T18:55:04.503-05:00

2019-04-22T13:48:00.643-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://bazaar.launchpad.net/~maria-captains/maria/5.5/revision/2502.565.64 REDHAT RHSA-2014:0164 REDHAT RHSA-2014:0173 REDHAT RHSA-2014:0186 REDHAT RHSA-2014:0189 SECUNIA 52161 GENTOO GLSA-201409-04 MANDRIVA MDVSA-2014:029 BID 65298 SECTRACK 1029708 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1054592 XF mysql-cve20140001-bo(90901) CONFIRM https://mariadb.com/kb/en/mariadb-5535-changelog/ Buffer overflow in client/mysql.cc in Oracle MySQL and MariaDB before 5.5.35 allows remote database servers to cause a denial of service (crash) and possibly execute arbitrary code via a long server version string.

cpe:/a:apache:camel:1.0.0 cpe:/a:apache:camel:1.1.0 cpe:/a:apache:camel:1.2.0 cpe:/a:apache:camel:1.3.0 cpe:/a:apache:camel:1.4.0 cpe:/a:apache:camel:1.5.0 cpe:/a:apache:camel:1.6.0 cpe:/a:apache:camel:1.6.1 cpe:/a:apache:camel:1.6.2 cpe:/a:apache:camel:1.6.3 cpe:/a:apache:camel:1.6.4 cpe:/a:apache:camel:2.0.0 cpe:/a:apache:camel:2.0.0:m1 cpe:/a:apache:camel:2.0.0:m2 cpe:/a:apache:camel:2.0.0:m3 cpe:/a:apache:camel:2.1.0 cpe:/a:apache:camel:2.10.0 cpe:/a:apache:camel:2.10.1 cpe:/a:apache:camel:2.10.2 cpe:/a:apache:camel:2.10.3 cpe:/a:apache:camel:2.10.4 cpe:/a:apache:camel:2.10.5 cpe:/a:apache:camel:2.10.6 cpe:/a:apache:camel:2.10.7 cpe:/a:apache:camel:2.11.0 cpe:/a:apache:camel:2.11.1 cpe:/a:apache:camel:2.11.2 cpe:/a:apache:camel:2.11.3 cpe:/a:apache:camel:2.12.0 cpe:/a:apache:camel:2.12.1 cpe:/a:apache:camel:2.12.2

CVE-2014-0002

2014-03-21T00:38:59.027-04:00

2019-05-24T07:29:00.953-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc REDHAT RHSA-2014:0371 REDHAT RHSA-2014:0372 BID 65901 MLIST [camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html MLIST [camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CVE-2014-0003

2014-03-21T00:38:59.057-04:00

2019-05-24T07:29:01.250-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc REDHAT RHSA-2014:0245 REDHAT RHSA-2014:0254 REDHAT RHSA-2014:0371 REDHAT RHSA-2014:0372 BID 65902 MLIST [camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html MLIST [camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.

cpe:/a:freedesktop:udisks:1.0 cpe:/a:freedesktop:udisks:1.0.1 cpe:/a:freedesktop:udisks:1.0.4 cpe:/a:freedesktop:udisks:2.0.0 cpe:/a:freedesktop:udisks:2.0.1 cpe:/a:freedesktop:udisks:2.0.90 cpe:/a:freedesktop:udisks:2.0.91 cpe:/a:freedesktop:udisks:2.0.92 cpe:/a:freedesktop:udisks:2.1.0 cpe:/a:freedesktop:udisks:2.1.1 cpe:/a:freedesktop:udisks:2.1.2 cpe:/o:canonical:ubuntu_linux:12.04:-:lts cpe:/o:canonical:ubuntu_linux:12.10 cpe:/o:canonical:ubuntu_linux:13.10

CVE-2014-0004

2014-03-11T15:37:03.223-04:00

2016-12-30T21:59:10.590-05:00

6.9

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MLIST [devkit-devel] 20140310 udisks 2.1.3 / 1.0.5 security updates SUSE openSUSE-SU-2014:0388 SUSE openSUSE-SU-2014:0389 SUSE openSUSE-SU-2014:0390 REDHAT RHSA-2014:0293 DEBIAN DSA-2872 BID 66081 UBUNTU USN-2142-1 Stack-based buffer overflow in udisks before 1.0.5 and 2.x before 2.1.3 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long mount point.

cpe:/a:redhat:jboss_enterprise_application_platform:6.2.2 cpe:/a:redhat:jboss_enterprise_brms_platform:6.0.3

CVE-2014-0005

2015-02-20T11:59:00.053-05:00

2015-03-27T21:59:08.687-04:00

3.6

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2014:0343 REDHAT RHSA-2014:0344 REDHAT RHSA-2014:0345 REDHAT RHSA-2015:0234 REDHAT RHSA-2015:0235 REDHAT RHSA-2015:0720 PicketBox and JBossSX, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2 and JBoss BRMS before 6.0.3 roll up patch 2, allows remote authenticated users to read and modify the application sever configuration and state by deploying a crafted application.

cpe:/a:openstack:swift:1.4.6 cpe:/a:openstack:swift:1.4.7 cpe:/a:openstack:swift:1.4.8 cpe:/a:openstack:swift:1.5.0 cpe:/a:openstack:swift:1.6.0 cpe:/a:openstack:swift:1.7.0 cpe:/a:openstack:swift:1.7.2 cpe:/a:openstack:swift:1.7.4 cpe:/a:openstack:swift:1.7.5 cpe:/a:openstack:swift:1.7.6 cpe:/a:openstack:swift:1.8.0 cpe:/a:openstack:swift:1.9.0 cpe:/a:openstack:swift:1.9.1 cpe:/a:openstack:swift:1.9.2 cpe:/a:openstack:swift:1.10.0 cpe:/a:openstack:swift:1.11.0

CVE-2014-0006

2014-01-22T20:55:04.007-05:00

2014-03-08T00:12:30.730-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2014:0232 MLIST [oss-security] 20140117 [OSSA 2014-002] Swift TempURL timing attack (CVE-2014-0006) CONFIRM https://bugs.launchpad.net/swift/+bug/1265665 The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.

cpe:/a:theforeman:foreman:1.4.0 cpe:/a:theforeman:foreman:1.4.1 cpe:/a:theforeman:foreman:1.4.2 cpe:/a:theforeman:foreman:1.4.3 cpe:/a:theforeman:foreman:1.4.4 cpe:/a:theforeman:foreman:1.5.0

CVE-2014-0007

2014-06-20T10:55:06.717-04:00

2014-06-23T10:45:10.527-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-06-23T10:45:10.307-04:00

CONFIRM http://projects.theforeman.org/issues/6086 REDHAT RHSA-2014:0770 The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetch_boot_file.

cpe:/a:moodle:moodle:2.3 cpe:/a:moodle:moodle:2.3.1 cpe:/a:moodle:moodle:2.3.2 cpe:/a:moodle:moodle:2.3.3 cpe:/a:moodle:moodle:2.3.4 cpe:/a:moodle:moodle:2.3.5 cpe:/a:moodle:moodle:2.3.6 cpe:/a:moodle:moodle:2.3.7 cpe:/a:moodle:moodle:2.3.8 cpe:/a:moodle:moodle:2.3.9 cpe:/a:moodle:moodle:2.3.10 cpe:/a:moodle:moodle:2.3.11 cpe:/a:moodle:moodle:2.4 cpe:/a:moodle:moodle:2.4.1 cpe:/a:moodle:moodle:2.4.2 cpe:/a:moodle:moodle:2.4.3 cpe:/a:moodle:moodle:2.4.4 cpe:/a:moodle:moodle:2.4.5 cpe:/a:moodle:moodle:2.4.6 cpe:/a:moodle:moodle:2.4.7 cpe:/a:moodle:moodle:2.5 cpe:/a:moodle:moodle:2.5.1 cpe:/a:moodle:moodle:2.5.2 cpe:/a:moodle:moodle:2.5.3 cpe:/a:moodle:moodle:2.6

CVE-2014-0008

2014-01-20T10:14:25.437-05:00

2014-02-21T00:06:06.437-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36721 FEDORA FEDORA-2014-1377 FEDORA FEDORA-2014-1396 MLIST [oss-security] 20140120 Moodle security notifications public SECTRACK 1029647 CONFIRM https://moodle.org/mod/forum/discuss.php?d=252414 lib/adminlib.php in Moodle through 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 logs cleartext passwords, which allows remote authenticated administrators to obtain sensitive information by reading the Config Changes Report.

cpe:/a:moodle:moodle:2.0 cpe:/a:moodle:moodle:2.0.1 cpe:/a:moodle:moodle:2.0.2 cpe:/a:moodle:moodle:2.0.3 cpe:/a:moodle:moodle:2.0.4 cpe:/a:moodle:moodle:2.0.5 cpe:/a:moodle:moodle:2.0.6 cpe:/a:moodle:moodle:2.0.7 cpe:/a:moodle:moodle:2.0.8 cpe:/a:moodle:moodle:2.0.9 cpe:/a:moodle:moodle:2.1 cpe:/a:moodle:moodle:2.1.1 cpe:/a:moodle:moodle:2.1.2 cpe:/a:moodle:moodle:2.1.3 cpe:/a:moodle:moodle:2.1.4 cpe:/a:moodle:moodle:2.1.5 cpe:/a:moodle:moodle:2.1.6 cpe:/a:moodle:moodle:2.1.7 cpe:/a:moodle:moodle:2.1.8 cpe:/a:moodle:moodle:2.1.9 cpe:/a:moodle:moodle:2.1.10 cpe:/a:moodle:moodle:2.2 cpe:/a:moodle:moodle:2.2.1 cpe:/a:moodle:moodle:2.2.2 cpe:/a:moodle:moodle:2.2.3 cpe:/a:moodle:moodle:2.2.4 cpe:/a:moodle:moodle:2.2.5 cpe:/a:moodle:moodle:2.2.6 cpe:/a:moodle:moodle:2.2.7 cpe:/a:moodle:moodle:2.2.8 cpe:/a:moodle:moodle:2.2.9 cpe:/a:moodle:moodle:2.2.10 cpe:/a:moodle:moodle:2.2.11 cpe:/a:moodle:moodle:2.3 cpe:/a:moodle:moodle:2.3.1 cpe:/a:moodle:moodle:2.3.2 cpe:/a:moodle:moodle:2.3.3 cpe:/a:moodle:moodle:2.3.4 cpe:/a:moodle:moodle:2.3.5 cpe:/a:moodle:moodle:2.3.6 cpe:/a:moodle:moodle:2.3.7 cpe:/a:moodle:moodle:2.3.8 cpe:/a:moodle:moodle:2.3.9 cpe:/a:moodle:moodle:2.3.10 cpe:/a:moodle:moodle:2.4 cpe:/a:moodle:moodle:2.4.1 cpe:/a:moodle:moodle:2.4.2 cpe:/a:moodle:moodle:2.4.3 cpe:/a:moodle:moodle:2.4.4 cpe:/a:moodle:moodle:2.4.5 cpe:/a:moodle:moodle:2.4.6 cpe:/a:moodle:moodle:2.4.7 cpe:/a:moodle:moodle:2.5 cpe:/a:moodle:moodle:2.5.1 cpe:/a:moodle:moodle:2.5.2 cpe:/a:moodle:moodle:2.5.3 cpe:/a:moodle:moodle:2.6

CVE-2014-0009

2014-01-20T10:14:32.313-05:00

2014-02-21T00:06:06.530-05:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-42643 FEDORA FEDORA-2014-1377 FEDORA FEDORA-2014-1396 MLIST [oss-security] 20140120 Moodle security notifications public SECTRACK 1029648 CONFIRM https://moodle.org/mod/forum/discuss.php?d=252415 course/loginas.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 does not enforce the moodle/site:accessallgroups capability requirement for outside-group users in a SEPARATEGROUPS configuration, which allows remote authenticated users to perform "login as" actions via a direct request.

CVE-2014-0010

2014-01-20T10:14:32.347-05:00

2016-04-06T08:12:54.230-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2016-04-04T16:26:27.803-04:00

CONFIRM http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-42883 FEDORA FEDORA-2014-1377 FEDORA FEDORA-2014-1396 MLIST [oss-security] 20140120 Moodle security notifications public SECTRACK 1029649 CONFIRM https://moodle.org/mod/forum/discuss.php?d=252416 Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete (1) categories or (2) fields.

cpe:/a:pocoo:jinja2:2.7.2

CVE-2014-0012

2014-05-19T10:55:10.330-04:00

2015-12-14T18:07:28.250-05:00

4.4

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2015-12-14T13:35:49.323-05:00

MLIST [oss-security] 20140110 CVE assignment for jinja2 GENTOO GLSA-201408-13 MISC https://bugzilla.redhat.com/show_bug.cgi?id=1051421 MISC https://github.com/mitsuhiko/jinja2/commit/acb672b6a179567632e032f547582f30fa2f4aa7 MISC https://github.com/mitsuhiko/jinja2/pull/292 MISC https://github.com/mitsuhiko/jinja2/pull/296 FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.

cpe:/a:emberjs:ember.js:1.0.0 cpe:/a:emberjs:ember.js:1.0.0:pre.2 cpe:/a:emberjs:ember.js:1.0.0:pre.3 cpe:/a:emberjs:ember.js:1.0.0:pre.4 cpe:/a:emberjs:ember.js:1.0.0:rc.1 cpe:/a:emberjs:ember.js:1.0.0:rc.1.1 cpe:/a:emberjs:ember.js:1.0.0:rc.2 cpe:/a:emberjs:ember.js:1.0.0:rc.2.1 cpe:/a:emberjs:ember.js:1.0.0:rc.3 cpe:/a:emberjs:ember.js:1.0.0:rc.3.1 cpe:/a:emberjs:ember.js:1.0.0:rc.4 cpe:/a:emberjs:ember.js:1.0.0:rc.4.1 cpe:/a:emberjs:ember.js:1.0.0:rc.5 cpe:/a:emberjs:ember.js:1.0.0:rc.5.1 cpe:/a:emberjs:ember.js:1.0.0:rc.6 cpe:/a:emberjs:ember.js:1.0.0:rc.6.1 cpe:/a:emberjs:ember.js:1.0.0:rc.7 cpe:/a:emberjs:ember.js:1.0.0:rc.8 cpe:/a:emberjs:ember.js:1.0.0:rc4 cpe:/a:emberjs:ember.js:1.1.0 cpe:/a:emberjs:ember.js:1.1.0:beta.1 cpe:/a:emberjs:ember.js:1.1.0:beta.2 cpe:/a:emberjs:ember.js:1.1.0:beta.3 cpe:/a:emberjs:ember.js:1.1.0:beta.4 cpe:/a:emberjs:ember.js:1.1.1 cpe:/a:emberjs:ember.js:1.1.2 cpe:/a:emberjs:ember.js:1.2.0 cpe:/a:emberjs:ember.js:1.2.0:beta.1 cpe:/a:emberjs:ember.js:1.2.0:beta.2 cpe:/a:emberjs:ember.js:1.2.0:beta.3 cpe:/a:emberjs:ember.js:1.2.0:beta.4 cpe:/a:emberjs:ember.js:1.3.0 cpe:/a:emberjs:ember.js:1.3.0:beta.1 cpe:/a:emberjs:ember.js:1.3.0:beta.2 cpe:/a:emberjs:ember.js:1.3.0:beta.3 cpe:/a:emberjs:ember.js:1.3.0:beta.4 cpe:/a:emberjs:ember.js:1.4.0 cpe:/a:emberjs:ember.js:1.4.0:beta.1

CVE-2014-0013

2018-02-15T16:29:00.430-05:00

2018-08-13T17:47:47.010-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://emberjs.com/blog/2014/01/14/ember-security-releases.html CONFIRM https://groups.google.com/forum/#!topic/ember-security/2kpXXCxISS4 Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging an application that contains templates whose context is set to a user-supplied primitive value and also contain the `{{this}}` special Handlebars variable.

CVE-2014-0014

2018-02-15T16:29:00.510-05:00

2018-10-16T21:29:01.163-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://emberjs.com/blog/2014/01/14/ember-security-releases.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html CONFIRM https://groups.google.com/forum/#!topic/ember-security/PSE4RzTi6l4 Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging an application using the "{{group}}" Helper and a crafted payload.

cpe:/a:haxx:curl:7.10.6 cpe:/a:haxx:curl:7.10.7 cpe:/a:haxx:curl:7.10.8 cpe:/a:haxx:curl:7.11.0 cpe:/a:haxx:curl:7.11.1 cpe:/a:haxx:curl:7.11.2 cpe:/a:haxx:curl:7.12.0 cpe:/a:haxx:curl:7.12.1 cpe:/a:haxx:curl:7.12.2 cpe:/a:haxx:curl:7.12.3 cpe:/a:haxx:curl:7.13.0 cpe:/a:haxx:curl:7.13.1 cpe:/a:haxx:curl:7.13.2 cpe:/a:haxx:curl:7.14.0 cpe:/a:haxx:curl:7.14.1 cpe:/a:haxx:curl:7.15.0 cpe:/a:haxx:curl:7.15.1 cpe:/a:haxx:curl:7.15.2 cpe:/a:haxx:curl:7.15.3 cpe:/a:haxx:curl:7.15.4 cpe:/a:haxx:curl:7.15.5 cpe:/a:haxx:curl:7.16.0 cpe:/a:haxx:curl:7.16.1 cpe:/a:haxx:curl:7.16.2 cpe:/a:haxx:curl:7.16.3 cpe:/a:haxx:curl:7.16.4 cpe:/a:haxx:curl:7.17.0 cpe:/a:haxx:curl:7.17.1 cpe:/a:haxx:curl:7.18.0 cpe:/a:haxx:curl:7.18.1 cpe:/a:haxx:curl:7.18.2 cpe:/a:haxx:curl:7.19.0 cpe:/a:haxx:curl:7.19.1 cpe:/a:haxx:curl:7.19.2 cpe:/a:haxx:curl:7.19.3 cpe:/a:haxx:curl:7.19.4 cpe:/a:haxx:curl:7.19.5 cpe:/a:haxx:curl:7.19.6 cpe:/a:haxx:curl:7.19.7 cpe:/a:haxx:curl:7.20.0 cpe:/a:haxx:curl:7.20.1 cpe:/a:haxx:curl:7.21.0 cpe:/a:haxx:curl:7.21.1 cpe:/a:haxx:curl:7.21.2 cpe:/a:haxx:curl:7.21.3 cpe:/a:haxx:curl:7.21.4 cpe:/a:haxx:curl:7.21.5 cpe:/a:haxx:curl:7.21.6 cpe:/a:haxx:curl:7.21.7 cpe:/a:haxx:curl:7.22.0 cpe:/a:haxx:curl:7.23.0 cpe:/a:haxx:curl:7.23.1 cpe:/a:haxx:curl:7.24.0 cpe:/a:haxx:curl:7.25.0 cpe:/a:haxx:curl:7.26.0 cpe:/a:haxx:curl:7.27.0 cpe:/a:haxx:curl:7.28.0 cpe:/a:haxx:curl:7.28.1 cpe:/a:haxx:curl:7.29.0 cpe:/a:haxx:curl:7.30.0 cpe:/a:haxx:curl:7.31.0 cpe:/a:haxx:curl:7.32.0 cpe:/a:haxx:curl:7.33.0 cpe:/a:haxx:curl:7.34.0 cpe:/a:haxx:libcurl:7.10.6 cpe:/a:haxx:libcurl:7.10.7 cpe:/a:haxx:libcurl:7.10.8 cpe:/a:haxx:libcurl:7.11.0 cpe:/a:haxx:libcurl:7.11.1 cpe:/a:haxx:libcurl:7.11.2 cpe:/a:haxx:libcurl:7.12.0 cpe:/a:haxx:libcurl:7.12.1 cpe:/a:haxx:libcurl:7.12.2 cpe:/a:haxx:libcurl:7.12.3 cpe:/a:haxx:libcurl:7.13.0 cpe:/a:haxx:libcurl:7.13.1 cpe:/a:haxx:libcurl:7.13.2 cpe:/a:haxx:libcurl:7.14.0 cpe:/a:haxx:libcurl:7.14.1 cpe:/a:haxx:libcurl:7.15.0 cpe:/a:haxx:libcurl:7.15.1 cpe:/a:haxx:libcurl:7.15.2 cpe:/a:haxx:libcurl:7.15.3 cpe:/a:haxx:libcurl:7.15.4 cpe:/a:haxx:libcurl:7.15.5 cpe:/a:haxx:libcurl:7.16.0 cpe:/a:haxx:libcurl:7.16.1 cpe:/a:haxx:libcurl:7.16.2 cpe:/a:haxx:libcurl:7.16.3 cpe:/a:haxx:libcurl:7.16.4 cpe:/a:haxx:libcurl:7.17.0 cpe:/a:haxx:libcurl:7.17.1 cpe:/a:haxx:libcurl:7.18.0 cpe:/a:haxx:libcurl:7.18.1 cpe:/a:haxx:libcurl:7.18.2 cpe:/a:haxx:libcurl:7.19.0 cpe:/a:haxx:libcurl:7.19.1 cpe:/a:haxx:libcurl:7.19.2 cpe:/a:haxx:libcurl:7.19.3 cpe:/a:haxx:libcurl:7.19.4 cpe:/a:haxx:libcurl:7.19.5 cpe:/a:haxx:libcurl:7.19.6 cpe:/a:haxx:libcurl:7.19.7 cpe:/a:haxx:libcurl:7.20.0 cpe:/a:haxx:libcurl:7.20.1 cpe:/a:haxx:libcurl:7.21.0 cpe:/a:haxx:libcurl:7.21.1 cpe:/a:haxx:libcurl:7.21.2 cpe:/a:haxx:libcurl:7.21.3 cpe:/a:haxx:libcurl:7.21.4 cpe:/a:haxx:libcurl:7.21.5 cpe:/a:haxx:libcurl:7.21.6 cpe:/a:haxx:libcurl:7.21.7 cpe:/a:haxx:libcurl:7.22.0 cpe:/a:haxx:libcurl:7.23.0 cpe:/a:haxx:libcurl:7.23.1 cpe:/a:haxx:libcurl:7.24.0 cpe:/a:haxx:libcurl:7.25.0 cpe:/a:haxx:libcurl:7.26.0 cpe:/a:haxx:libcurl:7.27.0 cpe:/a:haxx:libcurl:7.28.0 cpe:/a:haxx:libcurl:7.28.1 cpe:/a:haxx:libcurl:7.29.0 cpe:/a:haxx:libcurl:7.30.0 cpe:/a:haxx:libcurl:7.31.0 cpe:/a:haxx:libcurl:7.32.0 cpe:/a:haxx:libcurl:7.33.0 cpe:/a:haxx:libcurl:7.34.0

CVE-2014-0015

2014-02-01T19:55:05.317-05:00

2018-10-09T15:35:04.610-04:00

4.0

NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov APPLE APPLE-SA-2014-06-30-2 CONFIRM http://curl.haxx.se/docs/adv_20140129.html CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743 FEDORA FEDORA-2014-1876 FEDORA FEDORA-2014-1864 SUSE openSUSE-SU-2014:0274 FULLDISC 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities SECUNIA 56912 CONFIRM http://support.apple.com/kb/HT6296 DEBIAN DSA-2849 CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html BUGTRAQ 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities BID 65270 SECTRACK 1029710 SLACKWARE SSA:2014-044-01 UBUNTU USN-2097-1 CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0012.html CONFIRM http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095862 cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request.

cpe:/a:stunnel:stunnel:0.1 cpe:/a:stunnel:stunnel:1.0 cpe:/a:stunnel:stunnel:1.1 cpe:/a:stunnel:stunnel:1.2 cpe:/a:stunnel:stunnel:1.3 cpe:/a:stunnel:stunnel:1.4 cpe:/a:stunnel:stunnel:1.5 cpe:/a:stunnel:stunnel:1.6 cpe:/a:stunnel:stunnel:2.0 cpe:/a:stunnel:stunnel:2.1 cpe:/a:stunnel:stunnel:3.0 cpe:/a:stunnel:stunnel:3.0:b1 cpe:/a:stunnel:stunnel:3.0:b2 cpe:/a:stunnel:stunnel:3.0:b3 cpe:/a:stunnel:stunnel:3.0:b4 cpe:/a:stunnel:stunnel:3.0:b5 cpe:/a:stunnel:stunnel:3.0:b6 cpe:/a:stunnel:stunnel:3.0:b7 cpe:/a:stunnel:stunnel:3.1 cpe:/a:stunnel:stunnel:3.2 cpe:/a:stunnel:stunnel:3.3 cpe:/a:stunnel:stunnel:3.4a cpe:/a:stunnel:stunnel:3.5 cpe:/a:stunnel:stunnel:3.6 cpe:/a:stunnel:stunnel:3.7 cpe:/a:stunnel:stunnel:3.8 cpe:/a:stunnel:stunnel:3.8:p1 cpe:/a:stunnel:stunnel:3.8:p2 cpe:/a:stunnel:stunnel:3.8:p3 cpe:/a:stunnel:stunnel:3.8:p4 cpe:/a:stunnel:stunnel:3.8p1 cpe:/a:stunnel:stunnel:3.8p2 cpe:/a:stunnel:stunnel:3.8p3 cpe:/a:stunnel:stunnel:3.8p4 cpe:/a:stunnel:stunnel:3.9 cpe:/a:stunnel:stunnel:3.10 cpe:/a:stunnel:stunnel:3.11 cpe:/a:stunnel:stunnel:3.12 cpe:/a:stunnel:stunnel:3.13 cpe:/a:stunnel:stunnel:3.14 cpe:/a:stunnel:stunnel:3.15 cpe:/a:stunnel:stunnel:3.16 cpe:/a:stunnel:stunnel:3.17 cpe:/a:stunnel:stunnel:3.18 cpe:/a:stunnel:stunnel:3.19 cpe:/a:stunnel:stunnel:3.20 cpe:/a:stunnel:stunnel:3.21 cpe:/a:stunnel:stunnel:3.21a cpe:/a:stunnel:stunnel:3.21b cpe:/a:stunnel:stunnel:3.21c cpe:/a:stunnel:stunnel:3.22 cpe:/a:stunnel:stunnel:3.23 cpe:/a:stunnel:stunnel:3.24 cpe:/a:stunnel:stunnel:3.25 cpe:/a:stunnel:stunnel:3.26 cpe:/a:stunnel:stunnel:4.00 cpe:/a:stunnel:stunnel:4.01 cpe:/a:stunnel:stunnel:4.02 cpe:/a:stunnel:stunnel:4.03 cpe:/a:stunnel:stunnel:4.04 cpe:/a:stunnel:stunnel:4.05 cpe:/a:stunnel:stunnel:4.06 cpe:/a:stunnel:stunnel:4.07 cpe:/a:stunnel:stunnel:4.08 cpe:/a:stunnel:stunnel:4.09 cpe:/a:stunnel:stunnel:4.10 cpe:/a:stunnel:stunnel:4.11 cpe:/a:stunnel:stunnel:4.12 cpe:/a:stunnel:stunnel:4.13 cpe:/a:stunnel:stunnel:4.14 cpe:/a:stunnel:stunnel:4.15 cpe:/a:stunnel:stunnel:4.16 cpe:/a:stunnel:stunnel:4.17 cpe:/a:stunnel:stunnel:4.18 cpe:/a:stunnel:stunnel:4.19 cpe:/a:stunnel:stunnel:4.20 cpe:/a:stunnel:stunnel:4.21 cpe:/a:stunnel:stunnel:4.22 cpe:/a:stunnel:stunnel:4.23 cpe:/a:stunnel:stunnel:4.24 cpe:/a:stunnel:stunnel:4.25 cpe:/a:stunnel:stunnel:4.26 cpe:/a:stunnel:stunnel:4.27 cpe:/a:stunnel:stunnel:4.28 cpe:/a:stunnel:stunnel:4.29 cpe:/a:stunnel:stunnel:4.30 cpe:/a:stunnel:stunnel:4.31 cpe:/a:stunnel:stunnel:4.32 cpe:/a:stunnel:stunnel:4.33 cpe:/a:stunnel:stunnel:4.34 cpe:/a:stunnel:stunnel:4.35 cpe:/a:stunnel:stunnel:4.36 cpe:/a:stunnel:stunnel:4.37 cpe:/a:stunnel:stunnel:4.38 cpe:/a:stunnel:stunnel:4.39 cpe:/a:stunnel:stunnel:4.40 cpe:/a:stunnel:stunnel:4.41 cpe:/a:stunnel:stunnel:4.42 cpe:/a:stunnel:stunnel:4.43 cpe:/a:stunnel:stunnel:4.44 cpe:/a:stunnel:stunnel:4.45 cpe:/a:stunnel:stunnel:4.46 cpe:/a:stunnel:stunnel:4.47 cpe:/a:stunnel:stunnel:4.48 cpe:/a:stunnel:stunnel:4.49 cpe:/a:stunnel:stunnel:4.50 cpe:/a:stunnel:stunnel:4.51 cpe:/a:stunnel:stunnel:4.52 cpe:/a:stunnel:stunnel:4.53 cpe:/a:stunnel:stunnel:4.54 cpe:/a:stunnel:stunnel:4.55 cpe:/a:stunnel:stunnel:4.56

CVE-2014-0016

2014-03-24T12:31:08.447-04:00

2017-01-26T15:00:06.940-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-01-26T12:24:55.037-05:00

MLIST [oss-security] 20140305 libssh and stunnel PRNG flaws BID 65964 MISC https://bugzilla.redhat.com/attachment.cgi?id=870826&action=diff CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1072180 CONFIRM https://www.stunnel.org/sdf_ChangeLog.html stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator (PRNG), which causes subsequent children with the same process ID to use the same entropy pool and allows remote attackers to obtain private keys for EC (ECDSA) or DSA certificates.

cpe:/a:libssh:libssh:0.4.7 cpe:/a:libssh:libssh:0.4.8 cpe:/a:libssh:libssh:0.5.0 cpe:/a:libssh:libssh:0.5.0:rc1 cpe:/a:libssh:libssh:0.5.1 cpe:/a:libssh:libssh:0.5.2 cpe:/a:libssh:libssh:0.5.3 cpe:/a:libssh:libssh:0.5.4 cpe:/a:libssh:libssh:0.5.5 cpe:/a:libssh:libssh:0.6.0 cpe:/a:libssh:libssh:0.6.1 cpe:/a:libssh:libssh:0.6.2

CVE-2014-0017

2014-03-14T11:55:05.603-04:00

2014-03-26T00:55:45.500-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov SUSE openSUSE-SU-2014:0366 SUSE openSUSE-SU-2014:0370 DEBIAN DSA-2879 CONFIRM http://www.libssh.org/2014/03/04/libssh-0-6-3-security-release/ MLIST [oss-security] 20140305 libssh and stunnel PRNG flaws UBUNTU USN-2145-1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1072191 The RAND_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator (PRNG), which causes the state to be shared between children processes and allows local users to obtain sensitive information by leveraging a pid collision.

cpe:/a:redhat:jboss_enterprise_application_platform:6.2.0 cpe:/a:redhat:jboss_wildfly_application_server:-

CVE-2014-0018

2014-02-14T10:55:05.343-05:00

2017-01-06T21:59:14.777-05:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2014:0170 REDHAT RHSA-2014:0171 REDHAT RHSA-2014:0172 BID 65591 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1052783 Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.0 and JBoss WildFly Application Server, when run under a security manager, do not properly restrict access to the Modular Service Container (MSC) service registry, which allows local users to modify the server via a crafted deployment.

cpe:/a:dest-unreach:socat:1.3.0.0 cpe:/a:dest-unreach:socat:1.3.0.1 cpe:/a:dest-unreach:socat:1.3.1.0 cpe:/a:dest-unreach:socat:1.3.2.0 cpe:/a:dest-unreach:socat:1.3.2.1 cpe:/a:dest-unreach:socat:1.3.2.2 cpe:/a:dest-unreach:socat:1.4.0.0 cpe:/a:dest-unreach:socat:1.4.0.1 cpe:/a:dest-unreach:socat:1.4.0.2 cpe:/a:dest-unreach:socat:1.4.0.3 cpe:/a:dest-unreach:socat:1.4.1.0 cpe:/a:dest-unreach:socat:1.4.2.0 cpe:/a:dest-unreach:socat:1.4.3.0 cpe:/a:dest-unreach:socat:1.4.3.1 cpe:/a:dest-unreach:socat:1.5.0.0 cpe:/a:dest-unreach:socat:1.6.0.0 cpe:/a:dest-unreach:socat:1.6.0.1 cpe:/a:dest-unreach:socat:1.7.0.0 cpe:/a:dest-unreach:socat:1.7.0.1 cpe:/a:dest-unreach:socat:1.7.1.0 cpe:/a:dest-unreach:socat:1.7.1.1 cpe:/a:dest-unreach:socat:1.7.1.2 cpe:/a:dest-unreach:socat:1.7.1.3 cpe:/a:dest-unreach:socat:1.7.2.0 cpe:/a:dest-unreach:socat:1.7.2.1 cpe:/a:dest-unreach:socat:1.7.2.2 cpe:/a:dest-unreach:socat:2.0.0:b1 cpe:/a:dest-unreach:socat:2.0.0:b2 cpe:/a:dest-unreach:socat:2.0.0:b3 cpe:/a:dest-unreach:socat:2.0.0:b4 cpe:/a:dest-unreach:socat:2.0.0:b5 cpe:/a:dest-unreach:socat:2.0.0:b6 cpe:/o:fedoraproject:fedora:19 cpe:/o:fedoraproject:fedora:20 cpe:/o:opensuse:opensuse:13.1

CVE-2014-0019

2014-02-04T16:55:05.263-05:00

2018-10-30T12:27:34.687-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2016-08-30T11:49:36.427-04:00

FEDORA FEDORA-2014-1811 FEDORA FEDORA-2014-1795 SUSE openSUSE-SU-2015:0760 MLIST [oss-security] 20140128 Socat security advisory 5 - PROXY-CONNECT address overflow CONFIRM http://www.dest-unreach.org/socat MISC http://www.dest-unreach.org/socat/contrib/socat-secadv5.txt MANDRIVA MDVSA-2014:033 BID 65201 Stack-based buffer overflow in socat 1.3.0.0 through 1.7.2.2 and 2.0.0-b1 through 2.0.0-b6 allows local users to cause a denial of service (segmentation fault) via a long server name in the PROXY-CONNECT address in the command line.

cpe:/a:pidgin:pidgin:2.0.0 cpe:/a:pidgin:pidgin:2.0.1 cpe:/a:pidgin:pidgin:2.0.2 cpe:/a:pidgin:pidgin:2.1.0 cpe:/a:pidgin:pidgin:2.1.1 cpe:/a:pidgin:pidgin:2.2.0 cpe:/a:pidgin:pidgin:2.2.1 cpe:/a:pidgin:pidgin:2.2.2 cpe:/a:pidgin:pidgin:2.3.0 cpe:/a:pidgin:pidgin:2.3.1 cpe:/a:pidgin:pidgin:2.4.0 cpe:/a:pidgin:pidgin:2.4.1 cpe:/a:pidgin:pidgin:2.4.2 cpe:/a:pidgin:pidgin:2.4.3 cpe:/a:pidgin:pidgin:2.5.0 cpe:/a:pidgin:pidgin:2.5.1 cpe:/a:pidgin:pidgin:2.5.2 cpe:/a:pidgin:pidgin:2.5.3 cpe:/a:pidgin:pidgin:2.5.4 cpe:/a:pidgin:pidgin:2.5.5 cpe:/a:pidgin:pidgin:2.5.6 cpe:/a:pidgin:pidgin:2.5.7 cpe:/a:pidgin:pidgin:2.5.8 cpe:/a:pidgin:pidgin:2.5.9 cpe:/a:pidgin:pidgin:2.6.0 cpe:/a:pidgin:pidgin:2.6.1 cpe:/a:pidgin:pidgin:2.6.2 cpe:/a:pidgin:pidgin:2.6.3 cpe:/a:pidgin:pidgin:2.6.4 cpe:/a:pidgin:pidgin:2.6.5 cpe:/a:pidgin:pidgin:2.6.6 cpe:/a:pidgin:pidgin:2.7.0 cpe:/a:pidgin:pidgin:2.7.1 cpe:/a:pidgin:pidgin:2.7.2 cpe:/a:pidgin:pidgin:2.7.3 cpe:/a:pidgin:pidgin:2.7.4 cpe:/a:pidgin:pidgin:2.7.5 cpe:/a:pidgin:pidgin:2.7.6 cpe:/a:pidgin:pidgin:2.7.7 cpe:/a:pidgin:pidgin:2.7.8 cpe:/a:pidgin:pidgin:2.7.9 cpe:/a:pidgin:pidgin:2.7.10 cpe:/a:pidgin:pidgin:2.7.11 cpe:/a:pidgin:pidgin:2.8.0 cpe:/a:pidgin:pidgin:2.9.0 cpe:/a:pidgin:pidgin:2.10.0 cpe:/a:pidgin:pidgin:2.10.1 cpe:/a:pidgin:pidgin:2.10.2 cpe:/a:pidgin:pidgin:2.10.3 cpe:/a:pidgin:pidgin:2.10.4 cpe:/a:pidgin:pidgin:2.10.5 cpe:/a:pidgin:pidgin:2.10.6 cpe:/a:pidgin:pidgin:2.10.7

CVE-2014-0020

2014-02-06T11:10:59.217-05:00

2014-03-16T00:43:47.157-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://hg.pidgin.im/pidgin/main/rev/4d9be297d399 CONFIRM http://hg.pidgin.im/pidgin/main/rev/5845d9fa7084 CONFIRM http://hg.pidgin.im/pidgin/main/rev/6b0e0566af20 CONFIRM http://hg.pidgin.im/pidgin/main/rev/7d0fb0c6d8d4 CONFIRM http://hg.pidgin.im/pidgin/main/rev/9f132a6855cd CONFIRM http://hg.pidgin.im/pidgin/main/rev/a167504359e5 SUSE openSUSE-SU-2014:0239 SUSE openSUSE-SU-2014:0326 CONFIRM http://pidgin.im/news/security/?id=85 DEBIAN DSA-2859 UBUNTU USN-2100-1 REDHAT RHSA-2014:0139 The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts, which allows remote IRC servers to cause a denial of service (application crash) via a crafted message.

cpe:/a:baseurl:yum:3.4.0 cpe:/a:baseurl:yum:3.4.1 cpe:/a:baseurl:yum:3.4.2 cpe:/a:baseurl:yum:3.4.3

CVE-2014-0022

2014-01-26T11:58:11.197-05:00

2014-01-27T12:20:03.367-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-01-27T12:20:03.320-05:00

BID 65119 CONFIRM http://yum.baseurl.org/gitweb?p=yum.git;a=commitdiff;h=9df69e5794 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1052440 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1057377 The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package.

CVE-2014-0025

2014-01-28T18:55:03.547-05:00

2014-01-28T18:55:03.657-05:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-1690. Reason: This candidate is a reservation duplicate of CVE-2014-1690. Notes: All CVE users should reference CVE-2014-1690 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:cmu:flite:1.4

CVE-2014-0027

2014-01-25T20:55:19.877-05:00

2014-02-21T00:06:08.030-05:00

3.3

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov FEDORA FEDORA-2014-0574 FEDORA FEDORA-2014-0579 MLIST [oss-security] 20140110 temporary file issue in flite MANDRIVA MDVSA-2014:032 BID 64791 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1048678 The play_wave_from_socket function in audio/auserver.c in Flite 1.4 allows local users to modify arbitrary files via a symlink attack on /tmp/awb.wav. NOTE: some of these details are obtained from third party information.

cpe:/a:redhat:libvirt:1.1.1 cpe:/a:redhat:libvirt:1.1.2 cpe:/a:redhat:libvirt:1.1.3 cpe:/a:redhat:libvirt:1.1.4 cpe:/a:redhat:libvirt:1.2.0

CVE-2014-0028

2014-01-24T13:55:04.900-05:00

2015-01-02T21:08:36.000-05:00

4.3

ADJACENT_NETWORK

MEDIUM

NONE

PARTIAL

NONE

PARTIAL

http://nvd.nist.gov

2014-12-31T14:46:17.777-05:00

CONFIRM http://libvirt.org/news.html SUSE openSUSE-SU-2014:0268 GENTOO GLSA-201412-04 UBUNTU USN-2093-1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1048637 MLIST [libvirt] 20140115 [PATCH 0/4] CVE-2014-0028: domain events vs. ACL filtering libvirt 1.1.1 through 1.2.0 allows context-dependent attackers to bypass the domain:getattr and connect:search_domains restrictions in ACLs and obtain sensitive domain object information via a request to the (1) virConnectDomainEventRegister and (2) virConnectDomainEventRegisterAny functions in the event registration API.

cpe:/a:redhat:subscription_asset_manager:1.0.0

CVE-2014-0029

2017-10-16T09:29:00.187-04:00

2017-11-07T13:22:37.433-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-11-03T11:07:36.330-04:00

CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1059433 Multiple cross-site scripting (XSS) vulnerabilities in the SAM web application in Red Hat katello-headpin allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.

cpe:/a:apache:roller:3.1 cpe:/a:apache:roller:4.0 cpe:/a:apache:roller:4.0.1 cpe:/a:apache:roller:5.0 cpe:/a:apache:roller:5.0.1 cpe:/a:apache:roller:5.0.2

CVE-2014-0030

2017-10-09T21:30:20.250-04:00

2019-05-06T16:38:54.083-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-05-03T12:04:06.747-04:00

CONFIRM https://liftsecurity.io/advisories/Apache_Roller_XML-RPC_susceptible_to_XXE/ MLIST [roller-dev] 20140111 CVE-2014-0030 Apache Roller XML-RPC susceptible to XML Entended Entity attacks EXPLOIT-DB 45341 The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.

cpe:/a:apache:cloudstack:2.0:-:community cpe:/a:apache:cloudstack:2.0.1 cpe:/a:apache:cloudstack:2.1.0 cpe:/a:apache:cloudstack:2.1.1 cpe:/a:apache:cloudstack:2.1.2 cpe:/a:apache:cloudstack:2.1.3 cpe:/a:apache:cloudstack:2.1.4 cpe:/a:apache:cloudstack:2.1.5 cpe:/a:apache:cloudstack:2.1.6 cpe:/a:apache:cloudstack:2.1.7 cpe:/a:apache:cloudstack:2.1.8 cpe:/a:apache:cloudstack:2.1.9 cpe:/a:apache:cloudstack:2.1.10 cpe:/a:apache:cloudstack:2.2.0 cpe:/a:apache:cloudstack:2.2.1 cpe:/a:apache:cloudstack:2.2.2 cpe:/a:apache:cloudstack:2.2.3 cpe:/a:apache:cloudstack:2.2.5 cpe:/a:apache:cloudstack:2.2.6 cpe:/a:apache:cloudstack:2.2.7 cpe:/a:apache:cloudstack:2.2.8 cpe:/a:apache:cloudstack:2.2.9 cpe:/a:apache:cloudstack:2.2.11 cpe:/a:apache:cloudstack:2.2.12 cpe:/a:apache:cloudstack:2.2.13 cpe:/a:apache:cloudstack:2.2.14 cpe:/a:apache:cloudstack:3.0.0 cpe:/a:apache:cloudstack:3.0.1 cpe:/a:apache:cloudstack:3.0.2 cpe:/a:apache:cloudstack:4.0.0:incubating cpe:/a:apache:cloudstack:4.0.1 cpe:/a:apache:cloudstack:4.0.2 cpe:/a:apache:cloudstack:4.1.0 cpe:/a:apache:cloudstack:4.1.1 cpe:/a:apache:cloudstack:4.2.0

CVE-2014-0031

2014-01-15T11:08:04.093-05:00

2014-02-25T07:38:36.640-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2014-01-15T13:09:30.463-05:00

CONFIRM https://blogs.apache.org/cloudstack/entry/cve_2014_0031_cloudstack_listnetworkacl CONFIRM https://issues.apache.org/jira/browse/CLOUDSTACK-5145 The (1) ListNetworkACL and (2) listNetworkACLLists APIs in Apache CloudStack before 4.2.1 allow remote authenticated users to list network ACLS for other users via a crafted request.

cpe:/a:apache:subversion:1.7.0 cpe:/a:apache:subversion:1.7.1 cpe:/a:apache:subversion:1.7.2 cpe:/a:apache:subversion:1.7.3 cpe:/a:apache:subversion:1.7.4 cpe:/a:apache:subversion:1.7.5 cpe:/a:apache:subversion:1.7.6 cpe:/a:apache:subversion:1.7.7 cpe:/a:apache:subversion:1.7.8 cpe:/a:apache:subversion:1.7.9 cpe:/a:apache:subversion:1.7.10 cpe:/a:apache:subversion:1.7.11 cpe:/a:apache:subversion:1.7.12 cpe:/a:apache:subversion:1.7.13 cpe:/a:apache:subversion:1.7.14 cpe:/a:apache:subversion:1.8.0 cpe:/a:apache:subversion:1.8.1 cpe:/a:apache:subversion:1.8.2 cpe:/a:apache:subversion:1.8.3 cpe:/a:apache:subversion:1.8.4 cpe:/a:apache:subversion:1.8.5

CVE-2014-0032

2014-02-14T10:55:05.907-05:00

2017-08-28T21:34:07.687-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2014:0307 SUSE openSUSE-SU-2014:0334 MLIST [subversion-dev] 20140110 2 Re: Segfault in mod_dav_svn with repositories on / MLIST [subversion-dev] 20140110 Re: Segfault in mod_dav_svn with repositories on / MLIST [subversion-dev] 20140110 Sin mod_dav_svn with repositories on / REDHAT RHSA-2014:0255 SECUNIA 61321 CONFIRM http://support.apple.com/kb/HT6444 CONFIRM http://svn.apache.org/repos/asf/subversion/tags/1.7.15/CHANGES CONFIRM http://svn.apache.org/repos/asf/subversion/tags/1.8.6/CHANGES CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1557320 CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html BID 65434 UBUNTU USN-2316-1 XF apache-subversion-cve20140032-dos(90986) GENTOO GLSA-201610-05 The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET, as demonstrated by the "svn ls http://svn.example.com" command.

cpe:/a:apache:tomcat:6.0.33 cpe:/a:apache:tomcat:6.0.34 cpe:/a:apache:tomcat:6.0.35 cpe:/a:apache:tomcat:6.0.36 cpe:/a:apache:tomcat:6.0.37

CVE-2014-0033

2014-02-26T09:55:08.537-05:00

2019-04-15T12:29:34.820-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov FULLDISC 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1558822 CONFIRM http://tomcat.apache.org/security-6.html DEBIAN DSA-3530 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html BUGTRAQ 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities BID 65769 UBUNTU USN-2130-1 CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0012.html CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21675886 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677147 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21678231 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1069919 MLIST [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ MLIST [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ MLIST [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ MLIST [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL.

cpe:/a:apache:cxf:2.6.0 cpe:/a:apache:cxf:2.6.1 cpe:/a:apache:cxf:2.6.2 cpe:/a:apache:cxf:2.6.3 cpe:/a:apache:cxf:2.6.4 cpe:/a:apache:cxf:2.6.5 cpe:/a:apache:cxf:2.6.6 cpe:/a:apache:cxf:2.6.7 cpe:/a:apache:cxf:2.6.8 cpe:/a:apache:cxf:2.6.9 cpe:/a:apache:cxf:2.6.10 cpe:/a:apache:cxf:2.6.11 cpe:/a:apache:cxf:2.7.0 cpe:/a:apache:cxf:2.7.1 cpe:/a:apache:cxf:2.7.2 cpe:/a:apache:cxf:2.7.3 cpe:/a:apache:cxf:2.7.4 cpe:/a:apache:cxf:2.7.5 cpe:/a:apache:cxf:2.7.6 cpe:/a:apache:cxf:2.7.7 cpe:/a:apache:cxf:2.7.8 cpe:/a:redhat:jboss_enterprise_application_platform:6.0.0 cpe:/a:redhat:jboss_enterprise_application_platform:6.2.0

CVE-2014-0034

2014-07-07T10:55:03.347-04:00

2015-04-22T21:59:12.567-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://cxf.apache.org/security-advisories.data/CVE-2014-0034.txt.asc REDHAT RHSA-2014:0797 REDHAT RHSA-2014:0798 REDHAT RHSA-2014:0799 REDHAT RHSA-2014:1351 REDHAT RHSA-2015:0850 REDHAT RHSA-2015:0851 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1551228 BID 68441 The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token.

cpe:/a:apache:cxf:2.6.0 cpe:/a:apache:cxf:2.6.1 cpe:/a:apache:cxf:2.6.2 cpe:/a:apache:cxf:2.6.3 cpe:/a:apache:cxf:2.6.4 cpe:/a:apache:cxf:2.6.5 cpe:/a:apache:cxf:2.6.6 cpe:/a:apache:cxf:2.6.7 cpe:/a:apache:cxf:2.6.8 cpe:/a:apache:cxf:2.6.9 cpe:/a:apache:cxf:2.6.10 cpe:/a:apache:cxf:2.6.11 cpe:/a:apache:cxf:2.6.12 cpe:/a:apache:cxf:2.7.0 cpe:/a:apache:cxf:2.7.1 cpe:/a:apache:cxf:2.7.2 cpe:/a:apache:cxf:2.7.3 cpe:/a:apache:cxf:2.7.4 cpe:/a:apache:cxf:2.7.5 cpe:/a:apache:cxf:2.7.6 cpe:/a:apache:cxf:2.7.7 cpe:/a:apache:cxf:2.7.8 cpe:/a:apache:cxf:2.7.9 cpe:/a:redhat:jboss_enterprise_application_platform:6.0.0 cpe:/a:redhat:jboss_enterprise_application_platform:6.2.0

CVE-2014-0035

2014-07-07T10:55:03.397-04:00

2015-04-22T21:59:13.787-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://cxf.apache.org/security-advisories.data/CVE-2014-0035.txt.asc REDHAT RHSA-2014:0797 REDHAT RHSA-2014:0798 REDHAT RHSA-2014:0799 REDHAT RHSA-2014:1351 REDHAT RHSA-2015:0850 REDHAT RHSA-2015:0851 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1564724 The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.

cpe:/a:amos_benari:rbovirt:0.0.1::~~~ruby~~ cpe:/a:amos_benari:rbovirt:0.0.2::~~~ruby~~ cpe:/a:amos_benari:rbovirt:0.0.3::~~~ruby~~ cpe:/a:amos_benari:rbovirt:0.0.4::~~~ruby~~ cpe:/a:amos_benari:rbovirt:0.0.5::~~~ruby~~ cpe:/a:amos_benari:rbovirt:0.0.6::~~~ruby~~ cpe:/a:amos_benari:rbovirt:0.0.7::~~~ruby~~ cpe:/a:amos_benari:rbovirt:0.0.8::~~~ruby~~ cpe:/a:amos_benari:rbovirt:0.0.9::~~~ruby~~ cpe:/a:amos_benari:rbovirt:0.0.10::~~~ruby~~ cpe:/a:amos_benari:rbovirt:0.0.11::~~~ruby~~ cpe:/a:amos_benari:rbovirt:0.0.12::~~~ruby~~ cpe:/a:amos_benari:rbovirt:0.0.13::~~~ruby~~ cpe:/a:amos_benari:rbovirt:0.0.14::~~~ruby~~ cpe:/a:amos_benari:rbovirt:0.0.15::~~~ruby~~ cpe:/a:amos_benari:rbovirt:0.0.16::~~~ruby~~ cpe:/a:amos_benari:rbovirt:0.0.17::~~~ruby~~ cpe:/a:amos_benari:rbovirt:0.0.18::~~~ruby~~ cpe:/a:amos_benari:rbovirt:0.0.19::~~~ruby~~ cpe:/a:amos_benari:rbovirt:0.0.20::~~~ruby~~ cpe:/a:amos_benari:rbovirt:0.0.21::~~~ruby~~ cpe:/a:amos_benari:rbovirt:0.0.22::~~~ruby~~ cpe:/a:amos_benari:rbovirt:0.0.23::~~~ruby~~

CVE-2014-0036

2014-04-17T10:55:06.230-04:00

2014-04-18T09:48:54.390-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2014-04-18T09:48:54.233-04:00

FEDORA FEDORA-2014-3573 FEDORA FEDORA-2014-3526 MLIST [oss-security] 20140306 CVE-2014-0036 rubygem-rbovirt: unsafe use of rest-client CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1058595 The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.

cpe:/a:zarafa:zarafa:5.00 cpe:/a:zarafa:zarafa:5.01 cpe:/a:zarafa:zarafa:5.02 cpe:/a:zarafa:zarafa:5.10 cpe:/a:zarafa:zarafa:5.11 cpe:/a:zarafa:zarafa:5.20 cpe:/a:zarafa:zarafa:5.22 cpe:/a:zarafa:zarafa:6.00 cpe:/a:zarafa:zarafa:6.01 cpe:/a:zarafa:zarafa:6.02 cpe:/a:zarafa:zarafa:6.03 cpe:/a:zarafa:zarafa:6.10 cpe:/a:zarafa:zarafa:6.11 cpe:/a:zarafa:zarafa:6.20 cpe:/a:zarafa:zarafa:6.20.2 cpe:/a:zarafa:zarafa:6.20.3 cpe:/a:zarafa:zarafa:6.20.5 cpe:/a:zarafa:zarafa:6.20.6 cpe:/a:zarafa:zarafa:6.20.7 cpe:/a:zarafa:zarafa:6.20.10 cpe:/a:zarafa:zarafa:6.20.11 cpe:/a:zarafa:zarafa:6.20.12 cpe:/a:zarafa:zarafa:6.30.0 cpe:/a:zarafa:zarafa:6.30.3 cpe:/a:zarafa:zarafa:6.30.4 cpe:/a:zarafa:zarafa:6.30.5 cpe:/a:zarafa:zarafa:6.30.6 cpe:/a:zarafa:zarafa:6.30.7 cpe:/a:zarafa:zarafa:6.30.8 cpe:/a:zarafa:zarafa:6.30.9 cpe:/a:zarafa:zarafa:6.30.10 cpe:/a:zarafa:zarafa:6.30.11 cpe:/a:zarafa:zarafa:6.30.13 cpe:/a:zarafa:zarafa:6.30.16 cpe:/a:zarafa:zarafa:6.30.17 cpe:/a:zarafa:zarafa:6.40.0 cpe:/a:zarafa:zarafa:6.40.2 cpe:/a:zarafa:zarafa:6.40.3 cpe:/a:zarafa:zarafa:6.40.4 cpe:/a:zarafa:zarafa:6.40.5 cpe:/a:zarafa:zarafa:6.40.6 cpe:/a:zarafa:zarafa:6.40.7 cpe:/a:zarafa:zarafa:6.40.8 cpe:/a:zarafa:zarafa:6.40.9 cpe:/a:zarafa:zarafa:6.40.10 cpe:/a:zarafa:zarafa:6.40.11 cpe:/a:zarafa:zarafa:6.40.12 cpe:/a:zarafa:zarafa:6.40.13 cpe:/a:zarafa:zarafa:6.40.14 cpe:/a:zarafa:zarafa:6.40.15 cpe:/a:zarafa:zarafa:6.40.16 cpe:/a:zarafa:zarafa:6.40.17 cpe:/a:zarafa:zarafa:7.0 cpe:/a:zarafa:zarafa:7.0.1 cpe:/a:zarafa:zarafa:7.0.2 cpe:/a:zarafa:zarafa:7.0.3 cpe:/a:zarafa:zarafa:7.0.4 cpe:/a:zarafa:zarafa:7.0.5 cpe:/a:zarafa:zarafa:7.0.6 cpe:/a:zarafa:zarafa:7.0.7 cpe:/a:zarafa:zarafa:7.0.8 cpe:/a:zarafa:zarafa:7.0.9 cpe:/a:zarafa:zarafa:7.0.10 cpe:/a:zarafa:zarafa:7.0.11 cpe:/a:zarafa:zarafa:7.0.12 cpe:/a:zarafa:zarafa:7.0.13 cpe:/a:zarafa:zarafa:7.1.0 cpe:/a:zarafa:zarafa:7.1.1 cpe:/a:zarafa:zarafa:7.1.2 cpe:/a:zarafa:zarafa:7.1.3 cpe:/a:zarafa:zarafa:7.1.4

CVE-2014-0037

2014-04-28T10:09:06.080-04:00

2014-04-29T07:35:51.057-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-04-29T07:35:50.760-04:00

MANDRIVA MDVSA-2014:044 MLIST [oss-security] 20140131 Security Flaw CVE-2014-0037 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1056767 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1059903 The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 5.00 before 7.1.8 beta2 allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the username."

cpe:/o:linux:linux_kernel:3.0:rc1 cpe:/o:linux:linux_kernel:3.0:rc2 cpe:/o:linux:linux_kernel:3.0:rc3 cpe:/o:linux:linux_kernel:3.0:rc4 cpe:/o:linux:linux_kernel:3.0:rc5 cpe:/o:linux:linux_kernel:3.0:rc6 cpe:/o:linux:linux_kernel:3.0:rc7 cpe:/o:linux:linux_kernel:3.0.1 cpe:/o:linux:linux_kernel:3.0.2 cpe:/o:linux:linux_kernel:3.0.3 cpe:/o:linux:linux_kernel:3.0.4 cpe:/o:linux:linux_kernel:3.0.5 cpe:/o:linux:linux_kernel:3.0.6 cpe:/o:linux:linux_kernel:3.0.7 cpe:/o:linux:linux_kernel:3.0.8 cpe:/o:linux:linux_kernel:3.0.9 cpe:/o:linux:linux_kernel:3.0.10 cpe:/o:linux:linux_kernel:3.0.11 cpe:/o:linux:linux_kernel:3.0.12 cpe:/o:linux:linux_kernel:3.0.13 cpe:/o:linux:linux_kernel:3.0.14 cpe:/o:linux:linux_kernel:3.0.15 cpe:/o:linux:linux_kernel:3.0.16 cpe:/o:linux:linux_kernel:3.0.17 cpe:/o:linux:linux_kernel:3.0.18 cpe:/o:linux:linux_kernel:3.0.19 cpe:/o:linux:linux_kernel:3.0.20 cpe:/o:linux:linux_kernel:3.0.21 cpe:/o:linux:linux_kernel:3.0.22 cpe:/o:linux:linux_kernel:3.0.23 cpe:/o:linux:linux_kernel:3.0.24 cpe:/o:linux:linux_kernel:3.0.25 cpe:/o:linux:linux_kernel:3.0.26 cpe:/o:linux:linux_kernel:3.0.27 cpe:/o:linux:linux_kernel:3.0.28 cpe:/o:linux:linux_kernel:3.0.29 cpe:/o:linux:linux_kernel:3.0.30 cpe:/o:linux:linux_kernel:3.0.31 cpe:/o:linux:linux_kernel:3.0.32 cpe:/o:linux:linux_kernel:3.0.33 cpe:/o:linux:linux_kernel:3.0.34 cpe:/o:linux:linux_kernel:3.0.35 cpe:/o:linux:linux_kernel:3.0.36 cpe:/o:linux:linux_kernel:3.0.37 cpe:/o:linux:linux_kernel:3.0.38 cpe:/o:linux:linux_kernel:3.0.39 cpe:/o:linux:linux_kernel:3.0.40 cpe:/o:linux:linux_kernel:3.0.41 cpe:/o:linux:linux_kernel:3.0.42 cpe:/o:linux:linux_kernel:3.0.43 cpe:/o:linux:linux_kernel:3.0.44 cpe:/o:linux:linux_kernel:3.0.45 cpe:/o:linux:linux_kernel:3.0.46 cpe:/o:linux:linux_kernel:3.0.47 cpe:/o:linux:linux_kernel:3.0.48 cpe:/o:linux:linux_kernel:3.0.49 cpe:/o:linux:linux_kernel:3.0.50 cpe:/o:linux:linux_kernel:3.0.51 cpe:/o:linux:linux_kernel:3.0.52 cpe:/o:linux:linux_kernel:3.0.53 cpe:/o:linux:linux_kernel:3.0.54 cpe:/o:linux:linux_kernel:3.0.55 cpe:/o:linux:linux_kernel:3.0.56 cpe:/o:linux:linux_kernel:3.0.57 cpe:/o:linux:linux_kernel:3.0.58 cpe:/o:linux:linux_kernel:3.0.59 cpe:/o:linux:linux_kernel:3.0.60 cpe:/o:linux:linux_kernel:3.0.61 cpe:/o:linux:linux_kernel:3.0.62 cpe:/o:linux:linux_kernel:3.0.63 cpe:/o:linux:linux_kernel:3.0.64 cpe:/o:linux:linux_kernel:3.0.65 cpe:/o:linux:linux_kernel:3.0.66 cpe:/o:linux:linux_kernel:3.0.67 cpe:/o:linux:linux_kernel:3.0.68 cpe:/o:linux:linux_kernel:3.1 cpe:/o:linux:linux_kernel:3.1:rc1 cpe:/o:linux:linux_kernel:3.1:rc2 cpe:/o:linux:linux_kernel:3.1:rc3 cpe:/o:linux:linux_kernel:3.1:rc4 cpe:/o:linux:linux_kernel:3.1.1 cpe:/o:linux:linux_kernel:3.1.2 cpe:/o:linux:linux_kernel:3.1.3 cpe:/o:linux:linux_kernel:3.1.4 cpe:/o:linux:linux_kernel:3.1.5 cpe:/o:linux:linux_kernel:3.1.6 cpe:/o:linux:linux_kernel:3.1.7 cpe:/o:linux:linux_kernel:3.1.8 cpe:/o:linux:linux_kernel:3.1.9 cpe:/o:linux:linux_kernel:3.1.10 cpe:/o:linux:linux_kernel:3.2 cpe:/o:linux:linux_kernel:3.2:rc2 cpe:/o:linux:linux_kernel:3.2:rc3 cpe:/o:linux:linux_kernel:3.2:rc4 cpe:/o:linux:linux_kernel:3.2:rc5 cpe:/o:linux:linux_kernel:3.2:rc6 cpe:/o:linux:linux_kernel:3.2:rc7 cpe:/o:linux:linux_kernel:3.2.1 cpe:/o:linux:linux_kernel:3.2.2 cpe:/o:linux:linux_kernel:3.2.3 cpe:/o:linux:linux_kernel:3.2.4 cpe:/o:linux:linux_kernel:3.2.5 cpe:/o:linux:linux_kernel:3.2.6 cpe:/o:linux:linux_kernel:3.2.7 cpe:/o:linux:linux_kernel:3.2.8 cpe:/o:linux:linux_kernel:3.2.9 cpe:/o:linux:linux_kernel:3.2.10 cpe:/o:linux:linux_kernel:3.2.11 cpe:/o:linux:linux_kernel:3.2.12 cpe:/o:linux:linux_kernel:3.2.13 cpe:/o:linux:linux_kernel:3.2.14 cpe:/o:linux:linux_kernel:3.2.15 cpe:/o:linux:linux_kernel:3.2.16 cpe:/o:linux:linux_kernel:3.2.17 cpe:/o:linux:linux_kernel:3.2.18 cpe:/o:linux:linux_kernel:3.2.19 cpe:/o:linux:linux_kernel:3.2.20 cpe:/o:linux:linux_kernel:3.2.21 cpe:/o:linux:linux_kernel:3.2.22 cpe:/o:linux:linux_kernel:3.2.23 cpe:/o:linux:linux_kernel:3.2.24 cpe:/o:linux:linux_kernel:3.2.25 cpe:/o:linux:linux_kernel:3.2.26 cpe:/o:linux:linux_kernel:3.2.27 cpe:/o:linux:linux_kernel:3.2.28 cpe:/o:linux:linux_kernel:3.2.29 cpe:/o:linux:linux_kernel:3.2.30 cpe:/o:linux:linux_kernel:3.3 cpe:/o:linux:linux_kernel:3.3:rc1 cpe:/o:linux:linux_kernel:3.3:rc2 cpe:/o:linux:linux_kernel:3.3:rc3 cpe:/o:linux:linux_kernel:3.3:rc4 cpe:/o:linux:linux_kernel:3.3:rc5 cpe:/o:linux:linux_kernel:3.3:rc6 cpe:/o:linux:linux_kernel:3.3:rc7 cpe:/o:linux:linux_kernel:3.3.1 cpe:/o:linux:linux_kernel:3.3.2 cpe:/o:linux:linux_kernel:3.3.3 cpe:/o:linux:linux_kernel:3.3.4 cpe:/o:linux:linux_kernel:3.3.5 cpe:/o:linux:linux_kernel:3.3.6 cpe:/o:linux:linux_kernel:3.3.7 cpe:/o:linux:linux_kernel:3.3.8 cpe:/o:linux:linux_kernel:3.4 cpe:/o:linux:linux_kernel:3.4:rc1 cpe:/o:linux:linux_kernel:3.4:rc2 cpe:/o:linux:linux_kernel:3.4:rc3 cpe:/o:linux:linux_kernel:3.4:rc4 cpe:/o:linux:linux_kernel:3.4:rc5 cpe:/o:linux:linux_kernel:3.4:rc6 cpe:/o:linux:linux_kernel:3.4:rc7 cpe:/o:linux:linux_kernel:3.4.1 cpe:/o:linux:linux_kernel:3.4.2 cpe:/o:linux:linux_kernel:3.4.3 cpe:/o:linux:linux_kernel:3.4.4 cpe:/o:linux:linux_kernel:3.4.5 cpe:/o:linux:linux_kernel:3.4.6 cpe:/o:linux:linux_kernel:3.4.7 cpe:/o:linux:linux_kernel:3.4.8 cpe:/o:linux:linux_kernel:3.4.9 cpe:/o:linux:linux_kernel:3.4.10 cpe:/o:linux:linux_kernel:3.4.11 cpe:/o:linux:linux_kernel:3.4.12 cpe:/o:linux:linux_kernel:3.4.13 cpe:/o:linux:linux_kernel:3.4.14 cpe:/o:linux:linux_kernel:3.4.15 cpe:/o:linux:linux_kernel:3.4.16 cpe:/o:linux:linux_kernel:3.4.17 cpe:/o:linux:linux_kernel:3.4.18 cpe:/o:linux:linux_kernel:3.4.19 cpe:/o:linux:linux_kernel:3.4.20 cpe:/o:linux:linux_kernel:3.4.21 cpe:/o:linux:linux_kernel:3.4.22 cpe:/o:linux:linux_kernel:3.4.23 cpe:/o:linux:linux_kernel:3.4.24 cpe:/o:linux:linux_kernel:3.4.25 cpe:/o:linux:linux_kernel:3.4.26 cpe:/o:linux:linux_kernel:3.4.27 cpe:/o:linux:linux_kernel:3.4.28 cpe:/o:linux:linux_kernel:3.4.29 cpe:/o:linux:linux_kernel:3.4.30 cpe:/o:linux:linux_kernel:3.4.31 cpe:/o:linux:linux_kernel:3.4.32 cpe:/o:linux:linux_kernel:3.5.1 cpe:/o:linux:linux_kernel:3.5.2 cpe:/o:linux:linux_kernel:3.5.3 cpe:/o:linux:linux_kernel:3.5.4 cpe:/o:linux:linux_kernel:3.5.5 cpe:/o:linux:linux_kernel:3.5.6 cpe:/o:linux:linux_kernel:3.5.7 cpe:/o:linux:linux_kernel:3.6 cpe:/o:linux:linux_kernel:3.6.1 cpe:/o:linux:linux_kernel:3.6.2 cpe:/o:linux:linux_kernel:3.6.3 cpe:/o:linux:linux_kernel:3.6.4 cpe:/o:linux:linux_kernel:3.6.5 cpe:/o:linux:linux_kernel:3.6.6 cpe:/o:linux:linux_kernel:3.6.7 cpe:/o:linux:linux_kernel:3.6.8 cpe:/o:linux:linux_kernel:3.6.9 cpe:/o:linux:linux_kernel:3.6.10 cpe:/o:linux:linux_kernel:3.6.11 cpe:/o:linux:linux_kernel:3.7 cpe:/o:linux:linux_kernel:3.7.1 cpe:/o:linux:linux_kernel:3.7.2 cpe:/o:linux:linux_kernel:3.7.3 cpe:/o:linux:linux_kernel:3.7.4 cpe:/o:linux:linux_kernel:3.7.5 cpe:/o:linux:linux_kernel:3.7.6 cpe:/o:linux:linux_kernel:3.7.7 cpe:/o:linux:linux_kernel:3.7.8 cpe:/o:linux:linux_kernel:3.7.9 cpe:/o:linux:linux_kernel:3.7.10 cpe:/o:linux:linux_kernel:3.8.0 cpe:/o:linux:linux_kernel:3.8.1 cpe:/o:linux:linux_kernel:3.8.2 cpe:/o:linux:linux_kernel:3.8.3 cpe:/o:linux:linux_kernel:3.8.4 cpe:/o:linux:linux_kernel:3.8.5 cpe:/o:linux:linux_kernel:3.8.6 cpe:/o:linux:linux_kernel:3.8.7 cpe:/o:linux:linux_kernel:3.8.8 cpe:/o:linux:linux_kernel:3.8.9 cpe:/o:linux:linux_kernel:3.8.10 cpe:/o:linux:linux_kernel:3.8.11 cpe:/o:linux:linux_kernel:3.8.12 cpe:/o:linux:linux_kernel:3.8.13 cpe:/o:linux:linux_kernel:3.9:rc1 cpe:/o:linux:linux_kernel:3.9:rc2 cpe:/o:linux:linux_kernel:3.9:rc3 cpe:/o:linux:linux_kernel:3.9:rc4 cpe:/o:linux:linux_kernel:3.9:rc5 cpe:/o:linux:linux_kernel:3.9:rc6 cpe:/o:linux:linux_kernel:3.9:rc7 cpe:/o:linux:linux_kernel:3.9.0 cpe:/o:linux:linux_kernel:3.9.1 cpe:/o:linux:linux_kernel:3.9.2 cpe:/o:linux:linux_kernel:3.9.3 cpe:/o:linux:linux_kernel:3.9.4 cpe:/o:linux:linux_kernel:3.9.5 cpe:/o:linux:linux_kernel:3.9.6 cpe:/o:linux:linux_kernel:3.9.7 cpe:/o:linux:linux_kernel:3.9.8 cpe:/o:linux:linux_kernel:3.9.9 cpe:/o:linux:linux_kernel:3.9.10 cpe:/o:linux:linux_kernel:3.9.11 cpe:/o:linux:linux_kernel:3.10 cpe:/o:linux:linux_kernel:3.10.1 cpe:/o:linux:linux_kernel:3.10.2 cpe:/o:linux:linux_kernel:3.10.3 cpe:/o:linux:linux_kernel:3.10.4 cpe:/o:linux:linux_kernel:3.10.5 cpe:/o:linux:linux_kernel:3.10.6 cpe:/o:linux:linux_kernel:3.10.7 cpe:/o:linux:linux_kernel:3.10.8 cpe:/o:linux:linux_kernel:3.10.9 cpe:/o:linux:linux_kernel:3.10.10 cpe:/o:linux:linux_kernel:3.10.11 cpe:/o:linux:linux_kernel:3.10.12 cpe:/o:linux:linux_kernel:3.10.13 cpe:/o:linux:linux_kernel:3.10.14 cpe:/o:linux:linux_kernel:3.10.15 cpe:/o:linux:linux_kernel:3.10.16 cpe:/o:linux:linux_kernel:3.10.17 cpe:/o:linux:linux_kernel:3.10.18 cpe:/o:linux:linux_kernel:3.10.19 cpe:/o:linux:linux_kernel:3.10.20 cpe:/o:linux:linux_kernel:3.10.21 cpe:/o:linux:linux_kernel:3.10.22 cpe:/o:linux:linux_kernel:3.10.23 cpe:/o:linux:linux_kernel:3.10.24 cpe:/o:linux:linux_kernel:3.10.25 cpe:/o:linux:linux_kernel:3.10.26 cpe:/o:linux:linux_kernel:3.10.27 cpe:/o:linux:linux_kernel:3.10.28 cpe:/o:linux:linux_kernel:3.10.29 cpe:/o:linux:linux_kernel:3.11 cpe:/o:linux:linux_kernel:3.11.1 cpe:/o:linux:linux_kernel:3.11.2 cpe:/o:linux:linux_kernel:3.11.3 cpe:/o:linux:linux_kernel:3.11.4 cpe:/o:linux:linux_kernel:3.11.5 cpe:/o:linux:linux_kernel:3.11.6 cpe:/o:linux:linux_kernel:3.11.7 cpe:/o:linux:linux_kernel:3.11.8 cpe:/o:linux:linux_kernel:3.11.9 cpe:/o:linux:linux_kernel:3.11.10 cpe:/o:linux:linux_kernel:3.12 cpe:/o:linux:linux_kernel:3.12.1 cpe:/o:linux:linux_kernel:3.12.2 cpe:/o:linux:linux_kernel:3.12.3 cpe:/o:linux:linux_kernel:3.12.4 cpe:/o:linux:linux_kernel:3.12.5 cpe:/o:linux:linux_kernel:3.12.6 cpe:/o:linux:linux_kernel:3.12.7 cpe:/o:linux:linux_kernel:3.12.8 cpe:/o:linux:linux_kernel:3.12.9 cpe:/o:linux:linux_kernel:3.12.10 cpe:/o:linux:linux_kernel:3.13 cpe:/o:linux:linux_kernel:3.13.1

CVE-2014-0038

2014-02-06T17:55:03.327-05:00

2018-01-02T21:29:00.617-05:00

6.9

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2def2ef2ae5f3990aabdbe8a755911902707d268 SUSE openSUSE-SU-2014:0204 SUSE openSUSE-SU-2014:0205 MISC http://pastebin.com/raw.php?i=DH3Lbg54 SECUNIA 56669 EXPLOIT-DB 31346 EXPLOIT-DB 31347 CONFIRM http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.2 MANDRIVA MDVSA-2014:038 MLIST [oss-security] 20140131 Linux 3.4+: arbitrary write with CONFIG_X86_X32 (CVE-2014-0038) BID 65255 UBUNTU USN-2094-1 UBUNTU USN-2095-1 UBUNTU USN-2096-1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1060023 MISC https://code.google.com/p/chromium/issues/detail?id=338594 MISC https://github.com/saelo/cve-2014-0038 CONFIRM https://github.com/torvalds/linux/commit/2def2ef2ae5f3990aabdbe8a755911902707d268 EXPLOIT-DB 40503 The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.

cpe:/a:cipherdyne:fwsnort:0.5 cpe:/a:cipherdyne:fwsnort:0.6 cpe:/a:cipherdyne:fwsnort:0.6.1 cpe:/a:cipherdyne:fwsnort:0.6.2 cpe:/a:cipherdyne:fwsnort:0.6.3 cpe:/a:cipherdyne:fwsnort:0.6.4 cpe:/a:cipherdyne:fwsnort:0.6.5 cpe:/a:cipherdyne:fwsnort:0.7.0 cpe:/a:cipherdyne:fwsnort:0.8.0 cpe:/a:cipherdyne:fwsnort:0.8.1 cpe:/a:cipherdyne:fwsnort:0.8.2 cpe:/a:cipherdyne:fwsnort:0.9.0 cpe:/a:cipherdyne:fwsnort:1.0 cpe:/a:cipherdyne:fwsnort:1.0.1 cpe:/a:cipherdyne:fwsnort:1.0.2 cpe:/a:cipherdyne:fwsnort:1.0.3 cpe:/a:cipherdyne:fwsnort:1.0.4 cpe:/a:cipherdyne:fwsnort:1.0.5 cpe:/a:cipherdyne:fwsnort:1.0.6 cpe:/a:cipherdyne:fwsnort:1.5 cpe:/a:cipherdyne:fwsnort:1.6 cpe:/a:cipherdyne:fwsnort:1.6.1 cpe:/a:cipherdyne:fwsnort:1.6.2 cpe:/a:cipherdyne:fwsnort:1.6.3 cpe:/a:cipherdyne:fwsnort:1.6.4

CVE-2014-0039

2014-02-07T19:55:06.113-05:00

2014-02-21T00:06:09.170-05:00

4.4

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov FEDORA FEDORA-2014-1975 FEDORA FEDORA-2014-1972 MLIST [oss-security] 20140203 CVE-2014-0039: fwsnort loaded configuration file from cwd when run as a non-root user BID 65341 CONFIRM https://github.com/mrash/fwsnort/blob/master/ChangeLog CONFIRM https://github.com/mrash/fwsnort/commit/fa977453120cc48e1654f373311f9cac468d3348 Untrusted search path vulnerability in fwsnort before 1.6.4, when not running as root, allows local users to execute arbitrary code via a Trojan horse fwsnort.conf in the current working directory.

cpe:/a:redhat:openstack:4.0

CVE-2014-0040

2014-06-02T11:55:11.560-04:00

2014-06-03T11:02:03.437-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-06-03T11:02:03.200-04:00

REDHAT RHSA-2014:0579 MISC https://bugs.launchpad.net/heat-templates/+bug/1267635 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1059514 CONFIRM https://github.com/openstack/heat-templates/commit/65a4f8bebc72da71c616e2e378b7b1ac354db1a3 OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, uses an HTTP connection to download (1) packages and (2) signing keys from Yum repositories, which allows man-in-the-middle attackers to prevent updates via unspecified vectors.

cpe:/a:redhat:openstack:4.0

CVE-2014-0041

2014-06-02T11:55:11.620-04:00

2014-06-03T11:04:28.537-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-06-03T11:04:28.320-04:00

REDHAT RHSA-2014:0579 MISC https://bugs.launchpad.net/heat-templates/+bug/1267635 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1059515 OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets sslverify to false for certain Yum repositories, which disables SSL protection and allows man-in-the-middle attackers to prevent updates via unspecified vectors.

cpe:/a:redhat:openstack:4.0

CVE-2014-0042

2014-06-02T11:55:11.683-04:00

2014-06-03T11:05:31.417-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-06-03T11:05:31.197-04:00

REDHAT RHSA-2014:0579 MISC https://bugs.launchpad.net/heat-templates/+bug/1267635 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1059520 CONFIRM https://github.com/openstack/heat-templates/commit/65a4f8bebc72da71c616e2e378b7b1ac354db1a3 OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets gpgcheck to 0 for certain templates, which disables GPG signature checking on downloaded packages and allows man-in-the-middle attackers to install arbitrary packages via unspecified vectors.

cpe:/a:apache:wicket:1.5.10 cpe:/a:apache:wicket:6.13.0

CVE-2014-0043

2017-10-02T21:29:00.327-04:00

2017-10-11T13:32:15.123-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-10-11T09:41:05.120-04:00

MLIST [wicket-announce] 20140221 CVE-2014-0043 In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of particular classes in the classpath and thus check whether a third party library with a known security vulnerability is in use.

cpe:/a:light_speed_gaming:mumble:1.2.3:rc1 cpe:/a:light_speed_gaming:mumble:1.2.3:rc2 cpe:/a:light_speed_gaming:mumble:1.2.3:rc3 cpe:/a:light_speed_gaming:mumble:1.2.4

CVE-2014-0044

2014-02-07T19:55:06.160-05:00

2014-03-05T23:50:19.097-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2014:0271 CONFIRM http://mumble.info/security/Mumble-SA-2014-001.txt DEBIAN DSA-2854 The opus_packet_get_samples_per_frame function in client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots allows remote attackers to cause a denial of service (crash) via a crafted length prefix value, which triggers a NULL pointer dereference or a heap-based buffer over-read (aka "out-of-bounds array access").

cpe:/a:light_speed_gaming:mumble:1.1::~~~iphone_os~~ cpe:/a:light_speed_gaming:mumble:1.1:rc1:~~~iphone_os~~ cpe:/a:light_speed_gaming:mumble:1.1.1::~~~iphone_os~~ cpe:/a:light_speed_gaming:mumble:1.2::~~~iphone_os~~ cpe:/a:light_speed_gaming:mumble:1.2.1::~~~iphone_os~~ cpe:/a:light_speed_gaming:mumble:1.2.2::~~~iphone_os~~ cpe:/a:light_speed_gaming:mumble:1.2.3:rc1 cpe:/a:light_speed_gaming:mumble:1.2.3:rc2 cpe:/a:light_speed_gaming:mumble:1.2.3:rc3 cpe:/a:light_speed_gaming:mumble:1.2.4 cpe:/a:light_speed_gaming:mumblekit:-

CVE-2014-0045

2014-02-07T19:55:06.177-05:00

2016-12-30T21:59:10.637-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2014:0271 CONFIRM http://mumble.info/security/Mumble-SA-2014-002.txt CONFIRM http://mumble.info/security/Mumble-SA-2014-004.txt DEBIAN DSA-2854 BID 65374 The needSamples method in AudioOutputSpeech.cpp in the client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots, Mumble for iOS 1.1 through 1.2.2, and MumbleKit before commit fd190328a9b24d37382b269a5674b0c0c7a7e36d does not check the return value of the opus_decode_float function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted Opus voice packet, which triggers an error in opus_decode_float, a conversion of a negative integer to an unsigned integer, and a heap-based buffer over-read and over-write.

cpe:/a:emberjs:ember.js:1.2.0 cpe:/a:emberjs:ember.js:1.2.1 cpe:/a:emberjs:ember.js:1.3.0 cpe:/a:emberjs:ember.js:1.3.1 cpe:/a:emberjs:ember.js:1.4.0:beta

CVE-2014-0046

2014-02-27T10:55:04.907-05:00

2018-08-13T17:47:47.197-04:00

2.6

NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://emberjs.com/blog/2014/02/07/ember-security-releases.html MLIST [oss-security] 20140214 [CVE-2014-0046] XSS Vulnerability With {{link-to}} Helper in Non-block Form BID 65579 XF emberjs-linkto-xss(91242) CONFIRM https://groups.google.com/forum/#!topic/ember-security/1h6FRgr8lXQ Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beta.6, when used in non-block form, allows remote attackers to inject arbitrary web script or HTML via the title attribute.

cpe:/a:docker:docker:1.4.1

CVE-2014-0047

2017-10-06T11:29:00.247-04:00

2017-10-13T15:45:32.257-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2017-10-13T11:12:25.877-04:00

MLIST [oss-security] 20150324 Re: 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier BID 73315 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1063549 Docker before 1.5 allows local users to have unspecified impact via vectors involving unsafe /tmp usage.

cpe:/o:linux:linux_kernel:3.0:rc1 cpe:/o:linux:linux_kernel:3.0:rc2 cpe:/o:linux:linux_kernel:3.0:rc3 cpe:/o:linux:linux_kernel:3.0:rc4 cpe:/o:linux:linux_kernel:3.0:rc5 cpe:/o:linux:linux_kernel:3.0:rc6 cpe:/o:linux:linux_kernel:3.0:rc7 cpe:/o:linux:linux_kernel:3.0.1 cpe:/o:linux:linux_kernel:3.0.2 cpe:/o:linux:linux_kernel:3.0.3 cpe:/o:linux:linux_kernel:3.0.4 cpe:/o:linux:linux_kernel:3.0.5 cpe:/o:linux:linux_kernel:3.0.6 cpe:/o:linux:linux_kernel:3.0.7 cpe:/o:linux:linux_kernel:3.0.8 cpe:/o:linux:linux_kernel:3.0.9 cpe:/o:linux:linux_kernel:3.0.10 cpe:/o:linux:linux_kernel:3.0.11 cpe:/o:linux:linux_kernel:3.0.12 cpe:/o:linux:linux_kernel:3.0.13 cpe:/o:linux:linux_kernel:3.0.14 cpe:/o:linux:linux_kernel:3.0.15 cpe:/o:linux:linux_kernel:3.0.16 cpe:/o:linux:linux_kernel:3.0.17 cpe:/o:linux:linux_kernel:3.0.18 cpe:/o:linux:linux_kernel:3.0.19 cpe:/o:linux:linux_kernel:3.0.20 cpe:/o:linux:linux_kernel:3.0.21 cpe:/o:linux:linux_kernel:3.0.22 cpe:/o:linux:linux_kernel:3.0.23 cpe:/o:linux:linux_kernel:3.0.24 cpe:/o:linux:linux_kernel:3.0.25 cpe:/o:linux:linux_kernel:3.0.26 cpe:/o:linux:linux_kernel:3.0.27 cpe:/o:linux:linux_kernel:3.0.28 cpe:/o:linux:linux_kernel:3.0.29 cpe:/o:linux:linux_kernel:3.0.30 cpe:/o:linux:linux_kernel:3.0.31 cpe:/o:linux:linux_kernel:3.0.32 cpe:/o:linux:linux_kernel:3.0.33 cpe:/o:linux:linux_kernel:3.0.34 cpe:/o:linux:linux_kernel:3.0.35 cpe:/o:linux:linux_kernel:3.0.36 cpe:/o:linux:linux_kernel:3.0.37 cpe:/o:linux:linux_kernel:3.0.38 cpe:/o:linux:linux_kernel:3.0.39 cpe:/o:linux:linux_kernel:3.0.40 cpe:/o:linux:linux_kernel:3.0.41 cpe:/o:linux:linux_kernel:3.0.42 cpe:/o:linux:linux_kernel:3.0.43 cpe:/o:linux:linux_kernel:3.0.44 cpe:/o:linux:linux_kernel:3.0.45 cpe:/o:linux:linux_kernel:3.0.46 cpe:/o:linux:linux_kernel:3.0.47 cpe:/o:linux:linux_kernel:3.0.48 cpe:/o:linux:linux_kernel:3.0.49 cpe:/o:linux:linux_kernel:3.0.50 cpe:/o:linux:linux_kernel:3.0.51 cpe:/o:linux:linux_kernel:3.0.52 cpe:/o:linux:linux_kernel:3.0.53 cpe:/o:linux:linux_kernel:3.0.54 cpe:/o:linux:linux_kernel:3.0.55 cpe:/o:linux:linux_kernel:3.0.56 cpe:/o:linux:linux_kernel:3.0.57 cpe:/o:linux:linux_kernel:3.0.58 cpe:/o:linux:linux_kernel:3.0.59 cpe:/o:linux:linux_kernel:3.0.60 cpe:/o:linux:linux_kernel:3.0.61 cpe:/o:linux:linux_kernel:3.0.62 cpe:/o:linux:linux_kernel:3.0.63 cpe:/o:linux:linux_kernel:3.0.64 cpe:/o:linux:linux_kernel:3.0.65 cpe:/o:linux:linux_kernel:3.0.66 cpe:/o:linux:linux_kernel:3.0.67 cpe:/o:linux:linux_kernel:3.0.68 cpe:/o:linux:linux_kernel:3.1 cpe:/o:linux:linux_kernel:3.1:rc1 cpe:/o:linux:linux_kernel:3.1:rc2 cpe:/o:linux:linux_kernel:3.1:rc3 cpe:/o:linux:linux_kernel:3.1:rc4 cpe:/o:linux:linux_kernel:3.1.1 cpe:/o:linux:linux_kernel:3.1.2 cpe:/o:linux:linux_kernel:3.1.3 cpe:/o:linux:linux_kernel:3.1.4 cpe:/o:linux:linux_kernel:3.1.5 cpe:/o:linux:linux_kernel:3.1.6 cpe:/o:linux:linux_kernel:3.1.7 cpe:/o:linux:linux_kernel:3.1.8 cpe:/o:linux:linux_kernel:3.1.9 cpe:/o:linux:linux_kernel:3.1.10 cpe:/o:linux:linux_kernel:3.2 cpe:/o:linux:linux_kernel:3.2:rc2 cpe:/o:linux:linux_kernel:3.2:rc3 cpe:/o:linux:linux_kernel:3.2:rc4 cpe:/o:linux:linux_kernel:3.2:rc5 cpe:/o:linux:linux_kernel:3.2:rc6 cpe:/o:linux:linux_kernel:3.2:rc7 cpe:/o:linux:linux_kernel:3.2.1 cpe:/o:linux:linux_kernel:3.2.2 cpe:/o:linux:linux_kernel:3.2.3 cpe:/o:linux:linux_kernel:3.2.4 cpe:/o:linux:linux_kernel:3.2.5 cpe:/o:linux:linux_kernel:3.2.6 cpe:/o:linux:linux_kernel:3.2.7 cpe:/o:linux:linux_kernel:3.2.8 cpe:/o:linux:linux_kernel:3.2.9 cpe:/o:linux:linux_kernel:3.2.10 cpe:/o:linux:linux_kernel:3.2.11 cpe:/o:linux:linux_kernel:3.2.12 cpe:/o:linux:linux_kernel:3.2.13 cpe:/o:linux:linux_kernel:3.2.14 cpe:/o:linux:linux_kernel:3.2.15 cpe:/o:linux:linux_kernel:3.2.16 cpe:/o:linux:linux_kernel:3.2.17 cpe:/o:linux:linux_kernel:3.2.18 cpe:/o:linux:linux_kernel:3.2.19 cpe:/o:linux:linux_kernel:3.2.20 cpe:/o:linux:linux_kernel:3.2.21 cpe:/o:linux:linux_kernel:3.2.22 cpe:/o:linux:linux_kernel:3.2.23 cpe:/o:linux:linux_kernel:3.2.24 cpe:/o:linux:linux_kernel:3.2.25 cpe:/o:linux:linux_kernel:3.2.26 cpe:/o:linux:linux_kernel:3.2.27 cpe:/o:linux:linux_kernel:3.2.28 cpe:/o:linux:linux_kernel:3.2.29 cpe:/o:linux:linux_kernel:3.2.30 cpe:/o:linux:linux_kernel:3.3 cpe:/o:linux:linux_kernel:3.3:rc1 cpe:/o:linux:linux_kernel:3.3:rc2 cpe:/o:linux:linux_kernel:3.3:rc3 cpe:/o:linux:linux_kernel:3.3:rc4 cpe:/o:linux:linux_kernel:3.3:rc5 cpe:/o:linux:linux_kernel:3.3:rc6 cpe:/o:linux:linux_kernel:3.3:rc7 cpe:/o:linux:linux_kernel:3.3.1 cpe:/o:linux:linux_kernel:3.3.2 cpe:/o:linux:linux_kernel:3.3.3 cpe:/o:linux:linux_kernel:3.3.4 cpe:/o:linux:linux_kernel:3.3.5 cpe:/o:linux:linux_kernel:3.3.6 cpe:/o:linux:linux_kernel:3.3.7 cpe:/o:linux:linux_kernel:3.3.8 cpe:/o:linux:linux_kernel:3.4 cpe:/o:linux:linux_kernel:3.4:rc1 cpe:/o:linux:linux_kernel:3.4:rc2 cpe:/o:linux:linux_kernel:3.4:rc3 cpe:/o:linux:linux_kernel:3.4:rc4 cpe:/o:linux:linux_kernel:3.4:rc5 cpe:/o:linux:linux_kernel:3.4:rc6 cpe:/o:linux:linux_kernel:3.4:rc7 cpe:/o:linux:linux_kernel:3.4.1 cpe:/o:linux:linux_kernel:3.4.2 cpe:/o:linux:linux_kernel:3.4.3 cpe:/o:linux:linux_kernel:3.4.4 cpe:/o:linux:linux_kernel:3.4.5 cpe:/o:linux:linux_kernel:3.4.6 cpe:/o:linux:linux_kernel:3.4.7 cpe:/o:linux:linux_kernel:3.4.8 cpe:/o:linux:linux_kernel:3.4.9 cpe:/o:linux:linux_kernel:3.4.10 cpe:/o:linux:linux_kernel:3.4.11 cpe:/o:linux:linux_kernel:3.4.12 cpe:/o:linux:linux_kernel:3.4.13 cpe:/o:linux:linux_kernel:3.4.14 cpe:/o:linux:linux_kernel:3.4.15 cpe:/o:linux:linux_kernel:3.4.16 cpe:/o:linux:linux_kernel:3.4.17 cpe:/o:linux:linux_kernel:3.4.18 cpe:/o:linux:linux_kernel:3.4.19 cpe:/o:linux:linux_kernel:3.4.20 cpe:/o:linux:linux_kernel:3.4.21 cpe:/o:linux:linux_kernel:3.4.22 cpe:/o:linux:linux_kernel:3.4.23 cpe:/o:linux:linux_kernel:3.4.24 cpe:/o:linux:linux_kernel:3.4.25 cpe:/o:linux:linux_kernel:3.4.26 cpe:/o:linux:linux_kernel:3.4.27 cpe:/o:linux:linux_kernel:3.4.28 cpe:/o:linux:linux_kernel:3.4.29 cpe:/o:linux:linux_kernel:3.4.30 cpe:/o:linux:linux_kernel:3.4.31 cpe:/o:linux:linux_kernel:3.4.32 cpe:/o:linux:linux_kernel:3.4.33 cpe:/o:linux:linux_kernel:3.4.34 cpe:/o:linux:linux_kernel:3.4.35 cpe:/o:linux:linux_kernel:3.4.36 cpe:/o:linux:linux_kernel:3.4.37 cpe:/o:linux:linux_kernel:3.4.38 cpe:/o:linux:linux_kernel:3.4.39 cpe:/o:linux:linux_kernel:3.4.40 cpe:/o:linux:linux_kernel:3.4.41 cpe:/o:linux:linux_kernel:3.4.42 cpe:/o:linux:linux_kernel:3.4.43 cpe:/o:linux:linux_kernel:3.4.44 cpe:/o:linux:linux_kernel:3.4.45 cpe:/o:linux:linux_kernel:3.4.46 cpe:/o:linux:linux_kernel:3.4.47 cpe:/o:linux:linux_kernel:3.4.48 cpe:/o:linux:linux_kernel:3.4.49 cpe:/o:linux:linux_kernel:3.4.50 cpe:/o:linux:linux_kernel:3.4.51 cpe:/o:linux:linux_kernel:3.4.52 cpe:/o:linux:linux_kernel:3.4.53 cpe:/o:linux:linux_kernel:3.4.54 cpe:/o:linux:linux_kernel:3.4.55 cpe:/o:linux:linux_kernel:3.4.56 cpe:/o:linux:linux_kernel:3.4.57 cpe:/o:linux:linux_kernel:3.4.58 cpe:/o:linux:linux_kernel:3.4.59 cpe:/o:linux:linux_kernel:3.4.60 cpe:/o:linux:linux_kernel:3.4.61 cpe:/o:linux:linux_kernel:3.4.62 cpe:/o:linux:linux_kernel:3.4.63 cpe:/o:linux:linux_kernel:3.4.64 cpe:/o:linux:linux_kernel:3.4.65 cpe:/o:linux:linux_kernel:3.4.66 cpe:/o:linux:linux_kernel:3.4.67 cpe:/o:linux:linux_kernel:3.4.68 cpe:/o:linux:linux_kernel:3.4.69 cpe:/o:linux:linux_kernel:3.4.70 cpe:/o:linux:linux_kernel:3.4.71 cpe:/o:linux:linux_kernel:3.4.72 cpe:/o:linux:linux_kernel:3.4.73 cpe:/o:linux:linux_kernel:3.4.74 cpe:/o:linux:linux_kernel:3.4.75 cpe:/o:linux:linux_kernel:3.4.76 cpe:/o:linux:linux_kernel:3.4.77 cpe:/o:linux:linux_kernel:3.4.78 cpe:/o:linux:linux_kernel:3.4.79 cpe:/o:linux:linux_kernel:3.5.1 cpe:/o:linux:linux_kernel:3.5.2 cpe:/o:linux:linux_kernel:3.5.3 cpe:/o:linux:linux_kernel:3.5.4 cpe:/o:linux:linux_kernel:3.5.5 cpe:/o:linux:linux_kernel:3.5.6 cpe:/o:linux:linux_kernel:3.5.7 cpe:/o:linux:linux_kernel:3.6 cpe:/o:linux:linux_kernel:3.6.1 cpe:/o:linux:linux_kernel:3.6.2 cpe:/o:linux:linux_kernel:3.6.3 cpe:/o:linux:linux_kernel:3.6.4 cpe:/o:linux:linux_kernel:3.6.5 cpe:/o:linux:linux_kernel:3.6.6 cpe:/o:linux:linux_kernel:3.6.7 cpe:/o:linux:linux_kernel:3.6.8 cpe:/o:linux:linux_kernel:3.6.9 cpe:/o:linux:linux_kernel:3.6.10 cpe:/o:linux:linux_kernel:3.6.11 cpe:/o:linux:linux_kernel:3.7 cpe:/o:linux:linux_kernel:3.7.1 cpe:/o:linux:linux_kernel:3.7.2 cpe:/o:linux:linux_kernel:3.7.3 cpe:/o:linux:linux_kernel:3.7.4 cpe:/o:linux:linux_kernel:3.7.5 cpe:/o:linux:linux_kernel:3.7.6 cpe:/o:linux:linux_kernel:3.7.7 cpe:/o:linux:linux_kernel:3.7.8 cpe:/o:linux:linux_kernel:3.7.9 cpe:/o:linux:linux_kernel:3.7.10 cpe:/o:linux:linux_kernel:3.8.0 cpe:/o:linux:linux_kernel:3.8.1 cpe:/o:linux:linux_kernel:3.8.2 cpe:/o:linux:linux_kernel:3.8.3 cpe:/o:linux:linux_kernel:3.8.4 cpe:/o:linux:linux_kernel:3.8.5 cpe:/o:linux:linux_kernel:3.8.6 cpe:/o:linux:linux_kernel:3.8.7 cpe:/o:linux:linux_kernel:3.8.8 cpe:/o:linux:linux_kernel:3.8.9 cpe:/o:linux:linux_kernel:3.8.10 cpe:/o:linux:linux_kernel:3.8.11 cpe:/o:linux:linux_kernel:3.8.12 cpe:/o:linux:linux_kernel:3.8.13 cpe:/o:linux:linux_kernel:3.9:rc1 cpe:/o:linux:linux_kernel:3.9:rc2 cpe:/o:linux:linux_kernel:3.9:rc3 cpe:/o:linux:linux_kernel:3.9:rc4 cpe:/o:linux:linux_kernel:3.9:rc5 cpe:/o:linux:linux_kernel:3.9:rc6 cpe:/o:linux:linux_kernel:3.9:rc7 cpe:/o:linux:linux_kernel:3.9.0 cpe:/o:linux:linux_kernel:3.9.1 cpe:/o:linux:linux_kernel:3.9.2 cpe:/o:linux:linux_kernel:3.9.3 cpe:/o:linux:linux_kernel:3.9.4 cpe:/o:linux:linux_kernel:3.9.5 cpe:/o:linux:linux_kernel:3.9.6 cpe:/o:linux:linux_kernel:3.9.7 cpe:/o:linux:linux_kernel:3.9.8 cpe:/o:linux:linux_kernel:3.9.9 cpe:/o:linux:linux_kernel:3.9.10 cpe:/o:linux:linux_kernel:3.9.11 cpe:/o:linux:linux_kernel:3.10 cpe:/o:linux:linux_kernel:3.10.1 cpe:/o:linux:linux_kernel:3.10.2 cpe:/o:linux:linux_kernel:3.10.3 cpe:/o:linux:linux_kernel:3.10.4 cpe:/o:linux:linux_kernel:3.10.5 cpe:/o:linux:linux_kernel:3.10.6 cpe:/o:linux:linux_kernel:3.10.7 cpe:/o:linux:linux_kernel:3.10.8 cpe:/o:linux:linux_kernel:3.10.9 cpe:/o:linux:linux_kernel:3.10.10 cpe:/o:linux:linux_kernel:3.10.11 cpe:/o:linux:linux_kernel:3.10.12 cpe:/o:linux:linux_kernel:3.10.13 cpe:/o:linux:linux_kernel:3.10.14 cpe:/o:linux:linux_kernel:3.10.15 cpe:/o:linux:linux_kernel:3.10.16 cpe:/o:linux:linux_kernel:3.10.17 cpe:/o:linux:linux_kernel:3.10.18 cpe:/o:linux:linux_kernel:3.10.19 cpe:/o:linux:linux_kernel:3.10.20 cpe:/o:linux:linux_kernel:3.10.21 cpe:/o:linux:linux_kernel:3.10.22 cpe:/o:linux:linux_kernel:3.10.23 cpe:/o:linux:linux_kernel:3.10.24 cpe:/o:linux:linux_kernel:3.10.25 cpe:/o:linux:linux_kernel:3.10.26 cpe:/o:linux:linux_kernel:3.10.27 cpe:/o:linux:linux_kernel:3.10.28 cpe:/o:linux:linux_kernel:3.10.29 cpe:/o:linux:linux_kernel:3.11 cpe:/o:linux:linux_kernel:3.11.1 cpe:/o:linux:linux_kernel:3.11.2 cpe:/o:linux:linux_kernel:3.11.3 cpe:/o:linux:linux_kernel:3.11.4 cpe:/o:linux:linux_kernel:3.11.5 cpe:/o:linux:linux_kernel:3.11.6 cpe:/o:linux:linux_kernel:3.11.7 cpe:/o:linux:linux_kernel:3.11.8 cpe:/o:linux:linux_kernel:3.11.9 cpe:/o:linux:linux_kernel:3.11.10 cpe:/o:linux:linux_kernel:3.12 cpe:/o:linux:linux_kernel:3.12.1 cpe:/o:linux:linux_kernel:3.12.2 cpe:/o:linux:linux_kernel:3.12.3 cpe:/o:linux:linux_kernel:3.12.4 cpe:/o:linux:linux_kernel:3.12.5 cpe:/o:linux:linux_kernel:3.12.6 cpe:/o:linux:linux_kernel:3.12.7 cpe:/o:linux:linux_kernel:3.12.8 cpe:/o:linux:linux_kernel:3.12.9 cpe:/o:linux:linux_kernel:3.12.10 cpe:/o:linux:linux_kernel:3.12.11 cpe:/o:linux:linux_kernel:3.12.12 cpe:/o:linux:linux_kernel:3.12.13 cpe:/o:linux:linux_kernel:3.13 cpe:/o:linux:linux_kernel:3.13.1 cpe:/o:linux:linux_kernel:3.13.2 cpe:/o:linux:linux_kernel:3.13.3 cpe:/o:linux:linux_kernel:3.13.4 cpe:/o:linux:linux_kernel:3.13.5

CVE-2014-0049

2014-03-11T09:01:06.060-04:00

2014-03-11T10:26:44.843-04:00

7.4

ADJACENT_NETWORK

MEDIUM

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2014-03-11T10:26:42.767-04:00

CONFIRM http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a08d3b3b99efd509133946056531cdf8f3a0c09b CONFIRM http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.6 MLIST [oss-security] 20140303 CVE-2014-0049 -- Linux kernel: kvm: mmio_fragments out-of-the-bounds access CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1062368 CONFIRM https://github.com/torvalds/linux/commit/a08d3b3b99efd509133946056531cdf8f3a0c09b Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that triggers an invalid memory copy affecting certain cancel_work_item data.

cpe:/a:apache:commons_fileupload:1.0 cpe:/a:apache:commons_fileupload:1.1 cpe:/a:apache:commons_fileupload:1.1.1 cpe:/a:apache:commons_fileupload:1.2 cpe:/a:apache:commons_fileupload:1.2.1 cpe:/a:apache:commons_fileupload:1.2.2 cpe:/a:apache:commons_fileupload:1.3 cpe:/a:apache:tomcat:7.0.0 cpe:/a:apache:tomcat:7.0.0:beta cpe:/a:apache:tomcat:7.0.1 cpe:/a:apache:tomcat:7.0.2 cpe:/a:apache:tomcat:7.0.2:beta cpe:/a:apache:tomcat:7.0.3 cpe:/a:apache:tomcat:7.0.4 cpe:/a:apache:tomcat:7.0.4:beta cpe:/a:apache:tomcat:7.0.5 cpe:/a:apache:tomcat:7.0.6 cpe:/a:apache:tomcat:7.0.7 cpe:/a:apache:tomcat:7.0.8 cpe:/a:apache:tomcat:7.0.9 cpe:/a:apache:tomcat:7.0.10 cpe:/a:apache:tomcat:7.0.11 cpe:/a:apache:tomcat:7.0.12 cpe:/a:apache:tomcat:7.0.13 cpe:/a:apache:tomcat:7.0.14 cpe:/a:apache:tomcat:7.0.15 cpe:/a:apache:tomcat:7.0.16 cpe:/a:apache:tomcat:7.0.17 cpe:/a:apache:tomcat:7.0.18 cpe:/a:apache:tomcat:7.0.19 cpe:/a:apache:tomcat:7.0.20 cpe:/a:apache:tomcat:7.0.21 cpe:/a:apache:tomcat:7.0.22 cpe:/a:apache:tomcat:7.0.23 cpe:/a:apache:tomcat:7.0.24 cpe:/a:apache:tomcat:7.0.25 cpe:/a:apache:tomcat:7.0.26 cpe:/a:apache:tomcat:7.0.27 cpe:/a:apache:tomcat:7.0.28 cpe:/a:apache:tomcat:7.0.29 cpe:/a:apache:tomcat:7.0.30 cpe:/a:apache:tomcat:7.0.31 cpe:/a:apache:tomcat:7.0.32 cpe:/a:apache:tomcat:7.0.33 cpe:/a:apache:tomcat:7.0.34 cpe:/a:apache:tomcat:7.0.35 cpe:/a:apache:tomcat:7.0.36 cpe:/a:apache:tomcat:7.0.37 cpe:/a:apache:tomcat:7.0.38 cpe:/a:apache:tomcat:7.0.39 cpe:/a:apache:tomcat:7.0.40 cpe:/a:apache:tomcat:7.0.41 cpe:/a:apache:tomcat:7.0.42 cpe:/a:apache:tomcat:7.0.43 cpe:/a:apache:tomcat:7.0.44 cpe:/a:apache:tomcat:7.0.45 cpe:/a:apache:tomcat:7.0.46 cpe:/a:apache:tomcat:7.0.47 cpe:/a:apache:tomcat:7.0.48 cpe:/a:apache:tomcat:7.0.49 cpe:/a:apache:tomcat:7.0.50 cpe:/a:apache:tomcat:8.0.0:rc1 cpe:/a:apache:tomcat:8.0.0:rc10 cpe:/a:apache:tomcat:8.0.0:rc2 cpe:/a:apache:tomcat:8.0.0:rc5 cpe:/a:apache:tomcat:8.0.1 cpe:/a:oracle:retail_applications:12.0 cpe:/a:oracle:retail_applications:12.0in cpe:/a:oracle:retail_applications:13.0 cpe:/a:oracle:retail_applications:13.1 cpe:/a:oracle:retail_applications:13.2 cpe:/a:oracle:retail_applications:13.3 cpe:/a:oracle:retail_applications:13.4 cpe:/a:oracle:retail_applications:14.0

CVE-2014-0050

2014-04-01T02:27:51.373-04:00

2018-10-09T15:35:09.800-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://advisories.mageia.org/MGASA-2014-0110.html MISC http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html JVN JVN#14876762 JVNDB JVNDB-2014-000017 MLIST [commons-dev] 20140206 [SECURITY] CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat DoS HP HPSBGN03329 MISC http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html REDHAT RHSA-2014:0252 REDHAT RHSA-2014:0253 REDHAT RHSA-2014:0400 FULLDISC 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities CONFIRM http://svn.apache.org/r1565143 CONFIRM http://tomcat.apache.org/security-7.html CONFIRM http://tomcat.apache.org/security-8.html DEBIAN DSA-2856 CONFIRM http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-015/index.html CONFIRM http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-016/index.html CONFIRM http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.html CONFIRM http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm MANDRIVA MDVSA-2015:084 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html BUGTRAQ 20140625 NEW VMSA-2014-0007 - VMware product updates address security vulnerabilities in Apache Struts library BUGTRAQ 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities BID 65400 UBUNTU USN-2130-1 CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0007.html CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0008.html CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0012.html CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21669554 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21675432 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676091 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676092 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676401 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676403 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676405 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676410 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676656 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676853 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677691 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677724 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21681214 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1062337 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.

CVE-2014-0051

2017-05-15T11:29:00.200-04:00

2017-05-15T11:29:00.230-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CVE-2014-0052

2017-07-20T11:29:00.180-04:00

2017-07-20T11:29:00.197-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

cpe:/a:gopivotal:grails:2.0.0 cpe:/a:gopivotal:grails:2.0.1 cpe:/a:gopivotal:grails:2.0.2 cpe:/a:gopivotal:grails:2.0.3 cpe:/a:gopivotal:grails:2.0.4 cpe:/a:gopivotal:grails:2.1.0 cpe:/a:gopivotal:grails:2.1.1 cpe:/a:gopivotal:grails:2.1.2 cpe:/a:gopivotal:grails:2.1.3 cpe:/a:gopivotal:grails:2.1.4 cpe:/a:gopivotal:grails:2.1.5 cpe:/a:gopivotal:grails:2.2.0 cpe:/a:gopivotal:grails:2.2.1 cpe:/a:gopivotal:grails:2.2.2 cpe:/a:gopivotal:grails:2.2.3 cpe:/a:gopivotal:grails:2.2.4 cpe:/a:gopivotal:grails:2.2.5 cpe:/a:gopivotal:grails:2.3.0 cpe:/a:gopivotal:grails:2.3.1 cpe:/a:gopivotal:grails:2.3.2 cpe:/a:gopivotal:grails:2.3.3 cpe:/a:gopivotal:grails:2.3.4 cpe:/a:gopivotal:grails:2.3.5 cpe:/a:gopivotal:grails-resources:1.0.0 cpe:/a:gopivotal:grails-resources:1.0.2 cpe:/a:gopivotal:grails-resources:1.1.0 cpe:/a:gopivotal:grails-resources:1.1.1 cpe:/a:gopivotal:grails-resources:1.1.2 cpe:/a:gopivotal:grails-resources:1.1.4 cpe:/a:gopivotal:grails-resources:1.1.5 cpe:/a:gopivotal:grails-resources:1.1.6 cpe:/a:gopivotal:grails-resources:1.2.0 cpe:/a:gopivotal:grails-resources:1.2.1 cpe:/a:gopivotal:grails-resources:1.2.2 cpe:/a:gopivotal:grails-resources:1.2.3 cpe:/a:gopivotal:grails-resources:1.2.4 cpe:/a:gopivotal:grails-resources:1.2.5

CVE-2014-0053

2014-04-15T19:55:08.640-04:00

2018-10-09T15:35:23.863-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov FULLDISC 20140219 CVE-2014-0053 Information Disclosure when using Grails FULLDISC 20140227 Update: CVE-2014-0053 Information Disclosure when using Grails CONFIRM http://www.gopivotal.com/security/cve-2014-0053 BUGTRAQ 20140227 Update: CVE-2014-0053 Information Disclosure when using Grails BID 65678 XF grails-cve20140053-info-disc(91270) MISC https://twitter.com/Ramsharan065/status/434975409134792704 The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 before 2.3.6 does not properly restrict access to files in the WEB-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this identifier has been SPLIT due to different researchers and different vulnerability types. See CVE-2014-2857 for the META-INF variant and CVE-2014-2858 for the directory traversal.

cpe:/a:springsource:spring_framework:3.0.0 cpe:/a:springsource:spring_framework:3.0.0:m1 cpe:/a:springsource:spring_framework:3.0.0:m2 cpe:/a:springsource:spring_framework:3.0.0:m3 cpe:/a:springsource:spring_framework:3.0.0:m4 cpe:/a:springsource:spring_framework:3.0.0:rc1 cpe:/a:springsource:spring_framework:3.0.0:rc2 cpe:/a:springsource:spring_framework:3.0.0:rc3 cpe:/a:springsource:spring_framework:3.0.0.m1 cpe:/a:springsource:spring_framework:3.0.0.m2 cpe:/a:springsource:spring_framework:3.0.1 cpe:/a:springsource:spring_framework:3.0.2 cpe:/a:springsource:spring_framework:3.0.3 cpe:/a:springsource:spring_framework:3.0.4 cpe:/a:springsource:spring_framework:3.0.5 cpe:/a:springsource:spring_framework:3.0.6 cpe:/a:springsource:spring_framework:3.0.7 cpe:/a:springsource:spring_framework:3.1.0 cpe:/a:springsource:spring_framework:3.1.1 cpe:/a:springsource:spring_framework:3.1.2 cpe:/a:springsource:spring_framework:3.1.3 cpe:/a:springsource:spring_framework:3.1.4 cpe:/a:springsource:spring_framework:3.2.0 cpe:/a:springsource:spring_framework:3.2.1 cpe:/a:springsource:spring_framework:3.2.2 cpe:/a:springsource:spring_framework:3.2.3 cpe:/a:springsource:spring_framework:3.2.4 cpe:/a:springsource:spring_framework:3.2.5 cpe:/a:springsource:spring_framework:3.2.6 cpe:/a:springsource:spring_framework:3.2.7 cpe:/a:springsource:spring_framework:4.0.0:m1 cpe:/a:springsource:spring_framework:4.0.0:m2 cpe:/a:springsource:spring_framework:4.0.0:rc1 cpe:/a:springsource:spring_framework:4.0.1

CVE-2014-0054

2014-04-17T10:55:06.417-04:00

2018-04-19T21:29:00.370-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2014:0400 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html BID 66148 CONFIRM https://jira.spring.io/browse/SPR-11376 The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.

cpe:/o:redhat:enterprise_linux:6.0

CVE-2014-0055

2014-03-26T10:55:04.710-04:00

2019-04-22T13:48:00.643-04:00

5.5

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov REDHAT RHSA-2014:0328 REDHAT RHSA-2014:0339 BID 66441 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1062577 The get_rx_bufs function in drivers/vhost/net.c in the vhost-net subsystem in the Linux kernel package before 2.6.32-431.11.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly handle vhost_get_vq_desc errors, which allows guest OS users to cause a denial of service (host OS crash) via unspecified vectors.

cpe:/a:openstack:neutron:2012.2 cpe:/a:openstack:neutron:2012.2.1 cpe:/a:openstack:neutron:2012.2.2 cpe:/a:openstack:neutron:2012.2.3 cpe:/a:openstack:neutron:2012.2.4 cpe:/a:openstack:neutron:2013.1 cpe:/a:openstack:neutron:2013.1.1 cpe:/a:openstack:neutron:2013.1.2 cpe:/a:openstack:neutron:2013.1.3 cpe:/a:openstack:neutron:2013.1.4 cpe:/a:openstack:neutron:2013.1.5 cpe:/a:openstack:neutron:2013.2 cpe:/a:openstack:neutron:2013.2.1 cpe:/a:openstack:neutron:2013.2.2 cpe:/o:canonical:ubuntu_linux:13.10

CVE-2014-0056

2014-05-08T10:29:12.737-04:00

2014-06-05T00:28:33.883-04:00

2.1

NETWORK

HIGH

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2014:0516 MLIST [oss-security] 20140328 [OSSA 2014-008] Routers can be cross plugged by other tenants (CVE-2014-0056) UBUNTU USN-2194-1 CONFIRM https://bugs.launchpad.net/neutron/+bug/1243327 The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.

cpe:/a:redhat:cloudforms:3.0 cpe:/a:redhat:cloudforms_3.0_management_engine:5.2

CVE-2014-0057

2014-03-18T13:02:52.887-04:00

2014-03-19T10:03:56.427-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-03-19T10:03:38.987-04:00

REDHAT RHSA-2014:0215 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1064140 The x_button method in the ServiceController (vmdb/app/controllers/service_controller.rb) in Red Hat CloudForms 3.0 Management Engine 5.2 allows remote attackers to execute arbitrary methods via unspecified vectors.

cpe:/a:redhat:jboss_enterprise_application_platform:6.0.0 cpe:/a:redhat:jboss_enterprise_application_platform:6.0.1 cpe:/a:redhat:jboss_enterprise_application_platform:6.1.0 cpe:/a:redhat:jboss_enterprise_application_platform:6.2.0

CVE-2014-0058

2014-02-26T10:55:08.953-05:00

2017-01-06T21:59:15.060-05:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2014:0204 REDHAT RHSA-2014:0205 REDHAT RHSA-2015:0034 BID 65762 The security audit functionality in Red Hat JBoss Enterprise Application Platform (EAP) 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files.

cpe:/a:redhat:jboss_enterprise_application_platform:6.2.2

CVE-2014-0059

2014-11-17T17:59:02.610-05:00

2016-09-30T21:59:00.317-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2014:0563 REDHAT RHSA-2014:0564 REDHAT RHSA-2014:0565 REDHAT RHSA-2015:0675 REDHAT RHSA-2015:0850 REDHAT RHSA-2015:0851 JBoss SX and PicketBox, as used in Red Hat JBoss Enterprise Application Platform (EAP) before 6.2.3, use world-readable permissions on audit.log, which allows local users to obtain sensitive information by reading this file.

cpe:/a:postgresql:postgresql:8.4.1 cpe:/a:postgresql:postgresql:8.4.2 cpe:/a:postgresql:postgresql:8.4.3 cpe:/a:postgresql:postgresql:8.4.4 cpe:/a:postgresql:postgresql:8.4.5 cpe:/a:postgresql:postgresql:8.4.6 cpe:/a:postgresql:postgresql:8.4.7 cpe:/a:postgresql:postgresql:8.4.8 cpe:/a:postgresql:postgresql:8.4.9 cpe:/a:postgresql:postgresql:8.4.10 cpe:/a:postgresql:postgresql:8.4.11 cpe:/a:postgresql:postgresql:8.4.12 cpe:/a:postgresql:postgresql:8.4.13 cpe:/a:postgresql:postgresql:8.4.14 cpe:/a:postgresql:postgresql:8.4.15 cpe:/a:postgresql:postgresql:8.4.16 cpe:/a:postgresql:postgresql:8.4.17 cpe:/a:postgresql:postgresql:8.4.18 cpe:/a:postgresql:postgresql:8.4.19 cpe:/a:postgresql:postgresql:9.0 cpe:/a:postgresql:postgresql:9.0.1 cpe:/a:postgresql:postgresql:9.0.2 cpe:/a:postgresql:postgresql:9.0.3 cpe:/a:postgresql:postgresql:9.0.4 cpe:/a:postgresql:postgresql:9.0.5 cpe:/a:postgresql:postgresql:9.0.6 cpe:/a:postgresql:postgresql:9.0.7 cpe:/a:postgresql:postgresql:9.0.8 cpe:/a:postgresql:postgresql:9.0.9 cpe:/a:postgresql:postgresql:9.0.10 cpe:/a:postgresql:postgresql:9.0.11 cpe:/a:postgresql:postgresql:9.0.12 cpe:/a:postgresql:postgresql:9.0.13 cpe:/a:postgresql:postgresql:9.0.14 cpe:/a:postgresql:postgresql:9.0.15 cpe:/a:postgresql:postgresql:9.1 cpe:/a:postgresql:postgresql:9.1.1 cpe:/a:postgresql:postgresql:9.1.2 cpe:/a:postgresql:postgresql:9.1.3 cpe:/a:postgresql:postgresql:9.1.4 cpe:/a:postgresql:postgresql:9.1.5 cpe:/a:postgresql:postgresql:9.1.6 cpe:/a:postgresql:postgresql:9.1.7 cpe:/a:postgresql:postgresql:9.1.8 cpe:/a:postgresql:postgresql:9.1.9 cpe:/a:postgresql:postgresql:9.1.10 cpe:/a:postgresql:postgresql:9.1.11 cpe:/a:postgresql:postgresql:9.2 cpe:/a:postgresql:postgresql:9.2.1 cpe:/a:postgresql:postgresql:9.2.2 cpe:/a:postgresql:postgresql:9.2.3 cpe:/a:postgresql:postgresql:9.2.4 cpe:/a:postgresql:postgresql:9.2.5 cpe:/a:postgresql:postgresql:9.2.6 cpe:/a:postgresql:postgresql:9.3 cpe:/a:postgresql:postgresql:9.3.1 cpe:/a:postgresql:postgresql:9.3.2

CVE-2014-0060

2014-03-31T10:58:08.663-04:00

2017-12-15T21:29:01.510-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov APPLE APPLE-SA-2014-10-16-3 CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 SUSE openSUSE-SU-2014:0345 SUSE openSUSE-SU-2014:0368 REDHAT RHSA-2014:0211 REDHAT RHSA-2014:0221 REDHAT RHSA-2014:0249 REDHAT RHSA-2014:0469 SECUNIA 61307 CONFIRM http://support.apple.com/kb/HT6448 CONFIRM http://wiki.postgresql.org/wiki/20140220securityrelease DEBIAN DSA-2864 DEBIAN DSA-2865 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html CONFIRM http://www.postgresql.org/about/news/1506/ UBUNTU USN-2120-1 CONFIRM https://puppet.com/security/cve/cve-2014-0060 CONFIRM https://support.apple.com/kb/HT6536 PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command.

CVE-2014-0061

2014-03-31T10:58:15.383-04:00

2017-12-15T21:29:01.603-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov APPLE APPLE-SA-2014-10-16-3 CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 SUSE openSUSE-SU-2014:0345 SUSE openSUSE-SU-2014:0368 REDHAT RHSA-2014:0211 REDHAT RHSA-2014:0221 REDHAT RHSA-2014:0249 REDHAT RHSA-2014:0469 SECUNIA 61307 CONFIRM http://support.apple.com/kb/HT6448 CONFIRM http://wiki.postgresql.org/wiki/20140220securityrelease DEBIAN DSA-2864 DEBIAN DSA-2865 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html CONFIRM http://www.postgresql.org/about/news/1506/ UBUNTU USN-2120-1 CONFIRM https://support.apple.com/kb/HT6536 The validator functions for the procedural languages (PLs) in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to gain privileges via a function that is (1) defined in another language or (2) not allowed to be directly called by the user due to permissions.

CVE-2014-0062

2014-03-31T10:58:15.397-04:00

2017-12-15T21:29:01.697-05:00

4.9

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov APPLE APPLE-SA-2014-10-16-3 CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 SUSE openSUSE-SU-2014:0345 SUSE openSUSE-SU-2014:0368 REDHAT RHSA-2014:0211 REDHAT RHSA-2014:0221 REDHAT RHSA-2014:0249 REDHAT RHSA-2014:0469 SECUNIA 61307 CONFIRM http://support.apple.com/kb/HT6448 CONFIRM http://wiki.postgresql.org/wiki/20140220securityrelease DEBIAN DSA-2864 DEBIAN DSA-2865 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html CONFIRM http://www.postgresql.org/about/news/1506/ BID 65727 UBUNTU USN-2120-1 CONFIRM https://support.apple.com/kb/HT6536 Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allows remote authenticated users to create an unauthorized index or read portions of unauthorized tables by creating or deleting a table with the same name during the timing window.

CVE-2014-0063

2014-03-31T10:58:15.710-04:00

2017-12-15T21:29:01.793-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov APPLE APPLE-SA-2014-10-16-3 CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 SUSE openSUSE-SU-2014:0345 SUSE openSUSE-SU-2014:0368 REDHAT RHSA-2014:0211 REDHAT RHSA-2014:0221 REDHAT RHSA-2014:0249 REDHAT RHSA-2014:0469 SECUNIA 61307 CONFIRM http://support.apple.com/kb/HT6448 CONFIRM http://wiki.postgresql.org/wiki/20140220securityrelease DEBIAN DSA-2864 DEBIAN DSA-2865 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html CONFIRM http://www.postgresql.org/about/news/1506/ CONFIRM http://www.postgresql.org/support/security/ BID 65719 UBUNTU USN-2120-1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1065226 CONFIRM https://github.com/postgres/postgres/commit/4318daecc959886d001a6e79c6ea853e8b1dfb4b CONFIRM https://support.apple.com/kb/HT6536 Multiple stack-based buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via vectors related to an incorrect MAXDATELEN constant and datetime values involving (1) intervals, (2) timestamps, or (3) timezones, a different vulnerability than CVE-2014-0065.

CVE-2014-0064

2014-03-31T10:58:15.740-04:00

2017-12-15T21:29:01.887-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov APPLE APPLE-SA-2014-10-16-3 CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 SUSE openSUSE-SU-2014:0345 SUSE openSUSE-SU-2014:0368 REDHAT RHSA-2014:0211 REDHAT RHSA-2014:0221 REDHAT RHSA-2014:0249 REDHAT RHSA-2014:0469 SECUNIA 61307 CONFIRM http://support.apple.com/kb/HT6448 CONFIRM http://wiki.postgresql.org/wiki/20140220securityrelease DEBIAN DSA-2864 DEBIAN DSA-2865 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html CONFIRM http://www.postgresql.org/about/news/1506/ CONFIRM http://www.postgresql.org/support/security/ BID 65725 UBUNTU USN-2120-1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1065230 CONFIRM https://github.com/postgres/postgres/commit/31400a673325147e1205326008e32135a78b4d8a CONFIRM https://support.apple.com/kb/HT6536 Multiple integer overflows in the path_in and other unspecified functions in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors, which trigger a buffer overflow. NOTE: this identifier has been SPLIT due to different affected versions; use CVE-2014-2669 for the hstore vector.

CVE-2014-0065

2014-03-31T10:58:15.757-04:00

2017-12-15T21:29:01.980-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

CVE-2014-0066

2014-03-31T10:58:15.773-04:00

2017-12-15T21:29:02.073-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov APPLE APPLE-SA-2014-10-16-3 CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 SUSE openSUSE-SU-2014:0345 SUSE openSUSE-SU-2014:0368 REDHAT RHSA-2014:0211 REDHAT RHSA-2014:0221 REDHAT RHSA-2014:0249 REDHAT RHSA-2014:0469 CONFIRM http://support.apple.com/kb/HT6448 CONFIRM http://wiki.postgresql.org/wiki/20140220securityrelease DEBIAN DSA-2864 DEBIAN DSA-2865 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html CONFIRM http://www.postgresql.org/about/news/1506/ UBUNTU USN-2120-1 CONFIRM https://support.apple.com/kb/HT6536 The chkpass extension in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly check the return value of the crypt library function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via unspecified vectors.

CVE-2014-0067

2014-03-31T10:58:15.787-04:00

2017-12-15T21:29:02.150-05:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov APPLE APPLE-SA-2015-08-13-2 APPLE APPLE-SA-2015-09-16-4 SUSE openSUSE-SU-2014:0345 SUSE openSUSE-SU-2014:0368 CONFIRM http://wiki.postgresql.org/wiki/20140220securityrelease DEBIAN DSA-2864 DEBIAN DSA-2865 CONFIRM http://www.postgresql.org/about/news/1506/ BID 65721 CONFIRM https://support.apple.com/HT205219 CONFIRM https://support.apple.com/kb/HT205031 The "make check" command for the test suites in PostgreSQL 9.3.3 and earlier does not properly invoke initdb to specify the authentication requirements for a database cluster to be used for the tests, which allows local users to gain privileges by leveraging access to this cluster.

cpe:/o:linux:linux_kernel:3.0:rc1 cpe:/o:linux:linux_kernel:3.0:rc2 cpe:/o:linux:linux_kernel:3.0:rc3 cpe:/o:linux:linux_kernel:3.0:rc4 cpe:/o:linux:linux_kernel:3.0:rc5 cpe:/o:linux:linux_kernel:3.0:rc6 cpe:/o:linux:linux_kernel:3.0:rc7 cpe:/o:linux:linux_kernel:3.0.1 cpe:/o:linux:linux_kernel:3.0.2 cpe:/o:linux:linux_kernel:3.0.3 cpe:/o:linux:linux_kernel:3.0.4 cpe:/o:linux:linux_kernel:3.0.5 cpe:/o:linux:linux_kernel:3.0.6 cpe:/o:linux:linux_kernel:3.0.7 cpe:/o:linux:linux_kernel:3.0.8 cpe:/o:linux:linux_kernel:3.0.9 cpe:/o:linux:linux_kernel:3.0.10 cpe:/o:linux:linux_kernel:3.0.11 cpe:/o:linux:linux_kernel:3.0.12 cpe:/o:linux:linux_kernel:3.0.13 cpe:/o:linux:linux_kernel:3.0.14 cpe:/o:linux:linux_kernel:3.0.15 cpe:/o:linux:linux_kernel:3.0.16 cpe:/o:linux:linux_kernel:3.0.17 cpe:/o:linux:linux_kernel:3.0.18 cpe:/o:linux:linux_kernel:3.0.19 cpe:/o:linux:linux_kernel:3.0.20 cpe:/o:linux:linux_kernel:3.0.21 cpe:/o:linux:linux_kernel:3.0.22 cpe:/o:linux:linux_kernel:3.0.23 cpe:/o:linux:linux_kernel:3.0.24 cpe:/o:linux:linux_kernel:3.0.25 cpe:/o:linux:linux_kernel:3.0.26 cpe:/o:linux:linux_kernel:3.0.27 cpe:/o:linux:linux_kernel:3.0.28 cpe:/o:linux:linux_kernel:3.0.29 cpe:/o:linux:linux_kernel:3.0.30 cpe:/o:linux:linux_kernel:3.0.31 cpe:/o:linux:linux_kernel:3.0.32 cpe:/o:linux:linux_kernel:3.0.33 cpe:/o:linux:linux_kernel:3.0.34 cpe:/o:linux:linux_kernel:3.0.35 cpe:/o:linux:linux_kernel:3.0.36 cpe:/o:linux:linux_kernel:3.0.37 cpe:/o:linux:linux_kernel:3.0.38 cpe:/o:linux:linux_kernel:3.0.39 cpe:/o:linux:linux_kernel:3.0.40 cpe:/o:linux:linux_kernel:3.0.41 cpe:/o:linux:linux_kernel:3.0.42 cpe:/o:linux:linux_kernel:3.0.43 cpe:/o:linux:linux_kernel:3.0.44 cpe:/o:linux:linux_kernel:3.0.45 cpe:/o:linux:linux_kernel:3.0.46 cpe:/o:linux:linux_kernel:3.0.47 cpe:/o:linux:linux_kernel:3.0.48 cpe:/o:linux:linux_kernel:3.0.49 cpe:/o:linux:linux_kernel:3.0.50 cpe:/o:linux:linux_kernel:3.0.51 cpe:/o:linux:linux_kernel:3.0.52 cpe:/o:linux:linux_kernel:3.0.53 cpe:/o:linux:linux_kernel:3.0.54 cpe:/o:linux:linux_kernel:3.0.55 cpe:/o:linux:linux_kernel:3.0.56 cpe:/o:linux:linux_kernel:3.0.57 cpe:/o:linux:linux_kernel:3.0.58 cpe:/o:linux:linux_kernel:3.0.59 cpe:/o:linux:linux_kernel:3.0.60 cpe:/o:linux:linux_kernel:3.0.61 cpe:/o:linux:linux_kernel:3.0.62 cpe:/o:linux:linux_kernel:3.0.63 cpe:/o:linux:linux_kernel:3.0.64 cpe:/o:linux:linux_kernel:3.0.65 cpe:/o:linux:linux_kernel:3.0.66 cpe:/o:linux:linux_kernel:3.0.67 cpe:/o:linux:linux_kernel:3.0.68 cpe:/o:linux:linux_kernel:3.1 cpe:/o:linux:linux_kernel:3.1:rc1 cpe:/o:linux:linux_kernel:3.1:rc2 cpe:/o:linux:linux_kernel:3.1:rc3 cpe:/o:linux:linux_kernel:3.1:rc4 cpe:/o:linux:linux_kernel:3.1.1 cpe:/o:linux:linux_kernel:3.1.2 cpe:/o:linux:linux_kernel:3.1.3 cpe:/o:linux:linux_kernel:3.1.4 cpe:/o:linux:linux_kernel:3.1.5 cpe:/o:linux:linux_kernel:3.1.6 cpe:/o:linux:linux_kernel:3.1.7 cpe:/o:linux:linux_kernel:3.1.8 cpe:/o:linux:linux_kernel:3.1.9 cpe:/o:linux:linux_kernel:3.1.10 cpe:/o:linux:linux_kernel:3.2 cpe:/o:linux:linux_kernel:3.2:rc2 cpe:/o:linux:linux_kernel:3.2:rc3 cpe:/o:linux:linux_kernel:3.2:rc4 cpe:/o:linux:linux_kernel:3.2:rc5 cpe:/o:linux:linux_kernel:3.2:rc6 cpe:/o:linux:linux_kernel:3.2:rc7 cpe:/o:linux:linux_kernel:3.2.1 cpe:/o:linux:linux_kernel:3.2.2 cpe:/o:linux:linux_kernel:3.2.3 cpe:/o:linux:linux_kernel:3.2.4 cpe:/o:linux:linux_kernel:3.2.5 cpe:/o:linux:linux_kernel:3.2.6 cpe:/o:linux:linux_kernel:3.2.7 cpe:/o:linux:linux_kernel:3.2.8 cpe:/o:linux:linux_kernel:3.2.9 cpe:/o:linux:linux_kernel:3.2.10 cpe:/o:linux:linux_kernel:3.2.11 cpe:/o:linux:linux_kernel:3.2.12 cpe:/o:linux:linux_kernel:3.2.13 cpe:/o:linux:linux_kernel:3.2.14 cpe:/o:linux:linux_kernel:3.2.15 cpe:/o:linux:linux_kernel:3.2.16 cpe:/o:linux:linux_kernel:3.2.17 cpe:/o:linux:linux_kernel:3.2.18 cpe:/o:linux:linux_kernel:3.2.19 cpe:/o:linux:linux_kernel:3.2.20 cpe:/o:linux:linux_kernel:3.2.21 cpe:/o:linux:linux_kernel:3.2.22 cpe:/o:linux:linux_kernel:3.2.23 cpe:/o:linux:linux_kernel:3.2.24 cpe:/o:linux:linux_kernel:3.2.25 cpe:/o:linux:linux_kernel:3.2.26 cpe:/o:linux:linux_kernel:3.2.27 cpe:/o:linux:linux_kernel:3.2.28 cpe:/o:linux:linux_kernel:3.2.29 cpe:/o:linux:linux_kernel:3.2.30 cpe:/o:linux:linux_kernel:3.3 cpe:/o:linux:linux_kernel:3.3:rc1 cpe:/o:linux:linux_kernel:3.3:rc2 cpe:/o:linux:linux_kernel:3.3:rc3 cpe:/o:linux:linux_kernel:3.3:rc4 cpe:/o:linux:linux_kernel:3.3:rc5 cpe:/o:linux:linux_kernel:3.3:rc6 cpe:/o:linux:linux_kernel:3.3:rc7 cpe:/o:linux:linux_kernel:3.3.1 cpe:/o:linux:linux_kernel:3.3.2 cpe:/o:linux:linux_kernel:3.3.3 cpe:/o:linux:linux_kernel:3.3.4 cpe:/o:linux:linux_kernel:3.3.5 cpe:/o:linux:linux_kernel:3.3.6 cpe:/o:linux:linux_kernel:3.3.7 cpe:/o:linux:linux_kernel:3.3.8 cpe:/o:linux:linux_kernel:3.4 cpe:/o:linux:linux_kernel:3.4:rc1 cpe:/o:linux:linux_kernel:3.4:rc2 cpe:/o:linux:linux_kernel:3.4:rc3 cpe:/o:linux:linux_kernel:3.4:rc4 cpe:/o:linux:linux_kernel:3.4:rc5 cpe:/o:linux:linux_kernel:3.4:rc6 cpe:/o:linux:linux_kernel:3.4:rc7 cpe:/o:linux:linux_kernel:3.4.1 cpe:/o:linux:linux_kernel:3.4.2 cpe:/o:linux:linux_kernel:3.4.3 cpe:/o:linux:linux_kernel:3.4.4 cpe:/o:linux:linux_kernel:3.4.5 cpe:/o:linux:linux_kernel:3.4.6 cpe:/o:linux:linux_kernel:3.4.7 cpe:/o:linux:linux_kernel:3.4.8 cpe:/o:linux:linux_kernel:3.4.9 cpe:/o:linux:linux_kernel:3.4.10 cpe:/o:linux:linux_kernel:3.4.11 cpe:/o:linux:linux_kernel:3.4.12 cpe:/o:linux:linux_kernel:3.4.13 cpe:/o:linux:linux_kernel:3.4.14 cpe:/o:linux:linux_kernel:3.4.15 cpe:/o:linux:linux_kernel:3.4.16 cpe:/o:linux:linux_kernel:3.4.17 cpe:/o:linux:linux_kernel:3.4.18 cpe:/o:linux:linux_kernel:3.4.19 cpe:/o:linux:linux_kernel:3.4.20 cpe:/o:linux:linux_kernel:3.4.21 cpe:/o:linux:linux_kernel:3.4.22 cpe:/o:linux:linux_kernel:3.4.23 cpe:/o:linux:linux_kernel:3.4.24 cpe:/o:linux:linux_kernel:3.4.25 cpe:/o:linux:linux_kernel:3.4.26 cpe:/o:linux:linux_kernel:3.4.27 cpe:/o:linux:linux_kernel:3.4.28 cpe:/o:linux:linux_kernel:3.4.29 cpe:/o:linux:linux_kernel:3.4.30 cpe:/o:linux:linux_kernel:3.4.31 cpe:/o:linux:linux_kernel:3.4.32 cpe:/o:linux:linux_kernel:3.4.33 cpe:/o:linux:linux_kernel:3.4.34 cpe:/o:linux:linux_kernel:3.4.35 cpe:/o:linux:linux_kernel:3.4.36 cpe:/o:linux:linux_kernel:3.4.37 cpe:/o:linux:linux_kernel:3.4.38 cpe:/o:linux:linux_kernel:3.4.39 cpe:/o:linux:linux_kernel:3.4.40 cpe:/o:linux:linux_kernel:3.4.41 cpe:/o:linux:linux_kernel:3.4.42 cpe:/o:linux:linux_kernel:3.4.43 cpe:/o:linux:linux_kernel:3.4.44 cpe:/o:linux:linux_kernel:3.4.45 cpe:/o:linux:linux_kernel:3.4.46 cpe:/o:linux:linux_kernel:3.4.47 cpe:/o:linux:linux_kernel:3.4.48 cpe:/o:linux:linux_kernel:3.4.49 cpe:/o:linux:linux_kernel:3.4.50 cpe:/o:linux:linux_kernel:3.4.51 cpe:/o:linux:linux_kernel:3.4.52 cpe:/o:linux:linux_kernel:3.4.53 cpe:/o:linux:linux_kernel:3.4.54 cpe:/o:linux:linux_kernel:3.4.55 cpe:/o:linux:linux_kernel:3.4.56 cpe:/o:linux:linux_kernel:3.4.57 cpe:/o:linux:linux_kernel:3.4.58 cpe:/o:linux:linux_kernel:3.4.59 cpe:/o:linux:linux_kernel:3.4.60 cpe:/o:linux:linux_kernel:3.4.61 cpe:/o:linux:linux_kernel:3.4.62 cpe:/o:linux:linux_kernel:3.4.63 cpe:/o:linux:linux_kernel:3.4.64 cpe:/o:linux:linux_kernel:3.4.65 cpe:/o:linux:linux_kernel:3.4.66 cpe:/o:linux:linux_kernel:3.4.67 cpe:/o:linux:linux_kernel:3.4.68 cpe:/o:linux:linux_kernel:3.4.69 cpe:/o:linux:linux_kernel:3.4.70 cpe:/o:linux:linux_kernel:3.4.71 cpe:/o:linux:linux_kernel:3.4.72 cpe:/o:linux:linux_kernel:3.4.73 cpe:/o:linux:linux_kernel:3.4.74 cpe:/o:linux:linux_kernel:3.4.75 cpe:/o:linux:linux_kernel:3.4.76 cpe:/o:linux:linux_kernel:3.4.77 cpe:/o:linux:linux_kernel:3.4.78 cpe:/o:linux:linux_kernel:3.4.79 cpe:/o:linux:linux_kernel:3.5.1 cpe:/o:linux:linux_kernel:3.5.2 cpe:/o:linux:linux_kernel:3.5.3 cpe:/o:linux:linux_kernel:3.5.4 cpe:/o:linux:linux_kernel:3.5.5 cpe:/o:linux:linux_kernel:3.5.6 cpe:/o:linux:linux_kernel:3.5.7 cpe:/o:linux:linux_kernel:3.6 cpe:/o:linux:linux_kernel:3.6.1 cpe:/o:linux:linux_kernel:3.6.2 cpe:/o:linux:linux_kernel:3.6.3 cpe:/o:linux:linux_kernel:3.6.4 cpe:/o:linux:linux_kernel:3.6.5 cpe:/o:linux:linux_kernel:3.6.6 cpe:/o:linux:linux_kernel:3.6.7 cpe:/o:linux:linux_kernel:3.6.8 cpe:/o:linux:linux_kernel:3.6.9 cpe:/o:linux:linux_kernel:3.6.10 cpe:/o:linux:linux_kernel:3.6.11 cpe:/o:linux:linux_kernel:3.7 cpe:/o:linux:linux_kernel:3.7.1 cpe:/o:linux:linux_kernel:3.7.2 cpe:/o:linux:linux_kernel:3.7.3 cpe:/o:linux:linux_kernel:3.7.4 cpe:/o:linux:linux_kernel:3.7.5 cpe:/o:linux:linux_kernel:3.7.6 cpe:/o:linux:linux_kernel:3.7.7 cpe:/o:linux:linux_kernel:3.7.8 cpe:/o:linux:linux_kernel:3.7.9 cpe:/o:linux:linux_kernel:3.7.10 cpe:/o:linux:linux_kernel:3.8.0 cpe:/o:linux:linux_kernel:3.8.1 cpe:/o:linux:linux_kernel:3.8.2 cpe:/o:linux:linux_kernel:3.8.3 cpe:/o:linux:linux_kernel:3.8.4 cpe:/o:linux:linux_kernel:3.8.5 cpe:/o:linux:linux_kernel:3.8.6 cpe:/o:linux:linux_kernel:3.8.7 cpe:/o:linux:linux_kernel:3.8.8 cpe:/o:linux:linux_kernel:3.8.9 cpe:/o:linux:linux_kernel:3.8.10 cpe:/o:linux:linux_kernel:3.8.11 cpe:/o:linux:linux_kernel:3.8.12 cpe:/o:linux:linux_kernel:3.8.13 cpe:/o:linux:linux_kernel:3.9:rc1 cpe:/o:linux:linux_kernel:3.9:rc2 cpe:/o:linux:linux_kernel:3.9:rc3 cpe:/o:linux:linux_kernel:3.9:rc4 cpe:/o:linux:linux_kernel:3.9:rc5 cpe:/o:linux:linux_kernel:3.9:rc6 cpe:/o:linux:linux_kernel:3.9:rc7 cpe:/o:linux:linux_kernel:3.9.0 cpe:/o:linux:linux_kernel:3.9.1 cpe:/o:linux:linux_kernel:3.9.2 cpe:/o:linux:linux_kernel:3.9.3 cpe:/o:linux:linux_kernel:3.9.4 cpe:/o:linux:linux_kernel:3.9.5 cpe:/o:linux:linux_kernel:3.9.6 cpe:/o:linux:linux_kernel:3.9.7 cpe:/o:linux:linux_kernel:3.9.8 cpe:/o:linux:linux_kernel:3.9.9 cpe:/o:linux:linux_kernel:3.9.10 cpe:/o:linux:linux_kernel:3.9.11 cpe:/o:linux:linux_kernel:3.10 cpe:/o:linux:linux_kernel:3.10.1 cpe:/o:linux:linux_kernel:3.10.2 cpe:/o:linux:linux_kernel:3.10.3 cpe:/o:linux:linux_kernel:3.10.4 cpe:/o:linux:linux_kernel:3.10.5 cpe:/o:linux:linux_kernel:3.10.6 cpe:/o:linux:linux_kernel:3.10.7 cpe:/o:linux:linux_kernel:3.10.8 cpe:/o:linux:linux_kernel:3.10.9 cpe:/o:linux:linux_kernel:3.10.10 cpe:/o:linux:linux_kernel:3.10.11 cpe:/o:linux:linux_kernel:3.10.12 cpe:/o:linux:linux_kernel:3.10.13 cpe:/o:linux:linux_kernel:3.10.14 cpe:/o:linux:linux_kernel:3.10.15 cpe:/o:linux:linux_kernel:3.10.16 cpe:/o:linux:linux_kernel:3.10.17 cpe:/o:linux:linux_kernel:3.10.18 cpe:/o:linux:linux_kernel:3.10.19 cpe:/o:linux:linux_kernel:3.10.20 cpe:/o:linux:linux_kernel:3.10.21 cpe:/o:linux:linux_kernel:3.10.22 cpe:/o:linux:linux_kernel:3.10.23 cpe:/o:linux:linux_kernel:3.10.24 cpe:/o:linux:linux_kernel:3.10.25 cpe:/o:linux:linux_kernel:3.10.26 cpe:/o:linux:linux_kernel:3.10.27 cpe:/o:linux:linux_kernel:3.10.28 cpe:/o:linux:linux_kernel:3.10.29 cpe:/o:linux:linux_kernel:3.11 cpe:/o:linux:linux_kernel:3.11.1 cpe:/o:linux:linux_kernel:3.11.2 cpe:/o:linux:linux_kernel:3.11.3 cpe:/o:linux:linux_kernel:3.11.4 cpe:/o:linux:linux_kernel:3.11.5 cpe:/o:linux:linux_kernel:3.11.6 cpe:/o:linux:linux_kernel:3.11.7 cpe:/o:linux:linux_kernel:3.11.8 cpe:/o:linux:linux_kernel:3.11.9 cpe:/o:linux:linux_kernel:3.11.10 cpe:/o:linux:linux_kernel:3.12 cpe:/o:linux:linux_kernel:3.12.1 cpe:/o:linux:linux_kernel:3.12.2 cpe:/o:linux:linux_kernel:3.12.3 cpe:/o:linux:linux_kernel:3.12.4 cpe:/o:linux:linux_kernel:3.12.5 cpe:/o:linux:linux_kernel:3.12.6 cpe:/o:linux:linux_kernel:3.12.7 cpe:/o:linux:linux_kernel:3.12.8 cpe:/o:linux:linux_kernel:3.12.9 cpe:/o:linux:linux_kernel:3.12.10 cpe:/o:linux:linux_kernel:3.12.11 cpe:/o:linux:linux_kernel:3.12.12 cpe:/o:linux:linux_kernel:3.12.13 cpe:/o:linux:linux_kernel:3.13 cpe:/o:linux:linux_kernel:3.13.1 cpe:/o:linux:linux_kernel:3.13.2 cpe:/o:linux:linux_kernel:3.13.3 cpe:/o:linux:linux_kernel:3.13.4 cpe:/o:linux:linux_kernel:3.13.5

CVE-2014-0069

2014-02-28T01:18:54.010-05:00

2017-12-15T21:29:02.247-05:00

6.2

LOCAL

HIGH

NONE

COMPLETE

http://nvd.nist.gov MLIST [linux-cifs] 20140214 [PATCH] cifs: ensure that uncached writes handle unmapped areas correctly CONFIRM http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=5d81de8e8667da7135d3a32a964087c0faf5483f SUSE SUSE-SU-2014:0459 REDHAT RHSA-2014:0328 MLIST [oss-security] 20140217 CVE-2014-0069 -- kernel: cifs: incorrect handling of bogus user pointers during uncached writes BID 65588 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1064253 CONFIRM https://github.com/torvalds/linux/commit/5d81de8e8667da7135d3a32a964087c0faf5483f The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer.

CVE-2014-0070

2014-02-26T20:55:02.993-05:00

2014-02-26T20:55:03.070-05:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

cpe:/a:redhat:openstack:4.0

CVE-2014-0071

2014-04-17T10:55:06.450-04:00

2014-04-17T12:00:04.640-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-04-17T12:00:04.533-04:00

REDHAT RHSA-2014:0233 BID 66001 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1064163 PackStack in Red Hat OpenStack 4.0 does not enforce the default security groups when deployed to Neutron, which allows remote attackers to bypass intended access restrictions and make unauthorized connections.

cpe:/a:apache:cordova:2.6.0::~~~iphone_os~~ cpe:/a:apache:cordova:2.9.0::~~~iphone_os~~ cpe:/a:apache:cordova_file_transfer:0.4.1::~~~iphone_os~~

CVE-2014-0072

2017-10-30T15:29:00.327-04:00

2018-10-09T15:35:24.767-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://d3adend.org/blog/?p=403 FULLDISC 20140304 [CVE-2014-0072] Apache Cordova File-Transfer insecure defaults BUGTRAQ 20140304 [CVE-2014-0072] Apache Cordova File-Transfer insecure defaults XF apache-cordova-cve20140072-weak-security(91561) CONFIRM https://github.com/apache/cordova-plugin-file-transfer/commit/a1d6fc07e8a40c1b2b16f4103c403b30e1089668 MLIST [cordova-dev] 20140304 [CVE-2014-0072] Apache Cordova File-Transfer insecure defaults ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer plugin for iOS from Cordova 2.4.0 through 2.9.0 might allow remote attackers to spoof SSL servers by leveraging a default value of true for the trustAllHosts option.

cpe:/a:apache:cordova:2.6.0::~~~iphone_os~~ cpe:/a:apache:cordova:2.9.0::~~~iphone_os~~ cpe:/a:apache:cordova_in-app-browser:0.3.1::~~~iphone_os~~

CVE-2014-0073

2017-10-30T15:29:00.373-04:00

2018-10-09T15:35:25.283-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC http://d3adend.org/blog/?p=403 FULLDISC 20140304 [CVE-2014-0073] Apache Cordova In-App-Browser privilege escalation BUGTRAQ 20140304 [CVE-2014-0073] Apache Cordova In-App-Browser privilege escalation BID 65959 XF apache-cordova-cve20140073-priv-esc(91560) CONFIRM https://github.com/apache/cordova-plugin-inappbrowser/commit/26702cb0720c5c394b407c23570136c53171fa55 MLIST [cordova-dev] 20140304 [CVE-2014-0073] Apache Cordova In-App-Browser privilege escalation The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute arbitrary JavaScript in the host page and consequently gain privileges via a crafted gap-iab: URI.

cpe:/a:apache:shiro:1.0.0 cpe:/a:apache:shiro:1.1.0 cpe:/a:apache:shiro:1.2.0 cpe:/a:apache:shiro:1.2.1 cpe:/a:apache:shiro:1.2.2

CVE-2014-0074

2014-10-06T10:55:08.063-04:00

2014-10-07T10:16:31.060-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-10-07T10:16:30.827-04:00

REDHAT RHSA-2014:1351 FULLDISC 20140303 [Announce] Apache Shiro 1.2.3 Released - Security Advisory MISC https://issues.apache.org/jira/browse/SHIRO-460 Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.

cpe:/a:apache:tomcat:6 cpe:/a:apache:tomcat:6.0 cpe:/a:apache:tomcat:6.0.0 cpe:/a:apache:tomcat:6.0.0:alpha cpe:/a:apache:tomcat:6.0.1 cpe:/a:apache:tomcat:6.0.1:alpha cpe:/a:apache:tomcat:6.0.2 cpe:/a:apache:tomcat:6.0.2:alpha cpe:/a:apache:tomcat:6.0.2:beta cpe:/a:apache:tomcat:6.0.3 cpe:/a:apache:tomcat:6.0.4 cpe:/a:apache:tomcat:6.0.4:alpha cpe:/a:apache:tomcat:6.0.5 cpe:/a:apache:tomcat:6.0.6 cpe:/a:apache:tomcat:6.0.6:alpha cpe:/a:apache:tomcat:6.0.7 cpe:/a:apache:tomcat:6.0.7:alpha cpe:/a:apache:tomcat:6.0.7:beta cpe:/a:apache:tomcat:6.0.8 cpe:/a:apache:tomcat:6.0.8:alpha cpe:/a:apache:tomcat:6.0.9 cpe:/a:apache:tomcat:6.0.9:beta cpe:/a:apache:tomcat:6.0.10 cpe:/a:apache:tomcat:6.0.11 cpe:/a:apache:tomcat:6.0.12 cpe:/a:apache:tomcat:6.0.13 cpe:/a:apache:tomcat:6.0.14 cpe:/a:apache:tomcat:6.0.15 cpe:/a:apache:tomcat:6.0.16 cpe:/a:apache:tomcat:6.0.17 cpe:/a:apache:tomcat:6.0.18 cpe:/a:apache:tomcat:6.0.19 cpe:/a:apache:tomcat:6.0.20 cpe:/a:apache:tomcat:6.0.24 cpe:/a:apache:tomcat:6.0.26 cpe:/a:apache:tomcat:6.0.27 cpe:/a:apache:tomcat:6.0.28 cpe:/a:apache:tomcat:6.0.29 cpe:/a:apache:tomcat:6.0.30 cpe:/a:apache:tomcat:6.0.31 cpe:/a:apache:tomcat:6.0.32 cpe:/a:apache:tomcat:6.0.33 cpe:/a:apache:tomcat:6.0.35 cpe:/a:apache:tomcat:6.0.36 cpe:/a:apache:tomcat:6.0.37 cpe:/a:apache:tomcat:6.0.39 cpe:/a:apache:tomcat:7.0.0 cpe:/a:apache:tomcat:7.0.0:beta cpe:/a:apache:tomcat:7.0.1 cpe:/a:apache:tomcat:7.0.2 cpe:/a:apache:tomcat:7.0.2:beta cpe:/a:apache:tomcat:7.0.3 cpe:/a:apache:tomcat:7.0.4 cpe:/a:apache:tomcat:7.0.4:beta cpe:/a:apache:tomcat:7.0.5 cpe:/a:apache:tomcat:7.0.6 cpe:/a:apache:tomcat:7.0.7 cpe:/a:apache:tomcat:7.0.8 cpe:/a:apache:tomcat:7.0.9 cpe:/a:apache:tomcat:7.0.10 cpe:/a:apache:tomcat:7.0.11 cpe:/a:apache:tomcat:7.0.12 cpe:/a:apache:tomcat:7.0.13 cpe:/a:apache:tomcat:7.0.14 cpe:/a:apache:tomcat:7.0.15 cpe:/a:apache:tomcat:7.0.16 cpe:/a:apache:tomcat:7.0.17 cpe:/a:apache:tomcat:7.0.18 cpe:/a:apache:tomcat:7.0.19 cpe:/a:apache:tomcat:7.0.20 cpe:/a:apache:tomcat:7.0.21 cpe:/a:apache:tomcat:7.0.22 cpe:/a:apache:tomcat:7.0.23 cpe:/a:apache:tomcat:7.0.24 cpe:/a:apache:tomcat:7.0.25 cpe:/a:apache:tomcat:7.0.26 cpe:/a:apache:tomcat:7.0.27 cpe:/a:apache:tomcat:7.0.28 cpe:/a:apache:tomcat:7.0.29 cpe:/a:apache:tomcat:7.0.30 cpe:/a:apache:tomcat:7.0.31 cpe:/a:apache:tomcat:7.0.32 cpe:/a:apache:tomcat:7.0.33 cpe:/a:apache:tomcat:7.0.34 cpe:/a:apache:tomcat:7.0.35 cpe:/a:apache:tomcat:7.0.36 cpe:/a:apache:tomcat:7.0.37 cpe:/a:apache:tomcat:7.0.38 cpe:/a:apache:tomcat:7.0.39 cpe:/a:apache:tomcat:7.0.40 cpe:/a:apache:tomcat:7.0.41 cpe:/a:apache:tomcat:7.0.42 cpe:/a:apache:tomcat:7.0.43 cpe:/a:apache:tomcat:7.0.44 cpe:/a:apache:tomcat:7.0.45 cpe:/a:apache:tomcat:7.0.46 cpe:/a:apache:tomcat:7.0.47 cpe:/a:apache:tomcat:7.0.48 cpe:/a:apache:tomcat:7.0.49 cpe:/a:apache:tomcat:7.0.50 cpe:/a:apache:tomcat:7.0.52 cpe:/a:apache:tomcat:8.0.0:rc1 cpe:/a:apache:tomcat:8.0.0:rc10 cpe:/a:apache:tomcat:8.0.0:rc2 cpe:/a:apache:tomcat:8.0.0:rc5 cpe:/a:apache:tomcat:8.0.1 cpe:/a:apache:tomcat:8.0.3

CVE-2014-0075

2014-05-31T07:17:13.093-04:00

2019-04-15T12:29:35.773-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://advisories.mageia.org/MGASA-2014-0268.html CONFIRM http://linux.oracle.com/errata/ELSA-2014-0865.html FEDORA FEDORA-2015-2109 HP HPSBUX03102 HP HPSBUX03150 HP HPSBOV03503 REDHAT RHSA-2015:0675 REDHAT RHSA-2015:0720 REDHAT RHSA-2015:0765 FULLDISC 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities SECUNIA 59121 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1578337 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1578341 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1579262 CONFIRM http://tomcat.apache.org/security-6.html CONFIRM http://tomcat.apache.org/security-7.html CONFIRM http://tomcat.apache.org/security-8.html DEBIAN DSA-3447 DEBIAN DSA-3530 MANDRIVA MDVSA-2015:052 MANDRIVA MDVSA-2015:053 MANDRIVA MDVSA-2015:084 CONFIRM http://www.novell.com/support/kb/doc.php?id=7010166 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html BUGTRAQ 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities BID 67671 CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0012.html CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21678231 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21680603 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21681528 CONFIRM https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013 MLIST [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ MLIST [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ MLIST [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ MLIST [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

cpe:/a:openssl:openssl:0.9.1c cpe:/a:openssl:openssl:0.9.2b cpe:/a:openssl:openssl:0.9.3 cpe:/a:openssl:openssl:0.9.3a cpe:/a:openssl:openssl:0.9.4 cpe:/a:openssl:openssl:0.9.5 cpe:/a:openssl:openssl:0.9.5:beta1 cpe:/a:openssl:openssl:0.9.5:beta2 cpe:/a:openssl:openssl:0.9.5a cpe:/a:openssl:openssl:0.9.5a:beta1 cpe:/a:openssl:openssl:0.9.5a:beta2 cpe:/a:openssl:openssl:0.9.6 cpe:/a:openssl:openssl:0.9.6:beta1 cpe:/a:openssl:openssl:0.9.6:beta2 cpe:/a:openssl:openssl:0.9.6:beta3 cpe:/a:openssl:openssl:0.9.6a cpe:/a:openssl:openssl:0.9.6a:beta1 cpe:/a:openssl:openssl:0.9.6a:beta2 cpe:/a:openssl:openssl:0.9.6a:beta3 cpe:/a:openssl:openssl:0.9.6b cpe:/a:openssl:openssl:0.9.6c cpe:/a:openssl:openssl:0.9.6d cpe:/a:openssl:openssl:0.9.6e cpe:/a:openssl:openssl:0.9.6f cpe:/a:openssl:openssl:0.9.6g cpe:/a:openssl:openssl:0.9.6h cpe:/a:openssl:openssl:0.9.6i cpe:/a:openssl:openssl:0.9.6j cpe:/a:openssl:openssl:0.9.6k cpe:/a:openssl:openssl:0.9.6l cpe:/a:openssl:openssl:0.9.6m cpe:/a:openssl:openssl:0.9.7 cpe:/a:openssl:openssl:0.9.7:beta1 cpe:/a:openssl:openssl:0.9.7:beta2 cpe:/a:openssl:openssl:0.9.7:beta3 cpe:/a:openssl:openssl:0.9.7:beta4 cpe:/a:openssl:openssl:0.9.7:beta5 cpe:/a:openssl:openssl:0.9.7:beta6 cpe:/a:openssl:openssl:0.9.7a cpe:/a:openssl:openssl:0.9.7b cpe:/a:openssl:openssl:0.9.7c cpe:/a:openssl:openssl:0.9.7d cpe:/a:openssl:openssl:0.9.7e cpe:/a:openssl:openssl:0.9.7f cpe:/a:openssl:openssl:0.9.7g cpe:/a:openssl:openssl:0.9.7h cpe:/a:openssl:openssl:0.9.7i cpe:/a:openssl:openssl:0.9.7j cpe:/a:openssl:openssl:0.9.7k cpe:/a:openssl:openssl:0.9.7l cpe:/a:openssl:openssl:0.9.7m cpe:/a:openssl:openssl:0.9.8 cpe:/a:openssl:openssl:0.9.8a cpe:/a:openssl:openssl:0.9.8b cpe:/a:openssl:openssl:0.9.8c cpe:/a:openssl:openssl:0.9.8d cpe:/a:openssl:openssl:0.9.8e cpe:/a:openssl:openssl:0.9.8f cpe:/a:openssl:openssl:0.9.8g cpe:/a:openssl:openssl:0.9.8h cpe:/a:openssl:openssl:0.9.8i cpe:/a:openssl:openssl:0.9.8j cpe:/a:openssl:openssl:0.9.8k cpe:/a:openssl:openssl:0.9.8l cpe:/a:openssl:openssl:0.9.8m cpe:/a:openssl:openssl:0.9.8m:beta1 cpe:/a:openssl:openssl:0.9.8n cpe:/a:openssl:openssl:0.9.8o cpe:/a:openssl:openssl:0.9.8p cpe:/a:openssl:openssl:0.9.8q cpe:/a:openssl:openssl:0.9.8r cpe:/a:openssl:openssl:0.9.8s cpe:/a:openssl:openssl:0.9.8t cpe:/a:openssl:openssl:0.9.8u cpe:/a:openssl:openssl:0.9.8v cpe:/a:openssl:openssl:0.9.8w cpe:/a:openssl:openssl:0.9.8x cpe:/a:openssl:openssl:0.9.8y cpe:/a:openssl:openssl:1.0.0 cpe:/a:openssl:openssl:1.0.0:beta1 cpe:/a:openssl:openssl:1.0.0:beta2 cpe:/a:openssl:openssl:1.0.0:beta3 cpe:/a:openssl:openssl:1.0.0:beta4 cpe:/a:openssl:openssl:1.0.0:beta5 cpe:/a:openssl:openssl:1.0.0a cpe:/a:openssl:openssl:1.0.0b cpe:/a:openssl:openssl:1.0.0c cpe:/a:openssl:openssl:1.0.0d cpe:/a:openssl:openssl:1.0.0e cpe:/a:openssl:openssl:1.0.0f cpe:/a:openssl:openssl:1.0.0g cpe:/a:openssl:openssl:1.0.0h cpe:/a:openssl:openssl:1.0.0i cpe:/a:openssl:openssl:1.0.0j cpe:/a:openssl:openssl:1.0.0k cpe:/a:openssl:openssl:1.0.0l

CVE-2014-0076

2014-03-25T09:25:21.977-04:00

2017-12-15T21:29:02.447-05:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://advisories.mageia.org/MGASA-2014-0165.html MISC http://eprint.iacr.org/2014/140 CONFIRM http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=2198be3483259de374f91e57d247d0fc667aef29 CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629 SUSE openSUSE-SU-2016:0640 SUSE openSUSE-SU-2014:0480 HP SSRT101590 HP HPSBOV03047 HP HPSBMU03057 HP HPSBMU03056 HP HPSBMU03051 HP HPSBGN03050 HP HPSBMU03074 HP HPSBMU03062 HP HPSBMU03076 SECUNIA 58492 SECUNIA 59040 SECUNIA 59175 SECUNIA 59264 SECUNIA 59364 SECUNIA 59374 SECUNIA 59445 SECUNIA 59454 CONFIRM http://support.apple.com/kb/HT6443 CISCO 20140605 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products CONFIRM http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htm MANDRIVA MDVSA-2014:067 MANDRIVA MDVSA-2015:062 CONFIRM http://www.novell.com/support/kb/doc.php?id=7015264 CONFIRM http://www.novell.com/support/kb/doc.php?id=7015300 CONFIRM http://www.openssl.org/news/secadv_20140605.txt CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html BID 66363 UBUNTU USN-2165-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=isg400001841 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=isg400001843 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21673137 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676035 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676062 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676092 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676419 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676424 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676501 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676655 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677695 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677828 CONFIRM https://bugs.gentoo.org/show_bug.cgi?id=505278 CONFIRM https://bugzilla.novell.com/show_bug.cgi?id=869945 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946 CONFIRM https://kc.mcafee.com/corporate/index?page=content&id=SB10075 The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attack.

cpe:/o:linux:linux_kernel:3.0:rc1 cpe:/o:linux:linux_kernel:3.0:rc2 cpe:/o:linux:linux_kernel:3.0:rc3 cpe:/o:linux:linux_kernel:3.0:rc4 cpe:/o:linux:linux_kernel:3.0:rc5 cpe:/o:linux:linux_kernel:3.0:rc6 cpe:/o:linux:linux_kernel:3.0:rc7 cpe:/o:linux:linux_kernel:3.0.1 cpe:/o:linux:linux_kernel:3.0.2 cpe:/o:linux:linux_kernel:3.0.3 cpe:/o:linux:linux_kernel:3.0.4 cpe:/o:linux:linux_kernel:3.0.5 cpe:/o:linux:linux_kernel:3.0.6 cpe:/o:linux:linux_kernel:3.0.7 cpe:/o:linux:linux_kernel:3.0.8 cpe:/o:linux:linux_kernel:3.0.9 cpe:/o:linux:linux_kernel:3.0.10 cpe:/o:linux:linux_kernel:3.0.11 cpe:/o:linux:linux_kernel:3.0.12 cpe:/o:linux:linux_kernel:3.0.13 cpe:/o:linux:linux_kernel:3.0.14 cpe:/o:linux:linux_kernel:3.0.15 cpe:/o:linux:linux_kernel:3.0.16 cpe:/o:linux:linux_kernel:3.0.17 cpe:/o:linux:linux_kernel:3.0.18 cpe:/o:linux:linux_kernel:3.0.19 cpe:/o:linux:linux_kernel:3.0.20 cpe:/o:linux:linux_kernel:3.0.21 cpe:/o:linux:linux_kernel:3.0.22 cpe:/o:linux:linux_kernel:3.0.23 cpe:/o:linux:linux_kernel:3.0.24 cpe:/o:linux:linux_kernel:3.0.25 cpe:/o:linux:linux_kernel:3.0.26 cpe:/o:linux:linux_kernel:3.0.27 cpe:/o:linux:linux_kernel:3.0.28 cpe:/o:linux:linux_kernel:3.0.29 cpe:/o:linux:linux_kernel:3.0.30 cpe:/o:linux:linux_kernel:3.0.31 cpe:/o:linux:linux_kernel:3.0.32 cpe:/o:linux:linux_kernel:3.0.33 cpe:/o:linux:linux_kernel:3.0.34 cpe:/o:linux:linux_kernel:3.0.35 cpe:/o:linux:linux_kernel:3.0.36 cpe:/o:linux:linux_kernel:3.0.37 cpe:/o:linux:linux_kernel:3.0.38 cpe:/o:linux:linux_kernel:3.0.39 cpe:/o:linux:linux_kernel:3.0.40 cpe:/o:linux:linux_kernel:3.0.41 cpe:/o:linux:linux_kernel:3.0.42 cpe:/o:linux:linux_kernel:3.0.43 cpe:/o:linux:linux_kernel:3.0.44 cpe:/o:linux:linux_kernel:3.0.45 cpe:/o:linux:linux_kernel:3.0.46 cpe:/o:linux:linux_kernel:3.0.47 cpe:/o:linux:linux_kernel:3.0.48 cpe:/o:linux:linux_kernel:3.0.49 cpe:/o:linux:linux_kernel:3.0.50 cpe:/o:linux:linux_kernel:3.0.51 cpe:/o:linux:linux_kernel:3.0.52 cpe:/o:linux:linux_kernel:3.0.53 cpe:/o:linux:linux_kernel:3.0.54 cpe:/o:linux:linux_kernel:3.0.55 cpe:/o:linux:linux_kernel:3.0.56 cpe:/o:linux:linux_kernel:3.0.57 cpe:/o:linux:linux_kernel:3.0.58 cpe:/o:linux:linux_kernel:3.0.59 cpe:/o:linux:linux_kernel:3.0.60 cpe:/o:linux:linux_kernel:3.0.61 cpe:/o:linux:linux_kernel:3.0.62 cpe:/o:linux:linux_kernel:3.0.63 cpe:/o:linux:linux_kernel:3.0.64 cpe:/o:linux:linux_kernel:3.0.65 cpe:/o:linux:linux_kernel:3.0.66 cpe:/o:linux:linux_kernel:3.0.67 cpe:/o:linux:linux_kernel:3.0.68 cpe:/o:linux:linux_kernel:3.1 cpe:/o:linux:linux_kernel:3.1:rc1 cpe:/o:linux:linux_kernel:3.1:rc2 cpe:/o:linux:linux_kernel:3.1:rc3 cpe:/o:linux:linux_kernel:3.1:rc4 cpe:/o:linux:linux_kernel:3.1.1 cpe:/o:linux:linux_kernel:3.1.2 cpe:/o:linux:linux_kernel:3.1.3 cpe:/o:linux:linux_kernel:3.1.4 cpe:/o:linux:linux_kernel:3.1.5 cpe:/o:linux:linux_kernel:3.1.6 cpe:/o:linux:linux_kernel:3.1.7 cpe:/o:linux:linux_kernel:3.1.8 cpe:/o:linux:linux_kernel:3.1.9 cpe:/o:linux:linux_kernel:3.1.10 cpe:/o:linux:linux_kernel:3.2 cpe:/o:linux:linux_kernel:3.2:rc2 cpe:/o:linux:linux_kernel:3.2:rc3 cpe:/o:linux:linux_kernel:3.2:rc4 cpe:/o:linux:linux_kernel:3.2:rc5 cpe:/o:linux:linux_kernel:3.2:rc6 cpe:/o:linux:linux_kernel:3.2:rc7 cpe:/o:linux:linux_kernel:3.2.1 cpe:/o:linux:linux_kernel:3.2.2 cpe:/o:linux:linux_kernel:3.2.3 cpe:/o:linux:linux_kernel:3.2.4 cpe:/o:linux:linux_kernel:3.2.5 cpe:/o:linux:linux_kernel:3.2.6 cpe:/o:linux:linux_kernel:3.2.7 cpe:/o:linux:linux_kernel:3.2.8 cpe:/o:linux:linux_kernel:3.2.9 cpe:/o:linux:linux_kernel:3.2.10 cpe:/o:linux:linux_kernel:3.2.11 cpe:/o:linux:linux_kernel:3.2.12 cpe:/o:linux:linux_kernel:3.2.13 cpe:/o:linux:linux_kernel:3.2.14 cpe:/o:linux:linux_kernel:3.2.15 cpe:/o:linux:linux_kernel:3.2.16 cpe:/o:linux:linux_kernel:3.2.17 cpe:/o:linux:linux_kernel:3.2.18 cpe:/o:linux:linux_kernel:3.2.19 cpe:/o:linux:linux_kernel:3.2.20 cpe:/o:linux:linux_kernel:3.2.21 cpe:/o:linux:linux_kernel:3.2.22 cpe:/o:linux:linux_kernel:3.2.23 cpe:/o:linux:linux_kernel:3.2.24 cpe:/o:linux:linux_kernel:3.2.25 cpe:/o:linux:linux_kernel:3.2.26 cpe:/o:linux:linux_kernel:3.2.27 cpe:/o:linux:linux_kernel:3.2.28 cpe:/o:linux:linux_kernel:3.2.29 cpe:/o:linux:linux_kernel:3.2.30 cpe:/o:linux:linux_kernel:3.3 cpe:/o:linux:linux_kernel:3.3:rc1 cpe:/o:linux:linux_kernel:3.3:rc2 cpe:/o:linux:linux_kernel:3.3:rc3 cpe:/o:linux:linux_kernel:3.3:rc4 cpe:/o:linux:linux_kernel:3.3:rc5 cpe:/o:linux:linux_kernel:3.3:rc6 cpe:/o:linux:linux_kernel:3.3:rc7 cpe:/o:linux:linux_kernel:3.3.1 cpe:/o:linux:linux_kernel:3.3.2 cpe:/o:linux:linux_kernel:3.3.3 cpe:/o:linux:linux_kernel:3.3.4 cpe:/o:linux:linux_kernel:3.3.5 cpe:/o:linux:linux_kernel:3.3.6 cpe:/o:linux:linux_kernel:3.3.7 cpe:/o:linux:linux_kernel:3.3.8 cpe:/o:linux:linux_kernel:3.4 cpe:/o:linux:linux_kernel:3.4:rc1 cpe:/o:linux:linux_kernel:3.4:rc2 cpe:/o:linux:linux_kernel:3.4:rc3 cpe:/o:linux:linux_kernel:3.4:rc4 cpe:/o:linux:linux_kernel:3.4:rc5 cpe:/o:linux:linux_kernel:3.4:rc6 cpe:/o:linux:linux_kernel:3.4:rc7 cpe:/o:linux:linux_kernel:3.4.1 cpe:/o:linux:linux_kernel:3.4.2 cpe:/o:linux:linux_kernel:3.4.3 cpe:/o:linux:linux_kernel:3.4.4 cpe:/o:linux:linux_kernel:3.4.5 cpe:/o:linux:linux_kernel:3.4.6 cpe:/o:linux:linux_kernel:3.4.7 cpe:/o:linux:linux_kernel:3.4.8 cpe:/o:linux:linux_kernel:3.4.9 cpe:/o:linux:linux_kernel:3.4.10 cpe:/o:linux:linux_kernel:3.4.11 cpe:/o:linux:linux_kernel:3.4.12 cpe:/o:linux:linux_kernel:3.4.13 cpe:/o:linux:linux_kernel:3.4.14 cpe:/o:linux:linux_kernel:3.4.15 cpe:/o:linux:linux_kernel:3.4.16 cpe:/o:linux:linux_kernel:3.4.17 cpe:/o:linux:linux_kernel:3.4.18 cpe:/o:linux:linux_kernel:3.4.19 cpe:/o:linux:linux_kernel:3.4.20 cpe:/o:linux:linux_kernel:3.4.21 cpe:/o:linux:linux_kernel:3.4.22 cpe:/o:linux:linux_kernel:3.4.23 cpe:/o:linux:linux_kernel:3.4.24 cpe:/o:linux:linux_kernel:3.4.25 cpe:/o:linux:linux_kernel:3.4.26 cpe:/o:linux:linux_kernel:3.4.27 cpe:/o:linux:linux_kernel:3.4.28 cpe:/o:linux:linux_kernel:3.4.29 cpe:/o:linux:linux_kernel:3.4.30 cpe:/o:linux:linux_kernel:3.4.31 cpe:/o:linux:linux_kernel:3.4.32 cpe:/o:linux:linux_kernel:3.4.33 cpe:/o:linux:linux_kernel:3.4.34 cpe:/o:linux:linux_kernel:3.4.35 cpe:/o:linux:linux_kernel:3.4.36 cpe:/o:linux:linux_kernel:3.4.37 cpe:/o:linux:linux_kernel:3.4.38 cpe:/o:linux:linux_kernel:3.4.39 cpe:/o:linux:linux_kernel:3.4.40 cpe:/o:linux:linux_kernel:3.4.41 cpe:/o:linux:linux_kernel:3.4.42 cpe:/o:linux:linux_kernel:3.4.43 cpe:/o:linux:linux_kernel:3.4.44 cpe:/o:linux:linux_kernel:3.4.45 cpe:/o:linux:linux_kernel:3.4.46 cpe:/o:linux:linux_kernel:3.4.47 cpe:/o:linux:linux_kernel:3.4.48 cpe:/o:linux:linux_kernel:3.4.49 cpe:/o:linux:linux_kernel:3.4.50 cpe:/o:linux:linux_kernel:3.4.51 cpe:/o:linux:linux_kernel:3.4.52 cpe:/o:linux:linux_kernel:3.4.53 cpe:/o:linux:linux_kernel:3.4.54 cpe:/o:linux:linux_kernel:3.4.55 cpe:/o:linux:linux_kernel:3.4.56 cpe:/o:linux:linux_kernel:3.4.57 cpe:/o:linux:linux_kernel:3.4.58 cpe:/o:linux:linux_kernel:3.4.59 cpe:/o:linux:linux_kernel:3.4.60 cpe:/o:linux:linux_kernel:3.4.61 cpe:/o:linux:linux_kernel:3.4.62 cpe:/o:linux:linux_kernel:3.4.63 cpe:/o:linux:linux_kernel:3.4.64 cpe:/o:linux:linux_kernel:3.4.65 cpe:/o:linux:linux_kernel:3.4.66 cpe:/o:linux:linux_kernel:3.4.67 cpe:/o:linux:linux_kernel:3.4.68 cpe:/o:linux:linux_kernel:3.4.69 cpe:/o:linux:linux_kernel:3.4.70 cpe:/o:linux:linux_kernel:3.4.71 cpe:/o:linux:linux_kernel:3.4.72 cpe:/o:linux:linux_kernel:3.4.73 cpe:/o:linux:linux_kernel:3.4.74 cpe:/o:linux:linux_kernel:3.4.75 cpe:/o:linux:linux_kernel:3.4.76 cpe:/o:linux:linux_kernel:3.4.77 cpe:/o:linux:linux_kernel:3.4.78 cpe:/o:linux:linux_kernel:3.4.79 cpe:/o:linux:linux_kernel:3.5.1 cpe:/o:linux:linux_kernel:3.5.2 cpe:/o:linux:linux_kernel:3.5.3 cpe:/o:linux:linux_kernel:3.5.4 cpe:/o:linux:linux_kernel:3.5.5 cpe:/o:linux:linux_kernel:3.5.6 cpe:/o:linux:linux_kernel:3.5.7 cpe:/o:linux:linux_kernel:3.6 cpe:/o:linux:linux_kernel:3.6.1 cpe:/o:linux:linux_kernel:3.6.2 cpe:/o:linux:linux_kernel:3.6.3 cpe:/o:linux:linux_kernel:3.6.4 cpe:/o:linux:linux_kernel:3.6.5 cpe:/o:linux:linux_kernel:3.6.6 cpe:/o:linux:linux_kernel:3.6.7 cpe:/o:linux:linux_kernel:3.6.8 cpe:/o:linux:linux_kernel:3.6.9 cpe:/o:linux:linux_kernel:3.6.10 cpe:/o:linux:linux_kernel:3.6.11 cpe:/o:linux:linux_kernel:3.7 cpe:/o:linux:linux_kernel:3.7.1 cpe:/o:linux:linux_kernel:3.7.2 cpe:/o:linux:linux_kernel:3.7.3 cpe:/o:linux:linux_kernel:3.7.4 cpe:/o:linux:linux_kernel:3.7.5 cpe:/o:linux:linux_kernel:3.7.6 cpe:/o:linux:linux_kernel:3.7.7 cpe:/o:linux:linux_kernel:3.7.8 cpe:/o:linux:linux_kernel:3.7.9 cpe:/o:linux:linux_kernel:3.7.10 cpe:/o:linux:linux_kernel:3.8.0 cpe:/o:linux:linux_kernel:3.8.1 cpe:/o:linux:linux_kernel:3.8.2 cpe:/o:linux:linux_kernel:3.8.3 cpe:/o:linux:linux_kernel:3.8.4 cpe:/o:linux:linux_kernel:3.8.5 cpe:/o:linux:linux_kernel:3.8.6 cpe:/o:linux:linux_kernel:3.8.7 cpe:/o:linux:linux_kernel:3.8.8 cpe:/o:linux:linux_kernel:3.8.9 cpe:/o:linux:linux_kernel:3.8.10 cpe:/o:linux:linux_kernel:3.8.11 cpe:/o:linux:linux_kernel:3.8.12 cpe:/o:linux:linux_kernel:3.8.13 cpe:/o:linux:linux_kernel:3.9:rc1 cpe:/o:linux:linux_kernel:3.9:rc2 cpe:/o:linux:linux_kernel:3.9:rc3 cpe:/o:linux:linux_kernel:3.9:rc4 cpe:/o:linux:linux_kernel:3.9:rc5 cpe:/o:linux:linux_kernel:3.9:rc6 cpe:/o:linux:linux_kernel:3.9:rc7 cpe:/o:linux:linux_kernel:3.9.0 cpe:/o:linux:linux_kernel:3.9.1 cpe:/o:linux:linux_kernel:3.9.2 cpe:/o:linux:linux_kernel:3.9.3 cpe:/o:linux:linux_kernel:3.9.4 cpe:/o:linux:linux_kernel:3.9.5 cpe:/o:linux:linux_kernel:3.9.6 cpe:/o:linux:linux_kernel:3.9.7 cpe:/o:linux:linux_kernel:3.9.8 cpe:/o:linux:linux_kernel:3.9.9 cpe:/o:linux:linux_kernel:3.9.10 cpe:/o:linux:linux_kernel:3.9.11 cpe:/o:linux:linux_kernel:3.10 cpe:/o:linux:linux_kernel:3.10.1 cpe:/o:linux:linux_kernel:3.10.2 cpe:/o:linux:linux_kernel:3.10.3 cpe:/o:linux:linux_kernel:3.10.4 cpe:/o:linux:linux_kernel:3.10.5 cpe:/o:linux:linux_kernel:3.10.6 cpe:/o:linux:linux_kernel:3.10.7 cpe:/o:linux:linux_kernel:3.10.8 cpe:/o:linux:linux_kernel:3.10.9 cpe:/o:linux:linux_kernel:3.10.10 cpe:/o:linux:linux_kernel:3.10.11 cpe:/o:linux:linux_kernel:3.10.12 cpe:/o:linux:linux_kernel:3.10.13 cpe:/o:linux:linux_kernel:3.10.14 cpe:/o:linux:linux_kernel:3.10.15 cpe:/o:linux:linux_kernel:3.10.16 cpe:/o:linux:linux_kernel:3.10.17 cpe:/o:linux:linux_kernel:3.10.18 cpe:/o:linux:linux_kernel:3.10.19 cpe:/o:linux:linux_kernel:3.10.20 cpe:/o:linux:linux_kernel:3.10.21 cpe:/o:linux:linux_kernel:3.10.22 cpe:/o:linux:linux_kernel:3.10.23 cpe:/o:linux:linux_kernel:3.10.24 cpe:/o:linux:linux_kernel:3.10.25 cpe:/o:linux:linux_kernel:3.10.26 cpe:/o:linux:linux_kernel:3.10.27 cpe:/o:linux:linux_kernel:3.10.28 cpe:/o:linux:linux_kernel:3.10.29 cpe:/o:linux:linux_kernel:3.11 cpe:/o:linux:linux_kernel:3.11.1 cpe:/o:linux:linux_kernel:3.11.2 cpe:/o:linux:linux_kernel:3.11.3 cpe:/o:linux:linux_kernel:3.11.4 cpe:/o:linux:linux_kernel:3.11.5 cpe:/o:linux:linux_kernel:3.11.6 cpe:/o:linux:linux_kernel:3.11.7 cpe:/o:linux:linux_kernel:3.11.8 cpe:/o:linux:linux_kernel:3.11.9 cpe:/o:linux:linux_kernel:3.11.10 cpe:/o:linux:linux_kernel:3.12 cpe:/o:linux:linux_kernel:3.12.1 cpe:/o:linux:linux_kernel:3.12.2 cpe:/o:linux:linux_kernel:3.12.3 cpe:/o:linux:linux_kernel:3.12.4 cpe:/o:linux:linux_kernel:3.12.5 cpe:/o:linux:linux_kernel:3.12.6 cpe:/o:linux:linux_kernel:3.12.7 cpe:/o:linux:linux_kernel:3.12.8 cpe:/o:linux:linux_kernel:3.12.9 cpe:/o:linux:linux_kernel:3.12.10 cpe:/o:linux:linux_kernel:3.12.11 cpe:/o:linux:linux_kernel:3.12.12 cpe:/o:linux:linux_kernel:3.12.13 cpe:/o:linux:linux_kernel:3.12.14 cpe:/o:linux:linux_kernel:3.12.15 cpe:/o:linux:linux_kernel:3.12.16 cpe:/o:linux:linux_kernel:3.12.17 cpe:/o:linux:linux_kernel:3.13 cpe:/o:linux:linux_kernel:3.13.1 cpe:/o:linux:linux_kernel:3.13.2 cpe:/o:linux:linux_kernel:3.13.3 cpe:/o:linux:linux_kernel:3.13.4 cpe:/o:linux:linux_kernel:3.13.5 cpe:/o:linux:linux_kernel:3.13.6 cpe:/o:linux:linux_kernel:3.13.7 cpe:/o:linux:linux_kernel:3.13.8 cpe:/o:linux:linux_kernel:3.13.9

CVE-2014-0077

2014-04-14T19:55:07.530-04:00

2017-01-06T21:59:15.997-05:00

5.5

ADJACENT_NETWORK

HIGH

SINGLE_INSTANCE

PARTIAL

COMPLETE

http://nvd.nist.gov CONFIRM http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d8316f3991d207fe32881a9ac20241be8fa2bad0 CONFIRM http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.10 BID 66678 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1064440 CONFIRM https://github.com/torvalds/linux/commit/d8316f3991d207fe32881a9ac20241be8fa2bad0 drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions.

CVE-2014-0078

2014-05-14T15:55:10.687-04:00

2014-05-15T15:49:57.840-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2014-05-15T11:09:58.547-04:00

REDHAT RHSA-2014:0469 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1064556 The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to delete arbitrary catalogs via vectors involving guessing the catalog ID.

CVE-2014-0079

2014-04-28T10:09:06.157-04:00

2014-04-29T07:52:00.900-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-04-29T07:52:00.807-04:00

MANDRIVA MDVSA-2014:044 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1059903 The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and earlier, when using certain build conditions, allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the password."

cpe:/a:rubyonrails:rails:4.0.0:- cpe:/a:rubyonrails:rails:4.0.0:beta cpe:/a:rubyonrails:rails:4.0.0:rc1 cpe:/a:rubyonrails:rails:4.0.0:rc2 cpe:/a:rubyonrails:rails:4.0.1:- cpe:/a:rubyonrails:rails:4.0.1:rc1 cpe:/a:rubyonrails:rails:4.0.1:rc2 cpe:/a:rubyonrails:rails:4.0.1:rc3 cpe:/a:rubyonrails:rails:4.0.1:rc4 cpe:/a:rubyonrails:rails:4.0.2 cpe:/a:rubyonrails:rails:4.1.0:beta1

CVE-2014-0080

2014-02-20T10:27:02.750-05:00

2019-08-08T11:26:56.363-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2014-02-20T07:47:10.000-05:00

MLIST [oss-security] 20140218 Data Injection Vulnerability in Active Record (CVE-2014-0080) MLIST [rubyonrails-security] 20140218 Data Injection Vulnerability in Active Record (CVE-2014-0080) SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns.

cpe:/a:redhat:cloudforms:3.0 cpe:/a:rubyonrails:rails:0.9.1 cpe:/a:rubyonrails:rails:0.9.2 cpe:/a:rubyonrails:rails:0.9.3 cpe:/a:rubyonrails:rails:0.9.4 cpe:/a:rubyonrails:rails:0.9.4.1 cpe:/a:rubyonrails:rails:0.10.0 cpe:/a:rubyonrails:rails:0.10.1 cpe:/a:rubyonrails:rails:0.11.0 cpe:/a:rubyonrails:rails:0.11.1 cpe:/a:rubyonrails:rails:0.12.0 cpe:/a:rubyonrails:rails:0.12.1 cpe:/a:rubyonrails:rails:0.13.0 cpe:/a:rubyonrails:rails:0.13.1 cpe:/a:rubyonrails:rails:0.14.1 cpe:/a:rubyonrails:rails:0.14.2 cpe:/a:rubyonrails:rails:0.14.3 cpe:/a:rubyonrails:rails:0.14.4 cpe:/a:rubyonrails:rails:1.0.0 cpe:/a:rubyonrails:rails:1.1.0 cpe:/a:rubyonrails:rails:1.1.1 cpe:/a:rubyonrails:rails:1.1.2 cpe:/a:rubyonrails:rails:1.1.3 cpe:/a:rubyonrails:rails:1.1.4 cpe:/a:rubyonrails:rails:1.1.5 cpe:/a:rubyonrails:rails:1.1.6 cpe:/a:rubyonrails:rails:1.2.0 cpe:/a:rubyonrails:rails:1.2.1 cpe:/a:rubyonrails:rails:1.2.2 cpe:/a:rubyonrails:rails:1.2.3 cpe:/a:rubyonrails:rails:1.2.4 cpe:/a:rubyonrails:rails:1.2.5 cpe:/a:rubyonrails:rails:1.2.6 cpe:/a:rubyonrails:rails:1.9.5 cpe:/a:rubyonrails:rails:2.0.0 cpe:/a:rubyonrails:rails:2.0.0:rc1 cpe:/a:rubyonrails:rails:2.0.0:rc2 cpe:/a:rubyonrails:rails:2.0.1 cpe:/a:rubyonrails:rails:2.0.2 cpe:/a:rubyonrails:rails:2.0.4 cpe:/a:rubyonrails:rails:2.1.0 cpe:/a:rubyonrails:rails:2.1.1 cpe:/a:rubyonrails:rails:2.1.2 cpe:/a:rubyonrails:rails:2.2.0 cpe:/a:rubyonrails:rails:2.2.1 cpe:/a:rubyonrails:rails:2.2.2 cpe:/a:rubyonrails:rails:2.3.0 cpe:/a:rubyonrails:rails:2.3.1 cpe:/a:rubyonrails:rails:2.3.2 cpe:/a:rubyonrails:rails:2.3.3 cpe:/a:rubyonrails:rails:2.3.4 cpe:/a:rubyonrails:rails:2.3.9 cpe:/a:rubyonrails:rails:2.3.10 cpe:/a:rubyonrails:rails:2.3.11 cpe:/a:rubyonrails:rails:2.3.12 cpe:/a:rubyonrails:rails:2.3.13 cpe:/a:rubyonrails:rails:2.3.14 cpe:/a:rubyonrails:rails:2.3.15 cpe:/a:rubyonrails:rails:2.3.16 cpe:/a:rubyonrails:rails:3.0.0 cpe:/a:rubyonrails:rails:3.0.0:beta cpe:/a:rubyonrails:rails:3.0.0:beta2 cpe:/a:rubyonrails:rails:3.0.0:beta3 cpe:/a:rubyonrails:rails:3.0.0:beta4 cpe:/a:rubyonrails:rails:3.0.0:rc cpe:/a:rubyonrails:rails:3.0.0:rc2 cpe:/a:rubyonrails:rails:3.0.1 cpe:/a:rubyonrails:rails:3.0.1:pre cpe:/a:rubyonrails:rails:3.0.2 cpe:/a:rubyonrails:rails:3.0.2:pre cpe:/a:rubyonrails:rails:3.0.3 cpe:/a:rubyonrails:rails:3.0.4:rc1 cpe:/a:rubyonrails:rails:3.0.5 cpe:/a:rubyonrails:rails:3.0.5:rc1 cpe:/a:rubyonrails:rails:3.0.6 cpe:/a:rubyonrails:rails:3.0.6:rc1 cpe:/a:rubyonrails:rails:3.0.6:rc2 cpe:/a:rubyonrails:rails:3.0.7 cpe:/a:rubyonrails:rails:3.0.7:rc1 cpe:/a:rubyonrails:rails:3.0.7:rc2 cpe:/a:rubyonrails:rails:3.0.8 cpe:/a:rubyonrails:rails:3.0.8:rc1 cpe:/a:rubyonrails:rails:3.0.8:rc2 cpe:/a:rubyonrails:rails:3.0.8:rc3 cpe:/a:rubyonrails:rails:3.0.8:rc4 cpe:/a:rubyonrails:rails:3.0.9 cpe:/a:rubyonrails:rails:3.0.9:rc1 cpe:/a:rubyonrails:rails:3.0.9:rc2 cpe:/a:rubyonrails:rails:3.0.9:rc3 cpe:/a:rubyonrails:rails:3.0.9:rc4 cpe:/a:rubyonrails:rails:3.0.9:rc5 cpe:/a:rubyonrails:rails:3.0.10 cpe:/a:rubyonrails:rails:3.0.10:rc1 cpe:/a:rubyonrails:rails:3.0.11 cpe:/a:rubyonrails:rails:3.0.12 cpe:/a:rubyonrails:rails:3.0.12:rc1 cpe:/a:rubyonrails:rails:3.0.13 cpe:/a:rubyonrails:rails:3.0.13:rc1 cpe:/a:rubyonrails:rails:3.0.14 cpe:/a:rubyonrails:rails:3.0.16 cpe:/a:rubyonrails:rails:3.0.17 cpe:/a:rubyonrails:rails:3.0.18 cpe:/a:rubyonrails:rails:3.0.19 cpe:/a:rubyonrails:rails:3.0.20 cpe:/a:rubyonrails:rails:3.1.0 cpe:/a:rubyonrails:rails:3.1.0:beta1 cpe:/a:rubyonrails:rails:3.1.0:rc1 cpe:/a:rubyonrails:rails:3.1.0:rc2 cpe:/a:rubyonrails:rails:3.1.0:rc3 cpe:/a:rubyonrails:rails:3.1.0:rc4 cpe:/a:rubyonrails:rails:3.1.0:rc5 cpe:/a:rubyonrails:rails:3.1.0:rc6 cpe:/a:rubyonrails:rails:3.1.0:rc7 cpe:/a:rubyonrails:rails:3.1.0:rc8 cpe:/a:rubyonrails:rails:3.1.1 cpe:/a:rubyonrails:rails:3.1.1:rc1 cpe:/a:rubyonrails:rails:3.1.1:rc2 cpe:/a:rubyonrails:rails:3.1.1:rc3 cpe:/a:rubyonrails:rails:3.1.2 cpe:/a:rubyonrails:rails:3.1.2:rc1 cpe:/a:rubyonrails:rails:3.1.2:rc2 cpe:/a:rubyonrails:rails:3.1.3 cpe:/a:rubyonrails:rails:3.1.4 cpe:/a:rubyonrails:rails:3.1.4:rc1 cpe:/a:rubyonrails:rails:3.1.5 cpe:/a:rubyonrails:rails:3.1.5:rc1 cpe:/a:rubyonrails:rails:3.1.6 cpe:/a:rubyonrails:rails:3.1.7 cpe:/a:rubyonrails:rails:3.1.8 cpe:/a:rubyonrails:rails:3.1.9 cpe:/a:rubyonrails:rails:3.1.10 cpe:/a:rubyonrails:rails:3.2.0 cpe:/a:rubyonrails:rails:3.2.0:rc1 cpe:/a:rubyonrails:rails:3.2.0:rc2 cpe:/a:rubyonrails:rails:3.2.1 cpe:/a:rubyonrails:rails:3.2.2 cpe:/a:rubyonrails:rails:3.2.2:rc1 cpe:/a:rubyonrails:rails:3.2.3 cpe:/a:rubyonrails:rails:3.2.3:rc1 cpe:/a:rubyonrails:rails:3.2.3:rc2 cpe:/a:rubyonrails:rails:3.2.4 cpe:/a:rubyonrails:rails:3.2.4:rc1 cpe:/a:rubyonrails:rails:3.2.5 cpe:/a:rubyonrails:rails:3.2.6 cpe:/a:rubyonrails:rails:3.2.7 cpe:/a:rubyonrails:rails:3.2.8 cpe:/a:rubyonrails:rails:3.2.9 cpe:/a:rubyonrails:rails:3.2.10 cpe:/a:rubyonrails:rails:3.2.11 cpe:/a:rubyonrails:rails:3.2.12 cpe:/a:rubyonrails:rails:3.2.13 cpe:/a:rubyonrails:rails:3.2.13:rc1 cpe:/a:rubyonrails:rails:3.2.13:rc2 cpe:/a:rubyonrails:rails:3.2.15 cpe:/a:rubyonrails:rails:3.2.15:rc3 cpe:/a:rubyonrails:rails:4.0.0:- cpe:/a:rubyonrails:rails:4.0.0:beta cpe:/a:rubyonrails:rails:4.0.0:rc1 cpe:/a:rubyonrails:rails:4.0.0:rc2 cpe:/a:rubyonrails:rails:4.0.1:- cpe:/a:rubyonrails:rails:4.0.1:rc1 cpe:/a:rubyonrails:rails:4.0.1:rc2 cpe:/a:rubyonrails:rails:4.0.1:rc3 cpe:/a:rubyonrails:rails:4.0.1:rc4 cpe:/a:rubyonrails:rails:4.0.2 cpe:/a:rubyonrails:rails:4.1.0:beta1 cpe:/a:rubyonrails:ruby_on_rails:0.5.0 cpe:/a:rubyonrails:ruby_on_rails:0.5.5 cpe:/a:rubyonrails:ruby_on_rails:0.5.6 cpe:/a:rubyonrails:ruby_on_rails:0.5.7 cpe:/a:rubyonrails:ruby_on_rails:0.6.0 cpe:/a:rubyonrails:ruby_on_rails:0.6.5 cpe:/a:rubyonrails:ruby_on_rails:0.7.0 cpe:/a:rubyonrails:ruby_on_rails:0.8.0 cpe:/a:rubyonrails:ruby_on_rails:0.8.5 cpe:/a:rubyonrails:ruby_on_rails:0.9.0 cpe:/a:rubyonrails:ruby_on_rails:3.0.4 cpe:/a:rubyonrails:ruby_on_rails:3.2.14 cpe:/a:rubyonrails:ruby_on_rails:3.2.14:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.2.14:rc2 cpe:/a:rubyonrails:ruby_on_rails:3.2.15:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.2.15:rc2 cpe:/a:rubyonrails:ruby_on_rails:3.2.16 cpe:/o:opensuse:opensuse:13.1 cpe:/o:opensuse_project:opensuse:12.3 cpe:/o:redhat:enterprise_linux:6.0

CVE-2014-0081

2014-02-20T10:27:09.140-05:00

2019-08-08T11:42:45.623-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-11-17T13:37:39.387-05:00

SUSE openSUSE-SU-2014:0295 MLIST [oss-security] 20140218 XSS Vulnerability in number_to_currency, number_to_percentage and number_to_human (CVE-2014-0081) REDHAT RHSA-2014:0215 REDHAT RHSA-2014:0306 BID 65647 SECTRACK 1029782 MLIST [rubyonrails-security] 20140218 XSS Vulnerability in number_to_currency, number_to_percentage and number_to_human (CVE-2014-0081) Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.

cpe:/a:rubyonrails:rails:3.0.0 cpe:/a:rubyonrails:rails:3.0.0:beta cpe:/a:rubyonrails:rails:3.0.0:beta2 cpe:/a:rubyonrails:rails:3.0.0:beta3 cpe:/a:rubyonrails:rails:3.0.0:beta4 cpe:/a:rubyonrails:rails:3.0.0:rc cpe:/a:rubyonrails:rails:3.0.0:rc2 cpe:/a:rubyonrails:rails:3.0.1 cpe:/a:rubyonrails:rails:3.0.1:pre cpe:/a:rubyonrails:rails:3.0.2 cpe:/a:rubyonrails:rails:3.0.2:pre cpe:/a:rubyonrails:rails:3.0.3 cpe:/a:rubyonrails:rails:3.0.4:rc1 cpe:/a:rubyonrails:rails:3.0.5 cpe:/a:rubyonrails:rails:3.0.5:rc1 cpe:/a:rubyonrails:rails:3.0.6 cpe:/a:rubyonrails:rails:3.0.6:rc1 cpe:/a:rubyonrails:rails:3.0.6:rc2 cpe:/a:rubyonrails:rails:3.0.7 cpe:/a:rubyonrails:rails:3.0.7:rc1 cpe:/a:rubyonrails:rails:3.0.7:rc2 cpe:/a:rubyonrails:rails:3.0.8 cpe:/a:rubyonrails:rails:3.0.8:rc1 cpe:/a:rubyonrails:rails:3.0.8:rc2 cpe:/a:rubyonrails:rails:3.0.8:rc3 cpe:/a:rubyonrails:rails:3.0.8:rc4 cpe:/a:rubyonrails:rails:3.0.9 cpe:/a:rubyonrails:rails:3.0.9:rc1 cpe:/a:rubyonrails:rails:3.0.9:rc2 cpe:/a:rubyonrails:rails:3.0.9:rc3 cpe:/a:rubyonrails:rails:3.0.9:rc4 cpe:/a:rubyonrails:rails:3.0.9:rc5 cpe:/a:rubyonrails:rails:3.0.10 cpe:/a:rubyonrails:rails:3.0.10:rc1 cpe:/a:rubyonrails:rails:3.0.11 cpe:/a:rubyonrails:rails:3.0.12 cpe:/a:rubyonrails:rails:3.0.12:rc1 cpe:/a:rubyonrails:rails:3.0.13 cpe:/a:rubyonrails:rails:3.0.13:rc1 cpe:/a:rubyonrails:rails:3.0.14 cpe:/a:rubyonrails:rails:3.0.16 cpe:/a:rubyonrails:rails:3.0.17 cpe:/a:rubyonrails:rails:3.0.18 cpe:/a:rubyonrails:rails:3.0.19 cpe:/a:rubyonrails:rails:3.0.20 cpe:/a:rubyonrails:rails:3.1.0 cpe:/a:rubyonrails:rails:3.1.0:beta1 cpe:/a:rubyonrails:rails:3.1.0:rc1 cpe:/a:rubyonrails:rails:3.1.0:rc2 cpe:/a:rubyonrails:rails:3.1.0:rc3 cpe:/a:rubyonrails:rails:3.1.0:rc4 cpe:/a:rubyonrails:rails:3.1.0:rc5 cpe:/a:rubyonrails:rails:3.1.0:rc6 cpe:/a:rubyonrails:rails:3.1.0:rc7 cpe:/a:rubyonrails:rails:3.1.0:rc8 cpe:/a:rubyonrails:rails:3.1.1 cpe:/a:rubyonrails:rails:3.1.1:rc1 cpe:/a:rubyonrails:rails:3.1.1:rc2 cpe:/a:rubyonrails:rails:3.1.1:rc3 cpe:/a:rubyonrails:rails:3.1.2 cpe:/a:rubyonrails:rails:3.1.2:rc1 cpe:/a:rubyonrails:rails:3.1.2:rc2 cpe:/a:rubyonrails:rails:3.1.3 cpe:/a:rubyonrails:rails:3.1.4 cpe:/a:rubyonrails:rails:3.1.4:rc1 cpe:/a:rubyonrails:rails:3.1.5 cpe:/a:rubyonrails:rails:3.1.5:rc1 cpe:/a:rubyonrails:rails:3.1.6 cpe:/a:rubyonrails:rails:3.1.7 cpe:/a:rubyonrails:rails:3.1.8 cpe:/a:rubyonrails:rails:3.1.9 cpe:/a:rubyonrails:rails:3.1.10 cpe:/a:rubyonrails:rails:3.2.0 cpe:/a:rubyonrails:rails:3.2.0:rc1 cpe:/a:rubyonrails:rails:3.2.0:rc2 cpe:/a:rubyonrails:rails:3.2.1 cpe:/a:rubyonrails:rails:3.2.2 cpe:/a:rubyonrails:rails:3.2.2:rc1 cpe:/a:rubyonrails:rails:3.2.3 cpe:/a:rubyonrails:rails:3.2.3:rc1 cpe:/a:rubyonrails:rails:3.2.3:rc2 cpe:/a:rubyonrails:rails:3.2.4 cpe:/a:rubyonrails:rails:3.2.4:rc1 cpe:/a:rubyonrails:rails:3.2.5 cpe:/a:rubyonrails:rails:3.2.6 cpe:/a:rubyonrails:rails:3.2.7 cpe:/a:rubyonrails:rails:3.2.8 cpe:/a:rubyonrails:rails:3.2.9 cpe:/a:rubyonrails:rails:3.2.10 cpe:/a:rubyonrails:rails:3.2.11 cpe:/a:rubyonrails:rails:3.2.12 cpe:/a:rubyonrails:rails:3.2.13 cpe:/a:rubyonrails:rails:3.2.13:rc1 cpe:/a:rubyonrails:rails:3.2.13:rc2 cpe:/a:rubyonrails:rails:3.2.15 cpe:/a:rubyonrails:rails:3.2.15:rc3 cpe:/a:rubyonrails:ruby_on_rails:3.0.4 cpe:/a:rubyonrails:ruby_on_rails:3.2.14 cpe:/a:rubyonrails:ruby_on_rails:3.2.14:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.2.14:rc2 cpe:/a:rubyonrails:ruby_on_rails:3.2.15:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.2.15:rc2 cpe:/a:rubyonrails:ruby_on_rails:3.2.16

CVE-2014-0082

2014-02-20T10:27:09.170-05:00

2019-08-08T11:42:45.623-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2014:0295 MLIST [oss-security] 20140218 Denial of Service Vulnerability in Action View when using render :text (CVE-2014-0082) REDHAT RHSA-2014:0215 REDHAT RHSA-2014:0306 CONFIRM http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/ MLIST [rubyonrails-security] 20140218 Denial of Service Vulnerability in Action View when using render :text (CVE-2014-0082) CONFIRM https://puppet.com/security/cve/cve-2014-0082 actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.

cpe:/a:redhat:jboss_a-mq:6.0.0 cpe:/a:redhat:jboss_fuse:6.0.0

CVE-2014-0085

2014-04-17T10:55:06.467-04:00

2018-10-23T09:57:03.313-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-10-23T09:54:59.123-04:00

CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0085 JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. Note: this description has been updated; previous text mistakenly identified the source of the flaw as Zookeeper. Previous text: Apache Zookeeper logs cleartext admin passwords, which allows local users to obtain sensitive information by reading the log.

cpe:/a:redhat:jboss_web_framework_kit:2.5.0 cpe:/a:redhat:richfaces:4.3.4 cpe:/a:redhat:richfaces:4.3.5 cpe:/a:redhat:richfaces:5.0.0:alpha1 cpe:/a:redhat:richfaces:5.0.0:alpha2 cpe:/a:redhat:richfaces:5.0.0:alpha3

CVE-2014-0086

2014-03-31T10:58:19.587-04:00

2017-12-15T21:29:02.637-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2014:0335 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1067268 CONFIRM https://github.com/pslegr/core-1/commit/8131f15003f5bec73d475d2b724472e4b87d0757 CONFIRM https://issues.jboss.org/browse/RF-13250 The doFilter function in webapp/PushHandlerFilter.java in JBoss RichFaces 4.3.4, 4.3.5, and 5.x allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a large number of malformed atmosphere push requests.

cpe:/a:redhat:cloudforms_management_engine:- cpe:/a:redhat:cloudforms_management_engine:2.0 cpe:/a:redhat:cloudforms_management_engine:4.1 cpe:/a:redhat:cloudforms_management_engine:5.0 cpe:/a:redhat:cloudforms_management_engine:5.1 cpe:/a:redhat:cloudforms_management_engine:5.2

CVE-2014-0087

2018-01-11T11:29:00.297-05:00

2018-12-18T12:28:16.367-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2018-11-13T12:08:08.110-05:00

CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1067623 MISC https://github.com/ManageIQ/manageiq/issues/1581 The check_privileges method in vmdb/app/controllers/application_controller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine (CFME), allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbac_user_edit action.

cpe:/a:nginx:nginx:1.5.10

CVE-2014-0088

2014-04-29T10:38:49.920-04:00

2018-10-30T12:26:29.920-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-04-30T10:10:30.257-04:00

MLIST [nginx-announce] 20140304 nginx security advisory (CVE-2014-0088) SECTRACK 1030150 The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11, when running on a 32-bit platform, allows remote attackers to execute arbitrary code via a crafted request.

cpe:/a:theforeman:foreman:1.4.0 cpe:/a:theforeman:foreman:1.4.1

CVE-2014-0089

2014-03-27T12:55:05.660-04:00

2014-03-27T14:59:21.333-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-03-27T14:59:21.240-04:00

CONFIRM http://projects.theforeman.org/issues/4456 CONFIRM http://theforeman.org/security.html MISC https://bugzilla.redhat.com/show_bug.cgi?id=1071741 Cross-site scripting (XSS) vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before 1.4.2 allows remote authenticated users to inject arbitrary web script or HTML via the bookmark name when adding a bookmark.

cpe:/a:theforeman:foreman:1.0 cpe:/a:theforeman:foreman:1.1 cpe:/a:theforeman:foreman:1.2.0 cpe:/a:theforeman:foreman:1.2.0:rc1 cpe:/a:theforeman:foreman:1.2.0:rc2 cpe:/a:theforeman:foreman:1.2.1 cpe:/a:theforeman:foreman:1.2.2 cpe:/a:theforeman:foreman:1.2.3 cpe:/a:theforeman:foreman:1.4.0 cpe:/a:theforeman:foreman:1.4.1

CVE-2014-0090

2014-05-08T10:29:12.813-04:00

2014-05-09T10:50:06.077-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2014-05-09T10:50:05.843-04:00

CONFIRM http://projects.theforeman.org/issues/4457 CONFIRM http://theforeman.org/security.html CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1072151 Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie.

cpe:/a:gnu:gnutls:3.1.0 cpe:/a:gnu:gnutls:3.1.1 cpe:/a:gnu:gnutls:3.1.2 cpe:/a:gnu:gnutls:3.1.3 cpe:/a:gnu:gnutls:3.1.4 cpe:/a:gnu:gnutls:3.1.5 cpe:/a:gnu:gnutls:3.1.6 cpe:/a:gnu:gnutls:3.1.7 cpe:/a:gnu:gnutls:3.1.8 cpe:/a:gnu:gnutls:3.1.9 cpe:/a:gnu:gnutls:3.1.10 cpe:/a:gnu:gnutls:3.1.11 cpe:/a:gnu:gnutls:3.1.12 cpe:/a:gnu:gnutls:3.1.13 cpe:/a:gnu:gnutls:3.1.14 cpe:/a:gnu:gnutls:3.1.15 cpe:/a:gnu:gnutls:3.1.16 cpe:/a:gnu:gnutls:3.1.17 cpe:/a:gnu:gnutls:3.1.18 cpe:/a:gnu:gnutls:3.1.19 cpe:/a:gnu:gnutls:3.1.20 cpe:/a:gnu:gnutls:3.1.21 cpe:/a:gnu:gnutls:3.2.0 cpe:/a:gnu:gnutls:3.2.1 cpe:/a:gnu:gnutls:3.2.2 cpe:/a:gnu:gnutls:3.2.3 cpe:/a:gnu:gnutls:3.2.4 cpe:/a:gnu:gnutls:3.2.5 cpe:/a:gnu:gnutls:3.2.6 cpe:/a:gnu:gnutls:3.2.7 cpe:/a:gnu:gnutls:3.2.8 cpe:/a:gnu:gnutls:3.2.8.1 cpe:/a:gnu:gnutls:3.2.9 cpe:/a:gnu:gnutls:3.2.10 cpe:/a:gnu:gnutls:3.2.11

CVE-2014-0092

2014-03-06T19:10:53.573-05:00

2016-11-28T14:10:24.407-05:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://gnutls.org/security.html#GNUTLS-SA-2014-2 SUSE SUSE-SU-2014:0319 SUSE SUSE-SU-2014:0320 SUSE SUSE-SU-2014:0321 SUSE SUSE-SU-2014:0322 SUSE SUSE-SU-2014:0323 SUSE SUSE-SU-2014:0324 SUSE openSUSE-SU-2014:0325 SUSE openSUSE-SU-2014:0328 SUSE openSUSE-SU-2014:0346 SUSE SUSE-SU-2014:0445 REDHAT RHSA-2014:0246 REDHAT RHSA-2014:0247 REDHAT RHSA-2014:0288 REDHAT RHSA-2014:0339 DEBIAN DSA-2869 BID 65919 UBUNTU USN-2127-1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1069865 lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

cpe:/a:redhat:jboss_enterprise_application_platform:6.2.2

CVE-2014-0093

2014-04-03T12:15:12.127-04:00

2017-01-06T21:59:16.060-05:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2014:0343 REDHAT RHSA-2014:0344 REDHAT RHSA-2014:0345 BID 66596 Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2, when using a Java Security Manager (JSM), does not properly apply permissions defined by a policy file, which causes applications to be granted the java.security.AllPermission permission and allows remote attackers to bypass intended access restrictions.

cpe:/a:apache:struts:2.0.0 cpe:/a:apache:struts:2.0.1 cpe:/a:apache:struts:2.0.2 cpe:/a:apache:struts:2.0.3 cpe:/a:apache:struts:2.0.4 cpe:/a:apache:struts:2.0.5 cpe:/a:apache:struts:2.0.6 cpe:/a:apache:struts:2.0.7 cpe:/a:apache:struts:2.0.8 cpe:/a:apache:struts:2.0.9 cpe:/a:apache:struts:2.0.10 cpe:/a:apache:struts:2.0.11 cpe:/a:apache:struts:2.0.11.1 cpe:/a:apache:struts:2.0.11.2 cpe:/a:apache:struts:2.0.12 cpe:/a:apache:struts:2.0.13 cpe:/a:apache:struts:2.0.14 cpe:/a:apache:struts:2.1.0 cpe:/a:apache:struts:2.1.1 cpe:/a:apache:struts:2.1.2 cpe:/a:apache:struts:2.1.3 cpe:/a:apache:struts:2.1.4 cpe:/a:apache:struts:2.1.5 cpe:/a:apache:struts:2.1.6 cpe:/a:apache:struts:2.1.7 cpe:/a:apache:struts:2.1.8 cpe:/a:apache:struts:2.1.8.1 cpe:/a:apache:struts:2.2.1 cpe:/a:apache:struts:2.2.1.1 cpe:/a:apache:struts:2.2.3 cpe:/a:apache:struts:2.2.3.1 cpe:/a:apache:struts:2.3.0 cpe:/a:apache:struts:2.3.1 cpe:/a:apache:struts:2.3.1.1 cpe:/a:apache:struts:2.3.1.2 cpe:/a:apache:struts:2.3.3 cpe:/a:apache:struts:2.3.4 cpe:/a:apache:struts:2.3.4.1 cpe:/a:apache:struts:2.3.5 cpe:/a:apache:struts:2.3.6 cpe:/a:apache:struts:2.3.7 cpe:/a:apache:struts:2.3.8 cpe:/a:apache:struts:2.3.9 cpe:/a:apache:struts:2.3.10 cpe:/a:apache:struts:2.3.11 cpe:/a:apache:struts:2.3.12 cpe:/a:apache:struts:2.3.13 cpe:/a:apache:struts:2.3.14 cpe:/a:apache:struts:2.3.14.1 cpe:/a:apache:struts:2.3.14.2 cpe:/a:apache:struts:2.3.14.3 cpe:/a:apache:struts:2.3.15 cpe:/a:apache:struts:2.3.15.1 cpe:/a:apache:struts:2.3.15.2 cpe:/a:apache:struts:2.3.15.3 cpe:/a:apache:struts:2.3.16

CVE-2014-0094

2014-03-11T09:00:37.107-04:00

2019-08-12T17:15:12.140-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov JVN JVN#19294237 JVNDB JVNDB-2014-000045 MISC http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html SECUNIA 59178 CONFIRM http://struts.apache.org/release/2.3.x/docs/s2-020.html CONFIRM http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm CONFIRM http://www.konakart.com/downloads/ver-7-3-0-0-whats-new CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html BUGTRAQ 20140306 [ANN] Struts 2.3.16.1 GA release available - security fix BUGTRAQ 20140625 NEW VMSA-2014-0007 - VMware product updates address security vulnerabilities in Apache Struts library BID 65999 SECTRACK 1029876 CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0007.html CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676706 The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.

cpe:/a:apache:tomcat:8.0.0:rc1 cpe:/a:apache:tomcat:8.0.0:rc10 cpe:/a:apache:tomcat:8.0.0:rc2 cpe:/a:apache:tomcat:8.0.0:rc5 cpe:/a:apache:tomcat:8.0.1 cpe:/a:apache:tomcat:8.0.3

CVE-2014-0095

2014-05-31T07:17:13.157-04:00

2017-11-14T21:29:02.033-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov FULLDISC 20140527 [SECURITY] CVE-2014-0095 Apache Tomcat denial of service CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1578392 CONFIRM http://tomcat.apache.org/security-8.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html BID 67673 SECTRACK 1030300 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21678231 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21681528 java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of service (thread consumption) by using a "Content-Length: 0" AJP request to trigger a hang in request processing.

CVE-2014-0096

2014-05-31T07:17:13.233-04:00

2019-04-15T12:29:41.180-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://advisories.mageia.org/MGASA-2014-0268.html CONFIRM http://linux.oracle.com/errata/ELSA-2014-0865.html FEDORA FEDORA-2015-2109 HP HPSBUX03102 HP HPSBOV03503 REDHAT RHSA-2015:0675 REDHAT RHSA-2015:0720 REDHAT RHSA-2015:0765 FULLDISC 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities FULLDISC 20140527 [SECURITY] CVE-2014-0096 Apache Tomcat information disclosure SECUNIA 59121 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1578610 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1578611 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1578637 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1578655 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1585853 CONFIRM http://tomcat.apache.org/security-6.html CONFIRM http://tomcat.apache.org/security-7.html CONFIRM http://tomcat.apache.org/security-8.html DEBIAN DSA-3530 DEBIAN DSA-3552 MANDRIVA MDVSA-2015:052 MANDRIVA MDVSA-2015:053 MANDRIVA MDVSA-2015:084 CONFIRM http://www.novell.com/support/kb/doc.php?id=7010166 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html BUGTRAQ 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities BID 67667 SECTRACK 1030301 CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0012.html CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21678231 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21681528 CONFIRM https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013 MLIST [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ MLIST [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ MLIST [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ MLIST [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

cpe:/a:pivotal_software:spring_security:3.1.0 cpe:/a:pivotal_software:spring_security:3.1.1 cpe:/a:pivotal_software:spring_security:3.1.2 cpe:/a:pivotal_software:spring_security:3.1.3 cpe:/a:pivotal_software:spring_security:3.1.4 cpe:/a:pivotal_software:spring_security:3.1.5 cpe:/a:pivotal_software:spring_security:3.2.0 cpe:/a:pivotal_software:spring_security:3.2.1

CVE-2014-0097

2017-05-25T13:29:00.160-04:00

2017-06-07T10:23:01.297-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2017-06-07T09:57:42.957-04:00

CONFIRM https://pivotal.io/security/cve-2014-0097 The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password.

cpe:/a:apache:http_server:2.0 cpe:/a:apache:http_server:2.0.9 cpe:/a:apache:http_server:2.0.28 cpe:/a:apache:http_server:2.0.28:beta cpe:/a:apache:http_server:2.0.32 cpe:/a:apache:http_server:2.0.32:beta cpe:/a:apache:http_server:2.0.34:beta cpe:/a:apache:http_server:2.0.35 cpe:/a:apache:http_server:2.0.36 cpe:/a:apache:http_server:2.0.37 cpe:/a:apache:http_server:2.0.38 cpe:/a:apache:http_server:2.0.39 cpe:/a:apache:http_server:2.0.40 cpe:/a:apache:http_server:2.0.41 cpe:/a:apache:http_server:2.0.42 cpe:/a:apache:http_server:2.0.43 cpe:/a:apache:http_server:2.0.44 cpe:/a:apache:http_server:2.0.45 cpe:/a:apache:http_server:2.0.46 cpe:/a:apache:http_server:2.0.47 cpe:/a:apache:http_server:2.0.48 cpe:/a:apache:http_server:2.0.49 cpe:/a:apache:http_server:2.0.50 cpe:/a:apache:http_server:2.0.51 cpe:/a:apache:http_server:2.0.52 cpe:/a:apache:http_server:2.0.53 cpe:/a:apache:http_server:2.0.54 cpe:/a:apache:http_server:2.0.55 cpe:/a:apache:http_server:2.0.56 cpe:/a:apache:http_server:2.0.57 cpe:/a:apache:http_server:2.0.58 cpe:/a:apache:http_server:2.0.59 cpe:/a:apache:http_server:2.0.60 cpe:/a:apache:http_server:2.0.61 cpe:/a:apache:http_server:2.0.63 cpe:/a:apache:http_server:2.0.64 cpe:/a:apache:http_server:2.1 cpe:/a:apache:http_server:2.1.1 cpe:/a:apache:http_server:2.1.2 cpe:/a:apache:http_server:2.1.3 cpe:/a:apache:http_server:2.1.4 cpe:/a:apache:http_server:2.1.5 cpe:/a:apache:http_server:2.1.6 cpe:/a:apache:http_server:2.1.7 cpe:/a:apache:http_server:2.1.8 cpe:/a:apache:http_server:2.1.9 cpe:/a:apache:http_server:2.2 cpe:/a:apache:http_server:2.2.0 cpe:/a:apache:http_server:2.2.1 cpe:/a:apache:http_server:2.2.2 cpe:/a:apache:http_server:2.2.3 cpe:/a:apache:http_server:2.2.4 cpe:/a:apache:http_server:2.2.6 cpe:/a:apache:http_server:2.2.8 cpe:/a:apache:http_server:2.2.9 cpe:/a:apache:http_server:2.2.10 cpe:/a:apache:http_server:2.2.11 cpe:/a:apache:http_server:2.2.12 cpe:/a:apache:http_server:2.2.13 cpe:/a:apache:http_server:2.2.14 cpe:/a:apache:http_server:2.2.15 cpe:/a:apache:http_server:2.2.16 cpe:/a:apache:http_server:2.2.17 cpe:/a:apache:http_server:2.2.18 cpe:/a:apache:http_server:2.2.19 cpe:/a:apache:http_server:2.2.20 cpe:/a:apache:http_server:2.2.21 cpe:/a:apache:http_server:2.2.22 cpe:/a:apache:http_server:2.2.23 cpe:/a:apache:http_server:2.2.24 cpe:/a:apache:http_server:2.2.25 cpe:/a:apache:http_server:2.3.0 cpe:/a:apache:http_server:2.3.1 cpe:/a:apache:http_server:2.3.2 cpe:/a:apache:http_server:2.3.3 cpe:/a:apache:http_server:2.3.4 cpe:/a:apache:http_server:2.3.5 cpe:/a:apache:http_server:2.3.6 cpe:/a:apache:http_server:2.3.7 cpe:/a:apache:http_server:2.3.8 cpe:/a:apache:http_server:2.3.9 cpe:/a:apache:http_server:2.3.10 cpe:/a:apache:http_server:2.3.11 cpe:/a:apache:http_server:2.3.12 cpe:/a:apache:http_server:2.3.13 cpe:/a:apache:http_server:2.3.14 cpe:/a:apache:http_server:2.3.15 cpe:/a:apache:http_server:2.3.16 cpe:/a:apache:http_server:2.4.0 cpe:/a:apache:http_server:2.4.1 cpe:/a:apache:http_server:2.4.2 cpe:/a:apache:http_server:2.4.3 cpe:/a:apache:http_server:2.4.4 cpe:/a:apache:http_server:2.4.6 cpe:/a:apache:http_server:2.4.7

CVE-2014-0098

2014-03-18T01:18:18.750-04:00

2018-10-09T15:35:41.533-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://advisories.mageia.org/MGASA-2014-0135.html APPLE APPLE-SA-2014-10-16-1 CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698 APPLE APPLE-SA-2015-04-08-2 HP HPSBUX03102 HP HPSBUX03150 FULLDISC 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities SECUNIA 59219 GENTOO GLSA-201408-12 CONFIRM http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15320.html CONFIRM http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES CONFIRM http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/loggers/mod_log_config.c CONFIRM http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/loggers/mod_log_config.c?r1=1575394&r2=1575400&diff_format=h CONFIRM http://www.apache.org/dist/httpd/CHANGES_2.4.9 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html BUGTRAQ 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities BID 66303 UBUNTU USN-2152-1 CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0012.html CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21668973 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676091 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676092 CONFIRM https://blogs.oracle.com/sunsecurity/entry/multiple_input_validation_vulnerabilities_in1 CONFIRM https://httpd.apache.org/security/vulnerabilities_24.html MLIST [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html MLIST [httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html CONFIRM https://puppet.com/security/cve/cve-2014-0098 CONFIRM https://support.apple.com/HT204659 CONFIRM https://support.apple.com/kb/HT6535 The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.

CVE-2014-0099

2014-05-31T07:17:13.297-04:00

2019-04-15T12:29:46.603-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://advisories.mageia.org/MGASA-2014-0268.html CONFIRM http://linux.oracle.com/errata/ELSA-2014-0865.html FEDORA FEDORA-2015-2109 HP HPSBUX03102 HP HPSBUX03150 HP HPSBOV03503 REDHAT RHSA-2015:0675 REDHAT RHSA-2015:0720 REDHAT RHSA-2015:0765 FULLDISC 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities FULLDISC 20140527 [SECURITY] CVE-2014-0097 Apache Tomcat information disclosure FULLDISC 20140527 [SECURITY] Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure SECUNIA 59121 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1578812 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1578814 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1580473 CONFIRM http://tomcat.apache.org/security-6.html CONFIRM http://tomcat.apache.org/security-7.html CONFIRM http://tomcat.apache.org/security-8.html DEBIAN DSA-3447 DEBIAN DSA-3530 MANDRIVA MDVSA-2015:052 MANDRIVA MDVSA-2015:053 MANDRIVA MDVSA-2015:084 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html BUGTRAQ 20140527 [SECURITY] CVE-2014-0097 Apache Tomcat information disclosure BUGTRAQ 20140527 Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure BUGTRAQ 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities BID 67668 SECTRACK 1030302 CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0012.html CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21678231 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21680603 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21681528 CONFIRM https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013 MLIST [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ MLIST [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ MLIST [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ MLIST [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

cpe:/o:linux:linux_kernel:3.0:rc1 cpe:/o:linux:linux_kernel:3.0:rc2 cpe:/o:linux:linux_kernel:3.0:rc3 cpe:/o:linux:linux_kernel:3.0:rc4 cpe:/o:linux:linux_kernel:3.0:rc5 cpe:/o:linux:linux_kernel:3.0:rc6 cpe:/o:linux:linux_kernel:3.0:rc7 cpe:/o:linux:linux_kernel:3.0.1 cpe:/o:linux:linux_kernel:3.0.2 cpe:/o:linux:linux_kernel:3.0.3 cpe:/o:linux:linux_kernel:3.0.4 cpe:/o:linux:linux_kernel:3.0.5 cpe:/o:linux:linux_kernel:3.0.6 cpe:/o:linux:linux_kernel:3.0.7 cpe:/o:linux:linux_kernel:3.0.8 cpe:/o:linux:linux_kernel:3.0.9 cpe:/o:linux:linux_kernel:3.0.10 cpe:/o:linux:linux_kernel:3.0.11 cpe:/o:linux:linux_kernel:3.0.12 cpe:/o:linux:linux_kernel:3.0.13 cpe:/o:linux:linux_kernel:3.0.14 cpe:/o:linux:linux_kernel:3.0.15 cpe:/o:linux:linux_kernel:3.0.16 cpe:/o:linux:linux_kernel:3.0.17 cpe:/o:linux:linux_kernel:3.0.18 cpe:/o:linux:linux_kernel:3.0.19 cpe:/o:linux:linux_kernel:3.0.20 cpe:/o:linux:linux_kernel:3.0.21 cpe:/o:linux:linux_kernel:3.0.22 cpe:/o:linux:linux_kernel:3.0.23 cpe:/o:linux:linux_kernel:3.0.24 cpe:/o:linux:linux_kernel:3.0.25 cpe:/o:linux:linux_kernel:3.0.26 cpe:/o:linux:linux_kernel:3.0.27 cpe:/o:linux:linux_kernel:3.0.28 cpe:/o:linux:linux_kernel:3.0.29 cpe:/o:linux:linux_kernel:3.0.30 cpe:/o:linux:linux_kernel:3.0.31 cpe:/o:linux:linux_kernel:3.0.32 cpe:/o:linux:linux_kernel:3.0.33 cpe:/o:linux:linux_kernel:3.0.34 cpe:/o:linux:linux_kernel:3.0.35 cpe:/o:linux:linux_kernel:3.0.36 cpe:/o:linux:linux_kernel:3.0.37 cpe:/o:linux:linux_kernel:3.0.38 cpe:/o:linux:linux_kernel:3.0.39 cpe:/o:linux:linux_kernel:3.0.40 cpe:/o:linux:linux_kernel:3.0.41 cpe:/o:linux:linux_kernel:3.0.42 cpe:/o:linux:linux_kernel:3.0.43 cpe:/o:linux:linux_kernel:3.0.44 cpe:/o:linux:linux_kernel:3.0.45 cpe:/o:linux:linux_kernel:3.0.46 cpe:/o:linux:linux_kernel:3.0.47 cpe:/o:linux:linux_kernel:3.0.48 cpe:/o:linux:linux_kernel:3.0.49 cpe:/o:linux:linux_kernel:3.0.50 cpe:/o:linux:linux_kernel:3.0.51 cpe:/o:linux:linux_kernel:3.0.52 cpe:/o:linux:linux_kernel:3.0.53 cpe:/o:linux:linux_kernel:3.0.54 cpe:/o:linux:linux_kernel:3.0.55 cpe:/o:linux:linux_kernel:3.0.56 cpe:/o:linux:linux_kernel:3.0.57 cpe:/o:linux:linux_kernel:3.0.58 cpe:/o:linux:linux_kernel:3.0.59 cpe:/o:linux:linux_kernel:3.0.60 cpe:/o:linux:linux_kernel:3.0.61 cpe:/o:linux:linux_kernel:3.0.62 cpe:/o:linux:linux_kernel:3.0.63 cpe:/o:linux:linux_kernel:3.0.64 cpe:/o:linux:linux_kernel:3.0.65 cpe:/o:linux:linux_kernel:3.0.66 cpe:/o:linux:linux_kernel:3.0.67 cpe:/o:linux:linux_kernel:3.0.68 cpe:/o:linux:linux_kernel:3.1 cpe:/o:linux:linux_kernel:3.1:rc1 cpe:/o:linux:linux_kernel:3.1:rc2 cpe:/o:linux:linux_kernel:3.1:rc3 cpe:/o:linux:linux_kernel:3.1:rc4 cpe:/o:linux:linux_kernel:3.1.1 cpe:/o:linux:linux_kernel:3.1.2 cpe:/o:linux:linux_kernel:3.1.3 cpe:/o:linux:linux_kernel:3.1.4 cpe:/o:linux:linux_kernel:3.1.5 cpe:/o:linux:linux_kernel:3.1.6 cpe:/o:linux:linux_kernel:3.1.7 cpe:/o:linux:linux_kernel:3.1.8 cpe:/o:linux:linux_kernel:3.1.9 cpe:/o:linux:linux_kernel:3.1.10 cpe:/o:linux:linux_kernel:3.2 cpe:/o:linux:linux_kernel:3.2:rc2 cpe:/o:linux:linux_kernel:3.2:rc3 cpe:/o:linux:linux_kernel:3.2:rc4 cpe:/o:linux:linux_kernel:3.2:rc5 cpe:/o:linux:linux_kernel:3.2:rc6 cpe:/o:linux:linux_kernel:3.2:rc7 cpe:/o:linux:linux_kernel:3.2.1 cpe:/o:linux:linux_kernel:3.2.2 cpe:/o:linux:linux_kernel:3.2.3 cpe:/o:linux:linux_kernel:3.2.4 cpe:/o:linux:linux_kernel:3.2.5 cpe:/o:linux:linux_kernel:3.2.6 cpe:/o:linux:linux_kernel:3.2.7 cpe:/o:linux:linux_kernel:3.2.8 cpe:/o:linux:linux_kernel:3.2.9 cpe:/o:linux:linux_kernel:3.2.10 cpe:/o:linux:linux_kernel:3.2.11 cpe:/o:linux:linux_kernel:3.2.12 cpe:/o:linux:linux_kernel:3.2.13 cpe:/o:linux:linux_kernel:3.2.14 cpe:/o:linux:linux_kernel:3.2.15 cpe:/o:linux:linux_kernel:3.2.16 cpe:/o:linux:linux_kernel:3.2.17 cpe:/o:linux:linux_kernel:3.2.18 cpe:/o:linux:linux_kernel:3.2.19 cpe:/o:linux:linux_kernel:3.2.20 cpe:/o:linux:linux_kernel:3.2.21 cpe:/o:linux:linux_kernel:3.2.22 cpe:/o:linux:linux_kernel:3.2.23 cpe:/o:linux:linux_kernel:3.2.24 cpe:/o:linux:linux_kernel:3.2.25 cpe:/o:linux:linux_kernel:3.2.26 cpe:/o:linux:linux_kernel:3.2.27 cpe:/o:linux:linux_kernel:3.2.28 cpe:/o:linux:linux_kernel:3.2.29 cpe:/o:linux:linux_kernel:3.2.30 cpe:/o:linux:linux_kernel:3.3 cpe:/o:linux:linux_kernel:3.3:rc1 cpe:/o:linux:linux_kernel:3.3:rc2 cpe:/o:linux:linux_kernel:3.3:rc3 cpe:/o:linux:linux_kernel:3.3:rc4 cpe:/o:linux:linux_kernel:3.3:rc5 cpe:/o:linux:linux_kernel:3.3:rc6 cpe:/o:linux:linux_kernel:3.3:rc7 cpe:/o:linux:linux_kernel:3.3.1 cpe:/o:linux:linux_kernel:3.3.2 cpe:/o:linux:linux_kernel:3.3.3 cpe:/o:linux:linux_kernel:3.3.4 cpe:/o:linux:linux_kernel:3.3.5 cpe:/o:linux:linux_kernel:3.3.6 cpe:/o:linux:linux_kernel:3.3.7 cpe:/o:linux:linux_kernel:3.3.8 cpe:/o:linux:linux_kernel:3.4 cpe:/o:linux:linux_kernel:3.4:rc1 cpe:/o:linux:linux_kernel:3.4:rc2 cpe:/o:linux:linux_kernel:3.4:rc3 cpe:/o:linux:linux_kernel:3.4:rc4 cpe:/o:linux:linux_kernel:3.4:rc5 cpe:/o:linux:linux_kernel:3.4:rc6 cpe:/o:linux:linux_kernel:3.4:rc7 cpe:/o:linux:linux_kernel:3.4.1 cpe:/o:linux:linux_kernel:3.4.2 cpe:/o:linux:linux_kernel:3.4.3 cpe:/o:linux:linux_kernel:3.4.4 cpe:/o:linux:linux_kernel:3.4.5 cpe:/o:linux:linux_kernel:3.4.6 cpe:/o:linux:linux_kernel:3.4.7 cpe:/o:linux:linux_kernel:3.4.8 cpe:/o:linux:linux_kernel:3.4.9 cpe:/o:linux:linux_kernel:3.4.10 cpe:/o:linux:linux_kernel:3.4.11 cpe:/o:linux:linux_kernel:3.4.12 cpe:/o:linux:linux_kernel:3.4.13 cpe:/o:linux:linux_kernel:3.4.14 cpe:/o:linux:linux_kernel:3.4.15 cpe:/o:linux:linux_kernel:3.4.16 cpe:/o:linux:linux_kernel:3.4.17 cpe:/o:linux:linux_kernel:3.4.18 cpe:/o:linux:linux_kernel:3.4.19 cpe:/o:linux:linux_kernel:3.4.20 cpe:/o:linux:linux_kernel:3.4.21 cpe:/o:linux:linux_kernel:3.4.22 cpe:/o:linux:linux_kernel:3.4.23 cpe:/o:linux:linux_kernel:3.4.24 cpe:/o:linux:linux_kernel:3.4.25 cpe:/o:linux:linux_kernel:3.4.26 cpe:/o:linux:linux_kernel:3.4.27 cpe:/o:linux:linux_kernel:3.4.28 cpe:/o:linux:linux_kernel:3.4.29 cpe:/o:linux:linux_kernel:3.4.30 cpe:/o:linux:linux_kernel:3.4.31 cpe:/o:linux:linux_kernel:3.4.32 cpe:/o:linux:linux_kernel:3.4.33 cpe:/o:linux:linux_kernel:3.4.34 cpe:/o:linux:linux_kernel:3.4.35 cpe:/o:linux:linux_kernel:3.4.36 cpe:/o:linux:linux_kernel:3.4.37 cpe:/o:linux:linux_kernel:3.4.38 cpe:/o:linux:linux_kernel:3.4.39 cpe:/o:linux:linux_kernel:3.4.40 cpe:/o:linux:linux_kernel:3.4.41 cpe:/o:linux:linux_kernel:3.4.42 cpe:/o:linux:linux_kernel:3.4.43 cpe:/o:linux:linux_kernel:3.4.44 cpe:/o:linux:linux_kernel:3.4.45 cpe:/o:linux:linux_kernel:3.4.46 cpe:/o:linux:linux_kernel:3.4.47 cpe:/o:linux:linux_kernel:3.4.48 cpe:/o:linux:linux_kernel:3.4.49 cpe:/o:linux:linux_kernel:3.4.50 cpe:/o:linux:linux_kernel:3.4.51 cpe:/o:linux:linux_kernel:3.4.52 cpe:/o:linux:linux_kernel:3.4.53 cpe:/o:linux:linux_kernel:3.4.54 cpe:/o:linux:linux_kernel:3.4.55 cpe:/o:linux:linux_kernel:3.4.56 cpe:/o:linux:linux_kernel:3.4.57 cpe:/o:linux:linux_kernel:3.4.58 cpe:/o:linux:linux_kernel:3.4.59 cpe:/o:linux:linux_kernel:3.4.60 cpe:/o:linux:linux_kernel:3.4.61 cpe:/o:linux:linux_kernel:3.4.62 cpe:/o:linux:linux_kernel:3.4.63 cpe:/o:linux:linux_kernel:3.4.64 cpe:/o:linux:linux_kernel:3.4.65 cpe:/o:linux:linux_kernel:3.4.66 cpe:/o:linux:linux_kernel:3.4.67 cpe:/o:linux:linux_kernel:3.4.68 cpe:/o:linux:linux_kernel:3.4.69 cpe:/o:linux:linux_kernel:3.4.70 cpe:/o:linux:linux_kernel:3.4.71 cpe:/o:linux:linux_kernel:3.4.72 cpe:/o:linux:linux_kernel:3.4.73 cpe:/o:linux:linux_kernel:3.4.74 cpe:/o:linux:linux_kernel:3.4.75 cpe:/o:linux:linux_kernel:3.4.76 cpe:/o:linux:linux_kernel:3.4.77 cpe:/o:linux:linux_kernel:3.4.78 cpe:/o:linux:linux_kernel:3.4.79 cpe:/o:linux:linux_kernel:3.5.1 cpe:/o:linux:linux_kernel:3.5.2 cpe:/o:linux:linux_kernel:3.5.3 cpe:/o:linux:linux_kernel:3.5.4 cpe:/o:linux:linux_kernel:3.5.5 cpe:/o:linux:linux_kernel:3.5.6 cpe:/o:linux:linux_kernel:3.5.7 cpe:/o:linux:linux_kernel:3.6 cpe:/o:linux:linux_kernel:3.6.1 cpe:/o:linux:linux_kernel:3.6.2 cpe:/o:linux:linux_kernel:3.6.3 cpe:/o:linux:linux_kernel:3.6.4 cpe:/o:linux:linux_kernel:3.6.5 cpe:/o:linux:linux_kernel:3.6.6 cpe:/o:linux:linux_kernel:3.6.7 cpe:/o:linux:linux_kernel:3.6.8 cpe:/o:linux:linux_kernel:3.6.9 cpe:/o:linux:linux_kernel:3.6.10 cpe:/o:linux:linux_kernel:3.6.11 cpe:/o:linux:linux_kernel:3.7 cpe:/o:linux:linux_kernel:3.7.1 cpe:/o:linux:linux_kernel:3.7.2 cpe:/o:linux:linux_kernel:3.7.3 cpe:/o:linux:linux_kernel:3.7.4 cpe:/o:linux:linux_kernel:3.7.5 cpe:/o:linux:linux_kernel:3.7.6 cpe:/o:linux:linux_kernel:3.7.7 cpe:/o:linux:linux_kernel:3.7.8 cpe:/o:linux:linux_kernel:3.7.9 cpe:/o:linux:linux_kernel:3.7.10 cpe:/o:linux:linux_kernel:3.8.0 cpe:/o:linux:linux_kernel:3.8.1 cpe:/o:linux:linux_kernel:3.8.2 cpe:/o:linux:linux_kernel:3.8.3 cpe:/o:linux:linux_kernel:3.8.4 cpe:/o:linux:linux_kernel:3.8.5 cpe:/o:linux:linux_kernel:3.8.6 cpe:/o:linux:linux_kernel:3.8.7 cpe:/o:linux:linux_kernel:3.8.8 cpe:/o:linux:linux_kernel:3.8.9 cpe:/o:linux:linux_kernel:3.8.10 cpe:/o:linux:linux_kernel:3.8.11 cpe:/o:linux:linux_kernel:3.8.12 cpe:/o:linux:linux_kernel:3.8.13 cpe:/o:linux:linux_kernel:3.9:rc1 cpe:/o:linux:linux_kernel:3.9:rc2 cpe:/o:linux:linux_kernel:3.9:rc3 cpe:/o:linux:linux_kernel:3.9:rc4 cpe:/o:linux:linux_kernel:3.9:rc5 cpe:/o:linux:linux_kernel:3.9:rc6 cpe:/o:linux:linux_kernel:3.9:rc7 cpe:/o:linux:linux_kernel:3.9.0 cpe:/o:linux:linux_kernel:3.9.1 cpe:/o:linux:linux_kernel:3.9.2 cpe:/o:linux:linux_kernel:3.9.3 cpe:/o:linux:linux_kernel:3.9.4 cpe:/o:linux:linux_kernel:3.9.5 cpe:/o:linux:linux_kernel:3.9.6 cpe:/o:linux:linux_kernel:3.9.7 cpe:/o:linux:linux_kernel:3.9.8 cpe:/o:linux:linux_kernel:3.9.9 cpe:/o:linux:linux_kernel:3.9.10 cpe:/o:linux:linux_kernel:3.9.11 cpe:/o:linux:linux_kernel:3.10 cpe:/o:linux:linux_kernel:3.10.1 cpe:/o:linux:linux_kernel:3.10.2 cpe:/o:linux:linux_kernel:3.10.3 cpe:/o:linux:linux_kernel:3.10.4 cpe:/o:linux:linux_kernel:3.10.5 cpe:/o:linux:linux_kernel:3.10.6 cpe:/o:linux:linux_kernel:3.10.7 cpe:/o:linux:linux_kernel:3.10.8 cpe:/o:linux:linux_kernel:3.10.9 cpe:/o:linux:linux_kernel:3.10.10 cpe:/o:linux:linux_kernel:3.10.11 cpe:/o:linux:linux_kernel:3.10.12 cpe:/o:linux:linux_kernel:3.10.13 cpe:/o:linux:linux_kernel:3.10.14 cpe:/o:linux:linux_kernel:3.10.15 cpe:/o:linux:linux_kernel:3.10.16 cpe:/o:linux:linux_kernel:3.10.17 cpe:/o:linux:linux_kernel:3.10.18 cpe:/o:linux:linux_kernel:3.10.19 cpe:/o:linux:linux_kernel:3.10.20 cpe:/o:linux:linux_kernel:3.10.21 cpe:/o:linux:linux_kernel:3.10.22 cpe:/o:linux:linux_kernel:3.10.23 cpe:/o:linux:linux_kernel:3.10.24 cpe:/o:linux:linux_kernel:3.10.25 cpe:/o:linux:linux_kernel:3.10.26 cpe:/o:linux:linux_kernel:3.10.27 cpe:/o:linux:linux_kernel:3.10.28 cpe:/o:linux:linux_kernel:3.10.29 cpe:/o:linux:linux_kernel:3.11 cpe:/o:linux:linux_kernel:3.11.1 cpe:/o:linux:linux_kernel:3.11.2 cpe:/o:linux:linux_kernel:3.11.3 cpe:/o:linux:linux_kernel:3.11.4 cpe:/o:linux:linux_kernel:3.11.5 cpe:/o:linux:linux_kernel:3.11.6 cpe:/o:linux:linux_kernel:3.11.7 cpe:/o:linux:linux_kernel:3.11.8 cpe:/o:linux:linux_kernel:3.11.9 cpe:/o:linux:linux_kernel:3.11.10 cpe:/o:linux:linux_kernel:3.12 cpe:/o:linux:linux_kernel:3.12.1 cpe:/o:linux:linux_kernel:3.12.2 cpe:/o:linux:linux_kernel:3.12.3 cpe:/o:linux:linux_kernel:3.12.4 cpe:/o:linux:linux_kernel:3.12.5 cpe:/o:linux:linux_kernel:3.12.6 cpe:/o:linux:linux_kernel:3.12.7 cpe:/o:linux:linux_kernel:3.12.8 cpe:/o:linux:linux_kernel:3.12.9 cpe:/o:linux:linux_kernel:3.12.10 cpe:/o:linux:linux_kernel:3.12.11 cpe:/o:linux:linux_kernel:3.12.12 cpe:/o:linux:linux_kernel:3.12.13 cpe:/o:linux:linux_kernel:3.13 cpe:/o:linux:linux_kernel:3.13.1 cpe:/o:linux:linux_kernel:3.13.2 cpe:/o:linux:linux_kernel:3.13.3 cpe:/o:linux:linux_kernel:3.13.4 cpe:/o:linux:linux_kernel:3.13.5 cpe:/o:linux:linux_kernel:3.13.6

CVE-2014-0100

2014-03-11T09:01:06.733-04:00

2014-03-11T10:30:21.320-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2014-03-11T10:30:10.773-04:00

MISC http://patchwork.ozlabs.org/patch/325844/ MLIST [oss-security] 20140304 CVE-2014-0100 -- Linux kernel: net: inet frag code race condition leading to user-after-free CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1070618 Race condition in the inet_frag_intern function in net/ipv4/inet_fragment.c in the Linux kernel through 3.13.6 allows remote attackers to cause a denial of service (use-after-free error) or possibly have unspecified other impact via a large series of fragmented ICMP Echo Request packets to a system with a heavy CPU load.

cpe:/o:linux:linux_kernel:3.0:rc1 cpe:/o:linux:linux_kernel:3.0:rc2 cpe:/o:linux:linux_kernel:3.0:rc3 cpe:/o:linux:linux_kernel:3.0:rc4 cpe:/o:linux:linux_kernel:3.0:rc5 cpe:/o:linux:linux_kernel:3.0:rc6 cpe:/o:linux:linux_kernel:3.0:rc7 cpe:/o:linux:linux_kernel:3.0.1 cpe:/o:linux:linux_kernel:3.0.2 cpe:/o:linux:linux_kernel:3.0.3 cpe:/o:linux:linux_kernel:3.0.4 cpe:/o:linux:linux_kernel:3.0.5 cpe:/o:linux:linux_kernel:3.0.6 cpe:/o:linux:linux_kernel:3.0.7 cpe:/o:linux:linux_kernel:3.0.8 cpe:/o:linux:linux_kernel:3.0.9 cpe:/o:linux:linux_kernel:3.0.10 cpe:/o:linux:linux_kernel:3.0.11 cpe:/o:linux:linux_kernel:3.0.12 cpe:/o:linux:linux_kernel:3.0.13 cpe:/o:linux:linux_kernel:3.0.14 cpe:/o:linux:linux_kernel:3.0.15 cpe:/o:linux:linux_kernel:3.0.16 cpe:/o:linux:linux_kernel:3.0.17 cpe:/o:linux:linux_kernel:3.0.18 cpe:/o:linux:linux_kernel:3.0.19 cpe:/o:linux:linux_kernel:3.0.20 cpe:/o:linux:linux_kernel:3.0.21 cpe:/o:linux:linux_kernel:3.0.22 cpe:/o:linux:linux_kernel:3.0.23 cpe:/o:linux:linux_kernel:3.0.24 cpe:/o:linux:linux_kernel:3.0.25 cpe:/o:linux:linux_kernel:3.0.26 cpe:/o:linux:linux_kernel:3.0.27 cpe:/o:linux:linux_kernel:3.0.28 cpe:/o:linux:linux_kernel:3.0.29 cpe:/o:linux:linux_kernel:3.0.30 cpe:/o:linux:linux_kernel:3.0.31 cpe:/o:linux:linux_kernel:3.0.32 cpe:/o:linux:linux_kernel:3.0.33 cpe:/o:linux:linux_kernel:3.0.34 cpe:/o:linux:linux_kernel:3.0.35 cpe:/o:linux:linux_kernel:3.0.36 cpe:/o:linux:linux_kernel:3.0.37 cpe:/o:linux:linux_kernel:3.0.38 cpe:/o:linux:linux_kernel:3.0.39 cpe:/o:linux:linux_kernel:3.0.40 cpe:/o:linux:linux_kernel:3.0.41 cpe:/o:linux:linux_kernel:3.0.42 cpe:/o:linux:linux_kernel:3.0.43 cpe:/o:linux:linux_kernel:3.0.44 cpe:/o:linux:linux_kernel:3.0.45 cpe:/o:linux:linux_kernel:3.0.46 cpe:/o:linux:linux_kernel:3.0.47 cpe:/o:linux:linux_kernel:3.0.48 cpe:/o:linux:linux_kernel:3.0.49 cpe:/o:linux:linux_kernel:3.0.50 cpe:/o:linux:linux_kernel:3.0.51 cpe:/o:linux:linux_kernel:3.0.52 cpe:/o:linux:linux_kernel:3.0.53 cpe:/o:linux:linux_kernel:3.0.54 cpe:/o:linux:linux_kernel:3.0.55 cpe:/o:linux:linux_kernel:3.0.56 cpe:/o:linux:linux_kernel:3.0.57 cpe:/o:linux:linux_kernel:3.0.58 cpe:/o:linux:linux_kernel:3.0.59 cpe:/o:linux:linux_kernel:3.0.60 cpe:/o:linux:linux_kernel:3.0.61 cpe:/o:linux:linux_kernel:3.0.62 cpe:/o:linux:linux_kernel:3.0.63 cpe:/o:linux:linux_kernel:3.0.64 cpe:/o:linux:linux_kernel:3.0.65 cpe:/o:linux:linux_kernel:3.0.66 cpe:/o:linux:linux_kernel:3.0.67 cpe:/o:linux:linux_kernel:3.0.68 cpe:/o:linux:linux_kernel:3.1 cpe:/o:linux:linux_kernel:3.1:rc1 cpe:/o:linux:linux_kernel:3.1:rc2 cpe:/o:linux:linux_kernel:3.1:rc3 cpe:/o:linux:linux_kernel:3.1:rc4 cpe:/o:linux:linux_kernel:3.1.1 cpe:/o:linux:linux_kernel:3.1.2 cpe:/o:linux:linux_kernel:3.1.3 cpe:/o:linux:linux_kernel:3.1.4 cpe:/o:linux:linux_kernel:3.1.5 cpe:/o:linux:linux_kernel:3.1.6 cpe:/o:linux:linux_kernel:3.1.7 cpe:/o:linux:linux_kernel:3.1.8 cpe:/o:linux:linux_kernel:3.1.9 cpe:/o:linux:linux_kernel:3.1.10 cpe:/o:linux:linux_kernel:3.2 cpe:/o:linux:linux_kernel:3.2:rc2 cpe:/o:linux:linux_kernel:3.2:rc3 cpe:/o:linux:linux_kernel:3.2:rc4 cpe:/o:linux:linux_kernel:3.2:rc5 cpe:/o:linux:linux_kernel:3.2:rc6 cpe:/o:linux:linux_kernel:3.2:rc7 cpe:/o:linux:linux_kernel:3.2.1 cpe:/o:linux:linux_kernel:3.2.2 cpe:/o:linux:linux_kernel:3.2.3 cpe:/o:linux:linux_kernel:3.2.4 cpe:/o:linux:linux_kernel:3.2.5 cpe:/o:linux:linux_kernel:3.2.6 cpe:/o:linux:linux_kernel:3.2.7 cpe:/o:linux:linux_kernel:3.2.8 cpe:/o:linux:linux_kernel:3.2.9 cpe:/o:linux:linux_kernel:3.2.10 cpe:/o:linux:linux_kernel:3.2.11 cpe:/o:linux:linux_kernel:3.2.12 cpe:/o:linux:linux_kernel:3.2.13 cpe:/o:linux:linux_kernel:3.2.14 cpe:/o:linux:linux_kernel:3.2.15 cpe:/o:linux:linux_kernel:3.2.16 cpe:/o:linux:linux_kernel:3.2.17 cpe:/o:linux:linux_kernel:3.2.18 cpe:/o:linux:linux_kernel:3.2.19 cpe:/o:linux:linux_kernel:3.2.20 cpe:/o:linux:linux_kernel:3.2.21 cpe:/o:linux:linux_kernel:3.2.22 cpe:/o:linux:linux_kernel:3.2.23 cpe:/o:linux:linux_kernel:3.2.24 cpe:/o:linux:linux_kernel:3.2.25 cpe:/o:linux:linux_kernel:3.2.26 cpe:/o:linux:linux_kernel:3.2.27 cpe:/o:linux:linux_kernel:3.2.28 cpe:/o:linux:linux_kernel:3.2.29 cpe:/o:linux:linux_kernel:3.2.30 cpe:/o:linux:linux_kernel:3.3 cpe:/o:linux:linux_kernel:3.3:rc1 cpe:/o:linux:linux_kernel:3.3:rc2 cpe:/o:linux:linux_kernel:3.3:rc3 cpe:/o:linux:linux_kernel:3.3:rc4 cpe:/o:linux:linux_kernel:3.3:rc5 cpe:/o:linux:linux_kernel:3.3:rc6 cpe:/o:linux:linux_kernel:3.3:rc7 cpe:/o:linux:linux_kernel:3.3.1 cpe:/o:linux:linux_kernel:3.3.2 cpe:/o:linux:linux_kernel:3.3.3 cpe:/o:linux:linux_kernel:3.3.4 cpe:/o:linux:linux_kernel:3.3.5 cpe:/o:linux:linux_kernel:3.3.6 cpe:/o:linux:linux_kernel:3.3.7 cpe:/o:linux:linux_kernel:3.3.8 cpe:/o:linux:linux_kernel:3.4 cpe:/o:linux:linux_kernel:3.4:rc1 cpe:/o:linux:linux_kernel:3.4:rc2 cpe:/o:linux:linux_kernel:3.4:rc3 cpe:/o:linux:linux_kernel:3.4:rc4 cpe:/o:linux:linux_kernel:3.4:rc5 cpe:/o:linux:linux_kernel:3.4:rc6 cpe:/o:linux:linux_kernel:3.4:rc7 cpe:/o:linux:linux_kernel:3.4.1 cpe:/o:linux:linux_kernel:3.4.2 cpe:/o:linux:linux_kernel:3.4.3 cpe:/o:linux:linux_kernel:3.4.4 cpe:/o:linux:linux_kernel:3.4.5 cpe:/o:linux:linux_kernel:3.4.6 cpe:/o:linux:linux_kernel:3.4.7 cpe:/o:linux:linux_kernel:3.4.8 cpe:/o:linux:linux_kernel:3.4.9 cpe:/o:linux:linux_kernel:3.4.10 cpe:/o:linux:linux_kernel:3.4.11 cpe:/o:linux:linux_kernel:3.4.12 cpe:/o:linux:linux_kernel:3.4.13 cpe:/o:linux:linux_kernel:3.4.14 cpe:/o:linux:linux_kernel:3.4.15 cpe:/o:linux:linux_kernel:3.4.16 cpe:/o:linux:linux_kernel:3.4.17 cpe:/o:linux:linux_kernel:3.4.18 cpe:/o:linux:linux_kernel:3.4.19 cpe:/o:linux:linux_kernel:3.4.20 cpe:/o:linux:linux_kernel:3.4.21 cpe:/o:linux:linux_kernel:3.4.22 cpe:/o:linux:linux_kernel:3.4.23 cpe:/o:linux:linux_kernel:3.4.24 cpe:/o:linux:linux_kernel:3.4.25 cpe:/o:linux:linux_kernel:3.4.26 cpe:/o:linux:linux_kernel:3.4.27 cpe:/o:linux:linux_kernel:3.4.28 cpe:/o:linux:linux_kernel:3.4.29 cpe:/o:linux:linux_kernel:3.4.30 cpe:/o:linux:linux_kernel:3.4.31 cpe:/o:linux:linux_kernel:3.4.32 cpe:/o:linux:linux_kernel:3.4.33 cpe:/o:linux:linux_kernel:3.4.34 cpe:/o:linux:linux_kernel:3.4.35 cpe:/o:linux:linux_kernel:3.4.36 cpe:/o:linux:linux_kernel:3.4.37 cpe:/o:linux:linux_kernel:3.4.38 cpe:/o:linux:linux_kernel:3.4.39 cpe:/o:linux:linux_kernel:3.4.40 cpe:/o:linux:linux_kernel:3.4.41 cpe:/o:linux:linux_kernel:3.4.42 cpe:/o:linux:linux_kernel:3.4.43 cpe:/o:linux:linux_kernel:3.4.44 cpe:/o:linux:linux_kernel:3.4.45 cpe:/o:linux:linux_kernel:3.4.46 cpe:/o:linux:linux_kernel:3.4.47 cpe:/o:linux:linux_kernel:3.4.48 cpe:/o:linux:linux_kernel:3.4.49 cpe:/o:linux:linux_kernel:3.4.50 cpe:/o:linux:linux_kernel:3.4.51 cpe:/o:linux:linux_kernel:3.4.52 cpe:/o:linux:linux_kernel:3.4.53 cpe:/o:linux:linux_kernel:3.4.54 cpe:/o:linux:linux_kernel:3.4.55 cpe:/o:linux:linux_kernel:3.4.56 cpe:/o:linux:linux_kernel:3.4.57 cpe:/o:linux:linux_kernel:3.4.58 cpe:/o:linux:linux_kernel:3.4.59 cpe:/o:linux:linux_kernel:3.4.60 cpe:/o:linux:linux_kernel:3.4.61 cpe:/o:linux:linux_kernel:3.4.62 cpe:/o:linux:linux_kernel:3.4.63 cpe:/o:linux:linux_kernel:3.4.64 cpe:/o:linux:linux_kernel:3.4.65 cpe:/o:linux:linux_kernel:3.4.66 cpe:/o:linux:linux_kernel:3.4.67 cpe:/o:linux:linux_kernel:3.4.68 cpe:/o:linux:linux_kernel:3.4.69 cpe:/o:linux:linux_kernel:3.4.70 cpe:/o:linux:linux_kernel:3.4.71 cpe:/o:linux:linux_kernel:3.4.72 cpe:/o:linux:linux_kernel:3.4.73 cpe:/o:linux:linux_kernel:3.4.74 cpe:/o:linux:linux_kernel:3.4.75 cpe:/o:linux:linux_kernel:3.4.76 cpe:/o:linux:linux_kernel:3.4.77 cpe:/o:linux:linux_kernel:3.4.78 cpe:/o:linux:linux_kernel:3.4.79 cpe:/o:linux:linux_kernel:3.5.1 cpe:/o:linux:linux_kernel:3.5.2 cpe:/o:linux:linux_kernel:3.5.3 cpe:/o:linux:linux_kernel:3.5.4 cpe:/o:linux:linux_kernel:3.5.5 cpe:/o:linux:linux_kernel:3.5.6 cpe:/o:linux:linux_kernel:3.5.7 cpe:/o:linux:linux_kernel:3.6 cpe:/o:linux:linux_kernel:3.6.1 cpe:/o:linux:linux_kernel:3.6.2 cpe:/o:linux:linux_kernel:3.6.3 cpe:/o:linux:linux_kernel:3.6.4 cpe:/o:linux:linux_kernel:3.6.5 cpe:/o:linux:linux_kernel:3.6.6 cpe:/o:linux:linux_kernel:3.6.7 cpe:/o:linux:linux_kernel:3.6.8 cpe:/o:linux:linux_kernel:3.6.9 cpe:/o:linux:linux_kernel:3.6.10 cpe:/o:linux:linux_kernel:3.6.11 cpe:/o:linux:linux_kernel:3.7 cpe:/o:linux:linux_kernel:3.7.1 cpe:/o:linux:linux_kernel:3.7.2 cpe:/o:linux:linux_kernel:3.7.3 cpe:/o:linux:linux_kernel:3.7.4 cpe:/o:linux:linux_kernel:3.7.5 cpe:/o:linux:linux_kernel:3.7.6 cpe:/o:linux:linux_kernel:3.7.7 cpe:/o:linux:linux_kernel:3.7.8 cpe:/o:linux:linux_kernel:3.7.9 cpe:/o:linux:linux_kernel:3.7.10 cpe:/o:linux:linux_kernel:3.8.0 cpe:/o:linux:linux_kernel:3.8.1 cpe:/o:linux:linux_kernel:3.8.2 cpe:/o:linux:linux_kernel:3.8.3 cpe:/o:linux:linux_kernel:3.8.4 cpe:/o:linux:linux_kernel:3.8.5 cpe:/o:linux:linux_kernel:3.8.6 cpe:/o:linux:linux_kernel:3.8.7 cpe:/o:linux:linux_kernel:3.8.8 cpe:/o:linux:linux_kernel:3.8.9 cpe:/o:linux:linux_kernel:3.8.10 cpe:/o:linux:linux_kernel:3.8.11 cpe:/o:linux:linux_kernel:3.8.12 cpe:/o:linux:linux_kernel:3.8.13 cpe:/o:linux:linux_kernel:3.9:rc1 cpe:/o:linux:linux_kernel:3.9:rc2 cpe:/o:linux:linux_kernel:3.9:rc3 cpe:/o:linux:linux_kernel:3.9:rc4 cpe:/o:linux:linux_kernel:3.9:rc5 cpe:/o:linux:linux_kernel:3.9:rc6 cpe:/o:linux:linux_kernel:3.9:rc7 cpe:/o:linux:linux_kernel:3.9.0 cpe:/o:linux:linux_kernel:3.9.1 cpe:/o:linux:linux_kernel:3.9.2 cpe:/o:linux:linux_kernel:3.9.3 cpe:/o:linux:linux_kernel:3.9.4 cpe:/o:linux:linux_kernel:3.9.5 cpe:/o:linux:linux_kernel:3.9.6 cpe:/o:linux:linux_kernel:3.9.7 cpe:/o:linux:linux_kernel:3.9.8 cpe:/o:linux:linux_kernel:3.9.9 cpe:/o:linux:linux_kernel:3.9.10 cpe:/o:linux:linux_kernel:3.9.11 cpe:/o:linux:linux_kernel:3.10 cpe:/o:linux:linux_kernel:3.10.1 cpe:/o:linux:linux_kernel:3.10.2 cpe:/o:linux:linux_kernel:3.10.3 cpe:/o:linux:linux_kernel:3.10.4 cpe:/o:linux:linux_kernel:3.10.5 cpe:/o:linux:linux_kernel:3.10.6 cpe:/o:linux:linux_kernel:3.10.7 cpe:/o:linux:linux_kernel:3.10.8 cpe:/o:linux:linux_kernel:3.10.9 cpe:/o:linux:linux_kernel:3.10.10 cpe:/o:linux:linux_kernel:3.10.11 cpe:/o:linux:linux_kernel:3.10.12 cpe:/o:linux:linux_kernel:3.10.13 cpe:/o:linux:linux_kernel:3.10.14 cpe:/o:linux:linux_kernel:3.10.15 cpe:/o:linux:linux_kernel:3.10.16 cpe:/o:linux:linux_kernel:3.10.17 cpe:/o:linux:linux_kernel:3.10.18 cpe:/o:linux:linux_kernel:3.10.19 cpe:/o:linux:linux_kernel:3.10.20 cpe:/o:linux:linux_kernel:3.10.21 cpe:/o:linux:linux_kernel:3.10.22 cpe:/o:linux:linux_kernel:3.10.23 cpe:/o:linux:linux_kernel:3.10.24 cpe:/o:linux:linux_kernel:3.10.25 cpe:/o:linux:linux_kernel:3.10.26 cpe:/o:linux:linux_kernel:3.10.27 cpe:/o:linux:linux_kernel:3.10.28 cpe:/o:linux:linux_kernel:3.10.29 cpe:/o:linux:linux_kernel:3.11 cpe:/o:linux:linux_kernel:3.11.1 cpe:/o:linux:linux_kernel:3.11.2 cpe:/o:linux:linux_kernel:3.11.3 cpe:/o:linux:linux_kernel:3.11.4 cpe:/o:linux:linux_kernel:3.11.5 cpe:/o:linux:linux_kernel:3.11.6 cpe:/o:linux:linux_kernel:3.11.7 cpe:/o:linux:linux_kernel:3.11.8 cpe:/o:linux:linux_kernel:3.11.9 cpe:/o:linux:linux_kernel:3.11.10 cpe:/o:linux:linux_kernel:3.12 cpe:/o:linux:linux_kernel:3.12.1 cpe:/o:linux:linux_kernel:3.12.2 cpe:/o:linux:linux_kernel:3.12.3 cpe:/o:linux:linux_kernel:3.12.4 cpe:/o:linux:linux_kernel:3.12.5 cpe:/o:linux:linux_kernel:3.12.6 cpe:/o:linux:linux_kernel:3.12.7 cpe:/o:linux:linux_kernel:3.12.8 cpe:/o:linux:linux_kernel:3.12.9 cpe:/o:linux:linux_kernel:3.12.10 cpe:/o:linux:linux_kernel:3.12.11 cpe:/o:linux:linux_kernel:3.12.12 cpe:/o:linux:linux_kernel:3.12.13 cpe:/o:linux:linux_kernel:3.13 cpe:/o:linux:linux_kernel:3.13.1 cpe:/o:linux:linux_kernel:3.13.2 cpe:/o:linux:linux_kernel:3.13.3 cpe:/o:linux:linux_kernel:3.13.4 cpe:/o:linux:linux_kernel:3.13.5 cpe:/o:linux:linux_kernel:3.13.6

CVE-2014-0101

2014-03-11T09:01:06.733-04:00

2017-12-15T21:29:02.777-05:00

7.1

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ec0223ec48a90cb605244b45f7c62de856403729 REDHAT RHSA-2014:0328 REDHAT RHSA-2014:0419 REDHAT RHSA-2014:0432 SECUNIA 59216 CONFIRM http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15317.html MLIST [oss-security] 20140304 CVE-2014-0101 -- Linux kernel: net: sctp: null pointer dereference when processing authenticated cookie_echo chunk BID 65943 UBUNTU USN-2173-1 UBUNTU USN-2174-1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1070705 CONFIRM https://github.com/torvalds/linux/commit/ec0223ec48a90cb605244b45f7c62de856403729 The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk.

cpe:/o:linux:linux_kernel:3.0:rc1 cpe:/o:linux:linux_kernel:3.0:rc2 cpe:/o:linux:linux_kernel:3.0:rc3 cpe:/o:linux:linux_kernel:3.0:rc4 cpe:/o:linux:linux_kernel:3.0:rc5 cpe:/o:linux:linux_kernel:3.0:rc6 cpe:/o:linux:linux_kernel:3.0:rc7 cpe:/o:linux:linux_kernel:3.0.1 cpe:/o:linux:linux_kernel:3.0.2 cpe:/o:linux:linux_kernel:3.0.3 cpe:/o:linux:linux_kernel:3.0.4 cpe:/o:linux:linux_kernel:3.0.5 cpe:/o:linux:linux_kernel:3.0.6 cpe:/o:linux:linux_kernel:3.0.7 cpe:/o:linux:linux_kernel:3.0.8 cpe:/o:linux:linux_kernel:3.0.9 cpe:/o:linux:linux_kernel:3.0.10 cpe:/o:linux:linux_kernel:3.0.11 cpe:/o:linux:linux_kernel:3.0.12 cpe:/o:linux:linux_kernel:3.0.13 cpe:/o:linux:linux_kernel:3.0.14 cpe:/o:linux:linux_kernel:3.0.15 cpe:/o:linux:linux_kernel:3.0.16 cpe:/o:linux:linux_kernel:3.0.17 cpe:/o:linux:linux_kernel:3.0.18 cpe:/o:linux:linux_kernel:3.0.19 cpe:/o:linux:linux_kernel:3.0.20 cpe:/o:linux:linux_kernel:3.0.21 cpe:/o:linux:linux_kernel:3.0.22 cpe:/o:linux:linux_kernel:3.0.23 cpe:/o:linux:linux_kernel:3.0.24 cpe:/o:linux:linux_kernel:3.0.25 cpe:/o:linux:linux_kernel:3.0.26 cpe:/o:linux:linux_kernel:3.0.27 cpe:/o:linux:linux_kernel:3.0.28 cpe:/o:linux:linux_kernel:3.0.29 cpe:/o:linux:linux_kernel:3.0.30 cpe:/o:linux:linux_kernel:3.0.31 cpe:/o:linux:linux_kernel:3.0.32 cpe:/o:linux:linux_kernel:3.0.33 cpe:/o:linux:linux_kernel:3.0.34 cpe:/o:linux:linux_kernel:3.0.35 cpe:/o:linux:linux_kernel:3.0.36 cpe:/o:linux:linux_kernel:3.0.37 cpe:/o:linux:linux_kernel:3.0.38 cpe:/o:linux:linux_kernel:3.0.39 cpe:/o:linux:linux_kernel:3.0.40 cpe:/o:linux:linux_kernel:3.0.41 cpe:/o:linux:linux_kernel:3.0.42 cpe:/o:linux:linux_kernel:3.0.43 cpe:/o:linux:linux_kernel:3.0.44 cpe:/o:linux:linux_kernel:3.0.45 cpe:/o:linux:linux_kernel:3.0.46 cpe:/o:linux:linux_kernel:3.0.47 cpe:/o:linux:linux_kernel:3.0.48 cpe:/o:linux:linux_kernel:3.0.49 cpe:/o:linux:linux_kernel:3.0.50 cpe:/o:linux:linux_kernel:3.0.51 cpe:/o:linux:linux_kernel:3.0.52 cpe:/o:linux:linux_kernel:3.0.53 cpe:/o:linux:linux_kernel:3.0.54 cpe:/o:linux:linux_kernel:3.0.55 cpe:/o:linux:linux_kernel:3.0.56 cpe:/o:linux:linux_kernel:3.0.57 cpe:/o:linux:linux_kernel:3.0.58 cpe:/o:linux:linux_kernel:3.0.59 cpe:/o:linux:linux_kernel:3.0.60 cpe:/o:linux:linux_kernel:3.0.61 cpe:/o:linux:linux_kernel:3.0.62 cpe:/o:linux:linux_kernel:3.0.63 cpe:/o:linux:linux_kernel:3.0.64 cpe:/o:linux:linux_kernel:3.0.65 cpe:/o:linux:linux_kernel:3.0.66 cpe:/o:linux:linux_kernel:3.0.67 cpe:/o:linux:linux_kernel:3.0.68 cpe:/o:linux:linux_kernel:3.1 cpe:/o:linux:linux_kernel:3.1:rc1 cpe:/o:linux:linux_kernel:3.1:rc2 cpe:/o:linux:linux_kernel:3.1:rc3 cpe:/o:linux:linux_kernel:3.1:rc4 cpe:/o:linux:linux_kernel:3.1.1 cpe:/o:linux:linux_kernel:3.1.2 cpe:/o:linux:linux_kernel:3.1.3 cpe:/o:linux:linux_kernel:3.1.4 cpe:/o:linux:linux_kernel:3.1.5 cpe:/o:linux:linux_kernel:3.1.6 cpe:/o:linux:linux_kernel:3.1.7 cpe:/o:linux:linux_kernel:3.1.8 cpe:/o:linux:linux_kernel:3.1.9 cpe:/o:linux:linux_kernel:3.1.10 cpe:/o:linux:linux_kernel:3.2 cpe:/o:linux:linux_kernel:3.2:rc2 cpe:/o:linux:linux_kernel:3.2:rc3 cpe:/o:linux:linux_kernel:3.2:rc4 cpe:/o:linux:linux_kernel:3.2:rc5 cpe:/o:linux:linux_kernel:3.2:rc6 cpe:/o:linux:linux_kernel:3.2:rc7 cpe:/o:linux:linux_kernel:3.2.1 cpe:/o:linux:linux_kernel:3.2.2 cpe:/o:linux:linux_kernel:3.2.3 cpe:/o:linux:linux_kernel:3.2.4 cpe:/o:linux:linux_kernel:3.2.5 cpe:/o:linux:linux_kernel:3.2.6 cpe:/o:linux:linux_kernel:3.2.7 cpe:/o:linux:linux_kernel:3.2.8 cpe:/o:linux:linux_kernel:3.2.9 cpe:/o:linux:linux_kernel:3.2.10 cpe:/o:linux:linux_kernel:3.2.11 cpe:/o:linux:linux_kernel:3.2.12 cpe:/o:linux:linux_kernel:3.2.13 cpe:/o:linux:linux_kernel:3.2.14 cpe:/o:linux:linux_kernel:3.2.15 cpe:/o:linux:linux_kernel:3.2.16 cpe:/o:linux:linux_kernel:3.2.17 cpe:/o:linux:linux_kernel:3.2.18 cpe:/o:linux:linux_kernel:3.2.19 cpe:/o:linux:linux_kernel:3.2.20 cpe:/o:linux:linux_kernel:3.2.21 cpe:/o:linux:linux_kernel:3.2.22 cpe:/o:linux:linux_kernel:3.2.23 cpe:/o:linux:linux_kernel:3.2.24 cpe:/o:linux:linux_kernel:3.2.25 cpe:/o:linux:linux_kernel:3.2.26 cpe:/o:linux:linux_kernel:3.2.27 cpe:/o:linux:linux_kernel:3.2.28 cpe:/o:linux:linux_kernel:3.2.29 cpe:/o:linux:linux_kernel:3.2.30 cpe:/o:linux:linux_kernel:3.3 cpe:/o:linux:linux_kernel:3.3:rc1 cpe:/o:linux:linux_kernel:3.3:rc2 cpe:/o:linux:linux_kernel:3.3:rc3 cpe:/o:linux:linux_kernel:3.3:rc4 cpe:/o:linux:linux_kernel:3.3:rc5 cpe:/o:linux:linux_kernel:3.3:rc6 cpe:/o:linux:linux_kernel:3.3:rc7 cpe:/o:linux:linux_kernel:3.3.1 cpe:/o:linux:linux_kernel:3.3.2 cpe:/o:linux:linux_kernel:3.3.3 cpe:/o:linux:linux_kernel:3.3.4 cpe:/o:linux:linux_kernel:3.3.5 cpe:/o:linux:linux_kernel:3.3.6 cpe:/o:linux:linux_kernel:3.3.7 cpe:/o:linux:linux_kernel:3.3.8 cpe:/o:linux:linux_kernel:3.4 cpe:/o:linux:linux_kernel:3.4:rc1 cpe:/o:linux:linux_kernel:3.4:rc2 cpe:/o:linux:linux_kernel:3.4:rc3 cpe:/o:linux:linux_kernel:3.4:rc4 cpe:/o:linux:linux_kernel:3.4:rc5 cpe:/o:linux:linux_kernel:3.4:rc6 cpe:/o:linux:linux_kernel:3.4:rc7 cpe:/o:linux:linux_kernel:3.4.1 cpe:/o:linux:linux_kernel:3.4.2 cpe:/o:linux:linux_kernel:3.4.3 cpe:/o:linux:linux_kernel:3.4.4 cpe:/o:linux:linux_kernel:3.4.5 cpe:/o:linux:linux_kernel:3.4.6 cpe:/o:linux:linux_kernel:3.4.7 cpe:/o:linux:linux_kernel:3.4.8 cpe:/o:linux:linux_kernel:3.4.9 cpe:/o:linux:linux_kernel:3.4.10 cpe:/o:linux:linux_kernel:3.4.11 cpe:/o:linux:linux_kernel:3.4.12 cpe:/o:linux:linux_kernel:3.4.13 cpe:/o:linux:linux_kernel:3.4.14 cpe:/o:linux:linux_kernel:3.4.15 cpe:/o:linux:linux_kernel:3.4.16 cpe:/o:linux:linux_kernel:3.4.17 cpe:/o:linux:linux_kernel:3.4.18 cpe:/o:linux:linux_kernel:3.4.19 cpe:/o:linux:linux_kernel:3.4.20 cpe:/o:linux:linux_kernel:3.4.21 cpe:/o:linux:linux_kernel:3.4.22 cpe:/o:linux:linux_kernel:3.4.23 cpe:/o:linux:linux_kernel:3.4.24 cpe:/o:linux:linux_kernel:3.4.25 cpe:/o:linux:linux_kernel:3.4.26 cpe:/o:linux:linux_kernel:3.4.27 cpe:/o:linux:linux_kernel:3.4.28 cpe:/o:linux:linux_kernel:3.4.29 cpe:/o:linux:linux_kernel:3.4.30 cpe:/o:linux:linux_kernel:3.4.31 cpe:/o:linux:linux_kernel:3.4.32 cpe:/o:linux:linux_kernel:3.4.33 cpe:/o:linux:linux_kernel:3.4.34 cpe:/o:linux:linux_kernel:3.4.35 cpe:/o:linux:linux_kernel:3.4.36 cpe:/o:linux:linux_kernel:3.4.37 cpe:/o:linux:linux_kernel:3.4.38 cpe:/o:linux:linux_kernel:3.4.39 cpe:/o:linux:linux_kernel:3.4.40 cpe:/o:linux:linux_kernel:3.4.41 cpe:/o:linux:linux_kernel:3.4.42 cpe:/o:linux:linux_kernel:3.4.43 cpe:/o:linux:linux_kernel:3.4.44 cpe:/o:linux:linux_kernel:3.4.45 cpe:/o:linux:linux_kernel:3.4.46 cpe:/o:linux:linux_kernel:3.4.47 cpe:/o:linux:linux_kernel:3.4.48 cpe:/o:linux:linux_kernel:3.4.49 cpe:/o:linux:linux_kernel:3.4.50 cpe:/o:linux:linux_kernel:3.4.51 cpe:/o:linux:linux_kernel:3.4.52 cpe:/o:linux:linux_kernel:3.4.53 cpe:/o:linux:linux_kernel:3.4.54 cpe:/o:linux:linux_kernel:3.4.55 cpe:/o:linux:linux_kernel:3.4.56 cpe:/o:linux:linux_kernel:3.4.57 cpe:/o:linux:linux_kernel:3.4.58 cpe:/o:linux:linux_kernel:3.4.59 cpe:/o:linux:linux_kernel:3.4.60 cpe:/o:linux:linux_kernel:3.4.61 cpe:/o:linux:linux_kernel:3.4.62 cpe:/o:linux:linux_kernel:3.4.63 cpe:/o:linux:linux_kernel:3.4.64 cpe:/o:linux:linux_kernel:3.4.65 cpe:/o:linux:linux_kernel:3.4.66 cpe:/o:linux:linux_kernel:3.4.67 cpe:/o:linux:linux_kernel:3.4.68 cpe:/o:linux:linux_kernel:3.4.69 cpe:/o:linux:linux_kernel:3.4.70 cpe:/o:linux:linux_kernel:3.4.71 cpe:/o:linux:linux_kernel:3.4.72 cpe:/o:linux:linux_kernel:3.4.73 cpe:/o:linux:linux_kernel:3.4.74 cpe:/o:linux:linux_kernel:3.4.75 cpe:/o:linux:linux_kernel:3.4.76 cpe:/o:linux:linux_kernel:3.4.77 cpe:/o:linux:linux_kernel:3.4.78 cpe:/o:linux:linux_kernel:3.4.79 cpe:/o:linux:linux_kernel:3.5.1 cpe:/o:linux:linux_kernel:3.5.2 cpe:/o:linux:linux_kernel:3.5.3 cpe:/o:linux:linux_kernel:3.5.4 cpe:/o:linux:linux_kernel:3.5.5 cpe:/o:linux:linux_kernel:3.5.6 cpe:/o:linux:linux_kernel:3.5.7 cpe:/o:linux:linux_kernel:3.6 cpe:/o:linux:linux_kernel:3.6.1 cpe:/o:linux:linux_kernel:3.6.2 cpe:/o:linux:linux_kernel:3.6.3 cpe:/o:linux:linux_kernel:3.6.4 cpe:/o:linux:linux_kernel:3.6.5 cpe:/o:linux:linux_kernel:3.6.6 cpe:/o:linux:linux_kernel:3.6.7 cpe:/o:linux:linux_kernel:3.6.8 cpe:/o:linux:linux_kernel:3.6.9 cpe:/o:linux:linux_kernel:3.6.10 cpe:/o:linux:linux_kernel:3.6.11 cpe:/o:linux:linux_kernel:3.7 cpe:/o:linux:linux_kernel:3.7.1 cpe:/o:linux:linux_kernel:3.7.2 cpe:/o:linux:linux_kernel:3.7.3 cpe:/o:linux:linux_kernel:3.7.4 cpe:/o:linux:linux_kernel:3.7.5 cpe:/o:linux:linux_kernel:3.7.6 cpe:/o:linux:linux_kernel:3.7.7 cpe:/o:linux:linux_kernel:3.7.8 cpe:/o:linux:linux_kernel:3.7.9 cpe:/o:linux:linux_kernel:3.7.10 cpe:/o:linux:linux_kernel:3.8.0 cpe:/o:linux:linux_kernel:3.8.1 cpe:/o:linux:linux_kernel:3.8.2 cpe:/o:linux:linux_kernel:3.8.3 cpe:/o:linux:linux_kernel:3.8.4 cpe:/o:linux:linux_kernel:3.8.5 cpe:/o:linux:linux_kernel:3.8.6 cpe:/o:linux:linux_kernel:3.8.7 cpe:/o:linux:linux_kernel:3.8.8 cpe:/o:linux:linux_kernel:3.8.9 cpe:/o:linux:linux_kernel:3.8.10 cpe:/o:linux:linux_kernel:3.8.11 cpe:/o:linux:linux_kernel:3.8.12 cpe:/o:linux:linux_kernel:3.8.13 cpe:/o:linux:linux_kernel:3.9:rc1 cpe:/o:linux:linux_kernel:3.9:rc2 cpe:/o:linux:linux_kernel:3.9:rc3 cpe:/o:linux:linux_kernel:3.9:rc4 cpe:/o:linux:linux_kernel:3.9:rc5 cpe:/o:linux:linux_kernel:3.9:rc6 cpe:/o:linux:linux_kernel:3.9:rc7 cpe:/o:linux:linux_kernel:3.9.0 cpe:/o:linux:linux_kernel:3.9.1 cpe:/o:linux:linux_kernel:3.9.2 cpe:/o:linux:linux_kernel:3.9.3 cpe:/o:linux:linux_kernel:3.9.4 cpe:/o:linux:linux_kernel:3.9.5 cpe:/o:linux:linux_kernel:3.9.6 cpe:/o:linux:linux_kernel:3.9.7 cpe:/o:linux:linux_kernel:3.9.8 cpe:/o:linux:linux_kernel:3.9.9 cpe:/o:linux:linux_kernel:3.9.10 cpe:/o:linux:linux_kernel:3.9.11 cpe:/o:linux:linux_kernel:3.10 cpe:/o:linux:linux_kernel:3.10.1 cpe:/o:linux:linux_kernel:3.10.2 cpe:/o:linux:linux_kernel:3.10.3 cpe:/o:linux:linux_kernel:3.10.4 cpe:/o:linux:linux_kernel:3.10.5 cpe:/o:linux:linux_kernel:3.10.6 cpe:/o:linux:linux_kernel:3.10.7 cpe:/o:linux:linux_kernel:3.10.8 cpe:/o:linux:linux_kernel:3.10.9 cpe:/o:linux:linux_kernel:3.10.10 cpe:/o:linux:linux_kernel:3.10.11 cpe:/o:linux:linux_kernel:3.10.12 cpe:/o:linux:linux_kernel:3.10.13 cpe:/o:linux:linux_kernel:3.10.14 cpe:/o:linux:linux_kernel:3.10.15 cpe:/o:linux:linux_kernel:3.10.16 cpe:/o:linux:linux_kernel:3.10.17 cpe:/o:linux:linux_kernel:3.10.18 cpe:/o:linux:linux_kernel:3.10.19 cpe:/o:linux:linux_kernel:3.10.20 cpe:/o:linux:linux_kernel:3.10.21 cpe:/o:linux:linux_kernel:3.10.22 cpe:/o:linux:linux_kernel:3.10.23 cpe:/o:linux:linux_kernel:3.10.24 cpe:/o:linux:linux_kernel:3.10.25 cpe:/o:linux:linux_kernel:3.10.26 cpe:/o:linux:linux_kernel:3.10.27 cpe:/o:linux:linux_kernel:3.10.28 cpe:/o:linux:linux_kernel:3.10.29 cpe:/o:linux:linux_kernel:3.11 cpe:/o:linux:linux_kernel:3.11.1 cpe:/o:linux:linux_kernel:3.11.2 cpe:/o:linux:linux_kernel:3.11.3 cpe:/o:linux:linux_kernel:3.11.4 cpe:/o:linux:linux_kernel:3.11.5 cpe:/o:linux:linux_kernel:3.11.6 cpe:/o:linux:linux_kernel:3.11.7 cpe:/o:linux:linux_kernel:3.11.8 cpe:/o:linux:linux_kernel:3.11.9 cpe:/o:linux:linux_kernel:3.11.10 cpe:/o:linux:linux_kernel:3.12 cpe:/o:linux:linux_kernel:3.12.1 cpe:/o:linux:linux_kernel:3.12.2 cpe:/o:linux:linux_kernel:3.12.3 cpe:/o:linux:linux_kernel:3.12.4 cpe:/o:linux:linux_kernel:3.12.5 cpe:/o:linux:linux_kernel:3.12.6 cpe:/o:linux:linux_kernel:3.12.7 cpe:/o:linux:linux_kernel:3.12.8 cpe:/o:linux:linux_kernel:3.12.9 cpe:/o:linux:linux_kernel:3.12.10 cpe:/o:linux:linux_kernel:3.12.11 cpe:/o:linux:linux_kernel:3.12.12 cpe:/o:linux:linux_kernel:3.12.13 cpe:/o:linux:linux_kernel:3.13 cpe:/o:linux:linux_kernel:3.13.1 cpe:/o:linux:linux_kernel:3.13.2 cpe:/o:linux:linux_kernel:3.13.3 cpe:/o:linux:linux_kernel:3.13.4 cpe:/o:linux:linux_kernel:3.13.5 cpe:/o:linux:linux_kernel:3.13.6

CVE-2014-0102

2014-03-11T09:01:08.670-04:00

2014-03-11T11:03:22.243-04:00

5.2

ADJACENT_NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov

2014-03-11T11:03:20.897-04:00

MLIST [linux-kernel] 20140227 kernel BUG at security/keys/keyring.c:1003! MISC http://www.kernelhub.org/?msg=425013&p=2 MLIST [oss-security] 20140304 CVE-2014-0102 -- Linux kernel: security: keyring cycle detector DoS CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1072419 The keyring_detect_cycle_iterator function in security/keys/keyring.c in the Linux kernel through 3.13.6 does not properly determine whether keyrings are identical, which allows local users to cause a denial of service (OOPS) via crafted keyctl commands.

cpe:/a:zarafa:webapp:1.5 cpe:/a:zarafa:zarafa:7.0 cpe:/a:zarafa:zarafa:7.0.1 cpe:/a:zarafa:zarafa:7.0.2 cpe:/a:zarafa:zarafa:7.0.3 cpe:/a:zarafa:zarafa:7.0.4 cpe:/a:zarafa:zarafa:7.0.5 cpe:/a:zarafa:zarafa:7.0.6 cpe:/a:zarafa:zarafa:7.0.7 cpe:/a:zarafa:zarafa:7.0.8 cpe:/a:zarafa:zarafa:7.0.9 cpe:/a:zarafa:zarafa:7.0.10 cpe:/a:zarafa:zarafa:7.0.11 cpe:/a:zarafa:zarafa:7.0.12 cpe:/a:zarafa:zarafa:7.0.13 cpe:/a:zarafa:zarafa:7.1.0 cpe:/a:zarafa:zarafa:7.1.1 cpe:/a:zarafa:zarafa:7.1.2 cpe:/a:zarafa:zarafa:7.1.3 cpe:/a:zarafa:zarafa:7.1.4 cpe:/a:zarafa:zarafa:7.1.8 cpe:/a:zarafa:zarafa:7.1.9 cpe:/o:fedoraproject:fedora:19 cpe:/o:fedoraproject:fedora:20

CVE-2014-0103

2014-07-29T10:55:04.640-04:00

2015-11-04T12:35:22.093-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2015-11-04T11:31:05.097-05:00

CONFIRM http://advisories.mageia.org/MGASA-2014-0380.html FEDORA FEDORA-2014-7896 FEDORA FEDORA-2014-7889 MANDRIVA MDVSA-2014:182 BID 68247 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1073618 WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.

cpe:/a:openstack:python-keystoneclient:0.2.2 cpe:/a:openstack:python-keystoneclient:0.2.3 cpe:/a:openstack:python-keystoneclient:0.2.4 cpe:/a:openstack:python-keystoneclient:0.3.0 cpe:/a:openstack:python-keystoneclient:0.3.1 cpe:/a:openstack:python-keystoneclient:0.3.2 cpe:/a:openstack:python-keystoneclient:0.4.2

CVE-2014-0105

2014-04-15T10:55:03.577-04:00

2017-12-15T21:29:02.887-05:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2014:0382 REDHAT RHSA-2014:0409 MLIST [oss-security] 20140327 [OSSA 2014-007] Potential context confusion in Keystone middleware (CVE-2014-0105) CONFIRM https://bugs.launchpad.net/python-keystoneclient/+bug/1282865 The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."

cpe:/a:todd_miller:sudo:1.6.9 cpe:/a:todd_miller:sudo:1.6.9p20 cpe:/a:todd_miller:sudo:1.6.9p21 cpe:/a:todd_miller:sudo:1.6.9p22 cpe:/a:todd_miller:sudo:1.6.9p23 cpe:/a:todd_miller:sudo:1.7.0 cpe:/a:todd_miller:sudo:1.7.1 cpe:/a:todd_miller:sudo:1.7.2 cpe:/a:todd_miller:sudo:1.7.2p1 cpe:/a:todd_miller:sudo:1.7.2p2 cpe:/a:todd_miller:sudo:1.7.2p3 cpe:/a:todd_miller:sudo:1.7.2p4 cpe:/a:todd_miller:sudo:1.7.2p5 cpe:/a:todd_miller:sudo:1.7.2p6 cpe:/a:todd_miller:sudo:1.7.2p7 cpe:/a:todd_miller:sudo:1.7.3b1 cpe:/a:todd_miller:sudo:1.7.4 cpe:/a:todd_miller:sudo:1.7.4p1 cpe:/a:todd_miller:sudo:1.7.4p2 cpe:/a:todd_miller:sudo:1.7.4p3 cpe:/a:todd_miller:sudo:1.7.4p4 cpe:/a:todd_miller:sudo:1.7.4p5 cpe:/a:todd_miller:sudo:1.7.4p6 cpe:/a:todd_miller:sudo:1.7.5 cpe:/a:todd_miller:sudo:1.7.6 cpe:/a:todd_miller:sudo:1.7.6p1 cpe:/a:todd_miller:sudo:1.7.6p2 cpe:/a:todd_miller:sudo:1.7.7 cpe:/a:todd_miller:sudo:1.7.8 cpe:/a:todd_miller:sudo:1.7.8p1 cpe:/a:todd_miller:sudo:1.7.8p2 cpe:/a:todd_miller:sudo:1.7.9 cpe:/a:todd_miller:sudo:1.7.9p1 cpe:/a:todd_miller:sudo:1.7.10 cpe:/a:todd_miller:sudo:1.7.10p1 cpe:/a:todd_miller:sudo:1.7.10p2 cpe:/a:todd_miller:sudo:1.7.10p3 cpe:/a:todd_miller:sudo:1.7.10p4 cpe:/a:todd_miller:sudo:1.7.10p5 cpe:/a:todd_miller:sudo:1.7.10p6 cpe:/a:todd_miller:sudo:1.7.10p7 cpe:/a:todd_miller:sudo:1.7.10p8 cpe:/a:todd_miller:sudo:1.7.10p9 cpe:/a:todd_miller:sudo:1.7.10p10 cpe:/a:todd_miller:sudo:1.8.0 cpe:/a:todd_miller:sudo:1.8.1 cpe:/a:todd_miller:sudo:1.8.1p1 cpe:/a:todd_miller:sudo:1.8.1p2 cpe:/a:todd_miller:sudo:1.8.2 cpe:/a:todd_miller:sudo:1.8.3 cpe:/a:todd_miller:sudo:1.8.3p1 cpe:/a:todd_miller:sudo:1.8.3p2 cpe:/a:todd_miller:sudo:1.8.4 cpe:/a:todd_miller:sudo:1.8.4p1 cpe:/a:todd_miller:sudo:1.8.4p2 cpe:/a:todd_miller:sudo:1.8.4p3 cpe:/a:todd_miller:sudo:1.8.4p4 cpe:/a:todd_miller:sudo:1.8.4p5 cpe:/o:apple:mac_os_x:10.10.4

CVE-2014-0106

2014-03-11T15:37:03.240-04:00

2017-12-15T21:29:02.947-05:00

6.6

LOCAL

MEDIUM

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov APPLE APPLE-SA-2015-08-13-2 SUSE SUSE-SU-2014:0475 REDHAT RHSA-2014:0266 MLIST [oss-security] 20140305 sudo: security policy bypass when env_reset is disabled CONFIRM http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html BID 65997 CONFIRM http://www.sudo.ws/sudo/alerts/env_add.html UBUNTU USN-2146-1 CONFIRM https://support.apple.com/kb/HT205031 Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.

cpe:/a:apache:xalan-java:1.0.0 cpe:/a:apache:xalan-java:2.0.0 cpe:/a:apache:xalan-java:2.0.1 cpe:/a:apache:xalan-java:2.1.0 cpe:/a:apache:xalan-java:2.2.0 cpe:/a:apache:xalan-java:2.4.0 cpe:/a:apache:xalan-java:2.4.1 cpe:/a:apache:xalan-java:2.5.0 cpe:/a:apache:xalan-java:2.5.1 cpe:/a:apache:xalan-java:2.5.2 cpe:/a:apache:xalan-java:2.6.0 cpe:/a:apache:xalan-java:2.7.0 cpe:/a:apache:xalan-java:2.7.1 cpe:/a:oracle:webcenter_sites:7.6.2 cpe:/a:oracle:webcenter_sites:11.1.1.8.0

CVE-2014-0107

2014-04-15T19:13:13.070-04:00

2019-04-23T15:29:00.490-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2014:0348 REDHAT RHSA-2014:1351 REDHAT RHSA-2015:1888 SECUNIA 59151 SECUNIA 59247 SECUNIA 59290 SECUNIA 59291 SECUNIA 59515 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1581058 DEBIAN DSA-2886 CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21677967 MISC http://www.ocert.org/advisories/ocert-2014-002.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 66397 SECTRACK 1034711 SECTRACK 1034716 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21674334 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676093 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677145 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21680703 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21681933 XF apache-xalanjava-cve20140107-sec-bypass(92023) CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755 CONFIRM https://issues.apache.org/jira/browse/XALANJ-2435 GENTOO GLSA-201604-02 MISC https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html CONFIRM https://www.tenable.com/security/tns-2018-15 The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

CVE-2014-0108

2017-05-11T10:29:32.920-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

cpe:/a:apache:cxf:2.4.0 cpe:/a:apache:cxf:2.4.1 cpe:/a:apache:cxf:2.4.2 cpe:/a:apache:cxf:2.4.3 cpe:/a:apache:cxf:2.4.4 cpe:/a:apache:cxf:2.4.5 cpe:/a:apache:cxf:2.4.6 cpe:/a:apache:cxf:2.4.7 cpe:/a:apache:cxf:2.5.0 cpe:/a:apache:cxf:2.5.1 cpe:/a:apache:cxf:2.5.2 cpe:/a:apache:cxf:2.5.3 cpe:/a:apache:cxf:2.5.4 cpe:/a:apache:cxf:2.5.5 cpe:/a:apache:cxf:2.5.6 cpe:/a:apache:cxf:2.5.7 cpe:/a:apache:cxf:2.5.8 cpe:/a:apache:cxf:2.5.9 cpe:/a:apache:cxf:2.6.0 cpe:/a:apache:cxf:2.6.1 cpe:/a:apache:cxf:2.6.2 cpe:/a:apache:cxf:2.6.3 cpe:/a:apache:cxf:2.6.4 cpe:/a:apache:cxf:2.6.5 cpe:/a:apache:cxf:2.6.6 cpe:/a:apache:cxf:2.6.7 cpe:/a:apache:cxf:2.6.8 cpe:/a:apache:cxf:2.6.9 cpe:/a:apache:cxf:2.6.10 cpe:/a:apache:cxf:2.6.11 cpe:/a:apache:cxf:2.6.12 cpe:/a:apache:cxf:2.6.13 cpe:/a:apache:cxf:2.7.0 cpe:/a:apache:cxf:2.7.1 cpe:/a:apache:cxf:2.7.2 cpe:/a:apache:cxf:2.7.3 cpe:/a:apache:cxf:2.7.4 cpe:/a:apache:cxf:2.7.5 cpe:/a:apache:cxf:2.7.6 cpe:/a:apache:cxf:2.7.7 cpe:/a:apache:cxf:2.7.8 cpe:/a:apache:cxf:2.7.9 cpe:/a:apache:cxf:2.7.10

CVE-2014-0109

2014-05-08T10:29:13.080-04:00

2015-04-22T21:59:15.817-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2014:1351 REDHAT RHSA-2015:0850 REDHAT RHSA-2015:0851 SECTRACK 1030201 CONFIRM https://cxf.apache.org/security-advisories.data/CVE-2014-0109.txt.asc?version=1&modificationDate=1398873370740&api=v2 Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large request with the Content-Type set to text/html to a SOAP endpoint, which triggers an error.

CVE-2014-0110

2014-05-08T10:29:13.143-04:00

2015-04-22T21:59:17.007-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://cxf.apache.org/security-advisories.data/CVE-2014-0110.txt.asc?version=1&modificationDate=1398873378628&api=v2 REDHAT RHSA-2014:1351 REDHAT RHSA-2015:0850 REDHAT RHSA-2015:0851 SECTRACK 1030202 Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) via a large invalid SOAP message.

cpe:/a:apache:syncope:1.0.0 cpe:/a:apache:syncope:1.0.0:- cpe:/a:apache:syncope:1.0.0:rc1 cpe:/a:apache:syncope:1.0.0:rc2 cpe:/a:apache:syncope:1.0.0:rc3 cpe:/a:apache:syncope:1.0.1 cpe:/a:apache:syncope:1.0.2 cpe:/a:apache:syncope:1.0.3 cpe:/a:apache:syncope:1.0.4 cpe:/a:apache:syncope:1.0.5 cpe:/a:apache:syncope:1.0.6 cpe:/a:apache:syncope:1.0.7 cpe:/a:apache:syncope:1.0.8 cpe:/a:apache:syncope:1.1.0 cpe:/a:apache:syncope:1.1.1 cpe:/a:apache:syncope:1.1.2 cpe:/a:apache:syncope:1.1.3 cpe:/a:apache:syncope:1.1.4 cpe:/a:apache:syncope:1.1.5 cpe:/a:apache:syncope:1.1.6

CVE-2014-0111

2014-04-17T10:55:06.763-04:00

2019-03-21T10:23:07.723-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-03-21T08:39:18.757-04:00

MLIST [www-announce] 20140415 [SECURITY] CVE-2014-0111 Apache Syncope CONFIRM http://syncope.apache.org/security.html BUGTRAQ 20140415 [SECURITY] CVE-2014-0111 Apache Syncope Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."

CVE-2014-0112

2014-04-29T06:37:03.670-04:00

2019-08-12T17:15:12.360-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov JVN JVN#19294237 JVNDB JVNDB-2014-000045 MISC http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html SECUNIA 59178 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html BUGTRAQ 20140426 [ANN] Struts 2.3.16.2 GA release available - security fix BUGTRAQ 20140625 NEW VMSA-2014-0007 - VMware product updates address security vulnerabilities in Apache Struts library BID 67064 CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0007.html CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676706 REDHAT RHSA-2019:0910 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1091939 CONFIRM https://cwiki.apache.org/confluence/display/WW/S2-021 ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

CVE-2014-0113

2014-04-29T06:37:03.700-04:00

2019-08-12T17:15:12.563-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SECUNIA 59178 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html BUGTRAQ 20140426 [ANN] Struts 2.3.16.2 GA release available - security fix CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676706 CONFIRM https://cwiki.apache.org/confluence/display/WW/S2-021 CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

cpe:/a:apache:commons_beanutils:1.9.1 cpe:/a:apache:struts:1.0 cpe:/a:apache:struts:1.0.2 cpe:/a:apache:struts:1.1 cpe:/a:apache:struts:1.1:b1 cpe:/a:apache:struts:1.1:b2 cpe:/a:apache:struts:1.1:b3 cpe:/a:apache:struts:1.1:rc1 cpe:/a:apache:struts:1.1:rc2 cpe:/a:apache:struts:1.2.2 cpe:/a:apache:struts:1.2.4 cpe:/a:apache:struts:1.2.6 cpe:/a:apache:struts:1.2.7 cpe:/a:apache:struts:1.2.8 cpe:/a:apache:struts:1.2.9 cpe:/a:apache:struts:1.3.5 cpe:/a:apache:struts:1.3.8 cpe:/a:apache:struts:1.3.10

CVE-2014-0114

2014-04-30T06:49:03.973-04:00

2019-06-15T13:29:00.370-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://advisories.mageia.org/MGASA-2014-0219.html MLIST [apache-ignite-developers] 20180601 [CVE-2014-0114]: Apache Ignite is vulnerable to existing CVE-2014-0114 CONFIRM http://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.2/RELEASE-NOTES.txt FEDORA FEDORA-2014-9380 HP HPSBGN03041 HP HPSBMU03090 HP HPSBST03160 MLIST [oss-security] 20140616 CVE request for commons-beanutils: 'class' property is exposed, potentially leading to RCE MLIST [oss-security] 20140707 Re: CVE request for commons-beanutils: 'class' property is exposed, potentially leading to RCE FULLDISC 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities SECUNIA 57477 SECUNIA 58710 SECUNIA 58947 SECUNIA 59118 SECUNIA 59228 SECUNIA 59245 SECUNIA 59246 SECUNIA 59430 SECUNIA 59464 SECUNIA 59479 SECUNIA 59480 SECUNIA 59718 DEBIAN DSA-2940 CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21675496 MANDRIVA MDVSA-2014:095 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html BUGTRAQ 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities BID 67121 CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0008.html CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0012.html CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21674128 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21674812 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21675266 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21675387 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21675689 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21675898 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21675972 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676091 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676110 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676303 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676375 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676931 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677110 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg27042296 REDHAT RHSA-2018:2669 CONFIRM https://access.redhat.com/solutions/869353 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1091938 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1116665 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755 CONFIRM https://issues.apache.org/jira/browse/BEANUTILS-463 MLIST [commons-dev] 20190525 Re: [beanutils2] CVE-2014-0114 Pull Request MLIST [commons-issues] 20190522 [jira] [Work logged] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114 MISC https://lists.apache.org/thread.html/084ae814e69178d2ce174cfdf149bc6e46d7524f3308c08d3adb43cb@%3Cissues.commons.apache.org%3E MLIST [commons-issues] 20190528 [jira] [Closed] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114 MISC https://lists.apache.org/thread.html/09981ae3df188a2ad1ce20f62ef76a5b2d27cf6b9ebab366cf1d6cc6@%3Cissues.commons.apache.org%3E MLIST [commons-user] 20190814 [SECURITY] CVE-2019-10086. Apache Commons Beanutils does not suppresses the class property in PropertyUtilsBean by default. MLIST [activemq-issues] 20190909 [jira] [Work logged] (ARTEMIS-2470) Update Apache BeanUtils to Address CVE-2014-0114 MLIST [commons-commits] 20190906 [commons-configuration] branch master updated: [CONFIGURATION-755][CVE-2014-0114] Update Apache Commons BeanUtils from 1.9.3 to 1.9.4. MISC https://lists.apache.org/thread.html/15fcdf27fa060de276edc0b4098526afc21c236852eb3de9be9594f3@%3Cissues.commons.apache.org%3E MLIST [commons-issues] 20190906 [jira] [Closed] (CONFIGURATION-755) [CVE-2014-0114] Update Apache Commons BeanUtils from 1.9.3 to 1.9.4. MLIST [commons-issues] 20190615 [jira] [Resolved] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114 MISC https://lists.apache.org/thread.html/2ba22f2e3de945039db735cf6cbf7f8be901ab2537337c7b1dd6a0f0@%3Cissues.commons.apache.org%3E MLIST [commons-commits] 20190528 [commons-beanutils] branch master updated: BEANUTILS-520: Mitigate CVE-2014-0114 by enabling SuppressPropertiesBeanIntrospector.SUPPRESS_CLASS by default. (#7) MLIST [infra-devnull] 20190329 [GitHub] [pulsar] massakam opened pull request #3938: Upgrade third party libraries with security vulnerabilities MLIST [activemq-issues] 20190904 [jira] [Created] (ARTEMIS-2470) Update Apache BeanUtils to Address CVE-2014-0114 MLIST [commons-dev] 20190522 [beanutils2] CVE-2014-0114 Pull Request MLIST [commons-issues] 20190528 [jira] [Work logged] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114 MISC https://lists.apache.org/thread.html/4c3fd707a049bfe0577dba8fc9c4868ffcdabe68ad86586a0a49242e@%3Cissues.commons.apache.org%3E MISC https://lists.apache.org/thread.html/65b39fa6d700e511927e5668a4038127432178a210aff81500eb36e5@%3Cissues.commons.apache.org%3E MISC https://lists.apache.org/thread.html/6afe2f935493e69a332b9c5a4f23cafe95c15ede1591a492cf612293@%3Cissues.commons.apache.org%3E MISC https://lists.apache.org/thread.html/6b30629b32d020c40d537f00b004d281c37528d471de15ca8aec2cd4@%3Cissues.commons.apache.org%3E MISC https://lists.apache.org/thread.html/869c08899f34c1a70c9fb42f92ac0d043c98781317e0c19d7ba3f5e3@%3Cissues.commons.apache.org%3E MLIST [commons-dev] 20190814 [SECURITY] CVE-2019-10086. Apache Commons Beanutils does not suppresses the class property in PropertyUtilsBean by default. MLIST [commons-issues] 20190522 [jira] [Commented] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114 MLIST [announce] 20190814 [SECURITY] CVE-2019-10086. Apache Commons Beanutils does not suppresses the class property in PropertyUtilsBean by default. MLIST [commons-issues] 20190906 [jira] [Updated] (CONFIGURATION-755) [CVE-2014-0114] Update Apache Commons BeanUtils from 1.9.3 to 1.9.4. MLIST [commons-issues] 20190521 [jira] [Created] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114 MISC https://lists.apache.org/thread.html/9b5505632f5683ee17bda4f7878525e672226c7807d57709283ffa64@%3Cissues.commons.apache.org%3E MISC https://lists.apache.org/thread.html/aa4ca069c7aea5b1d7329bc21576c44a39bcc4eb7bb2760c4b16f2f6@%3Cissues.commons.apache.org%3E MLIST [commons-commits] 20190528 [commons-beanutils] branch master updated: [BEANUTILS-520] BeanUtils2 mitigate CVE-2014-0114. MLIST [pulsar-commits] 20190329 [GitHub] [pulsar] massakam opened a new pull request #3938: Upgrade third party libraries with security vulnerabilities MLIST [commons-issues] 20190818 [jira] [Commented] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114 MLIST [commons-issues] 20190615 [jira] [Updated] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114 MLIST [activemq-gitbox] 20190903 [GitHub] [activemq-artemis] jeloba opened a new pull request #2820: Updated Apache BeanUtils to address CVE MLIST [commons-dev] 20190605 Re: [beanutils] Towards 1.10 MLIST [commons-issues] 20190615 [jira] [Reopened] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114 MLIST [commons-notifications] 20190528 Build failed in Jenkins: commons-beanutils #75 MISC https://lists.apache.org/thread.html/f3682772e62926b5c009eed63c62767021be6da0bb7427610751809f@%3Cissues.commons.apache.org%3E MLIST [commons-notifications] 20190528 Build failed in Jenkins: commons-beanutils #74 MISC https://lists.apache.org/thread.html/ffde3f266d3bde190b54c9202169e7918a92de7e7e0337d792dc7263@%3Cissues.commons.apache.org%3E GENTOO GLSA-201607-09 CONFIRM https://security.netapp.com/advisory/ntap-20140911-0001/ CONFIRM https://security.netapp.com/advisory/ntap-20180629-0006/ MISC https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html CONFIRM https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html MISC https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

cpe:/a:apache:storm:0.9.0.1

CVE-2014-0115

2017-10-30T12:29:00.317-04:00

2017-11-15T08:38:29.563-05:00

7.8

NETWORK

LOW

NONE

COMPLETE

NONE

http://nvd.nist.gov

2017-11-14T17:56:08.903-05:00

CONFIRM https://issues.apache.org/jira/browse/STORM-269 MLIST [storm-dev] 20140429 [jira] [Commented] (STORM-269) Any readable file exposed via UI log viewer Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to log.

cpe:/a:apache:struts:2.0.0 cpe:/a:apache:struts:2.0.1 cpe:/a:apache:struts:2.0.2 cpe:/a:apache:struts:2.0.3 cpe:/a:apache:struts:2.0.4 cpe:/a:apache:struts:2.0.5 cpe:/a:apache:struts:2.0.6 cpe:/a:apache:struts:2.0.7 cpe:/a:apache:struts:2.0.8 cpe:/a:apache:struts:2.0.9 cpe:/a:apache:struts:2.0.10 cpe:/a:apache:struts:2.0.11 cpe:/a:apache:struts:2.0.11.1 cpe:/a:apache:struts:2.0.11.2 cpe:/a:apache:struts:2.0.12 cpe:/a:apache:struts:2.0.13 cpe:/a:apache:struts:2.0.14 cpe:/a:apache:struts:2.1.0 cpe:/a:apache:struts:2.1.1 cpe:/a:apache:struts:2.1.2 cpe:/a:apache:struts:2.1.3 cpe:/a:apache:struts:2.1.4 cpe:/a:apache:struts:2.1.5 cpe:/a:apache:struts:2.1.6 cpe:/a:apache:struts:2.1.8 cpe:/a:apache:struts:2.1.8.1 cpe:/a:apache:struts:2.2.1 cpe:/a:apache:struts:2.2.1.1 cpe:/a:apache:struts:2.2.3 cpe:/a:apache:struts:2.2.3.1 cpe:/a:apache:struts:2.3.1 cpe:/a:apache:struts:2.3.1.1 cpe:/a:apache:struts:2.3.1.2 cpe:/a:apache:struts:2.3.3 cpe:/a:apache:struts:2.3.4 cpe:/a:apache:struts:2.3.4.1 cpe:/a:apache:struts:2.3.7 cpe:/a:apache:struts:2.3.8 cpe:/a:apache:struts:2.3.12 cpe:/a:apache:struts:2.3.14 cpe:/a:apache:struts:2.3.14.1 cpe:/a:apache:struts:2.3.14.2 cpe:/a:apache:struts:2.3.14.3 cpe:/a:apache:struts:2.3.15 cpe:/a:apache:struts:2.3.15.1 cpe:/a:apache:struts:2.3.15.2 cpe:/a:apache:struts:2.3.15.3 cpe:/a:apache:struts:2.3.16 cpe:/a:apache:struts:2.3.16.1 cpe:/a:apache:struts:2.3.16.2

CVE-2014-0116

2014-05-08T06:55:02.967-04:00

2019-08-12T17:15:12.703-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://struts.apache.org/release/2.3.x/docs/s2-022.html CONFIRM http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html BID 67218 CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and modify session state via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0113.

cpe:/a:apache:http_server:2.4.6 cpe:/a:apache:http_server:2.4.7 cpe:/a:apache:http_server:2.4.8 cpe:/a:apache:http_server:2.4.9 cpe:/o:apple:mac_os_x:10.10.2

CVE-2014-0117

2014-07-20T07:12:48.823-04:00

2019-08-15T05:15:27.327-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://advisories.mageia.org/MGASA-2014-0305.html CONFIRM http://httpd.apache.org/security/vulnerabilities_24.html APPLE APPLE-SA-2015-04-08-2 FULLDISC 20140722 Apache HTTPd - description of the CVE-2014-0117. CONFIRM http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c CONFIRM http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=1599486&r2=1610674&diff_format=h CONFIRM http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/proxy_util.c CONFIRM http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/proxy_util.c?r1=1609680&r2=1610674&diff_format=h CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html MISC http://zerodayinitiative.com/advisories/ZDI-14-239/ CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1120599 MLIST [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html CONFIRM https://support.apple.com/HT204659 The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.

cpe:/a:apache:http_server:2.4.1 cpe:/a:apache:http_server:2.4.2 cpe:/a:apache:http_server:2.4.3 cpe:/a:apache:http_server:2.4.4 cpe:/a:apache:http_server:2.4.6 cpe:/a:apache:http_server:2.4.7 cpe:/a:apache:http_server:2.4.8 cpe:/a:apache:http_server:2.4.9

CVE-2014-0118

2014-07-20T07:12:48.887-04:00

2017-12-08T21:29:02.887-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://advisories.mageia.org/MGASA-2014-0304.html CONFIRM http://advisories.mageia.org/MGASA-2014-0305.html CONFIRM http://httpd.apache.org/security/vulnerabilities_24.html APPLE APPLE-SA-2015-04-08-2 HP SSRT102066 HP HPSBMU03380 HP HPSBMU03409 HP HPSBUX03512 REDHAT RHSA-2014:1019 REDHAT RHSA-2014:1020 REDHAT RHSA-2014:1021 CONFIRM http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES CONFIRM http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/filters/mod_deflate.c CONFIRM http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/filters/mod_deflate.c?r1=1604353&r2=1610501&diff_format=h DEBIAN DSA-2989 MANDRIVA MDVSA-2014:142 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html BID 68745 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1120601 CONFIRM https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246 MLIST [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html CONFIRM https://puppet.com/security/cve/cve-2014-0118 GENTOO GLSA-201504-03 CONFIRM https://support.apple.com/HT204659 The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size.

cpe:/a:apache:tomcat:6 cpe:/a:apache:tomcat:6.0 cpe:/a:apache:tomcat:6.0.0 cpe:/a:apache:tomcat:6.0.0:alpha cpe:/a:apache:tomcat:6.0.1 cpe:/a:apache:tomcat:6.0.1:alpha cpe:/a:apache:tomcat:6.0.2 cpe:/a:apache:tomcat:6.0.2:alpha cpe:/a:apache:tomcat:6.0.2:beta cpe:/a:apache:tomcat:6.0.3 cpe:/a:apache:tomcat:6.0.4 cpe:/a:apache:tomcat:6.0.4:alpha cpe:/a:apache:tomcat:6.0.5 cpe:/a:apache:tomcat:6.0.6 cpe:/a:apache:tomcat:6.0.6:alpha cpe:/a:apache:tomcat:6.0.7 cpe:/a:apache:tomcat:6.0.7:alpha cpe:/a:apache:tomcat:6.0.7:beta cpe:/a:apache:tomcat:6.0.8 cpe:/a:apache:tomcat:6.0.8:alpha cpe:/a:apache:tomcat:6.0.9 cpe:/a:apache:tomcat:6.0.9:beta cpe:/a:apache:tomcat:6.0.10 cpe:/a:apache:tomcat:6.0.11 cpe:/a:apache:tomcat:6.0.12 cpe:/a:apache:tomcat:6.0.13 cpe:/a:apache:tomcat:6.0.14 cpe:/a:apache:tomcat:6.0.15 cpe:/a:apache:tomcat:6.0.16 cpe:/a:apache:tomcat:6.0.17 cpe:/a:apache:tomcat:6.0.18 cpe:/a:apache:tomcat:6.0.19 cpe:/a:apache:tomcat:6.0.20 cpe:/a:apache:tomcat:6.0.24 cpe:/a:apache:tomcat:6.0.26 cpe:/a:apache:tomcat:6.0.27 cpe:/a:apache:tomcat:6.0.28 cpe:/a:apache:tomcat:6.0.29 cpe:/a:apache:tomcat:6.0.30 cpe:/a:apache:tomcat:6.0.31 cpe:/a:apache:tomcat:6.0.32 cpe:/a:apache:tomcat:6.0.33 cpe:/a:apache:tomcat:6.0.35 cpe:/a:apache:tomcat:6.0.36 cpe:/a:apache:tomcat:6.0.37 cpe:/a:apache:tomcat:6.0.39 cpe:/a:apache:tomcat:7.0.0 cpe:/a:apache:tomcat:7.0.0:beta cpe:/a:apache:tomcat:7.0.1 cpe:/a:apache:tomcat:7.0.2 cpe:/a:apache:tomcat:7.0.2:beta cpe:/a:apache:tomcat:7.0.3 cpe:/a:apache:tomcat:7.0.4 cpe:/a:apache:tomcat:7.0.4:beta cpe:/a:apache:tomcat:7.0.5 cpe:/a:apache:tomcat:7.0.6 cpe:/a:apache:tomcat:7.0.7 cpe:/a:apache:tomcat:7.0.8 cpe:/a:apache:tomcat:7.0.9 cpe:/a:apache:tomcat:7.0.10 cpe:/a:apache:tomcat:7.0.11 cpe:/a:apache:tomcat:7.0.12 cpe:/a:apache:tomcat:7.0.13 cpe:/a:apache:tomcat:7.0.14 cpe:/a:apache:tomcat:7.0.15 cpe:/a:apache:tomcat:7.0.16 cpe:/a:apache:tomcat:7.0.17 cpe:/a:apache:tomcat:7.0.18 cpe:/a:apache:tomcat:7.0.19 cpe:/a:apache:tomcat:7.0.20 cpe:/a:apache:tomcat:7.0.21 cpe:/a:apache:tomcat:7.0.22 cpe:/a:apache:tomcat:7.0.23 cpe:/a:apache:tomcat:7.0.24 cpe:/a:apache:tomcat:7.0.25 cpe:/a:apache:tomcat:7.0.26 cpe:/a:apache:tomcat:7.0.27 cpe:/a:apache:tomcat:7.0.28 cpe:/a:apache:tomcat:7.0.29 cpe:/a:apache:tomcat:7.0.30 cpe:/a:apache:tomcat:7.0.31 cpe:/a:apache:tomcat:7.0.32 cpe:/a:apache:tomcat:7.0.33 cpe:/a:apache:tomcat:7.0.34 cpe:/a:apache:tomcat:7.0.35 cpe:/a:apache:tomcat:7.0.36 cpe:/a:apache:tomcat:7.0.37 cpe:/a:apache:tomcat:7.0.38 cpe:/a:apache:tomcat:7.0.39 cpe:/a:apache:tomcat:7.0.40 cpe:/a:apache:tomcat:7.0.41 cpe:/a:apache:tomcat:7.0.42 cpe:/a:apache:tomcat:7.0.43 cpe:/a:apache:tomcat:7.0.44 cpe:/a:apache:tomcat:7.0.45 cpe:/a:apache:tomcat:7.0.46 cpe:/a:apache:tomcat:7.0.47 cpe:/a:apache:tomcat:7.0.48 cpe:/a:apache:tomcat:7.0.49 cpe:/a:apache:tomcat:7.0.50 cpe:/a:apache:tomcat:7.0.52 cpe:/a:apache:tomcat:7.0.53 cpe:/a:apache:tomcat:8.0.0:rc1 cpe:/a:apache:tomcat:8.0.0:rc10 cpe:/a:apache:tomcat:8.0.0:rc2 cpe:/a:apache:tomcat:8.0.0:rc5 cpe:/a:apache:tomcat:8.0.1 cpe:/a:apache:tomcat:8.0.3 cpe:/a:apache:tomcat:8.0.5

CVE-2014-0119

2014-05-31T07:17:13.357-04:00

2019-04-15T12:29:52.273-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://advisories.mageia.org/MGASA-2014-0268.html HP HPSBUX03102 HP HPSBOV03503 REDHAT RHSA-2015:0675 REDHAT RHSA-2015:0720 REDHAT RHSA-2015:0765 FULLDISC 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities FULLDISC 20140527 [SECURITY] CVE-2014-0119 Apache Tomcat information disclosure CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1588193 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1588199 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1589640 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1589837 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1589980 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1589983 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1589985 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1589990 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1589992 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1589997 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1590028 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1590036 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1593815 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1593821 CONFIRM http://tomcat.apache.org/security-6.html CONFIRM http://tomcat.apache.org/security-7.html CONFIRM http://tomcat.apache.org/security-8.html DEBIAN DSA-3530 DEBIAN DSA-3552 MANDRIVA MDVSA-2015:052 MANDRIVA MDVSA-2015:053 MANDRIVA MDVSA-2015:084 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html BUGTRAQ 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities BID 67669 SECTRACK 1030298 UBUNTU USN-2654-1 CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0012.html CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21678231 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21681528 CONFIRM https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013 MLIST [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ MLIST [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ MLIST [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ MLIST [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

cpe:/a:hawt:hawtio:1.2.2 cpe:/a:redhat:jboss_fuse:6.1.0:beta

CVE-2014-0120

2017-12-29T17:29:00.270-05:00

2018-01-11T08:46:41.953-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2018-01-10T16:50:38.250-05:00

CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1072681 CONFIRM https://github.com/hawtio/hawtio/commit/b4e23e002639c274a2f687ada980118512f06113 MISC https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdf Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for requests that run commands on the Karaf server, as demonstrated by running "shutdown -f."

cpe:/a:hawt:hawtio:1.2.2 cpe:/a:redhat:jboss_fuse:6.1.0:beta

CVE-2014-0121

2017-12-29T17:29:00.317-05:00

2018-01-11T08:49:05.210-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2018-01-10T15:32:45.233-05:00

CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1072716 CONFIRM https://github.com/hawtio/hawtio/commit/5289715e4f2657562fdddcbad830a30969b96e1e MISC https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdf The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k parameter.

cpe:/a:moodle:moodle:2.0 cpe:/a:moodle:moodle:2.0.1 cpe:/a:moodle:moodle:2.0.2 cpe:/a:moodle:moodle:2.0.3 cpe:/a:moodle:moodle:2.0.4 cpe:/a:moodle:moodle:2.0.5 cpe:/a:moodle:moodle:2.0.6 cpe:/a:moodle:moodle:2.0.7 cpe:/a:moodle:moodle:2.0.8 cpe:/a:moodle:moodle:2.0.9 cpe:/a:moodle:moodle:2.1 cpe:/a:moodle:moodle:2.1.1 cpe:/a:moodle:moodle:2.1.2 cpe:/a:moodle:moodle:2.1.3 cpe:/a:moodle:moodle:2.1.4 cpe:/a:moodle:moodle:2.1.5 cpe:/a:moodle:moodle:2.1.6 cpe:/a:moodle:moodle:2.1.7 cpe:/a:moodle:moodle:2.1.8 cpe:/a:moodle:moodle:2.1.9 cpe:/a:moodle:moodle:2.1.10 cpe:/a:moodle:moodle:2.2 cpe:/a:moodle:moodle:2.2.1 cpe:/a:moodle:moodle:2.2.2 cpe:/a:moodle:moodle:2.2.3 cpe:/a:moodle:moodle:2.2.4 cpe:/a:moodle:moodle:2.2.5 cpe:/a:moodle:moodle:2.2.6 cpe:/a:moodle:moodle:2.2.7 cpe:/a:moodle:moodle:2.2.8 cpe:/a:moodle:moodle:2.2.9 cpe:/a:moodle:moodle:2.2.10 cpe:/a:moodle:moodle:2.2.11 cpe:/a:moodle:moodle:2.3 cpe:/a:moodle:moodle:2.3.1 cpe:/a:moodle:moodle:2.3.2 cpe:/a:moodle:moodle:2.3.3 cpe:/a:moodle:moodle:2.3.4 cpe:/a:moodle:moodle:2.3.5 cpe:/a:moodle:moodle:2.3.6 cpe:/a:moodle:moodle:2.3.7 cpe:/a:moodle:moodle:2.3.8 cpe:/a:moodle:moodle:2.3.9 cpe:/a:moodle:moodle:2.3.10 cpe:/a:moodle:moodle:2.3.11 cpe:/a:moodle:moodle:2.4 cpe:/a:moodle:moodle:2.4.1 cpe:/a:moodle:moodle:2.4.2 cpe:/a:moodle:moodle:2.4.3 cpe:/a:moodle:moodle:2.4.4 cpe:/a:moodle:moodle:2.4.5 cpe:/a:moodle:moodle:2.4.6 cpe:/a:moodle:moodle:2.4.7 cpe:/a:moodle:moodle:2.4.8 cpe:/a:moodle:moodle:2.5 cpe:/a:moodle:moodle:2.5.1 cpe:/a:moodle:moodle:2.5.2 cpe:/a:moodle:moodle:2.5.3 cpe:/a:moodle:moodle:2.5.4 cpe:/a:moodle:moodle:2.6 cpe:/a:moodle:moodle:2.6.1

CVE-2014-0122

2014-03-24T10:20:39.370-04:00

2014-03-24T11:28:28.697-04:00

4.9

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2014-03-24T11:28:28.007-04:00

CONFIRM http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-44082 MLIST [oss-security] 20140317 Moodle security notifications public CONFIRM https://moodle.org/mod/forum/discuss.php?d=256418 mod/chat/chat_ajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly check for the mod/chat:chat capability during chat sessions, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by remaining in a chat session after an intra-session capability removal by an administrator.

cpe:/a:moodle:moodle:2.0 cpe:/a:moodle:moodle:2.0.1 cpe:/a:moodle:moodle:2.0.2 cpe:/a:moodle:moodle:2.0.3 cpe:/a:moodle:moodle:2.0.4 cpe:/a:moodle:moodle:2.0.5 cpe:/a:moodle:moodle:2.0.6 cpe:/a:moodle:moodle:2.0.7 cpe:/a:moodle:moodle:2.0.8 cpe:/a:moodle:moodle:2.0.9 cpe:/a:moodle:moodle:2.1 cpe:/a:moodle:moodle:2.1.1 cpe:/a:moodle:moodle:2.1.2 cpe:/a:moodle:moodle:2.1.3 cpe:/a:moodle:moodle:2.1.4 cpe:/a:moodle:moodle:2.1.5 cpe:/a:moodle:moodle:2.1.6 cpe:/a:moodle:moodle:2.1.7 cpe:/a:moodle:moodle:2.1.8 cpe:/a:moodle:moodle:2.1.9 cpe:/a:moodle:moodle:2.1.10 cpe:/a:moodle:moodle:2.2 cpe:/a:moodle:moodle:2.2.1 cpe:/a:moodle:moodle:2.2.2 cpe:/a:moodle:moodle:2.2.3 cpe:/a:moodle:moodle:2.2.4 cpe:/a:moodle:moodle:2.2.5 cpe:/a:moodle:moodle:2.2.6 cpe:/a:moodle:moodle:2.2.7 cpe:/a:moodle:moodle:2.2.8 cpe:/a:moodle:moodle:2.2.9 cpe:/a:moodle:moodle:2.2.10 cpe:/a:moodle:moodle:2.2.11 cpe:/a:moodle:moodle:2.3 cpe:/a:moodle:moodle:2.3.1 cpe:/a:moodle:moodle:2.3.2 cpe:/a:moodle:moodle:2.3.3 cpe:/a:moodle:moodle:2.3.4 cpe:/a:moodle:moodle:2.3.5 cpe:/a:moodle:moodle:2.3.6 cpe:/a:moodle:moodle:2.3.7 cpe:/a:moodle:moodle:2.3.8 cpe:/a:moodle:moodle:2.3.9 cpe:/a:moodle:moodle:2.3.10 cpe:/a:moodle:moodle:2.3.11 cpe:/a:moodle:moodle:2.4 cpe:/a:moodle:moodle:2.4.1 cpe:/a:moodle:moodle:2.4.2 cpe:/a:moodle:moodle:2.4.3 cpe:/a:moodle:moodle:2.4.4 cpe:/a:moodle:moodle:2.4.5 cpe:/a:moodle:moodle:2.4.6 cpe:/a:moodle:moodle:2.4.7 cpe:/a:moodle:moodle:2.4.8 cpe:/a:moodle:moodle:2.5 cpe:/a:moodle:moodle:2.5.1 cpe:/a:moodle:moodle:2.5.2 cpe:/a:moodle:moodle:2.5.3 cpe:/a:moodle:moodle:2.5.4 cpe:/a:moodle:moodle:2.6 cpe:/a:moodle:moodle:2.6.1

CVE-2014-0123

2014-03-24T10:20:39.370-04:00

2014-03-24T18:39:47.670-04:00

4.9

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2014-03-24T07:26:46.000-04:00

CONFIRM http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39990 MLIST [oss-security] 20140317 Moodle security notifications public CONFIRM https://moodle.org/mod/forum/discuss.php?d=256419 The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly restrict (1) view and (2) edit access, which allows remote authenticated users to perform wiki operations by leveraging the student role and using the Recent Activity block to reach the individual wiki of an arbitrary student.

cpe:/a:moodle:moodle:2.0 cpe:/a:moodle:moodle:2.0.1 cpe:/a:moodle:moodle:2.0.2 cpe:/a:moodle:moodle:2.0.3 cpe:/a:moodle:moodle:2.0.4 cpe:/a:moodle:moodle:2.0.5 cpe:/a:moodle:moodle:2.0.6 cpe:/a:moodle:moodle:2.0.7 cpe:/a:moodle:moodle:2.0.8 cpe:/a:moodle:moodle:2.0.9 cpe:/a:moodle:moodle:2.1 cpe:/a:moodle:moodle:2.1.1 cpe:/a:moodle:moodle:2.1.2 cpe:/a:moodle:moodle:2.1.3 cpe:/a:moodle:moodle:2.1.4 cpe:/a:moodle:moodle:2.1.5 cpe:/a:moodle:moodle:2.1.6 cpe:/a:moodle:moodle:2.1.7 cpe:/a:moodle:moodle:2.1.8 cpe:/a:moodle:moodle:2.1.9 cpe:/a:moodle:moodle:2.1.10 cpe:/a:moodle:moodle:2.2 cpe:/a:moodle:moodle:2.2.1 cpe:/a:moodle:moodle:2.2.2 cpe:/a:moodle:moodle:2.2.3 cpe:/a:moodle:moodle:2.2.4 cpe:/a:moodle:moodle:2.2.5 cpe:/a:moodle:moodle:2.2.6 cpe:/a:moodle:moodle:2.2.7 cpe:/a:moodle:moodle:2.2.8 cpe:/a:moodle:moodle:2.2.9 cpe:/a:moodle:moodle:2.2.10 cpe:/a:moodle:moodle:2.2.11 cpe:/a:moodle:moodle:2.3 cpe:/a:moodle:moodle:2.3.1 cpe:/a:moodle:moodle:2.3.2 cpe:/a:moodle:moodle:2.3.3 cpe:/a:moodle:moodle:2.3.4 cpe:/a:moodle:moodle:2.3.5 cpe:/a:moodle:moodle:2.3.6 cpe:/a:moodle:moodle:2.3.7 cpe:/a:moodle:moodle:2.3.8 cpe:/a:moodle:moodle:2.3.9 cpe:/a:moodle:moodle:2.3.10 cpe:/a:moodle:moodle:2.3.11 cpe:/a:moodle:moodle:2.4 cpe:/a:moodle:moodle:2.4.1 cpe:/a:moodle:moodle:2.4.2 cpe:/a:moodle:moodle:2.4.3 cpe:/a:moodle:moodle:2.4.4 cpe:/a:moodle:moodle:2.4.5 cpe:/a:moodle:moodle:2.4.6 cpe:/a:moodle:moodle:2.4.7 cpe:/a:moodle:moodle:2.4.8 cpe:/a:moodle:moodle:2.5 cpe:/a:moodle:moodle:2.5.1 cpe:/a:moodle:moodle:2.5.2 cpe:/a:moodle:moodle:2.5.3 cpe:/a:moodle:moodle:2.5.4 cpe:/a:moodle:moodle:2.6 cpe:/a:moodle:moodle:2.6.1

CVE-2014-0124

2014-03-24T10:20:39.387-04:00

2014-03-24T18:37:38.167-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2014-03-24T11:28:53.027-04:00

CONFIRM http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43916 MLIST [oss-security] 20140317 Moodle security notifications public CONFIRM https://moodle.org/mod/forum/discuss.php?d=256421 The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/override_form.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 do not properly restrict the display of e-mail addresses, which allows remote authenticated users to obtain sensitive information by using the (1) Forum or (2) Quiz module.

cpe:/a:moodle:moodle:2.0 cpe:/a:moodle:moodle:2.0.1 cpe:/a:moodle:moodle:2.0.2 cpe:/a:moodle:moodle:2.0.3 cpe:/a:moodle:moodle:2.0.4 cpe:/a:moodle:moodle:2.0.5 cpe:/a:moodle:moodle:2.0.6 cpe:/a:moodle:moodle:2.0.7 cpe:/a:moodle:moodle:2.0.8 cpe:/a:moodle:moodle:2.0.9 cpe:/a:moodle:moodle:2.1 cpe:/a:moodle:moodle:2.1.1 cpe:/a:moodle:moodle:2.1.2 cpe:/a:moodle:moodle:2.1.3 cpe:/a:moodle:moodle:2.1.4 cpe:/a:moodle:moodle:2.1.5 cpe:/a:moodle:moodle:2.1.6 cpe:/a:moodle:moodle:2.1.7 cpe:/a:moodle:moodle:2.1.8 cpe:/a:moodle:moodle:2.1.9 cpe:/a:moodle:moodle:2.1.10 cpe:/a:moodle:moodle:2.2 cpe:/a:moodle:moodle:2.2.1 cpe:/a:moodle:moodle:2.2.2 cpe:/a:moodle:moodle:2.2.3 cpe:/a:moodle:moodle:2.2.4 cpe:/a:moodle:moodle:2.2.5 cpe:/a:moodle:moodle:2.2.6 cpe:/a:moodle:moodle:2.2.7 cpe:/a:moodle:moodle:2.2.8 cpe:/a:moodle:moodle:2.2.9 cpe:/a:moodle:moodle:2.2.10 cpe:/a:moodle:moodle:2.2.11 cpe:/a:moodle:moodle:2.3 cpe:/a:moodle:moodle:2.3.1 cpe:/a:moodle:moodle:2.3.2 cpe:/a:moodle:moodle:2.3.3 cpe:/a:moodle:moodle:2.3.4 cpe:/a:moodle:moodle:2.3.5 cpe:/a:moodle:moodle:2.3.6 cpe:/a:moodle:moodle:2.3.7 cpe:/a:moodle:moodle:2.3.8 cpe:/a:moodle:moodle:2.3.9 cpe:/a:moodle:moodle:2.3.10 cpe:/a:moodle:moodle:2.3.11 cpe:/a:moodle:moodle:2.4 cpe:/a:moodle:moodle:2.4.1 cpe:/a:moodle:moodle:2.4.2 cpe:/a:moodle:moodle:2.4.3 cpe:/a:moodle:moodle:2.4.4 cpe:/a:moodle:moodle:2.4.5 cpe:/a:moodle:moodle:2.4.6 cpe:/a:moodle:moodle:2.4.7 cpe:/a:moodle:moodle:2.4.8 cpe:/a:moodle:moodle:2.5 cpe:/a:moodle:moodle:2.5.1 cpe:/a:moodle:moodle:2.5.2 cpe:/a:moodle:moodle:2.5.3 cpe:/a:moodle:moodle:2.5.4 cpe:/a:moodle:moodle:2.6 cpe:/a:moodle:moodle:2.6.1

CVE-2014-0125

2014-03-24T10:20:39.400-04:00

2014-03-24T18:37:09.290-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-03-24T07:30:13.000-04:00

CONFIRM http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-29409 MLIST [oss-security] 20140317 Moodle security notifications public CONFIRM https://moodle.org/mod/forum/discuss.php?d=256422 repository/alfresco/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 places a session key in a URL, which allows remote attackers to bypass intended Alfresco Repository file restrictions by impersonating a file's owner.

cpe:/a:moodle:moodle:2.0 cpe:/a:moodle:moodle:2.0.1 cpe:/a:moodle:moodle:2.0.2 cpe:/a:moodle:moodle:2.0.3 cpe:/a:moodle:moodle:2.0.4 cpe:/a:moodle:moodle:2.0.5 cpe:/a:moodle:moodle:2.0.6 cpe:/a:moodle:moodle:2.0.7 cpe:/a:moodle:moodle:2.0.8 cpe:/a:moodle:moodle:2.0.9 cpe:/a:moodle:moodle:2.1 cpe:/a:moodle:moodle:2.1.1 cpe:/a:moodle:moodle:2.1.2 cpe:/a:moodle:moodle:2.1.3 cpe:/a:moodle:moodle:2.1.4 cpe:/a:moodle:moodle:2.1.5 cpe:/a:moodle:moodle:2.1.6 cpe:/a:moodle:moodle:2.1.7 cpe:/a:moodle:moodle:2.1.8 cpe:/a:moodle:moodle:2.1.9 cpe:/a:moodle:moodle:2.1.10 cpe:/a:moodle:moodle:2.2 cpe:/a:moodle:moodle:2.2.1 cpe:/a:moodle:moodle:2.2.2 cpe:/a:moodle:moodle:2.2.3 cpe:/a:moodle:moodle:2.2.4 cpe:/a:moodle:moodle:2.2.5 cpe:/a:moodle:moodle:2.2.6 cpe:/a:moodle:moodle:2.2.7 cpe:/a:moodle:moodle:2.2.8 cpe:/a:moodle:moodle:2.2.9 cpe:/a:moodle:moodle:2.2.10 cpe:/a:moodle:moodle:2.2.11 cpe:/a:moodle:moodle:2.3 cpe:/a:moodle:moodle:2.3.1 cpe:/a:moodle:moodle:2.3.2 cpe:/a:moodle:moodle:2.3.3 cpe:/a:moodle:moodle:2.3.4 cpe:/a:moodle:moodle:2.3.5 cpe:/a:moodle:moodle:2.3.6 cpe:/a:moodle:moodle:2.3.7 cpe:/a:moodle:moodle:2.3.8 cpe:/a:moodle:moodle:2.3.9 cpe:/a:moodle:moodle:2.3.10 cpe:/a:moodle:moodle:2.3.11 cpe:/a:moodle:moodle:2.4 cpe:/a:moodle:moodle:2.4.1 cpe:/a:moodle:moodle:2.4.2 cpe:/a:moodle:moodle:2.4.3 cpe:/a:moodle:moodle:2.4.4 cpe:/a:moodle:moodle:2.4.5 cpe:/a:moodle:moodle:2.4.6 cpe:/a:moodle:moodle:2.4.7 cpe:/a:moodle:moodle:2.4.8 cpe:/a:moodle:moodle:2.5 cpe:/a:moodle:moodle:2.5.1 cpe:/a:moodle:moodle:2.5.2 cpe:/a:moodle:moodle:2.5.3 cpe:/a:moodle:moodle:2.5.4 cpe:/a:moodle:moodle:2.6 cpe:/a:moodle:moodle:2.6.1

CVE-2014-0126

2014-03-24T10:20:39.400-04:00

2014-03-24T18:34:58.520-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2014-03-24T11:31:10.233-04:00

CONFIRM http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43146 MLIST [oss-security] 20140317 Moodle security notifications public CONFIRM https://moodle.org/mod/forum/discuss.php?d=256423 Cross-site request forgery (CSRF) vulnerability in enrol/imsenterprise/importnow.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests that import an IMS Enterprise file.

cpe:/a:moodle:moodle:2.0 cpe:/a:moodle:moodle:2.0.1 cpe:/a:moodle:moodle:2.0.2 cpe:/a:moodle:moodle:2.0.3 cpe:/a:moodle:moodle:2.0.4 cpe:/a:moodle:moodle:2.0.5 cpe:/a:moodle:moodle:2.0.6 cpe:/a:moodle:moodle:2.0.7 cpe:/a:moodle:moodle:2.0.8 cpe:/a:moodle:moodle:2.0.9 cpe:/a:moodle:moodle:2.1 cpe:/a:moodle:moodle:2.1.1 cpe:/a:moodle:moodle:2.1.2 cpe:/a:moodle:moodle:2.1.3 cpe:/a:moodle:moodle:2.1.4 cpe:/a:moodle:moodle:2.1.5 cpe:/a:moodle:moodle:2.1.6 cpe:/a:moodle:moodle:2.1.7 cpe:/a:moodle:moodle:2.1.8 cpe:/a:moodle:moodle:2.1.9 cpe:/a:moodle:moodle:2.1.10 cpe:/a:moodle:moodle:2.2 cpe:/a:moodle:moodle:2.2.1 cpe:/a:moodle:moodle:2.2.2 cpe:/a:moodle:moodle:2.2.3 cpe:/a:moodle:moodle:2.2.4 cpe:/a:moodle:moodle:2.2.5 cpe:/a:moodle:moodle:2.2.6 cpe:/a:moodle:moodle:2.2.7 cpe:/a:moodle:moodle:2.2.8 cpe:/a:moodle:moodle:2.2.9 cpe:/a:moodle:moodle:2.2.10 cpe:/a:moodle:moodle:2.2.11 cpe:/a:moodle:moodle:2.3 cpe:/a:moodle:moodle:2.3.1 cpe:/a:moodle:moodle:2.3.2 cpe:/a:moodle:moodle:2.3.3 cpe:/a:moodle:moodle:2.3.4 cpe:/a:moodle:moodle:2.3.5 cpe:/a:moodle:moodle:2.3.6 cpe:/a:moodle:moodle:2.3.7 cpe:/a:moodle:moodle:2.3.8 cpe:/a:moodle:moodle:2.3.9 cpe:/a:moodle:moodle:2.3.10 cpe:/a:moodle:moodle:2.3.11 cpe:/a:moodle:moodle:2.4 cpe:/a:moodle:moodle:2.4.1 cpe:/a:moodle:moodle:2.4.2 cpe:/a:moodle:moodle:2.4.3 cpe:/a:moodle:moodle:2.4.4 cpe:/a:moodle:moodle:2.4.5 cpe:/a:moodle:moodle:2.4.6 cpe:/a:moodle:moodle:2.4.7 cpe:/a:moodle:moodle:2.4.8 cpe:/a:moodle:moodle:2.5 cpe:/a:moodle:moodle:2.5.1 cpe:/a:moodle:moodle:2.5.2 cpe:/a:moodle:moodle:2.5.3 cpe:/a:moodle:moodle:2.5.4 cpe:/a:moodle:moodle:2.6 cpe:/a:moodle:moodle:2.6.1

CVE-2014-0127

2014-03-24T10:20:39.417-04:00

2014-03-24T11:33:00.220-04:00

4.9

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2014-03-24T11:32:59.767-04:00

CONFIRM http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43656 MLIST [oss-security] 20140317 Moodle security notifications public CONFIRM https://moodle.org/mod/forum/discuss.php?d=256417 The time-validation implementation in (1) mod/feedback/complete.php and (2) mod/feedback/complete_guest.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote authenticated users to bypass intended restrictions on starting a Feedback activity by choosing an unavailable time.

cpe:/a:squid-cache:squid:3.1 cpe:/a:squid-cache:squid:3.1.0.1 cpe:/a:squid-cache:squid:3.1.0.2 cpe:/a:squid-cache:squid:3.1.0.3 cpe:/a:squid-cache:squid:3.1.0.4 cpe:/a:squid-cache:squid:3.1.0.5 cpe:/a:squid-cache:squid:3.1.0.6 cpe:/a:squid-cache:squid:3.1.0.7 cpe:/a:squid-cache:squid:3.1.0.8 cpe:/a:squid-cache:squid:3.1.0.9 cpe:/a:squid-cache:squid:3.1.0.10 cpe:/a:squid-cache:squid:3.1.0.11 cpe:/a:squid-cache:squid:3.1.0.12 cpe:/a:squid-cache:squid:3.1.0.13 cpe:/a:squid-cache:squid:3.1.0.14 cpe:/a:squid-cache:squid:3.1.0.15 cpe:/a:squid-cache:squid:3.1.0.16 cpe:/a:squid-cache:squid:3.1.0.17 cpe:/a:squid-cache:squid:3.1.0.18 cpe:/a:squid-cache:squid:3.1.1 cpe:/a:squid-cache:squid:3.1.2 cpe:/a:squid-cache:squid:3.1.3 cpe:/a:squid-cache:squid:3.1.4 cpe:/a:squid-cache:squid:3.1.5 cpe:/a:squid-cache:squid:3.1.5.1 cpe:/a:squid-cache:squid:3.1.6 cpe:/a:squid-cache:squid:3.1.7 cpe:/a:squid-cache:squid:3.1.8 cpe:/a:squid-cache:squid:3.1.9 cpe:/a:squid-cache:squid:3.1.10 cpe:/a:squid-cache:squid:3.1.11 cpe:/a:squid-cache:squid:3.1.12 cpe:/a:squid-cache:squid:3.1.13 cpe:/a:squid-cache:squid:3.1.14 cpe:/a:squid-cache:squid:3.1.15 cpe:/a:squid-cache:squid:3.2.0.1 cpe:/a:squid-cache:squid:3.2.0.2 cpe:/a:squid-cache:squid:3.2.0.3 cpe:/a:squid-cache:squid:3.2.0.4 cpe:/a:squid-cache:squid:3.2.0.5 cpe:/a:squid-cache:squid:3.2.0.6 cpe:/a:squid-cache:squid:3.2.0.7 cpe:/a:squid-cache:squid:3.2.0.8 cpe:/a:squid-cache:squid:3.2.0.9 cpe:/a:squid-cache:squid:3.2.0.10 cpe:/a:squid-cache:squid:3.2.0.11 cpe:/a:squid-cache:squid:3.2.0.12 cpe:/a:squid-cache:squid:3.2.0.13 cpe:/a:squid-cache:squid:3.2.0.14 cpe:/a:squid-cache:squid:3.2.0.15 cpe:/a:squid-cache:squid:3.2.0.16 cpe:/a:squid-cache:squid:3.2.0.17 cpe:/a:squid-cache:squid:3.2.0.18 cpe:/a:squid-cache:squid:3.2.0.19 cpe:/a:squid-cache:squid:3.2.1 cpe:/a:squid-cache:squid:3.2.2 cpe:/a:squid-cache:squid:3.2.3 cpe:/a:squid-cache:squid:3.2.4 cpe:/a:squid-cache:squid:3.2.5 cpe:/a:squid-cache:squid:3.2.6 cpe:/a:squid-cache:squid:3.2.7 cpe:/a:squid-cache:squid:3.2.8 cpe:/a:squid-cache:squid:3.2.9 cpe:/a:squid-cache:squid:3.2.10 cpe:/a:squid-cache:squid:3.2.11 cpe:/a:squid-cache:squid:3.2.12 cpe:/a:squid-cache:squid:3.3.0 cpe:/a:squid-cache:squid:3.3.0.2 cpe:/a:squid-cache:squid:3.3.0.3 cpe:/a:squid-cache:squid:3.3.1 cpe:/a:squid-cache:squid:3.3.2 cpe:/a:squid-cache:squid:3.3.3 cpe:/a:squid-cache:squid:3.3.4 cpe:/a:squid-cache:squid:3.3.5 cpe:/a:squid-cache:squid:3.3.6 cpe:/a:squid-cache:squid:3.3.7 cpe:/a:squid-cache:squid:3.3.8 cpe:/a:squid-cache:squid:3.3.9 cpe:/a:squid-cache:squid:3.3.10 cpe:/a:squid-cache:squid:3.3.11 cpe:/a:squid-cache:squid:3.4.0.1 cpe:/a:squid-cache:squid:3.4.0.2 cpe:/a:squid-cache:squid:3.4.0.3 cpe:/a:squid-cache:squid:3.4.1 cpe:/a:squid-cache:squid:3.4.2 cpe:/a:squid-cache:squid:3.4.3 cpe:/o:opensuse:opensuse:11.4

CVE-2014-0128

2014-04-14T11:09:05.710-04:00

2018-10-30T12:27:33.420-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SUSE SUSE-SU-2016:1996 SUSE SUSE-SU-2016:2089 SUSE openSUSE-SU-2014:0513 SUSE openSUSE-SU-2014:0559 CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html BID 66112 CONFIRM http://www.squid-cache.org/Advisories/SQUID-2014_1.txt Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management.

cpe:/a:moodle:moodle:2.0 cpe:/a:moodle:moodle:2.0.1 cpe:/a:moodle:moodle:2.0.2 cpe:/a:moodle:moodle:2.0.3 cpe:/a:moodle:moodle:2.0.4 cpe:/a:moodle:moodle:2.0.5 cpe:/a:moodle:moodle:2.0.6 cpe:/a:moodle:moodle:2.0.7 cpe:/a:moodle:moodle:2.0.8 cpe:/a:moodle:moodle:2.0.9 cpe:/a:moodle:moodle:2.1 cpe:/a:moodle:moodle:2.1.1 cpe:/a:moodle:moodle:2.1.2 cpe:/a:moodle:moodle:2.1.3 cpe:/a:moodle:moodle:2.1.4 cpe:/a:moodle:moodle:2.1.5 cpe:/a:moodle:moodle:2.1.6 cpe:/a:moodle:moodle:2.1.7 cpe:/a:moodle:moodle:2.1.8 cpe:/a:moodle:moodle:2.1.9 cpe:/a:moodle:moodle:2.1.10 cpe:/a:moodle:moodle:2.2 cpe:/a:moodle:moodle:2.2.1 cpe:/a:moodle:moodle:2.2.2 cpe:/a:moodle:moodle:2.2.3 cpe:/a:moodle:moodle:2.2.4 cpe:/a:moodle:moodle:2.2.5 cpe:/a:moodle:moodle:2.2.6 cpe:/a:moodle:moodle:2.2.7 cpe:/a:moodle:moodle:2.2.8 cpe:/a:moodle:moodle:2.2.9 cpe:/a:moodle:moodle:2.2.10 cpe:/a:moodle:moodle:2.2.11 cpe:/a:moodle:moodle:2.3 cpe:/a:moodle:moodle:2.3.1 cpe:/a:moodle:moodle:2.3.2 cpe:/a:moodle:moodle:2.3.3 cpe:/a:moodle:moodle:2.3.4 cpe:/a:moodle:moodle:2.3.5 cpe:/a:moodle:moodle:2.3.6 cpe:/a:moodle:moodle:2.3.7 cpe:/a:moodle:moodle:2.3.8 cpe:/a:moodle:moodle:2.3.9 cpe:/a:moodle:moodle:2.3.10 cpe:/a:moodle:moodle:2.3.11 cpe:/a:moodle:moodle:2.4 cpe:/a:moodle:moodle:2.4.1 cpe:/a:moodle:moodle:2.4.2 cpe:/a:moodle:moodle:2.4.3 cpe:/a:moodle:moodle:2.4.4 cpe:/a:moodle:moodle:2.4.5 cpe:/a:moodle:moodle:2.4.6 cpe:/a:moodle:moodle:2.4.7 cpe:/a:moodle:moodle:2.4.8 cpe:/a:moodle:moodle:2.5 cpe:/a:moodle:moodle:2.5.1 cpe:/a:moodle:moodle:2.5.2 cpe:/a:moodle:moodle:2.5.3 cpe:/a:moodle:moodle:2.5.4 cpe:/a:moodle:moodle:2.6 cpe:/a:moodle:moodle:2.6.1

CVE-2014-0129

2014-03-24T10:20:39.417-04:00

2014-03-24T18:33:25.890-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-03-24T07:41:34.000-04:00

CONFIRM http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-44140 MLIST [oss-security] 20140317 Moodle security notifications public CONFIRM https://moodle.org/mod/forum/discuss.php?d=256424 badges/mybadges.php in Moodle 2.5.x before 2.5.5 and 2.6.x before 2.6.2 does not properly track the user to whom a badge was issued, which allows remote authenticated users to modify the visibility of an arbitrary badge via unspecified vectors.

cpe:/a:redhat:subscription_asset_manager:1.3.0 cpe:/a:rubyonrails:rails:3.2.0 cpe:/a:rubyonrails:rails:3.2.0:rc1 cpe:/a:rubyonrails:rails:3.2.0:rc2 cpe:/a:rubyonrails:rails:3.2.1 cpe:/a:rubyonrails:rails:3.2.2 cpe:/a:rubyonrails:rails:3.2.2:rc1 cpe:/a:rubyonrails:rails:3.2.3 cpe:/a:rubyonrails:rails:3.2.3:rc1 cpe:/a:rubyonrails:rails:3.2.3:rc2 cpe:/a:rubyonrails:rails:3.2.4 cpe:/a:rubyonrails:rails:3.2.4:rc1 cpe:/a:rubyonrails:rails:3.2.5 cpe:/a:rubyonrails:rails:3.2.6 cpe:/a:rubyonrails:rails:3.2.7 cpe:/a:rubyonrails:rails:3.2.8 cpe:/a:rubyonrails:rails:3.2.9 cpe:/a:rubyonrails:rails:3.2.10 cpe:/a:rubyonrails:rails:3.2.11 cpe:/a:rubyonrails:rails:3.2.12 cpe:/a:rubyonrails:rails:3.2.13:rc1 cpe:/a:rubyonrails:rails:3.2.13:rc2 cpe:/a:rubyonrails:rails:3.2.15:rc3 cpe:/a:rubyonrails:rails:3.2.16 cpe:/a:rubyonrails:rails:4.0.0:- cpe:/a:rubyonrails:rails:4.0.0:beta cpe:/a:rubyonrails:rails:4.0.0:rc1 cpe:/a:rubyonrails:rails:4.0.0:rc2 cpe:/a:rubyonrails:rails:4.0.1:- cpe:/a:rubyonrails:rails:4.0.1:rc1 cpe:/a:rubyonrails:rails:4.0.1:rc2 cpe:/a:rubyonrails:rails:4.0.1:rc3 cpe:/a:rubyonrails:rails:4.0.1:rc4 cpe:/a:rubyonrails:rails:4.0.2 cpe:/a:rubyonrails:rails:4.0.3 cpe:/a:rubyonrails:rails:4.0.4 cpe:/a:rubyonrails:rails:4.1.0:beta1 cpe:/a:rubyonrails:ruby_on_rails:3.2.17

CVE-2014-0130

2014-05-07T06:55:04.133-04:00

2019-08-08T11:43:52.230-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-11-17T12:24:01.783-05:00

MISC http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf REDHAT RHSA-2014:1863 BID 67244 MLIST [rubyonrails-security] 20140506 [CVE-2014-0130] Directory Traversal Vulnerability With Certain Route Configurations Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

cpe:/o:linux:linux_kernel:3.0 cpe:/o:linux:linux_kernel:3.0:rc1 cpe:/o:linux:linux_kernel:3.0:rc2 cpe:/o:linux:linux_kernel:3.0:rc3 cpe:/o:linux:linux_kernel:3.0:rc4 cpe:/o:linux:linux_kernel:3.0:rc5 cpe:/o:linux:linux_kernel:3.0:rc6 cpe:/o:linux:linux_kernel:3.0:rc7 cpe:/o:linux:linux_kernel:3.0.1 cpe:/o:linux:linux_kernel:3.0.2 cpe:/o:linux:linux_kernel:3.0.3 cpe:/o:linux:linux_kernel:3.0.4 cpe:/o:linux:linux_kernel:3.0.5 cpe:/o:linux:linux_kernel:3.0.6 cpe:/o:linux:linux_kernel:3.0.7 cpe:/o:linux:linux_kernel:3.0.8 cpe:/o:linux:linux_kernel:3.0.9 cpe:/o:linux:linux_kernel:3.0.10 cpe:/o:linux:linux_kernel:3.0.11 cpe:/o:linux:linux_kernel:3.0.12 cpe:/o:linux:linux_kernel:3.0.13 cpe:/o:linux:linux_kernel:3.0.14 cpe:/o:linux:linux_kernel:3.0.15 cpe:/o:linux:linux_kernel:3.0.16 cpe:/o:linux:linux_kernel:3.0.17 cpe:/o:linux:linux_kernel:3.0.18 cpe:/o:linux:linux_kernel:3.0.19 cpe:/o:linux:linux_kernel:3.0.20 cpe:/o:linux:linux_kernel:3.0.21 cpe:/o:linux:linux_kernel:3.0.22 cpe:/o:linux:linux_kernel:3.0.23 cpe:/o:linux:linux_kernel:3.0.24 cpe:/o:linux:linux_kernel:3.0.25 cpe:/o:linux:linux_kernel:3.0.26 cpe:/o:linux:linux_kernel:3.0.27 cpe:/o:linux:linux_kernel:3.0.28 cpe:/o:linux:linux_kernel:3.0.29 cpe:/o:linux:linux_kernel:3.0.30 cpe:/o:linux:linux_kernel:3.0.31 cpe:/o:linux:linux_kernel:3.0.32 cpe:/o:linux:linux_kernel:3.0.33 cpe:/o:linux:linux_kernel:3.0.34 cpe:/o:linux:linux_kernel:3.0.35 cpe:/o:linux:linux_kernel:3.0.36 cpe:/o:linux:linux_kernel:3.0.37 cpe:/o:linux:linux_kernel:3.0.38 cpe:/o:linux:linux_kernel:3.0.39 cpe:/o:linux:linux_kernel:3.0.40 cpe:/o:linux:linux_kernel:3.0.41 cpe:/o:linux:linux_kernel:3.0.42 cpe:/o:linux:linux_kernel:3.0.43 cpe:/o:linux:linux_kernel:3.0.44 cpe:/o:linux:linux_kernel:3.0.45 cpe:/o:linux:linux_kernel:3.0.46 cpe:/o:linux:linux_kernel:3.0.47 cpe:/o:linux:linux_kernel:3.0.48 cpe:/o:linux:linux_kernel:3.0.49 cpe:/o:linux:linux_kernel:3.0.50 cpe:/o:linux:linux_kernel:3.0.51 cpe:/o:linux:linux_kernel:3.0.52 cpe:/o:linux:linux_kernel:3.0.53 cpe:/o:linux:linux_kernel:3.0.54 cpe:/o:linux:linux_kernel:3.0.55 cpe:/o:linux:linux_kernel:3.0.56 cpe:/o:linux:linux_kernel:3.0.57 cpe:/o:linux:linux_kernel:3.0.58 cpe:/o:linux:linux_kernel:3.0.59 cpe:/o:linux:linux_kernel:3.0.60 cpe:/o:linux:linux_kernel:3.0.61 cpe:/o:linux:linux_kernel:3.0.62 cpe:/o:linux:linux_kernel:3.0.63 cpe:/o:linux:linux_kernel:3.0.64 cpe:/o:linux:linux_kernel:3.0.65 cpe:/o:linux:linux_kernel:3.0.66 cpe:/o:linux:linux_kernel:3.0.67 cpe:/o:linux:linux_kernel:3.0.68 cpe:/o:linux:linux_kernel:3.0.69 cpe:/o:linux:linux_kernel:3.0.70 cpe:/o:linux:linux_kernel:3.0.71 cpe:/o:linux:linux_kernel:3.0.72 cpe:/o:linux:linux_kernel:3.0.73 cpe:/o:linux:linux_kernel:3.0.74 cpe:/o:linux:linux_kernel:3.0.75 cpe:/o:linux:linux_kernel:3.0.76 cpe:/o:linux:linux_kernel:3.0.77 cpe:/o:linux:linux_kernel:3.0.78 cpe:/o:linux:linux_kernel:3.0.79 cpe:/o:linux:linux_kernel:3.0.80 cpe:/o:linux:linux_kernel:3.0.81 cpe:/o:linux:linux_kernel:3.0.82 cpe:/o:linux:linux_kernel:3.0.83 cpe:/o:linux:linux_kernel:3.0.84 cpe:/o:linux:linux_kernel:3.0.85 cpe:/o:linux:linux_kernel:3.0.86 cpe:/o:linux:linux_kernel:3.0.87 cpe:/o:linux:linux_kernel:3.0.88 cpe:/o:linux:linux_kernel:3.0.89 cpe:/o:linux:linux_kernel:3.0.90 cpe:/o:linux:linux_kernel:3.0.91 cpe:/o:linux:linux_kernel:3.0.92 cpe:/o:linux:linux_kernel:3.0.93 cpe:/o:linux:linux_kernel:3.0.94 cpe:/o:linux:linux_kernel:3.0.95 cpe:/o:linux:linux_kernel:3.0.96 cpe:/o:linux:linux_kernel:3.0.97 cpe:/o:linux:linux_kernel:3.0.98 cpe:/o:linux:linux_kernel:3.0.99 cpe:/o:linux:linux_kernel:3.0.100 cpe:/o:linux:linux_kernel:3.0.101 cpe:/o:linux:linux_kernel:3.1 cpe:/o:linux:linux_kernel:3.1:rc1 cpe:/o:linux:linux_kernel:3.1:rc2 cpe:/o:linux:linux_kernel:3.1:rc3 cpe:/o:linux:linux_kernel:3.1:rc4 cpe:/o:linux:linux_kernel:3.1.1 cpe:/o:linux:linux_kernel:3.1.2 cpe:/o:linux:linux_kernel:3.1.3 cpe:/o:linux:linux_kernel:3.1.4 cpe:/o:linux:linux_kernel:3.1.5 cpe:/o:linux:linux_kernel:3.1.6 cpe:/o:linux:linux_kernel:3.1.7 cpe:/o:linux:linux_kernel:3.1.8 cpe:/o:linux:linux_kernel:3.1.9 cpe:/o:linux:linux_kernel:3.1.10 cpe:/o:linux:linux_kernel:3.2 cpe:/o:linux:linux_kernel:3.2::~~~~x86~ cpe:/o:linux:linux_kernel:3.2:rc2 cpe:/o:linux:linux_kernel:3.2:rc3 cpe:/o:linux:linux_kernel:3.2:rc4 cpe:/o:linux:linux_kernel:3.2:rc5 cpe:/o:linux:linux_kernel:3.2:rc6 cpe:/o:linux:linux_kernel:3.2:rc7 cpe:/o:linux:linux_kernel:3.2.1 cpe:/o:linux:linux_kernel:3.2.1::~~~~x86~ cpe:/o:linux:linux_kernel:3.2.2 cpe:/o:linux:linux_kernel:3.2.3 cpe:/o:linux:linux_kernel:3.2.4 cpe:/o:linux:linux_kernel:3.2.5 cpe:/o:linux:linux_kernel:3.2.6 cpe:/o:linux:linux_kernel:3.2.7 cpe:/o:linux:linux_kernel:3.2.8 cpe:/o:linux:linux_kernel:3.2.9 cpe:/o:linux:linux_kernel:3.2.10 cpe:/o:linux:linux_kernel:3.2.11 cpe:/o:linux:linux_kernel:3.2.12 cpe:/o:linux:linux_kernel:3.2.13 cpe:/o:linux:linux_kernel:3.2.14 cpe:/o:linux:linux_kernel:3.2.15 cpe:/o:linux:linux_kernel:3.2.16 cpe:/o:linux:linux_kernel:3.2.17 cpe:/o:linux:linux_kernel:3.2.18 cpe:/o:linux:linux_kernel:3.2.19 cpe:/o:linux:linux_kernel:3.2.20 cpe:/o:linux:linux_kernel:3.2.21 cpe:/o:linux:linux_kernel:3.2.22 cpe:/o:linux:linux_kernel:3.2.23 cpe:/o:linux:linux_kernel:3.2.24 cpe:/o:linux:linux_kernel:3.2.25 cpe:/o:linux:linux_kernel:3.2.26 cpe:/o:linux:linux_kernel:3.2.27 cpe:/o:linux:linux_kernel:3.2.28 cpe:/o:linux:linux_kernel:3.2.29 cpe:/o:linux:linux_kernel:3.2.30 cpe:/o:linux:linux_kernel:3.2.64 cpe:/o:linux:linux_kernel:3.2.65 cpe:/o:linux:linux_kernel:3.2.66 cpe:/o:linux:linux_kernel:3.2.67 cpe:/o:linux:linux_kernel:3.2.68 cpe:/o:linux:linux_kernel:3.2.69 cpe:/o:linux:linux_kernel:3.2.70 cpe:/o:linux:linux_kernel:3.2.71 cpe:/o:linux:linux_kernel:3.2.72 cpe:/o:linux:linux_kernel:3.2.73 cpe:/o:linux:linux_kernel:3.2.74 cpe:/o:linux:linux_kernel:3.2.75 cpe:/o:linux:linux_kernel:3.2.76 cpe:/o:linux:linux_kernel:3.2.77 cpe:/o:linux:linux_kernel:3.2.78 cpe:/o:linux:linux_kernel:3.2.79 cpe:/o:linux:linux_kernel:3.2.80 cpe:/o:linux:linux_kernel:3.3 cpe:/o:linux:linux_kernel:3.3:rc1 cpe:/o:linux:linux_kernel:3.3:rc2 cpe:/o:linux:linux_kernel:3.3:rc3 cpe:/o:linux:linux_kernel:3.3:rc4 cpe:/o:linux:linux_kernel:3.3:rc5 cpe:/o:linux:linux_kernel:3.3:rc6 cpe:/o:linux:linux_kernel:3.3:rc7 cpe:/o:linux:linux_kernel:3.3.1 cpe:/o:linux:linux_kernel:3.3.2 cpe:/o:linux:linux_kernel:3.3.3 cpe:/o:linux:linux_kernel:3.3.4 cpe:/o:linux:linux_kernel:3.3.5 cpe:/o:linux:linux_kernel:3.3.6 cpe:/o:linux:linux_kernel:3.3.7 cpe:/o:linux:linux_kernel:3.3.8 cpe:/o:linux:linux_kernel:3.4 cpe:/o:linux:linux_kernel:3.4::~~~~x86~ cpe:/o:linux:linux_kernel:3.4:rc1 cpe:/o:linux:linux_kernel:3.4:rc1:~~~~x86~ cpe:/o:linux:linux_kernel:3.4:rc2 cpe:/o:linux:linux_kernel:3.4:rc2:~~~~x86~ cpe:/o:linux:linux_kernel:3.4:rc3 cpe:/o:linux:linux_kernel:3.4:rc3:~~~~x86~ cpe:/o:linux:linux_kernel:3.4:rc4 cpe:/o:linux:linux_kernel:3.4:rc4:~~~~x86~ cpe:/o:linux:linux_kernel:3.4:rc5 cpe:/o:linux:linux_kernel:3.4:rc5:~~~~x86~ cpe:/o:linux:linux_kernel:3.4:rc6 cpe:/o:linux:linux_kernel:3.4:rc6:~~~~x86~ cpe:/o:linux:linux_kernel:3.4:rc7 cpe:/o:linux:linux_kernel:3.4:rc7:~~~~x86~ cpe:/o:linux:linux_kernel:3.4.1 cpe:/o:linux:linux_kernel:3.4.1::~~~~x86~ cpe:/o:linux:linux_kernel:3.4.2 cpe:/o:linux:linux_kernel:3.4.2::~~~~x86~ cpe:/o:linux:linux_kernel:3.4.3 cpe:/o:linux:linux_kernel:3.4.3::~~~~x86~ cpe:/o:linux:linux_kernel:3.4.4 cpe:/o:linux:linux_kernel:3.4.4::~~~~x86~ cpe:/o:linux:linux_kernel:3.4.5 cpe:/o:linux:linux_kernel:3.4.5::~~~~x86~ cpe:/o:linux:linux_kernel:3.4.6 cpe:/o:linux:linux_kernel:3.4.7 cpe:/o:linux:linux_kernel:3.4.8 cpe:/o:linux:linux_kernel:3.4.9 cpe:/o:linux:linux_kernel:3.4.10 cpe:/o:linux:linux_kernel:3.4.11 cpe:/o:linux:linux_kernel:3.4.12 cpe:/o:linux:linux_kernel:3.4.13 cpe:/o:linux:linux_kernel:3.4.14 cpe:/o:linux:linux_kernel:3.4.15 cpe:/o:linux:linux_kernel:3.4.16 cpe:/o:linux:linux_kernel:3.4.17 cpe:/o:linux:linux_kernel:3.4.18 cpe:/o:linux:linux_kernel:3.4.19 cpe:/o:linux:linux_kernel:3.4.20 cpe:/o:linux:linux_kernel:3.4.21 cpe:/o:linux:linux_kernel:3.4.22 cpe:/o:linux:linux_kernel:3.4.23 cpe:/o:linux:linux_kernel:3.4.24 cpe:/o:linux:linux_kernel:3.4.25 cpe:/o:linux:linux_kernel:3.4.26 cpe:/o:linux:linux_kernel:3.4.27 cpe:/o:linux:linux_kernel:3.4.28 cpe:/o:linux:linux_kernel:3.4.29 cpe:/o:linux:linux_kernel:3.4.30 cpe:/o:linux:linux_kernel:3.4.31 cpe:/o:linux:linux_kernel:3.4.32 cpe:/o:linux:linux_kernel:3.4.33 cpe:/o:linux:linux_kernel:3.4.34 cpe:/o:linux:linux_kernel:3.4.35 cpe:/o:linux:linux_kernel:3.4.36 cpe:/o:linux:linux_kernel:3.4.37 cpe:/o:linux:linux_kernel:3.4.38 cpe:/o:linux:linux_kernel:3.4.39 cpe:/o:linux:linux_kernel:3.4.40 cpe:/o:linux:linux_kernel:3.4.41 cpe:/o:linux:linux_kernel:3.4.42 cpe:/o:linux:linux_kernel:3.4.43 cpe:/o:linux:linux_kernel:3.4.44 cpe:/o:linux:linux_kernel:3.4.45 cpe:/o:linux:linux_kernel:3.4.46 cpe:/o:linux:linux_kernel:3.4.47 cpe:/o:linux:linux_kernel:3.4.48 cpe:/o:linux:linux_kernel:3.4.49 cpe:/o:linux:linux_kernel:3.4.50 cpe:/o:linux:linux_kernel:3.4.51 cpe:/o:linux:linux_kernel:3.4.52 cpe:/o:linux:linux_kernel:3.4.53 cpe:/o:linux:linux_kernel:3.4.54 cpe:/o:linux:linux_kernel:3.4.55 cpe:/o:linux:linux_kernel:3.4.56 cpe:/o:linux:linux_kernel:3.4.57 cpe:/o:linux:linux_kernel:3.4.58 cpe:/o:linux:linux_kernel:3.4.59 cpe:/o:linux:linux_kernel:3.4.60 cpe:/o:linux:linux_kernel:3.4.61 cpe:/o:linux:linux_kernel:3.4.62 cpe:/o:linux:linux_kernel:3.4.63 cpe:/o:linux:linux_kernel:3.4.64 cpe:/o:linux:linux_kernel:3.4.65 cpe:/o:linux:linux_kernel:3.4.66 cpe:/o:linux:linux_kernel:3.4.67 cpe:/o:linux:linux_kernel:3.4.68 cpe:/o:linux:linux_kernel:3.4.69 cpe:/o:linux:linux_kernel:3.4.70 cpe:/o:linux:linux_kernel:3.4.71 cpe:/o:linux:linux_kernel:3.4.72 cpe:/o:linux:linux_kernel:3.4.73 cpe:/o:linux:linux_kernel:3.4.74 cpe:/o:linux:linux_kernel:3.4.75 cpe:/o:linux:linux_kernel:3.4.76 cpe:/o:linux:linux_kernel:3.4.77 cpe:/o:linux:linux_kernel:3.4.78 cpe:/o:linux:linux_kernel:3.4.79 cpe:/o:linux:linux_kernel:3.4.80 cpe:/o:linux:linux_kernel:3.4.81 cpe:/o:linux:linux_kernel:3.4.82 cpe:/o:linux:linux_kernel:3.4.83 cpe:/o:linux:linux_kernel:3.4.84 cpe:/o:linux:linux_kernel:3.4.85 cpe:/o:linux:linux_kernel:3.4.86 cpe:/o:linux:linux_kernel:3.4.87 cpe:/o:linux:linux_kernel:3.4.88 cpe:/o:linux:linux_kernel:3.4.89 cpe:/o:linux:linux_kernel:3.4.90 cpe:/o:linux:linux_kernel:3.4.91 cpe:/o:linux:linux_kernel:3.4.92 cpe:/o:linux:linux_kernel:3.4.93 cpe:/o:linux:linux_kernel:3.4.94 cpe:/o:linux:linux_kernel:3.4.95 cpe:/o:linux:linux_kernel:3.4.96 cpe:/o:linux:linux_kernel:3.4.97 cpe:/o:linux:linux_kernel:3.4.98 cpe:/o:linux:linux_kernel:3.4.99 cpe:/o:linux:linux_kernel:3.4.100 cpe:/o:linux:linux_kernel:3.4.101 cpe:/o:linux:linux_kernel:3.4.102 cpe:/o:linux:linux_kernel:3.4.103 cpe:/o:linux:linux_kernel:3.4.104 cpe:/o:linux:linux_kernel:3.4.105 cpe:/o:linux:linux_kernel:3.4.106 cpe:/o:linux:linux_kernel:3.4.107 cpe:/o:linux:linux_kernel:3.4.108 cpe:/o:linux:linux_kernel:3.4.109 cpe:/o:linux:linux_kernel:3.4.110 cpe:/o:linux:linux_kernel:3.4.111 cpe:/o:linux:linux_kernel:3.4.112 cpe:/o:linux:linux_kernel:3.5 cpe:/o:linux:linux_kernel:3.5.1 cpe:/o:linux:linux_kernel:3.5.2 cpe:/o:linux:linux_kernel:3.5.3 cpe:/o:linux:linux_kernel:3.5.4 cpe:/o:linux:linux_kernel:3.5.5 cpe:/o:linux:linux_kernel:3.5.6 cpe:/o:linux:linux_kernel:3.5.7 cpe:/o:linux:linux_kernel:3.6 cpe:/o:linux:linux_kernel:3.6:rc5 cpe:/o:linux:linux_kernel:3.6.1 cpe:/o:linux:linux_kernel:3.6.2 cpe:/o:linux:linux_kernel:3.6.3 cpe:/o:linux:linux_kernel:3.6.4 cpe:/o:linux:linux_kernel:3.6.5 cpe:/o:linux:linux_kernel:3.6.6 cpe:/o:linux:linux_kernel:3.6.7 cpe:/o:linux:linux_kernel:3.6.8 cpe:/o:linux:linux_kernel:3.6.9 cpe:/o:linux:linux_kernel:3.6.10 cpe:/o:linux:linux_kernel:3.6.11 cpe:/o:linux:linux_kernel:3.7 cpe:/o:linux:linux_kernel:3.7.1 cpe:/o:linux:linux_kernel:3.7.2 cpe:/o:linux:linux_kernel:3.7.3 cpe:/o:linux:linux_kernel:3.7.4 cpe:/o:linux:linux_kernel:3.7.5 cpe:/o:linux:linux_kernel:3.7.6 cpe:/o:linux:linux_kernel:3.7.7 cpe:/o:linux:linux_kernel:3.7.8 cpe:/o:linux:linux_kernel:3.7.9 cpe:/o:linux:linux_kernel:3.7.10 cpe:/o:linux:linux_kernel:3.8 cpe:/o:linux:linux_kernel:3.8.0 cpe:/o:linux:linux_kernel:3.8.1 cpe:/o:linux:linux_kernel:3.8.2 cpe:/o:linux:linux_kernel:3.8.3 cpe:/o:linux:linux_kernel:3.8.4 cpe:/o:linux:linux_kernel:3.8.5 cpe:/o:linux:linux_kernel:3.8.6 cpe:/o:linux:linux_kernel:3.8.7 cpe:/o:linux:linux_kernel:3.8.8 cpe:/o:linux:linux_kernel:3.8.9 cpe:/o:linux:linux_kernel:3.8.10 cpe:/o:linux:linux_kernel:3.8.11 cpe:/o:linux:linux_kernel:3.8.12 cpe:/o:linux:linux_kernel:3.8.13 cpe:/o:linux:linux_kernel:3.9 cpe:/o:linux:linux_kernel:3.9:rc1 cpe:/o:linux:linux_kernel:3.9:rc2 cpe:/o:linux:linux_kernel:3.9:rc3 cpe:/o:linux:linux_kernel:3.9:rc4 cpe:/o:linux:linux_kernel:3.9:rc5 cpe:/o:linux:linux_kernel:3.9:rc6 cpe:/o:linux:linux_kernel:3.9:rc7 cpe:/o:linux:linux_kernel:3.9.0 cpe:/o:linux:linux_kernel:3.9.0::~~~~arm64~ cpe:/o:linux:linux_kernel:3.9.1 cpe:/o:linux:linux_kernel:3.9.1::~~~~arm64~ cpe:/o:linux:linux_kernel:3.9.2 cpe:/o:linux:linux_kernel:3.9.2::~~~~arm64~ cpe:/o:linux:linux_kernel:3.9.3 cpe:/o:linux:linux_kernel:3.9.3::~~~~arm64~ cpe:/o:linux:linux_kernel:3.9.4 cpe:/o:linux:linux_kernel:3.9.4::~~~~arm64~ cpe:/o:linux:linux_kernel:3.9.5 cpe:/o:linux:linux_kernel:3.9.5::~~~~arm64~ cpe:/o:linux:linux_kernel:3.9.6 cpe:/o:linux:linux_kernel:3.9.6::~~~~arm64~ cpe:/o:linux:linux_kernel:3.9.7 cpe:/o:linux:linux_kernel:3.9.7::~~~~arm64~ cpe:/o:linux:linux_kernel:3.9.8 cpe:/o:linux:linux_kernel:3.9.8::~~~~arm64~ cpe:/o:linux:linux_kernel:3.9.9 cpe:/o:linux:linux_kernel:3.9.9::~~~~arm64~ cpe:/o:linux:linux_kernel:3.9.10 cpe:/o:linux:linux_kernel:3.9.10::~~~~arm64~ cpe:/o:linux:linux_kernel:3.9.11 cpe:/o:linux:linux_kernel:3.9.11::~~~~arm64~ cpe:/o:linux:linux_kernel:3.10 cpe:/o:linux:linux_kernel:3.10.0::~~~~arm64~ cpe:/o:linux:linux_kernel:3.10.1 cpe:/o:linux:linux_kernel:3.10.1::~~~~arm64~ cpe:/o:linux:linux_kernel:3.10.2 cpe:/o:linux:linux_kernel:3.10.2::~~~~arm64~ cpe:/o:linux:linux_kernel:3.10.3 cpe:/o:linux:linux_kernel:3.10.3::~~~~arm64~ cpe:/o:linux:linux_kernel:3.10.4 cpe:/o:linux:linux_kernel:3.10.4::~~~~arm64~ cpe:/o:linux:linux_kernel:3.10.5 cpe:/o:linux:linux_kernel:3.10.5::~~~~arm64~ cpe:/o:linux:linux_kernel:3.10.6 cpe:/o:linux:linux_kernel:3.10.6::~~~~arm64~ cpe:/o:linux:linux_kernel:3.10.7 cpe:/o:linux:linux_kernel:3.10.7::~~~~arm64~ cpe:/o:linux:linux_kernel:3.10.8 cpe:/o:linux:linux_kernel:3.10.8::~~~~arm64~ cpe:/o:linux:linux_kernel:3.10.9 cpe:/o:linux:linux_kernel:3.10.9::~~~~arm64~ cpe:/o:linux:linux_kernel:3.10.10 cpe:/o:linux:linux_kernel:3.10.11 cpe:/o:linux:linux_kernel:3.10.12 cpe:/o:linux:linux_kernel:3.10.13 cpe:/o:linux:linux_kernel:3.10.14 cpe:/o:linux:linux_kernel:3.10.15 cpe:/o:linux:linux_kernel:3.10.16 cpe:/o:linux:linux_kernel:3.10.17 cpe:/o:linux:linux_kernel:3.10.18 cpe:/o:linux:linux_kernel:3.10.19 cpe:/o:linux:linux_kernel:3.10.20 cpe:/o:linux:linux_kernel:3.10.21 cpe:/o:linux:linux_kernel:3.10.22 cpe:/o:linux:linux_kernel:3.10.23 cpe:/o:linux:linux_kernel:3.10.24 cpe:/o:linux:linux_kernel:3.10.25 cpe:/o:linux:linux_kernel:3.10.26 cpe:/o:linux:linux_kernel:3.10.27 cpe:/o:linux:linux_kernel:3.10.28 cpe:/o:linux:linux_kernel:3.10.29 cpe:/o:linux:linux_kernel:3.10.30 cpe:/o:linux:linux_kernel:3.10.31 cpe:/o:linux:linux_kernel:3.10.32 cpe:/o:linux:linux_kernel:3.10.33 cpe:/o:linux:linux_kernel:3.10.34 cpe:/o:linux:linux_kernel:3.10.35 cpe:/o:linux:linux_kernel:3.10.36 cpe:/o:linux:linux_kernel:3.10.37 cpe:/o:linux:linux_kernel:3.10.38 cpe:/o:linux:linux_kernel:3.10.39 cpe:/o:linux:linux_kernel:3.10.40 cpe:/o:linux:linux_kernel:3.10.41 cpe:/o:linux:linux_kernel:3.10.42 cpe:/o:linux:linux_kernel:3.10.43 cpe:/o:linux:linux_kernel:3.10.44 cpe:/o:linux:linux_kernel:3.10.45 cpe:/o:linux:linux_kernel:3.10.46 cpe:/o:linux:linux_kernel:3.10.47 cpe:/o:linux:linux_kernel:3.10.48 cpe:/o:linux:linux_kernel:3.10.49 cpe:/o:linux:linux_kernel:3.10.50 cpe:/o:linux:linux_kernel:3.10.51 cpe:/o:linux:linux_kernel:3.10.52 cpe:/o:linux:linux_kernel:3.10.53 cpe:/o:linux:linux_kernel:3.10.54 cpe:/o:linux:linux_kernel:3.10.55 cpe:/o:linux:linux_kernel:3.10.56 cpe:/o:linux:linux_kernel:3.10.57 cpe:/o:linux:linux_kernel:3.10.58 cpe:/o:linux:linux_kernel:3.10.59 cpe:/o:linux:linux_kernel:3.10.60 cpe:/o:linux:linux_kernel:3.10.61 cpe:/o:linux:linux_kernel:3.10.62 cpe:/o:linux:linux_kernel:3.10.63 cpe:/o:linux:linux_kernel:3.10.64 cpe:/o:linux:linux_kernel:3.10.65 cpe:/o:linux:linux_kernel:3.10.66 cpe:/o:linux:linux_kernel:3.10.67 cpe:/o:linux:linux_kernel:3.10.68 cpe:/o:linux:linux_kernel:3.10.69 cpe:/o:linux:linux_kernel:3.10.70 cpe:/o:linux:linux_kernel:3.10.71 cpe:/o:linux:linux_kernel:3.10.72 cpe:/o:linux:linux_kernel:3.10.73 cpe:/o:linux:linux_kernel:3.10.74 cpe:/o:linux:linux_kernel:3.10.75 cpe:/o:linux:linux_kernel:3.10.76 cpe:/o:linux:linux_kernel:3.10.77 cpe:/o:linux:linux_kernel:3.10.78 cpe:/o:linux:linux_kernel:3.10.79 cpe:/o:linux:linux_kernel:3.10.80 cpe:/o:linux:linux_kernel:3.10.81 cpe:/o:linux:linux_kernel:3.10.82 cpe:/o:linux:linux_kernel:3.10.83 cpe:/o:linux:linux_kernel:3.10.84 cpe:/o:linux:linux_kernel:3.10.85 cpe:/o:linux:linux_kernel:3.10.86 cpe:/o:linux:linux_kernel:3.10.87 cpe:/o:linux:linux_kernel:3.10.88 cpe:/o:linux:linux_kernel:3.10.89 cpe:/o:linux:linux_kernel:3.10.90 cpe:/o:linux:linux_kernel:3.10.91 cpe:/o:linux:linux_kernel:3.10.92 cpe:/o:linux:linux_kernel:3.10.93 cpe:/o:linux:linux_kernel:3.10.94 cpe:/o:linux:linux_kernel:3.10.95 cpe:/o:linux:linux_kernel:3.10.96 cpe:/o:linux:linux_kernel:3.10.97 cpe:/o:linux:linux_kernel:3.10.98 cpe:/o:linux:linux_kernel:3.10.99 cpe:/o:linux:linux_kernel:3.10.100 cpe:/o:linux:linux_kernel:3.10.101 cpe:/o:linux:linux_kernel:3.10.102 cpe:/o:linux:linux_kernel:3.11 cpe:/o:linux:linux_kernel:3.11.1 cpe:/o:linux:linux_kernel:3.11.2 cpe:/o:linux:linux_kernel:3.11.3 cpe:/o:linux:linux_kernel:3.11.4 cpe:/o:linux:linux_kernel:3.11.5 cpe:/o:linux:linux_kernel:3.11.6 cpe:/o:linux:linux_kernel:3.11.7 cpe:/o:linux:linux_kernel:3.11.8 cpe:/o:linux:linux_kernel:3.11.9 cpe:/o:linux:linux_kernel:3.11.10 cpe:/o:linux:linux_kernel:3.12 cpe:/o:linux:linux_kernel:3.12.1 cpe:/o:linux:linux_kernel:3.12.2 cpe:/o:linux:linux_kernel:3.12.3 cpe:/o:linux:linux_kernel:3.12.4 cpe:/o:linux:linux_kernel:3.12.5 cpe:/o:linux:linux_kernel:3.12.6 cpe:/o:linux:linux_kernel:3.12.7 cpe:/o:linux:linux_kernel:3.12.8 cpe:/o:linux:linux_kernel:3.12.9 cpe:/o:linux:linux_kernel:3.12.10 cpe:/o:linux:linux_kernel:3.12.11 cpe:/o:linux:linux_kernel:3.12.12 cpe:/o:linux:linux_kernel:3.12.13 cpe:/o:linux:linux_kernel:3.12.14 cpe:/o:linux:linux_kernel:3.12.15 cpe:/o:linux:linux_kernel:3.12.16 cpe:/o:linux:linux_kernel:3.12.17 cpe:/o:linux:linux_kernel:3.12.18 cpe:/o:linux:linux_kernel:3.12.19 cpe:/o:linux:linux_kernel:3.12.20 cpe:/o:linux:linux_kernel:3.12.21 cpe:/o:linux:linux_kernel:3.12.22 cpe:/o:linux:linux_kernel:3.12.23 cpe:/o:linux:linux_kernel:3.12.24 cpe:/o:linux:linux_kernel:3.12.25 cpe:/o:linux:linux_kernel:3.12.26 cpe:/o:linux:linux_kernel:3.12.27 cpe:/o:linux:linux_kernel:3.12.28 cpe:/o:linux:linux_kernel:3.12.29 cpe:/o:linux:linux_kernel:3.12.30 cpe:/o:linux:linux_kernel:3.12.31 cpe:/o:linux:linux_kernel:3.12.32 cpe:/o:linux:linux_kernel:3.12.33 cpe:/o:linux:linux_kernel:3.12.34 cpe:/o:linux:linux_kernel:3.12.35 cpe:/o:linux:linux_kernel:3.12.36 cpe:/o:linux:linux_kernel:3.12.37 cpe:/o:linux:linux_kernel:3.12.38 cpe:/o:linux:linux_kernel:3.12.39 cpe:/o:linux:linux_kernel:3.12.40 cpe:/o:linux:linux_kernel:3.12.41 cpe:/o:linux:linux_kernel:3.12.42 cpe:/o:linux:linux_kernel:3.12.43 cpe:/o:linux:linux_kernel:3.12.44 cpe:/o:linux:linux_kernel:3.12.45 cpe:/o:linux:linux_kernel:3.12.46 cpe:/o:linux:linux_kernel:3.12.47 cpe:/o:linux:linux_kernel:3.12.48 cpe:/o:linux:linux_kernel:3.12.49 cpe:/o:linux:linux_kernel:3.12.50 cpe:/o:linux:linux_kernel:3.12.51 cpe:/o:linux:linux_kernel:3.12.52 cpe:/o:linux:linux_kernel:3.12.53 cpe:/o:linux:linux_kernel:3.12.54 cpe:/o:linux:linux_kernel:3.12.55 cpe:/o:linux:linux_kernel:3.12.56 cpe:/o:linux:linux_kernel:3.12.57 cpe:/o:linux:linux_kernel:3.12.58 cpe:/o:linux:linux_kernel:3.12.59 cpe:/o:linux:linux_kernel:3.13 cpe:/o:linux:linux_kernel:3.13.1 cpe:/o:linux:linux_kernel:3.13.2 cpe:/o:linux:linux_kernel:3.13.3 cpe:/o:linux:linux_kernel:3.13.4 cpe:/o:linux:linux_kernel:3.13.5 cpe:/o:linux:linux_kernel:3.13.6 cpe:/o:opensuse:evergreen:11.4 cpe:/o:suse:linux_enterprise_server:11:sp2:~~ltss~~~

CVE-2014-0131

2014-03-24T12:40:48.093-04:00

2019-05-13T14:03:02.620-04:00

2.9

ADJACENT_NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-05-10T07:29:25.233-04:00

CONFIRM http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1fd819ecb90cc9b822cd84d3056ddba315d3340f SUSE SUSE-SU-2015:0481 SUSE openSUSE-SU-2015:0566 MLIST [oss-security] 20140310 CVE-2014-0131 -- kernel: net: use-after-free during segmentation with zerocopy MLIST [netdev] 20140310 [PATCH 0/5] skbuff: fix skb_segment with zero copy skbs MLIST [netdev] 20140310 [PATCH 5/5] skbuff: skb_segment: orphan frags before copying CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1074589 CONFIRM https://github.com/torvalds/linux/commit/1fd819ecb90cc9b822cd84d3056ddba315d3340f Use-after-free vulnerability in the skb_segment function in net/core/skbuff.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation.

cpe:/a:fedoraproject:389_directory_server:1.2.11.1 cpe:/a:fedoraproject:389_directory_server:1.2.11.5 cpe:/a:fedoraproject:389_directory_server:1.2.11.6 cpe:/a:fedoraproject:389_directory_server:1.2.11.8 cpe:/a:fedoraproject:389_directory_server:1.2.11.9 cpe:/a:fedoraproject:389_directory_server:1.2.11.10 cpe:/a:fedoraproject:389_directory_server:1.2.11.11 cpe:/a:fedoraproject:389_directory_server:1.2.11.12 cpe:/a:fedoraproject:389_directory_server:1.2.11.13 cpe:/a:fedoraproject:389_directory_server:1.2.11.14 cpe:/a:fedoraproject:389_directory_server:1.2.11.15 cpe:/a:fedoraproject:389_directory_server:1.2.11.17 cpe:/a:fedoraproject:389_directory_server:1.2.11.19 cpe:/a:fedoraproject:389_directory_server:1.2.11.20 cpe:/a:fedoraproject:389_directory_server:1.2.11.21 cpe:/a:fedoraproject:389_directory_server:1.2.11.22 cpe:/a:fedoraproject:389_directory_server:1.2.11.23 cpe:/a:fedoraproject:389_directory_server:1.2.11.25

CVE-2014-0132

2014-03-18T13:02:53.420-04:00

2014-03-19T10:12:09.563-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2014-03-19T10:12:03.673-04:00

REDHAT RHSA-2014:0292 CONFIRM https://fedorahosted.org/389/changeset/76acff12a86110d4165f94e2cba13ef5c7ebc38a/ CONFIRM https://fedorahosted.org/389/ticket/47739 The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind.

cpe:/a:nginx:nginx:1.3.15 cpe:/a:nginx:nginx:1.3.16 cpe:/a:nginx:nginx:1.4.0 cpe:/a:nginx:nginx:1.4.1 cpe:/a:nginx:nginx:1.4.2 cpe:/a:nginx:nginx:1.4.3 cpe:/a:nginx:nginx:1.5.0 cpe:/a:nginx:nginx:1.5.1 cpe:/a:nginx:nginx:1.5.2 cpe:/a:nginx:nginx:1.5.3 cpe:/a:nginx:nginx:1.5.4 cpe:/a:nginx:nginx:1.5.5 cpe:/a:nginx:nginx:1.5.6 cpe:/a:nginx:nginx:1.5.7 cpe:/a:nginx:nginx:1.5.8 cpe:/a:nginx:nginx:1.5.9 cpe:/a:nginx:nginx:1.5.10 cpe:/a:nginx:nginx:1.5.11 cpe:/o:opensuse:opensuse:13.1

CVE-2014-0133

2014-03-28T11:55:08.607-04:00

2018-10-30T12:27:34.687-04:00

5.1

NETWORK

HIGH

NONE

PARTIAL

http://nvd.nist.gov

2016-03-31T12:24:41.670-04:00

SUSE openSUSE-SU-2014:0450 MLIST [nginx-announce] 20140318 nginx security advisory (CVE-2014-0133) BID 66537 Heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execute arbitrary code via a crafted request.

cpe:/a:openstack:compute:2013.2 cpe:/a:openstack:compute:2013.2.1 cpe:/a:openstack:compute:2013.2.2

CVE-2014-0134

2014-05-08T10:29:13.220-04:00

2014-06-21T00:38:06.550-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20140327 [OSSA 2014-009] Nova host data leak to vm instance in rescue mode (CVE-2014-0134) UBUNTU USN-2247-1 CONFIRM https://bugs.launchpad.net/nova/+bug/1221190 The instance rescue mode in OpenStack Compute (Nova) 2013.2 before 2013.2.3 and Icehouse before 2014.1, when using libvirt to spawn images and use_cow_images is set to false, allows remote authenticated users to read certain compute host files by overwriting an instance disk with a crafted image.

cpe:/a:theforeman:kafo:0.0.1 cpe:/a:theforeman:kafo:0.0.2 cpe:/a:theforeman:kafo:0.0.3 cpe:/a:theforeman:kafo:0.0.4 cpe:/a:theforeman:kafo:0.0.5 cpe:/a:theforeman:kafo:0.0.6 cpe:/a:theforeman:kafo:0.0.7 cpe:/a:theforeman:kafo:0.0.8 cpe:/a:theforeman:kafo:0.0.9 cpe:/a:theforeman:kafo:0.0.10 cpe:/a:theforeman:kafo:0.0.11 cpe:/a:theforeman:kafo:0.0.12 cpe:/a:theforeman:kafo:0.0.13 cpe:/a:theforeman:kafo:0.0.14 cpe:/a:theforeman:kafo:0.0.15 cpe:/a:theforeman:kafo:0.0.16 cpe:/a:theforeman:kafo:0.0.17 cpe:/a:theforeman:kafo:0.1.0 cpe:/a:theforeman:kafo:0.2.0 cpe:/a:theforeman:kafo:0.2.1 cpe:/a:theforeman:kafo:0.2.2 cpe:/a:theforeman:kafo:0.3.0 cpe:/a:theforeman:kafo:0.3.1 cpe:/a:theforeman:kafo:0.3.2 cpe:/a:theforeman:kafo:0.3.3 cpe:/a:theforeman:kafo:0.3.4 cpe:/a:theforeman:kafo:0.3.5 cpe:/a:theforeman:kafo:0.3.6 cpe:/a:theforeman:kafo:0.3.7 cpe:/a:theforeman:kafo:0.3.8 cpe:/a:theforeman:kafo:0.3.9 cpe:/a:theforeman:kafo:0.3.10 cpe:/a:theforeman:kafo:0.3.11 cpe:/a:theforeman:kafo:0.3.12 cpe:/a:theforeman:kafo:0.3.13 cpe:/a:theforeman:kafo:0.3.14 cpe:/a:theforeman:kafo:0.3.15 cpe:/a:theforeman:kafo:0.3.16 cpe:/a:theforeman:kafo:0.4.0 cpe:/a:theforeman:kafo:0.5.0 cpe:/a:theforeman:kafo:0.5.1

CVE-2014-0135

2014-05-08T10:29:13.283-04:00

2014-05-09T12:12:24.607-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-05-09T12:12:24.373-04:00

CONFIRM http://theforeman.org/security.html Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_values.yaml, which allows local users to obtain passwords and other sensitive information by reading the file.

cpe:/a:redhat:cloudforms_3.0_management_engine:5.2.5.3

CVE-2014-0136

2014-10-26T21:55:24.157-04:00

2015-01-27T19:31:54.530-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2015-01-27T16:01:07.100-05:00

REDHAT RHSA-2014:1037 BID 69233 The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors.

CVE-2014-0137

2014-05-14T15:55:10.747-04:00

2014-05-15T15:49:04.183-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2014-05-15T07:12:41.000-04:00

REDHAT RHSA-2014:0469 SQL injection vulnerability in the saved_report_delete action in the ReportController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, related to MiqReportResult.exists.

cpe:/a:haxx:curl:7.10.6 cpe:/a:haxx:curl:7.10.7 cpe:/a:haxx:curl:7.10.8 cpe:/a:haxx:curl:7.11.0 cpe:/a:haxx:curl:7.11.1 cpe:/a:haxx:curl:7.11.2 cpe:/a:haxx:curl:7.12.0 cpe:/a:haxx:curl:7.12.1 cpe:/a:haxx:curl:7.12.2 cpe:/a:haxx:curl:7.12.3 cpe:/a:haxx:curl:7.13.0 cpe:/a:haxx:curl:7.13.1 cpe:/a:haxx:curl:7.13.2 cpe:/a:haxx:curl:7.14.0 cpe:/a:haxx:curl:7.14.1 cpe:/a:haxx:curl:7.15.0 cpe:/a:haxx:curl:7.15.1 cpe:/a:haxx:curl:7.15.2 cpe:/a:haxx:curl:7.15.3 cpe:/a:haxx:curl:7.15.4 cpe:/a:haxx:curl:7.15.5 cpe:/a:haxx:curl:7.16.0 cpe:/a:haxx:curl:7.16.1 cpe:/a:haxx:curl:7.16.2 cpe:/a:haxx:curl:7.16.3 cpe:/a:haxx:curl:7.16.4 cpe:/a:haxx:curl:7.17.0 cpe:/a:haxx:curl:7.17.1 cpe:/a:haxx:curl:7.18.0 cpe:/a:haxx:curl:7.18.1 cpe:/a:haxx:curl:7.18.2 cpe:/a:haxx:curl:7.19.0 cpe:/a:haxx:curl:7.19.1 cpe:/a:haxx:curl:7.19.2 cpe:/a:haxx:curl:7.19.3 cpe:/a:haxx:curl:7.19.4 cpe:/a:haxx:curl:7.19.5 cpe:/a:haxx:curl:7.19.6 cpe:/a:haxx:curl:7.19.7 cpe:/a:haxx:curl:7.20.0 cpe:/a:haxx:curl:7.20.1 cpe:/a:haxx:curl:7.21.0 cpe:/a:haxx:curl:7.21.1 cpe:/a:haxx:curl:7.21.2 cpe:/a:haxx:curl:7.21.3 cpe:/a:haxx:curl:7.21.4 cpe:/a:haxx:curl:7.21.5 cpe:/a:haxx:curl:7.21.6 cpe:/a:haxx:curl:7.21.7 cpe:/a:haxx:curl:7.22.0 cpe:/a:haxx:curl:7.23.0 cpe:/a:haxx:curl:7.23.1 cpe:/a:haxx:curl:7.24.0 cpe:/a:haxx:curl:7.25.0 cpe:/a:haxx:curl:7.26.0 cpe:/a:haxx:curl:7.27.0 cpe:/a:haxx:curl:7.28.0 cpe:/a:haxx:curl:7.28.1 cpe:/a:haxx:curl:7.29.0 cpe:/a:haxx:curl:7.30.0 cpe:/a:haxx:curl:7.31.0 cpe:/a:haxx:curl:7.32.0 cpe:/a:haxx:curl:7.33.0 cpe:/a:haxx:curl:7.34.0 cpe:/a:haxx:curl:7.35.0 cpe:/a:haxx:libcurl:7.10.6 cpe:/a:haxx:libcurl:7.10.7 cpe:/a:haxx:libcurl:7.10.8 cpe:/a:haxx:libcurl:7.11.0 cpe:/a:haxx:libcurl:7.11.1 cpe:/a:haxx:libcurl:7.11.2 cpe:/a:haxx:libcurl:7.12.0 cpe:/a:haxx:libcurl:7.12.1 cpe:/a:haxx:libcurl:7.12.2 cpe:/a:haxx:libcurl:7.12.3 cpe:/a:haxx:libcurl:7.13.0 cpe:/a:haxx:libcurl:7.13.1 cpe:/a:haxx:libcurl:7.13.2 cpe:/a:haxx:libcurl:7.14.0 cpe:/a:haxx:libcurl:7.14.1 cpe:/a:haxx:libcurl:7.15.0 cpe:/a:haxx:libcurl:7.15.1 cpe:/a:haxx:libcurl:7.15.2 cpe:/a:haxx:libcurl:7.15.3 cpe:/a:haxx:libcurl:7.15.4 cpe:/a:haxx:libcurl:7.15.5 cpe:/a:haxx:libcurl:7.16.0 cpe:/a:haxx:libcurl:7.16.1 cpe:/a:haxx:libcurl:7.16.2 cpe:/a:haxx:libcurl:7.16.3 cpe:/a:haxx:libcurl:7.16.4 cpe:/a:haxx:libcurl:7.17.0 cpe:/a:haxx:libcurl:7.17.1 cpe:/a:haxx:libcurl:7.18.0 cpe:/a:haxx:libcurl:7.18.1 cpe:/a:haxx:libcurl:7.18.2 cpe:/a:haxx:libcurl:7.19.0 cpe:/a:haxx:libcurl:7.19.1 cpe:/a:haxx:libcurl:7.19.2 cpe:/a:haxx:libcurl:7.19.3 cpe:/a:haxx:libcurl:7.19.4 cpe:/a:haxx:libcurl:7.19.5 cpe:/a:haxx:libcurl:7.19.6 cpe:/a:haxx:libcurl:7.19.7 cpe:/a:haxx:libcurl:7.20.0 cpe:/a:haxx:libcurl:7.20.1 cpe:/a:haxx:libcurl:7.21.0 cpe:/a:haxx:libcurl:7.21.1 cpe:/a:haxx:libcurl:7.21.2 cpe:/a:haxx:libcurl:7.21.3 cpe:/a:haxx:libcurl:7.21.4 cpe:/a:haxx:libcurl:7.21.5 cpe:/a:haxx:libcurl:7.21.6 cpe:/a:haxx:libcurl:7.21.7 cpe:/a:haxx:libcurl:7.22.0 cpe:/a:haxx:libcurl:7.23.0 cpe:/a:haxx:libcurl:7.23.1 cpe:/a:haxx:libcurl:7.24.0 cpe:/a:haxx:libcurl:7.25.0 cpe:/a:haxx:libcurl:7.26.0 cpe:/a:haxx:libcurl:7.27.0 cpe:/a:haxx:libcurl:7.28.0 cpe:/a:haxx:libcurl:7.28.1 cpe:/a:haxx:libcurl:7.29.0 cpe:/a:haxx:libcurl:7.30.0 cpe:/a:haxx:libcurl:7.31.0 cpe:/a:haxx:libcurl:7.32.0 cpe:/a:haxx:libcurl:7.33.0 cpe:/a:haxx:libcurl:7.34.0 cpe:/a:haxx:libcurl:7.35.0 cpe:/o:debian:debian_linux:7.0

CVE-2014-0138

2014-04-15T10:55:04.107-04:00

2018-10-09T15:36:15.973-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://curl.haxx.se/docs/adv_20140326A.html SUSE openSUSE-SU-2014:0530 FULLDISC 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities SECUNIA 58615 DEBIAN DSA-2902 CONFIRM http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/ CONFIRM http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/ CONFIRM http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/ CONFIRM http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html BUGTRAQ 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities UBUNTU USN-2167-1 CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0012.html CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21675820 CONFIRM http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095862 The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015.

cpe:/a:haxx:curl:7.10.6 cpe:/a:haxx:curl:7.10.7 cpe:/a:haxx:curl:7.10.8 cpe:/a:haxx:curl:7.11.0 cpe:/a:haxx:curl:7.11.1 cpe:/a:haxx:curl:7.11.2 cpe:/a:haxx:curl:7.12.0 cpe:/a:haxx:curl:7.12.1 cpe:/a:haxx:curl:7.12.2 cpe:/a:haxx:curl:7.12.3 cpe:/a:haxx:curl:7.13.0 cpe:/a:haxx:curl:7.13.1 cpe:/a:haxx:curl:7.13.2 cpe:/a:haxx:curl:7.14.0 cpe:/a:haxx:curl:7.14.1 cpe:/a:haxx:curl:7.15.0 cpe:/a:haxx:curl:7.15.1 cpe:/a:haxx:curl:7.15.2 cpe:/a:haxx:curl:7.15.3 cpe:/a:haxx:curl:7.15.4 cpe:/a:haxx:curl:7.15.5 cpe:/a:haxx:curl:7.16.0 cpe:/a:haxx:curl:7.16.1 cpe:/a:haxx:curl:7.16.2 cpe:/a:haxx:curl:7.16.3 cpe:/a:haxx:curl:7.16.4 cpe:/a:haxx:curl:7.17.0 cpe:/a:haxx:curl:7.17.1 cpe:/a:haxx:curl:7.18.0 cpe:/a:haxx:curl:7.18.1 cpe:/a:haxx:curl:7.18.2 cpe:/a:haxx:curl:7.19.0 cpe:/a:haxx:curl:7.19.1 cpe:/a:haxx:curl:7.19.2 cpe:/a:haxx:curl:7.19.3 cpe:/a:haxx:curl:7.19.4 cpe:/a:haxx:curl:7.19.5 cpe:/a:haxx:curl:7.19.6 cpe:/a:haxx:curl:7.19.7 cpe:/a:haxx:curl:7.20.0 cpe:/a:haxx:curl:7.20.1 cpe:/a:haxx:curl:7.21.0 cpe:/a:haxx:curl:7.21.1 cpe:/a:haxx:curl:7.21.2 cpe:/a:haxx:curl:7.21.3 cpe:/a:haxx:curl:7.21.4 cpe:/a:haxx:curl:7.21.5 cpe:/a:haxx:curl:7.21.6 cpe:/a:haxx:curl:7.21.7 cpe:/a:haxx:curl:7.22.0 cpe:/a:haxx:curl:7.23.0 cpe:/a:haxx:curl:7.23.1 cpe:/a:haxx:curl:7.24.0 cpe:/a:haxx:curl:7.25.0 cpe:/a:haxx:curl:7.26.0 cpe:/a:haxx:curl:7.27.0 cpe:/a:haxx:curl:7.28.0 cpe:/a:haxx:curl:7.28.1 cpe:/a:haxx:curl:7.29.0 cpe:/a:haxx:curl:7.30.0 cpe:/a:haxx:curl:7.31.0 cpe:/a:haxx:curl:7.32.0 cpe:/a:haxx:curl:7.33.0 cpe:/a:haxx:curl:7.34.0 cpe:/a:haxx:curl:7.35.0 cpe:/a:haxx:libcurl:7.10.6 cpe:/a:haxx:libcurl:7.10.7 cpe:/a:haxx:libcurl:7.10.8 cpe:/a:haxx:libcurl:7.11.0 cpe:/a:haxx:libcurl:7.11.1 cpe:/a:haxx:libcurl:7.11.2 cpe:/a:haxx:libcurl:7.12.0 cpe:/a:haxx:libcurl:7.12.1 cpe:/a:haxx:libcurl:7.12.2 cpe:/a:haxx:libcurl:7.12.3 cpe:/a:haxx:libcurl:7.13.0 cpe:/a:haxx:libcurl:7.13.1 cpe:/a:haxx:libcurl:7.13.2 cpe:/a:haxx:libcurl:7.14.0 cpe:/a:haxx:libcurl:7.14.1 cpe:/a:haxx:libcurl:7.15.0 cpe:/a:haxx:libcurl:7.15.1 cpe:/a:haxx:libcurl:7.15.2 cpe:/a:haxx:libcurl:7.15.3 cpe:/a:haxx:libcurl:7.15.4 cpe:/a:haxx:libcurl:7.15.5 cpe:/a:haxx:libcurl:7.16.0 cpe:/a:haxx:libcurl:7.16.1 cpe:/a:haxx:libcurl:7.16.2 cpe:/a:haxx:libcurl:7.16.3 cpe:/a:haxx:libcurl:7.16.4 cpe:/a:haxx:libcurl:7.17.0 cpe:/a:haxx:libcurl:7.17.1 cpe:/a:haxx:libcurl:7.18.0 cpe:/a:haxx:libcurl:7.18.1 cpe:/a:haxx:libcurl:7.18.2 cpe:/a:haxx:libcurl:7.19.0 cpe:/a:haxx:libcurl:7.19.1 cpe:/a:haxx:libcurl:7.19.2 cpe:/a:haxx:libcurl:7.19.3 cpe:/a:haxx:libcurl:7.19.4 cpe:/a:haxx:libcurl:7.19.5 cpe:/a:haxx:libcurl:7.19.6 cpe:/a:haxx:libcurl:7.19.7 cpe:/a:haxx:libcurl:7.20.0 cpe:/a:haxx:libcurl:7.20.1 cpe:/a:haxx:libcurl:7.21.0 cpe:/a:haxx:libcurl:7.21.1 cpe:/a:haxx:libcurl:7.21.2 cpe:/a:haxx:libcurl:7.21.3 cpe:/a:haxx:libcurl:7.21.4 cpe:/a:haxx:libcurl:7.21.5 cpe:/a:haxx:libcurl:7.21.6 cpe:/a:haxx:libcurl:7.21.7 cpe:/a:haxx:libcurl:7.22.0 cpe:/a:haxx:libcurl:7.23.0 cpe:/a:haxx:libcurl:7.23.1 cpe:/a:haxx:libcurl:7.24.0 cpe:/a:haxx:libcurl:7.25.0 cpe:/a:haxx:libcurl:7.26.0 cpe:/a:haxx:libcurl:7.27.0 cpe:/a:haxx:libcurl:7.28.0 cpe:/a:haxx:libcurl:7.28.1 cpe:/a:haxx:libcurl:7.29.0 cpe:/a:haxx:libcurl:7.30.0 cpe:/a:haxx:libcurl:7.31.0 cpe:/a:haxx:libcurl:7.32.0 cpe:/a:haxx:libcurl:7.33.0 cpe:/a:haxx:libcurl:7.34.0 cpe:/a:haxx:libcurl:7.35.0

CVE-2014-0139

2014-04-15T10:55:04.137-04:00

2017-12-15T21:29:03.307-05:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://advisories.mageia.org/MGASA-2015-0165.html CONFIRM http://curl.haxx.se/docs/adv_20140326B.html SUSE openSUSE-SU-2014:0530 SECUNIA 58615 DEBIAN DSA-2902 CONFIRM http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/ CONFIRM http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/ CONFIRM http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/ MANDRIVA MDVSA-2015:213 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html UBUNTU USN-2167-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21675820 CONFIRM http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095862 cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.

cpe:/a:redhat:cloudforms_3.0.1_management_engine:5.2.1 cpe:/a:redhat:cloudforms_3.0.2_management_engine:5.2.2 cpe:/a:redhat:cloudforms_3.0.3_management_engine:5.2.3 cpe:/a:redhat:cloudforms_3.0.4_management_engine:5.2.4 cpe:/a:redhat:cloudforms_3.0.5_management_engine:5.2.5 cpe:/a:redhat:cloudforms_3.0_management_engine:5.2

CVE-2014-0140

2014-10-06T10:55:08.110-04:00

2014-10-07T10:56:54.957-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-10-07T10:56:54.707-04:00

REDHAT RHSA-2014:1317 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1077359 Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to access sensitive controllers and actions via a direct HTTP or HTTPS request.

cpe:/a:redhat:satellite:6.0.3

CVE-2014-0141

2017-08-28T11:29:00.267-04:00

2017-08-31T09:47:30.650-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-08-30T16:00:31.823-04:00

CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1187466 Cross-site scripting (XSS) vulnerability in Red Hat Satellite 6.0.3.

cpe:/a:qemu:qemu:2.0.0:rc3

CVE-2014-0142

2017-08-10T11:29:00.177-04:00

2017-11-03T21:29:00.333-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://git.qemu.org/?p=qemu.git;a=commitdiff;h=8e53abbc20d08ae3ec30c2054e1161314ad9501d CONFIRM http://git.qemu.org/?p=qemu.git;a=commitdiff;h=9302e863aa8baa5d932fc078967050c055fa1a7f REDHAT RHSA-2014:0420 REDHAT RHSA-2014:0421 DEBIAN DSA-3044 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1078201 QEMU, possibly before 2.0.0, allows local users to cause a denial of service (divide-by-zero error and crash) via a zero value in the (1) tracks field to the seek_to_sector function in block/parallels.c or (2) extent_size field in the bochs function in block/bochs.c.

cpe:/a:qemu:qemu:1.7.1 cpe:/o:redhat:enterprise_linux:6.0

CVE-2014-0143

2017-08-10T11:29:00.223-04:00

2019-04-22T13:48:00.643-04:00

4.4

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://git.qemu.org/?p=qemu.git;a=commit;h=509a41bab5306181044b5fff02eadf96d9c8676a CONFIRM http://git.qemu.org/?p=qemu.git;a=commit;h=6a83f8b5bec6f59e56cc49bd49e4c3f8f805d56f CONFIRM http://git.qemu.org/?p=qemu.git;a=commit;h=8f4754ede56e3f9ea3fd7207f4a7c4453e59285b CONFIRM http://git.qemu.org/?p=qemu.git;a=commit;h=afbcc40bee4ef51731102d7d4b499ee12fc182e1 CONFIRM http://git.qemu.org/?p=qemu.git;a=commit;h=cab60de930684c33f67d4e32c7509b567f8c445b CONFIRM http://git.qemu.org/?p=qemu.git;a=commit;h=db8a31d11d6a60f48d6817530640d75aa72a9a2f CONFIRM http://git.qemu.org/?p=qemu.git;a=commit;h=e3737b820b45e54b059656dc3f914f895ac7a88b REDHAT RHSA-2014:0420 REDHAT RHSA-2014:0421 DEBIAN DSA-3044 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1079140 Multiple integer overflows in the block drivers in QEMU, possibly before 2.0.0, allow local users to cause a denial of service (crash) via a crafted catalog size in (1) the parallels_open function in block/parallels.c or (2) bochs_open function in bochs.c, a large L1 table in the (3) qcow2_snapshot_load_tmp in qcow2-snapshot.c or (4) qcow2_grow_l1_table function in qcow2-cluster.c, (5) a large request in the bdrv_check_byte_request function in block.c and other block drivers, (6) crafted cluster indexes in the get_refcount function in qcow2-refcount.c, or (7) a large number of blocks in the cloop_open function in cloop.c, which trigger buffer overflows, memory corruption, large memory allocations and out-of-bounds read and writes.

cpe:/a:qemu:qemu:1.7.1 cpe:/a:qemu:qemu:2.0.0:rc0 cpe:/a:qemu:qemu:2.0.0:rc1 cpe:/a:qemu:qemu:2.0.0:rc2 cpe:/a:qemu:qemu:2.0.0:rc3

CVE-2014-0145

2017-08-10T11:29:00.270-04:00

2017-11-03T21:29:00.457-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://git.qemu.org/?p=qemu.git;a=commit;h=c05e4667be91b46ab42b5a11babf8e84d476cc6b CONFIRM http://git.qemu.org/?p=qemu.git;a=commit;h=f0dce23475b5af5da6b17b97c1765271307734b6 CONFIRM http://git.qemu.org/?p=qemu.git;a=commitdiff;h=c165f7758009a4f793c1fc19ebb69cf55313450b REDHAT RHSA-2014:0420 REDHAT RHSA-2014:0421 DEBIAN DSA-3044 MLIST [oss-security] 20140326 QEMU image format input validation fixes (multiple CVEs) CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1078885 MISC https://lists.gnu.org/archive/html/qemu-devel/2014-03/msg04994.html Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0, allow local users to cause a denial of service (crash) or possibly execute arbitrary code via a large (1) L1 table in the qcow2_snapshot_load_tmp in the QCOW 2 block driver (block/qcow2-snapshot.c) or (2) uncompressed chunk, (3) chunk length, or (4) number of sectors in the DMG block driver (block/dmg.c).

cpe:/a:qemu:qemu:1.7.1 cpe:/a:qemu:qemu:2.0.0:rc0 cpe:/a:qemu:qemu:2.0.0:rc1 cpe:/a:qemu:qemu:2.0.0:rc2 cpe:/a:qemu:qemu:2.0.0:rc3

CVE-2014-0146

2017-08-10T11:29:00.317-04:00

2017-11-03T21:29:00.520-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://git.qemu.org/?p=qemu.git;a=commit;h=11b128f4062dd7f89b14abc8877ff20d41b28be9 REDHAT RHSA-2014:0420 REDHAT RHSA-2014:0421 DEBIAN DSA-3044 MLIST [oss-security] 20140326 QEMU image format input validation fixes (multiple CVEs) CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1078232 The qcow2_open function in the (block/qcow2.c) in QEMU before 1.7.2 and 2.x before 2.0.0 allows local users to cause a denial of service (NULL pointer dereference) via a crafted image which causes an error, related to the initialization of the snapshot_offset and nb_snapshots fields.

cpe:/a:redhat:jboss_web_framework_kit:2.5.0

CVE-2014-0149

2014-05-05T13:06:05.543-04:00

2014-05-06T15:07:45.927-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-05-05T13:49:26.313-04:00

REDHAT RHSA-2014:0462 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1078646 Multiple cross-site scripting (XSS) vulnerabilities in Red Hat JBoss Web Framework Kit 2.5.0 allow remote attackers to inject arbitrary web script or HTML via a (1) parameter or (2) id name.

cpe:/a:qemu:qemu:0.1 cpe:/a:qemu:qemu:0.1.1 cpe:/a:qemu:qemu:0.1.2 cpe:/a:qemu:qemu:0.1.3 cpe:/a:qemu:qemu:0.1.4 cpe:/a:qemu:qemu:0.1.5 cpe:/a:qemu:qemu:0.1.6 cpe:/a:qemu:qemu:0.2 cpe:/a:qemu:qemu:0.3 cpe:/a:qemu:qemu:0.4 cpe:/a:qemu:qemu:0.4.1 cpe:/a:qemu:qemu:0.4.2 cpe:/a:qemu:qemu:0.4.3 cpe:/a:qemu:qemu:0.5.0 cpe:/a:qemu:qemu:0.5.1 cpe:/a:qemu:qemu:0.5.2 cpe:/a:qemu:qemu:0.5.3 cpe:/a:qemu:qemu:0.5.4 cpe:/a:qemu:qemu:0.5.5 cpe:/a:qemu:qemu:0.6.0 cpe:/a:qemu:qemu:0.6.1 cpe:/a:qemu:qemu:0.7.0 cpe:/a:qemu:qemu:0.7.1 cpe:/a:qemu:qemu:0.7.2 cpe:/a:qemu:qemu:0.8.0 cpe:/a:qemu:qemu:0.8.1 cpe:/a:qemu:qemu:0.8.2 cpe:/a:qemu:qemu:0.9.0 cpe:/a:qemu:qemu:0.9.1 cpe:/a:qemu:qemu:0.9.1-5 cpe:/a:qemu:qemu:0.10.0 cpe:/a:qemu:qemu:0.10.1 cpe:/a:qemu:qemu:0.10.2 cpe:/a:qemu:qemu:0.10.3 cpe:/a:qemu:qemu:0.10.4 cpe:/a:qemu:qemu:0.10.5 cpe:/a:qemu:qemu:0.10.6 cpe:/a:qemu:qemu:0.11.0 cpe:/a:qemu:qemu:0.11.0:rc0 cpe:/a:qemu:qemu:0.11.0:rc1 cpe:/a:qemu:qemu:0.11.0:rc2 cpe:/a:qemu:qemu:0.11.0-rc0 cpe:/a:qemu:qemu:0.11.0-rc1 cpe:/a:qemu:qemu:0.11.0-rc2 cpe:/a:qemu:qemu:0.11.1 cpe:/a:qemu:qemu:0.12.0 cpe:/a:qemu:qemu:0.12.0:rc1 cpe:/a:qemu:qemu:0.12.0:rc2 cpe:/a:qemu:qemu:0.12.1 cpe:/a:qemu:qemu:0.12.2 cpe:/a:qemu:qemu:0.12.3 cpe:/a:qemu:qemu:0.12.4 cpe:/a:qemu:qemu:0.12.5 cpe:/a:qemu:qemu:0.13.0 cpe:/a:qemu:qemu:0.13.0:rc0 cpe:/a:qemu:qemu:0.13.0:rc1 cpe:/a:qemu:qemu:0.14.0 cpe:/a:qemu:qemu:0.14.0:rc0 cpe:/a:qemu:qemu:0.14.0:rc1 cpe:/a:qemu:qemu:0.14.0:rc2 cpe:/a:qemu:qemu:0.14.1 cpe:/a:qemu:qemu:0.15.0:rc1 cpe:/a:qemu:qemu:0.15.0:rc2 cpe:/a:qemu:qemu:0.15.1 cpe:/a:qemu:qemu:0.15.2 cpe:/a:qemu:qemu:1.0 cpe:/a:qemu:qemu:1.0:rc1 cpe:/a:qemu:qemu:1.0:rc2 cpe:/a:qemu:qemu:1.0:rc3 cpe:/a:qemu:qemu:1.0:rc4 cpe:/a:qemu:qemu:1.0.1 cpe:/a:qemu:qemu:1.1 cpe:/a:qemu:qemu:1.1:rc1 cpe:/a:qemu:qemu:1.1:rc2 cpe:/a:qemu:qemu:1.1:rc3 cpe:/a:qemu:qemu:1.1:rc4 cpe:/a:qemu:qemu:1.4.1 cpe:/a:qemu:qemu:1.4.2 cpe:/a:qemu:qemu:1.5.0 cpe:/a:qemu:qemu:1.5.0:rc1 cpe:/a:qemu:qemu:1.5.0:rc2 cpe:/a:qemu:qemu:1.5.0:rc3 cpe:/a:qemu:qemu:1.5.1 cpe:/a:qemu:qemu:1.5.2 cpe:/a:qemu:qemu:1.5.3 cpe:/a:qemu:qemu:1.6.0 cpe:/a:qemu:qemu:1.6.0:rc1 cpe:/a:qemu:qemu:1.6.0:rc2 cpe:/a:qemu:qemu:1.6.0:rc3 cpe:/a:qemu:qemu:1.6.1 cpe:/a:qemu:qemu:1.6.2 cpe:/a:qemu:qemu:1.7.1 cpe:/a:qemu:qemu:2.0 cpe:/a:qemu:qemu:2.0.0:- cpe:/a:qemu:qemu:2.0.0:rc0 cpe:/a:qemu:qemu:2.0.0:rc1 cpe:/a:qemu:qemu:2.0.0:rc2 cpe:/a:qemu:qemu:2.0.0:rc3 cpe:/o:redhat:enterprise_linux:6.0

CVE-2014-0150

2014-04-18T10:55:25.947-04:00

2019-04-22T13:48:00.643-04:00

4.9

ADJACENT_NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov MLIST [Qemu-devel] 20140411 Re: [PATCH for-2.0] virtio-net: fix guest-triggerable buffer overrun MLIST [Qemu-devel] 20140411 [PATCH for-2.0] virtio-net: fix guest-triggerable buffer overrun DEBIAN DSA-2909 DEBIAN DSA-2910 UBUNTU USN-2182-1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1078846 Integer overflow in the virtio_net_handle_mac function in hw/net/virtio-net.c in QEMU 2.0 and earlier allows local guest users to execute arbitrary code via a MAC addresses table update request, which triggers a heap-based buffer overflow.

cpe:/a:ovirt:ovirt:3.5.0:beta1

CVE-2014-0151

2015-02-13T10:59:01.830-05:00

2015-02-13T18:19:00.160-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2015-02-13T13:56:12.657-05:00

REDHAT RHSA-2015:0158 CONFIRM http://www.ovirt.org/OVirt_3.5_Release_Notes CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1077441 Cross-site request forgery (CSRF) vulnerability in oVirt Engine before 3.5.0 beta2 allows remote attackers to hijack the authentication of users for requests that perform unspecified actions via a REST API request.

cpe:/a:ovirt:ovirt:3.0.0 cpe:/a:ovirt:ovirt:3.1.0 cpe:/a:ovirt:ovirt:3.2.0 cpe:/a:ovirt:ovirt:3.3.0 cpe:/a:ovirt:ovirt:3.3.2:rc1 cpe:/a:ovirt:ovirt:3.3.3 cpe:/a:ovirt:ovirt:3.3.4 cpe:/a:ovirt:ovirt:3.3.5 cpe:/a:ovirt:ovirt:3.4.0 cpe:/a:ovirt:ovirt:3.4.0:rc1

CVE-2014-0152

2014-09-08T10:55:02.403-04:00

2018-10-30T12:27:25.077-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2014-09-09T09:06:30.097-04:00

CONFIRM http://gerrit.ovirt.org/#/c/25959/ CONFIRM http://www.ovirt.org/Security_advisories Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors.

CVE-2014-0153

2014-09-08T10:55:02.467-04:00

2018-10-30T12:27:25.077-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-09-09T10:03:31.657-04:00

CONFIRM http://gerrit.ovirt.org/#/c/25987/ CONFIRM http://www.ovirt.org/Security_advisories The REST API in oVirt 3.4.0 and earlier stores session IDs in HTML5 local storage, which allows remote attackers to obtain sensitive information via a crafted web page.

cpe:/a:ovirt:ovirt:3.4.4

CVE-2014-0154

2015-02-13T10:59:03.313-05:00

2015-02-13T18:19:19.817-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2015-02-13T13:46:36.700-05:00

REDHAT RHSA-2015:0158 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1077450 oVirt Engine before 3.5.0 does not include the HTTPOnly flag in a Set-Cookie header for the session IDs, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

cpe:/o:linux:linux_kernel:3.0:rc1 cpe:/o:linux:linux_kernel:3.0:rc2 cpe:/o:linux:linux_kernel:3.0:rc3 cpe:/o:linux:linux_kernel:3.0:rc4 cpe:/o:linux:linux_kernel:3.0:rc5 cpe:/o:linux:linux_kernel:3.0:rc6 cpe:/o:linux:linux_kernel:3.0:rc7 cpe:/o:linux:linux_kernel:3.0.1 cpe:/o:linux:linux_kernel:3.0.2 cpe:/o:linux:linux_kernel:3.0.3 cpe:/o:linux:linux_kernel:3.0.4 cpe:/o:linux:linux_kernel:3.0.5 cpe:/o:linux:linux_kernel:3.0.6 cpe:/o:linux:linux_kernel:3.0.7 cpe:/o:linux:linux_kernel:3.0.8 cpe:/o:linux:linux_kernel:3.0.9 cpe:/o:linux:linux_kernel:3.0.10 cpe:/o:linux:linux_kernel:3.0.11 cpe:/o:linux:linux_kernel:3.0.12 cpe:/o:linux:linux_kernel:3.0.13 cpe:/o:linux:linux_kernel:3.0.14 cpe:/o:linux:linux_kernel:3.0.15 cpe:/o:linux:linux_kernel:3.0.16 cpe:/o:linux:linux_kernel:3.0.17 cpe:/o:linux:linux_kernel:3.0.18 cpe:/o:linux:linux_kernel:3.0.19 cpe:/o:linux:linux_kernel:3.0.20 cpe:/o:linux:linux_kernel:3.0.21 cpe:/o:linux:linux_kernel:3.0.22 cpe:/o:linux:linux_kernel:3.0.23 cpe:/o:linux:linux_kernel:3.0.24 cpe:/o:linux:linux_kernel:3.0.25 cpe:/o:linux:linux_kernel:3.0.26 cpe:/o:linux:linux_kernel:3.0.27 cpe:/o:linux:linux_kernel:3.0.28 cpe:/o:linux:linux_kernel:3.0.29 cpe:/o:linux:linux_kernel:3.0.30 cpe:/o:linux:linux_kernel:3.0.31 cpe:/o:linux:linux_kernel:3.0.32 cpe:/o:linux:linux_kernel:3.0.33 cpe:/o:linux:linux_kernel:3.0.34 cpe:/o:linux:linux_kernel:3.0.35 cpe:/o:linux:linux_kernel:3.0.36 cpe:/o:linux:linux_kernel:3.0.37 cpe:/o:linux:linux_kernel:3.0.38 cpe:/o:linux:linux_kernel:3.0.39 cpe:/o:linux:linux_kernel:3.0.40 cpe:/o:linux:linux_kernel:3.0.41 cpe:/o:linux:linux_kernel:3.0.42 cpe:/o:linux:linux_kernel:3.0.43 cpe:/o:linux:linux_kernel:3.0.44 cpe:/o:linux:linux_kernel:3.0.45 cpe:/o:linux:linux_kernel:3.0.46 cpe:/o:linux:linux_kernel:3.0.47 cpe:/o:linux:linux_kernel:3.0.48 cpe:/o:linux:linux_kernel:3.0.49 cpe:/o:linux:linux_kernel:3.0.50 cpe:/o:linux:linux_kernel:3.0.51 cpe:/o:linux:linux_kernel:3.0.52 cpe:/o:linux:linux_kernel:3.0.53 cpe:/o:linux:linux_kernel:3.0.54 cpe:/o:linux:linux_kernel:3.0.55 cpe:/o:linux:linux_kernel:3.0.56 cpe:/o:linux:linux_kernel:3.0.57 cpe:/o:linux:linux_kernel:3.0.58 cpe:/o:linux:linux_kernel:3.0.59 cpe:/o:linux:linux_kernel:3.0.60 cpe:/o:linux:linux_kernel:3.0.61 cpe:/o:linux:linux_kernel:3.0.62 cpe:/o:linux:linux_kernel:3.0.63 cpe:/o:linux:linux_kernel:3.0.64 cpe:/o:linux:linux_kernel:3.0.65 cpe:/o:linux:linux_kernel:3.0.66 cpe:/o:linux:linux_kernel:3.0.67 cpe:/o:linux:linux_kernel:3.0.68 cpe:/o:linux:linux_kernel:3.1 cpe:/o:linux:linux_kernel:3.1:rc1 cpe:/o:linux:linux_kernel:3.1:rc2 cpe:/o:linux:linux_kernel:3.1:rc3 cpe:/o:linux:linux_kernel:3.1:rc4 cpe:/o:linux:linux_kernel:3.1.1 cpe:/o:linux:linux_kernel:3.1.2 cpe:/o:linux:linux_kernel:3.1.3 cpe:/o:linux:linux_kernel:3.1.4 cpe:/o:linux:linux_kernel:3.1.5 cpe:/o:linux:linux_kernel:3.1.6 cpe:/o:linux:linux_kernel:3.1.7 cpe:/o:linux:linux_kernel:3.1.8 cpe:/o:linux:linux_kernel:3.1.9 cpe:/o:linux:linux_kernel:3.1.10 cpe:/o:linux:linux_kernel:3.2 cpe:/o:linux:linux_kernel:3.2:rc2 cpe:/o:linux:linux_kernel:3.2:rc3 cpe:/o:linux:linux_kernel:3.2:rc4 cpe:/o:linux:linux_kernel:3.2:rc5 cpe:/o:linux:linux_kernel:3.2:rc6 cpe:/o:linux:linux_kernel:3.2:rc7 cpe:/o:linux:linux_kernel:3.2.1 cpe:/o:linux:linux_kernel:3.2.2 cpe:/o:linux:linux_kernel:3.2.3 cpe:/o:linux:linux_kernel:3.2.4 cpe:/o:linux:linux_kernel:3.2.5 cpe:/o:linux:linux_kernel:3.2.6 cpe:/o:linux:linux_kernel:3.2.7 cpe:/o:linux:linux_kernel:3.2.8 cpe:/o:linux:linux_kernel:3.2.9 cpe:/o:linux:linux_kernel:3.2.10 cpe:/o:linux:linux_kernel:3.2.11 cpe:/o:linux:linux_kernel:3.2.12 cpe:/o:linux:linux_kernel:3.2.13 cpe:/o:linux:linux_kernel:3.2.14 cpe:/o:linux:linux_kernel:3.2.15 cpe:/o:linux:linux_kernel:3.2.16 cpe:/o:linux:linux_kernel:3.2.17 cpe:/o:linux:linux_kernel:3.2.18 cpe:/o:linux:linux_kernel:3.2.19 cpe:/o:linux:linux_kernel:3.2.20 cpe:/o:linux:linux_kernel:3.2.21 cpe:/o:linux:linux_kernel:3.2.22 cpe:/o:linux:linux_kernel:3.2.23 cpe:/o:linux:linux_kernel:3.2.24 cpe:/o:linux:linux_kernel:3.2.25 cpe:/o:linux:linux_kernel:3.2.26 cpe:/o:linux:linux_kernel:3.2.27 cpe:/o:linux:linux_kernel:3.2.28 cpe:/o:linux:linux_kernel:3.2.29 cpe:/o:linux:linux_kernel:3.2.30 cpe:/o:linux:linux_kernel:3.3 cpe:/o:linux:linux_kernel:3.3:rc1 cpe:/o:linux:linux_kernel:3.3:rc2 cpe:/o:linux:linux_kernel:3.3:rc3 cpe:/o:linux:linux_kernel:3.3:rc4 cpe:/o:linux:linux_kernel:3.3:rc5 cpe:/o:linux:linux_kernel:3.3:rc6 cpe:/o:linux:linux_kernel:3.3:rc7 cpe:/o:linux:linux_kernel:3.3.1 cpe:/o:linux:linux_kernel:3.3.2 cpe:/o:linux:linux_kernel:3.3.3 cpe:/o:linux:linux_kernel:3.3.4 cpe:/o:linux:linux_kernel:3.3.5 cpe:/o:linux:linux_kernel:3.3.6 cpe:/o:linux:linux_kernel:3.3.7 cpe:/o:linux:linux_kernel:3.3.8 cpe:/o:linux:linux_kernel:3.4 cpe:/o:linux:linux_kernel:3.4:rc1 cpe:/o:linux:linux_kernel:3.4:rc2 cpe:/o:linux:linux_kernel:3.4:rc3 cpe:/o:linux:linux_kernel:3.4:rc4 cpe:/o:linux:linux_kernel:3.4:rc5 cpe:/o:linux:linux_kernel:3.4:rc6 cpe:/o:linux:linux_kernel:3.4:rc7 cpe:/o:linux:linux_kernel:3.4.1 cpe:/o:linux:linux_kernel:3.4.2 cpe:/o:linux:linux_kernel:3.4.3 cpe:/o:linux:linux_kernel:3.4.4 cpe:/o:linux:linux_kernel:3.4.5 cpe:/o:linux:linux_kernel:3.4.6 cpe:/o:linux:linux_kernel:3.4.7 cpe:/o:linux:linux_kernel:3.4.8 cpe:/o:linux:linux_kernel:3.4.9 cpe:/o:linux:linux_kernel:3.4.10 cpe:/o:linux:linux_kernel:3.4.11 cpe:/o:linux:linux_kernel:3.4.12 cpe:/o:linux:linux_kernel:3.4.13 cpe:/o:linux:linux_kernel:3.4.14 cpe:/o:linux:linux_kernel:3.4.15 cpe:/o:linux:linux_kernel:3.4.16 cpe:/o:linux:linux_kernel:3.4.17 cpe:/o:linux:linux_kernel:3.4.18 cpe:/o:linux:linux_kernel:3.4.19 cpe:/o:linux:linux_kernel:3.4.20 cpe:/o:linux:linux_kernel:3.4.21 cpe:/o:linux:linux_kernel:3.4.22 cpe:/o:linux:linux_kernel:3.4.23 cpe:/o:linux:linux_kernel:3.4.24 cpe:/o:linux:linux_kernel:3.4.25 cpe:/o:linux:linux_kernel:3.4.26 cpe:/o:linux:linux_kernel:3.4.27 cpe:/o:linux:linux_kernel:3.4.28 cpe:/o:linux:linux_kernel:3.4.29 cpe:/o:linux:linux_kernel:3.4.30 cpe:/o:linux:linux_kernel:3.4.31 cpe:/o:linux:linux_kernel:3.4.32 cpe:/o:linux:linux_kernel:3.4.33 cpe:/o:linux:linux_kernel:3.4.34 cpe:/o:linux:linux_kernel:3.4.35 cpe:/o:linux:linux_kernel:3.4.36 cpe:/o:linux:linux_kernel:3.4.37 cpe:/o:linux:linux_kernel:3.4.38 cpe:/o:linux:linux_kernel:3.4.39 cpe:/o:linux:linux_kernel:3.4.40 cpe:/o:linux:linux_kernel:3.4.41 cpe:/o:linux:linux_kernel:3.4.42 cpe:/o:linux:linux_kernel:3.4.43 cpe:/o:linux:linux_kernel:3.4.44 cpe:/o:linux:linux_kernel:3.4.45 cpe:/o:linux:linux_kernel:3.4.46 cpe:/o:linux:linux_kernel:3.4.47 cpe:/o:linux:linux_kernel:3.4.48 cpe:/o:linux:linux_kernel:3.4.49 cpe:/o:linux:linux_kernel:3.4.50 cpe:/o:linux:linux_kernel:3.4.51 cpe:/o:linux:linux_kernel:3.4.52 cpe:/o:linux:linux_kernel:3.4.53 cpe:/o:linux:linux_kernel:3.4.54 cpe:/o:linux:linux_kernel:3.4.55 cpe:/o:linux:linux_kernel:3.4.56 cpe:/o:linux:linux_kernel:3.4.57 cpe:/o:linux:linux_kernel:3.4.58 cpe:/o:linux:linux_kernel:3.4.59 cpe:/o:linux:linux_kernel:3.4.60 cpe:/o:linux:linux_kernel:3.4.61 cpe:/o:linux:linux_kernel:3.4.62 cpe:/o:linux:linux_kernel:3.4.63 cpe:/o:linux:linux_kernel:3.4.64 cpe:/o:linux:linux_kernel:3.4.65 cpe:/o:linux:linux_kernel:3.4.66 cpe:/o:linux:linux_kernel:3.4.67 cpe:/o:linux:linux_kernel:3.4.68 cpe:/o:linux:linux_kernel:3.4.69 cpe:/o:linux:linux_kernel:3.4.70 cpe:/o:linux:linux_kernel:3.4.71 cpe:/o:linux:linux_kernel:3.4.72 cpe:/o:linux:linux_kernel:3.4.73 cpe:/o:linux:linux_kernel:3.4.74 cpe:/o:linux:linux_kernel:3.4.75 cpe:/o:linux:linux_kernel:3.4.76 cpe:/o:linux:linux_kernel:3.4.77 cpe:/o:linux:linux_kernel:3.4.78 cpe:/o:linux:linux_kernel:3.4.79 cpe:/o:linux:linux_kernel:3.5.1 cpe:/o:linux:linux_kernel:3.5.2 cpe:/o:linux:linux_kernel:3.5.3 cpe:/o:linux:linux_kernel:3.5.4 cpe:/o:linux:linux_kernel:3.5.5 cpe:/o:linux:linux_kernel:3.5.6 cpe:/o:linux:linux_kernel:3.5.7 cpe:/o:linux:linux_kernel:3.6 cpe:/o:linux:linux_kernel:3.6.1 cpe:/o:linux:linux_kernel:3.6.2 cpe:/o:linux:linux_kernel:3.6.3 cpe:/o:linux:linux_kernel:3.6.4 cpe:/o:linux:linux_kernel:3.6.5 cpe:/o:linux:linux_kernel:3.6.6 cpe:/o:linux:linux_kernel:3.6.7 cpe:/o:linux:linux_kernel:3.6.8 cpe:/o:linux:linux_kernel:3.6.9 cpe:/o:linux:linux_kernel:3.6.10 cpe:/o:linux:linux_kernel:3.6.11 cpe:/o:linux:linux_kernel:3.7 cpe:/o:linux:linux_kernel:3.7.1 cpe:/o:linux:linux_kernel:3.7.2 cpe:/o:linux:linux_kernel:3.7.3 cpe:/o:linux:linux_kernel:3.7.4 cpe:/o:linux:linux_kernel:3.7.5 cpe:/o:linux:linux_kernel:3.7.6 cpe:/o:linux:linux_kernel:3.7.7 cpe:/o:linux:linux_kernel:3.7.8 cpe:/o:linux:linux_kernel:3.7.9 cpe:/o:linux:linux_kernel:3.7.10 cpe:/o:linux:linux_kernel:3.8.0 cpe:/o:linux:linux_kernel:3.8.1 cpe:/o:linux:linux_kernel:3.8.2 cpe:/o:linux:linux_kernel:3.8.3 cpe:/o:linux:linux_kernel:3.8.4 cpe:/o:linux:linux_kernel:3.8.5 cpe:/o:linux:linux_kernel:3.8.6 cpe:/o:linux:linux_kernel:3.8.7 cpe:/o:linux:linux_kernel:3.8.8 cpe:/o:linux:linux_kernel:3.8.9 cpe:/o:linux:linux_kernel:3.8.10 cpe:/o:linux:linux_kernel:3.8.11 cpe:/o:linux:linux_kernel:3.8.12 cpe:/o:linux:linux_kernel:3.8.13 cpe:/o:linux:linux_kernel:3.9:rc1 cpe:/o:linux:linux_kernel:3.9:rc2 cpe:/o:linux:linux_kernel:3.9:rc3 cpe:/o:linux:linux_kernel:3.9:rc4 cpe:/o:linux:linux_kernel:3.9:rc5 cpe:/o:linux:linux_kernel:3.9:rc6 cpe:/o:linux:linux_kernel:3.9:rc7 cpe:/o:linux:linux_kernel:3.9.0 cpe:/o:linux:linux_kernel:3.9.1 cpe:/o:linux:linux_kernel:3.9.2 cpe:/o:linux:linux_kernel:3.9.3 cpe:/o:linux:linux_kernel:3.9.4 cpe:/o:linux:linux_kernel:3.9.5 cpe:/o:linux:linux_kernel:3.9.6 cpe:/o:linux:linux_kernel:3.9.7 cpe:/o:linux:linux_kernel:3.9.8 cpe:/o:linux:linux_kernel:3.9.9 cpe:/o:linux:linux_kernel:3.9.10 cpe:/o:linux:linux_kernel:3.9.11 cpe:/o:linux:linux_kernel:3.10 cpe:/o:linux:linux_kernel:3.10.1 cpe:/o:linux:linux_kernel:3.10.2 cpe:/o:linux:linux_kernel:3.10.3 cpe:/o:linux:linux_kernel:3.10.4 cpe:/o:linux:linux_kernel:3.10.5 cpe:/o:linux:linux_kernel:3.10.6 cpe:/o:linux:linux_kernel:3.10.7 cpe:/o:linux:linux_kernel:3.10.8 cpe:/o:linux:linux_kernel:3.10.9 cpe:/o:linux:linux_kernel:3.10.10 cpe:/o:linux:linux_kernel:3.10.11 cpe:/o:linux:linux_kernel:3.10.12 cpe:/o:linux:linux_kernel:3.10.13 cpe:/o:linux:linux_kernel:3.10.14 cpe:/o:linux:linux_kernel:3.10.15 cpe:/o:linux:linux_kernel:3.10.16 cpe:/o:linux:linux_kernel:3.10.17 cpe:/o:linux:linux_kernel:3.10.18 cpe:/o:linux:linux_kernel:3.10.19 cpe:/o:linux:linux_kernel:3.10.20 cpe:/o:linux:linux_kernel:3.10.21 cpe:/o:linux:linux_kernel:3.10.22 cpe:/o:linux:linux_kernel:3.10.23 cpe:/o:linux:linux_kernel:3.10.24 cpe:/o:linux:linux_kernel:3.10.25 cpe:/o:linux:linux_kernel:3.10.26 cpe:/o:linux:linux_kernel:3.10.27 cpe:/o:linux:linux_kernel:3.10.28 cpe:/o:linux:linux_kernel:3.10.29 cpe:/o:linux:linux_kernel:3.11 cpe:/o:linux:linux_kernel:3.11.1 cpe:/o:linux:linux_kernel:3.11.2 cpe:/o:linux:linux_kernel:3.11.3 cpe:/o:linux:linux_kernel:3.11.4 cpe:/o:linux:linux_kernel:3.11.5 cpe:/o:linux:linux_kernel:3.11.6 cpe:/o:linux:linux_kernel:3.11.7 cpe:/o:linux:linux_kernel:3.11.8 cpe:/o:linux:linux_kernel:3.11.9 cpe:/o:linux:linux_kernel:3.11.10 cpe:/o:linux:linux_kernel:3.12 cpe:/o:linux:linux_kernel:3.12.1 cpe:/o:linux:linux_kernel:3.12.2 cpe:/o:linux:linux_kernel:3.12.3 cpe:/o:linux:linux_kernel:3.12.4 cpe:/o:linux:linux_kernel:3.12.5 cpe:/o:linux:linux_kernel:3.12.6 cpe:/o:linux:linux_kernel:3.12.7 cpe:/o:linux:linux_kernel:3.12.8 cpe:/o:linux:linux_kernel:3.12.9 cpe:/o:linux:linux_kernel:3.12.10 cpe:/o:linux:linux_kernel:3.12.11 cpe:/o:linux:linux_kernel:3.12.12 cpe:/o:linux:linux_kernel:3.12.13 cpe:/o:linux:linux_kernel:3.12.14 cpe:/o:linux:linux_kernel:3.12.15 cpe:/o:linux:linux_kernel:3.12.16 cpe:/o:linux:linux_kernel:3.12.17 cpe:/o:linux:linux_kernel:3.13 cpe:/o:linux:linux_kernel:3.13.1 cpe:/o:linux:linux_kernel:3.13.2 cpe:/o:linux:linux_kernel:3.13.3 cpe:/o:linux:linux_kernel:3.13.4 cpe:/o:linux:linux_kernel:3.13.5 cpe:/o:linux:linux_kernel:3.13.6 cpe:/o:linux:linux_kernel:3.13.7 cpe:/o:linux:linux_kernel:3.13.8 cpe:/o:linux:linux_kernel:3.13.9 cpe:/o:linux:linux_kernel:3.14.1

CVE-2014-0155

2014-04-14T19:55:07.577-04:00

2014-04-15T11:06:54.553-04:00

5.5

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov

2014-04-15T11:06:52.443-04:00

CONFIRM http://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=5678de3f15010b9022ee45673f33bcfc71d47b60 MLIST [oss-security] 20140407 CVE-2014-0155 -- kernel: kvm: BUG caused by invalid entry in guest ioapic redirection table CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1081589 The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC. NOTE: the affected code was moved to the ioapic_service function before the vulnerability was announced.

cpe:/a:openstack:horizon:2013.2 cpe:/a:openstack:horizon:2013.2.1 cpe:/a:openstack:horizon:2013.2.2 cpe:/a:openstack:horizon:2013.2.3 cpe:/o:opensuse:opensuse:13.1

CVE-2014-0157

2014-04-15T10:55:04.187-04:00

2018-10-30T12:27:34.687-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-03-31T12:29:22.807-04:00

SUSE openSUSE-SU-2015:0078 MLIST [oss-security] 20140408 [OSSA 2014-010] XSS in Horizon orchestration dashboard (CVE-2014-0157) BID 66706 CONFIRM https://launchpad.net/bugs/1289033 Cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard (aka Horizon) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to inject arbitrary web script or HTML via the description field of a Heat template.

cpe:/a:openjpeg:openjpeg:- cpe:/a:openjpeg:openjpeg:1.3 cpe:/a:openjpeg:openjpeg:1.4 cpe:/a:openjpeg:openjpeg:1.5 cpe:/a:openjpeg:openjpeg:1.5.1 cpe:/o:opensuse:opensuse:12.3 cpe:/o:opensuse:opensuse:13.1

CVE-2014-0158

2018-04-10T11:29:00.207-04:00

2018-05-17T09:37:52.617-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2018-05-16T20:22:52.647-04:00

MISC https://bugzilla.redhat.com/show_bug.cgi?id=1082925 MISC https://bugzilla.suse.com/show_bug.cgi?id=871412 Heap-based buffer overflow in the JPEG2000 image tile decoder in OpenJPEG before 1.5.2 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file because of incorrect j2k_decode, j2k_read_eoc, and tcd_decode_tile interaction, a related issue to CVE-2013-6045. NOTE: this is not a duplicate of CVE-2013-1447, because the scope of CVE-2013-1447 was specifically defined in http://openwall.com/lists/oss-security/2013/12/04/6 as only "null pointer dereferences, division by zero, and anything that would just fit as DoS."

cpe:/a:openafs:openafs:1.4.8 cpe:/a:openafs:openafs:1.4.9 cpe:/a:openafs:openafs:1.4.10 cpe:/a:openafs:openafs:1.4.11 cpe:/a:openafs:openafs:1.4.12 cpe:/a:openafs:openafs:1.4.14 cpe:/a:openafs:openafs:1.4.14.1 cpe:/a:openafs:openafs:1.4.15 cpe:/a:openafs:openafs:1.6.0 cpe:/a:openafs:openafs:1.6.1 cpe:/a:openafs:openafs:1.6.2 cpe:/a:openafs:openafs:1.6.2.1 cpe:/a:openafs:openafs:1.6.3 cpe:/a:openafs:openafs:1.6.4 cpe:/a:openafs:openafs:1.6.5 cpe:/a:openafs:openafs:1.6.5.1 cpe:/a:openafs:openafs:1.6.5.2 cpe:/a:openafs:openafs:1.6.6 cpe:/o:debian:debian_linux:7.0

CVE-2014-0159

2014-04-14T11:09:05.990-04:00

2016-08-24T11:32:01.053-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2016-08-24T09:43:31.200-04:00

CONFIRM http://openafs.org/pages/security/OPENAFS-SA-2014-001.txt DEBIAN DSA-2899 MANDRIVA MDVSA-2014:244 CONFIRM http://www.openafs.org/frameset/dl/openafs/1.6.7/ChangeLog Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial of service (crash) via a crafted statsVersion argument.

cpe:/a:openssl:openssl:1.0.1 cpe:/a:openssl:openssl:1.0.1:beta1 cpe:/a:openssl:openssl:1.0.1:beta2 cpe:/a:openssl:openssl:1.0.1:beta3 cpe:/a:openssl:openssl:1.0.1a cpe:/a:openssl:openssl:1.0.1b cpe:/a:openssl:openssl:1.0.1c cpe:/a:openssl:openssl:1.0.1d cpe:/a:openssl:openssl:1.0.1e cpe:/a:openssl:openssl:1.0.1f cpe:/a:openssl:openssl:1.0.2:beta1

CVE-2014-0160

2014-04-07T18:55:03.893-04:00

2019-10-09T19:09:21.837-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://advisories.mageia.org/MGASA-2014-0165.html MISC http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/ CONFIRM http://cogentdatahub.com/ReleaseNotes.html CONFIRM http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-119-01 CONFIRM http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=96db9023b881d7cd9f379b0c154650d6c108e9a3 MISC http://heartbleed.com/ FEDORA FEDORA-2014-4879 FEDORA FEDORA-2014-4910 FEDORA FEDORA-2014-9308 SUSE openSUSE-SU-2014:0492 SUSE SUSE-SA:2014:002 SUSE openSUSE-SU-2014:0560 HP HPSBMU02995 HP HPSBMU02994 HP HPSBMU02998 HP HPSBMU02997 HP HPSBST03001 HP HPSBMU02999 HP HPSBGN03008 HP HPSBGN03010 HP HPSBMU03012 HP HPSBMU03019 HP HPSBMU03017 HP HPSBMU03018 HP HPSBST03015 HP HPSBMU03013 HP HPSBGN03011 HP HPSBHF03021 HP HPSBPI03014 HP HPSBMU03020 HP HPSBST03016 HP HPSBMU03023 HP HPSBMU03025 HP HPSBMU03022 HP HPSBMU03024 HP HPSBPI03031 HP HPSBMU03029 HP HPSBMU03028 HP HPSBMU03033 HP HPSBMU03030 HP HPSBMU03032 HP HPSBMU03009 HP HPSBST03004 HP HPSBST03027 HP HPSBMU03040 HP HPSBMU03044 HP HPSBMU03037 HP HPSBMU03062 HP HPSBHF03136 HP SSRT101846 CONFIRM http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=1 CONFIRM http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=3 REDHAT RHSA-2014:0376 REDHAT RHSA-2014:0377 REDHAT RHSA-2014:0378 REDHAT RHSA-2014:0396 FULLDISC 20140409 Re: heartbleed OpenSSL bug CVE-2014-0160 FULLDISC 20140411 MRI Rubies may contain statically linked, vulnerable OpenSSL FULLDISC 20140412 Re: heartbleed OpenSSL bug CVE-2014-0160 FULLDISC 20140408 heartbleed OpenSSL bug CVE-2014-0160 FULLDISC 20140408 Re: heartbleed OpenSSL bug CVE-2014-0160 FULLDISC 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities SECUNIA 59139 SECUNIA 59243 SECUNIA 59347 CONFIRM http://support.citrix.com/article/CTX140605 CISCO 20140409 OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products CONFIRM http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf CONFIRM http://www.blackberry.com/btsc/KB35882 DEBIAN DSA-2896 EXPLOIT-DB 32745 EXPLOIT-DB 32764 CONFIRM http://www.f-secure.com/en/web/labs_global/fsc-2014-1 CONFIRM http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/ CONFIRM http://www.getchef.com/blog/2014/04/09/chef-server-heartbleed-cve-2014-0160-releases/ CONFIRM http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/ CONFIRM http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/ CONFIRM http://www.innominate.com/data/downloads/manuals/mdm_1.5.2.1_Release_Notes.pdf CERT-VN VU#720951 CONFIRM http://www.kerio.com/support/kerio-control/release-history MANDRIVA MDVSA-2015:062 CONFIRM http://www.openssl.org/news/secadv_20140407.txt CONFIRM http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html CONFIRM http://www.oracle.com/technetwork/topics/security/opensslheartbleedcve-2014-0160-2188454.html BUGTRAQ 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities BID 66690 SECTRACK 1030026 SECTRACK 1030074 SECTRACK 1030077 SECTRACK 1030078 SECTRACK 1030079 SECTRACK 1030080 SECTRACK 1030081 SECTRACK 1030082 CONFIRM http://www.splunk.com/view/SP-CAAAMB3 CONFIRM http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160512_00 UBUNTU USN-2165-1 CERT TA14-098A CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0012.html CONFIRM http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=isg400001841 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=isg400001843 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004661 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21670161 MISC https://blog.torproject.org/blog/openssl-bug-cve-2014-0160 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1084875 CONFIRM https://code.google.com/p/mod-spdy/issues/detail?id=85 CONFIRM https://filezilla-project.org/versions.php?type=server MISC https://gist.github.com/chapmajs/10473815 HP HPSBST03000 MLIST [tomcat-dev] 20190319 svn commit: r1855831 [26/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ MLIST [tomcat-dev] 20190325 svn commit: r1856174 [26/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ MLIST [syslog-ng-announce] 20140411 syslog-ng Premium Edition 5 LTS (5.0.4a) has been released CONFIRM https://support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html CONFIRM https://support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html?sr=36517217 MISC https://www.cert.fi/en/reports/2014/vulnerability788210.html CONFIRM https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-17-0008 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

cpe:/a:openstack:icehouse:rc-1 cpe:/a:openstack:image_registry_and_delivery_service_%28glance%29:2013.2 cpe:/a:openstack:image_registry_and_delivery_service_%28glance%29:2013.2.1 cpe:/a:openstack:image_registry_and_delivery_service_%28glance%29:2013.2.2 cpe:/a:openstack:image_registry_and_delivery_service_%28glance%29:2013.2.3

CVE-2014-0162

2014-04-27T16:55:23.667-04:00

2014-06-05T00:28:46.510-04:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2014:0455 MLIST [oss-security] 20140410 [OSSA 2014-012] Remote code execution in Glance Sheepdog backend (CVE-2014-0162) UBUNTU USN-2193-1 CONFIRM https://launchpad.net/bugs/1298698 The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote authenticated users with permission to insert or modify an image to execute arbitrary commands via a crafted location.

cpe:/a:redhat:openshift:1.2.7::enterprise cpe:/a:redhat:openshift:2.0.5::enterprise

CVE-2014-0164

2014-05-05T13:06:05.607-04:00

2014-06-30T14:32:28.087-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-05-05T13:59:50.250-04:00

REDHAT RHSA-2014:0460 REDHAT RHSA-2014:0461 openshift-origin-broker-util, as used in Red Hat OpenShift Enterprise 1.2.7 and 2.0.5, uses world-readable permissions for the mcollective client.cfg configuration file, which allows local users to obtain credentials and other sensitive information by reading the file.

cpe:/a:wordpress:wordpress:0.71 cpe:/a:wordpress:wordpress:1.0 cpe:/a:wordpress:wordpress:1.0.1 cpe:/a:wordpress:wordpress:1.0.2 cpe:/a:wordpress:wordpress:1.1.1 cpe:/a:wordpress:wordpress:1.2 cpe:/a:wordpress:wordpress:1.2.1 cpe:/a:wordpress:wordpress:1.2.2 cpe:/a:wordpress:wordpress:1.2.3 cpe:/a:wordpress:wordpress:1.2.4 cpe:/a:wordpress:wordpress:1.2.5 cpe:/a:wordpress:wordpress:1.2.5:a cpe:/a:wordpress:wordpress:1.3 cpe:/a:wordpress:wordpress:1.3.2 cpe:/a:wordpress:wordpress:1.3.3 cpe:/a:wordpress:wordpress:1.5 cpe:/a:wordpress:wordpress:1.5.1 cpe:/a:wordpress:wordpress:1.5.1.1 cpe:/a:wordpress:wordpress:1.5.1.2 cpe:/a:wordpress:wordpress:1.5.1.3 cpe:/a:wordpress:wordpress:1.5.2 cpe:/a:wordpress:wordpress:1.6.2 cpe:/a:wordpress:wordpress:2.0 cpe:/a:wordpress:wordpress:2.0.1 cpe:/a:wordpress:wordpress:2.0.2 cpe:/a:wordpress:wordpress:2.0.4 cpe:/a:wordpress:wordpress:2.0.5 cpe:/a:wordpress:wordpress:2.0.6 cpe:/a:wordpress:wordpress:2.0.7 cpe:/a:wordpress:wordpress:2.0.8 cpe:/a:wordpress:wordpress:2.0.9 cpe:/a:wordpress:wordpress:2.0.10 cpe:/a:wordpress:wordpress:2.0.11 cpe:/a:wordpress:wordpress:2.1 cpe:/a:wordpress:wordpress:2.1.1 cpe:/a:wordpress:wordpress:2.1.2 cpe:/a:wordpress:wordpress:2.1.3 cpe:/a:wordpress:wordpress:2.2 cpe:/a:wordpress:wordpress:2.2.1 cpe:/a:wordpress:wordpress:2.2.2 cpe:/a:wordpress:wordpress:2.2.3 cpe:/a:wordpress:wordpress:2.3 cpe:/a:wordpress:wordpress:2.3.1 cpe:/a:wordpress:wordpress:2.3.2 cpe:/a:wordpress:wordpress:2.3.3 cpe:/a:wordpress:wordpress:2.5 cpe:/a:wordpress:wordpress:2.5.1 cpe:/a:wordpress:wordpress:2.6 cpe:/a:wordpress:wordpress:2.6.1 cpe:/a:wordpress:wordpress:2.6.2 cpe:/a:wordpress:wordpress:2.6.3 cpe:/a:wordpress:wordpress:2.6.5 cpe:/a:wordpress:wordpress:2.7 cpe:/a:wordpress:wordpress:2.7.1 cpe:/a:wordpress:wordpress:2.8 cpe:/a:wordpress:wordpress:2.8.1 cpe:/a:wordpress:wordpress:2.8.2 cpe:/a:wordpress:wordpress:2.8.3 cpe:/a:wordpress:wordpress:2.8.4 cpe:/a:wordpress:wordpress:2.8.4:a cpe:/a:wordpress:wordpress:2.8.5 cpe:/a:wordpress:wordpress:2.8.5.1 cpe:/a:wordpress:wordpress:2.8.5.2 cpe:/a:wordpress:wordpress:2.8.6 cpe:/a:wordpress:wordpress:2.9 cpe:/a:wordpress:wordpress:2.9.1 cpe:/a:wordpress:wordpress:2.9.1.1 cpe:/a:wordpress:wordpress:2.9.2 cpe:/a:wordpress:wordpress:3.0 cpe:/a:wordpress:wordpress:3.0.1 cpe:/a:wordpress:wordpress:3.0.2 cpe:/a:wordpress:wordpress:3.0.3 cpe:/a:wordpress:wordpress:3.0.4 cpe:/a:wordpress:wordpress:3.0.5 cpe:/a:wordpress:wordpress:3.0.6 cpe:/a:wordpress:wordpress:3.1 cpe:/a:wordpress:wordpress:3.1.1 cpe:/a:wordpress:wordpress:3.1.2 cpe:/a:wordpress:wordpress:3.1.3 cpe:/a:wordpress:wordpress:3.1.4 cpe:/a:wordpress:wordpress:3.2 cpe:/a:wordpress:wordpress:3.2:beta1 cpe:/a:wordpress:wordpress:3.2.1 cpe:/a:wordpress:wordpress:3.3 cpe:/a:wordpress:wordpress:3.3.1 cpe:/a:wordpress:wordpress:3.3.2 cpe:/a:wordpress:wordpress:3.3.3 cpe:/a:wordpress:wordpress:3.4.0 cpe:/a:wordpress:wordpress:3.4.1 cpe:/a:wordpress:wordpress:3.4.2 cpe:/a:wordpress:wordpress:3.5.0 cpe:/a:wordpress:wordpress:3.5.1 cpe:/a:wordpress:wordpress:3.6 cpe:/a:wordpress:wordpress:3.6.1 cpe:/a:wordpress:wordpress:3.7 cpe:/a:wordpress:wordpress:3.7.1 cpe:/a:wordpress:wordpress:3.8 cpe:/a:wordpress:wordpress:3.8.1

CVE-2014-0165

2014-04-09T20:55:06.267-04:00

2017-12-15T21:29:03.650-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://codex.wordpress.org/Version_3.7.2 CONFIRM http://codex.wordpress.org/Version_3.8.2 CONFIRM http://core.trac.wordpress.org/changeset/27976 DEBIAN DSA-2901 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1085866 WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.

CVE-2014-0166

2014-04-09T20:55:09.530-04:00

2017-12-15T21:29:03.730-05:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://codex.wordpress.org/Version_3.7.2 CONFIRM http://codex.wordpress.org/Version_3.8.2 CONFIRM http://core.trac.wordpress.org/changeset/28054 DEBIAN DSA-2901 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1085858 The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie.

cpe:/a:openstack:compute:2013.1 cpe:/a:openstack:compute:2013.1.1 cpe:/a:openstack:compute:2013.1.2 cpe:/a:openstack:compute:2013.1.3 cpe:/a:openstack:compute:2013.2 cpe:/a:openstack:compute:2013.2.1 cpe:/a:openstack:compute:2013.2.2 cpe:/a:openstack:compute:2013.2.3 cpe:/a:openstack:icehouse:-

CVE-2014-0167

2014-04-15T10:55:04.200-04:00

2014-06-21T00:38:11.017-04:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov MLIST [oss-security] 20140409 [OSSA 2014-011] RBAC policy not properly enforced in Nova EC2 API (CVE-2014-0167) UBUNTU USN-2247-1 CONFIRM https://launchpad.net/bugs/1290537 The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows remote authenticated users to gain privileges via these API requests.

cpe:/a:jolokia:jolokia:1.0.0 cpe:/a:jolokia:jolokia:1.0.1 cpe:/a:jolokia:jolokia:1.0.2 cpe:/a:jolokia:jolokia:1.0.3 cpe:/a:jolokia:jolokia:1.0.4 cpe:/a:jolokia:jolokia:1.0.5 cpe:/a:jolokia:jolokia:1.0.6 cpe:/a:jolokia:jolokia:1.1.0 cpe:/a:jolokia:jolokia:1.1.1 cpe:/a:jolokia:jolokia:1.1.2 cpe:/a:jolokia:jolokia:1.1.3 cpe:/a:jolokia:jolokia:1.1.4 cpe:/a:jolokia:jolokia:1.1.5 cpe:/a:jolokia:jolokia:1.2.0

CVE-2014-0168

2014-10-06T10:55:08.250-04:00

2014-10-07T11:20:13.237-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2014-10-07T07:19:32.000-04:00

REDHAT RHSA-2014:1351 CONFIRM https://github.com/rhuss/jolokia/commit/2d9b168cfbbf5a6d16fa6e8a5b34503e3dc42364 Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via a crafted web page.

cpe:/a:jboss:teiid:8.4 cpe:/a:jboss:teiid:8.6 cpe:/a:redhat:jboss_data_virtualization:6.0.0

CVE-2014-0170

2014-09-30T10:55:08.453-04:00

2017-08-28T21:34:08.077-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2014:1284 SECTRACK 1030886 XF jboss-data-cve20140170-info-disc(96192) CONFIRM https://issues.jboss.org/browse/TEIID-2911 Teiid before 8.4.3 and before 8.7 and Red Hat JBoss Data Virtualization 6.0.0 before patch 3 allows remote attackers to read arbitrary files via a crafted request to a REST endpoint, related to an XML External Entity (XXE) issue.

cpe:/a:redhat:jboss_data_virtualization:6.0.0

CVE-2014-0171

2015-01-15T10:59:00.060-05:00

2015-01-15T19:29:33.750-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2015-01-15T13:53:02.600-05:00

REDHAT RHSA-2015:0034 CONFIRM https://issues.jboss.org/browse/TEIID-2911 XML external entity (XXE) vulnerability in StaxXMLFactoryProvider2 in Odata4j, as used in Red Hat JBoss Data Virtualization before 6.0.0 patch 4, allows remote attackers to read arbitrary files via a crafted request to a REST endpoint.

cpe:/a:elfutils_project:elfutils:0.153 cpe:/a:elfutils_project:elfutils:0.154 cpe:/a:elfutils_project:elfutils:0.155 cpe:/a:elfutils_project:elfutils:0.156 cpe:/a:elfutils_project:elfutils:0.157 cpe:/a:elfutils_project:elfutils:0.158

CVE-2014-0172

2014-04-11T11:55:18.757-04:00

2017-06-30T21:29:05.170-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MLIST [oss-security] 20140409 Heap-based buffer overflow in libdw/elfutils (CVE-2014-0172) BID 66714 UBUNTU USN-2188-1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1085663 MLIST [elfutils-devel] 20140409 [PATCH] CVE-2014-0172 Check for overflow before calling malloc to uncompress data. GENTOO GLSA-201612-32 Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used in elfutils 0.153 and possibly through 0.158 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed compressed debug section in an ELF file, which triggers a heap-based buffer overflow.

cpe:/a:automattic:jetpack:1.9::~~~wordpress~~ cpe:/a:automattic:jetpack:1.9.1::~~~wordpress~~ cpe:/a:automattic:jetpack:1.9.2::~~~wordpress~~ cpe:/a:automattic:jetpack:2.0::~~~wordpress~~ cpe:/a:automattic:jetpack:2.0.1::~~~wordpress~~ cpe:/a:automattic:jetpack:2.0.2::~~~wordpress~~ cpe:/a:automattic:jetpack:2.0.3::~~~wordpress~~ cpe:/a:automattic:jetpack:2.0.4::~~~wordpress~~ cpe:/a:automattic:jetpack:2.1::~~~wordpress~~ cpe:/a:automattic:jetpack:2.1.1::~~~wordpress~~ cpe:/a:automattic:jetpack:2.1.2::~~~wordpress~~ cpe:/a:automattic:jetpack:2.2::~~~wordpress~~ cpe:/a:automattic:jetpack:2.2.1::~~~wordpress~~ cpe:/a:automattic:jetpack:2.2.2::~~~wordpress~~ cpe:/a:automattic:jetpack:2.2.3::~~~wordpress~~ cpe:/a:automattic:jetpack:2.2.4::~~~wordpress~~ cpe:/a:automattic:jetpack:2.2.5::~~~wordpress~~ cpe:/a:automattic:jetpack:2.3::~~~wordpress~~ cpe:/a:automattic:jetpack:2.3.1::~~~wordpress~~ cpe:/a:automattic:jetpack:2.3.2::~~~wordpress~~ cpe:/a:automattic:jetpack:2.3.3::~~~wordpress~~ cpe:/a:automattic:jetpack:2.3.4::~~~wordpress~~ cpe:/a:automattic:jetpack:2.3.5::~~~wordpress~~ cpe:/a:automattic:jetpack:2.4::~~~wordpress~~ cpe:/a:automattic:jetpack:2.4.1::~~~wordpress~~ cpe:/a:automattic:jetpack:2.4.2::~~~wordpress~~ cpe:/a:automattic:jetpack:2.5::~~~wordpress~~ cpe:/a:automattic:jetpack:2.6::~~~wordpress~~ cpe:/a:automattic:jetpack:2.6.1::~~~wordpress~~ cpe:/a:automattic:jetpack:2.7::~~~wordpress~~ cpe:/a:automattic:jetpack:2.8::~~~wordpress~~ cpe:/a:automattic:jetpack:2.9::~~~wordpress~~ cpe:/a:automattic:jetpack:2.9.1::~~~wordpress~~ cpe:/a:automattic:jetpack:2.9.2::~~~wordpress~~ cpe:/a:automattic:jetpack:2.9.3::~~~wordpress~~

CVE-2014-0173

2014-04-22T09:06:27.023-04:00

2017-08-28T21:34:08.153-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://jetpack.me/2014/04/10/jetpack-security-update/ BID 66789 XF jetpack-wordpress-cve20140173-sec-bypass(92560) The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.2, 2.6.x before 2.6.3, 2.7.x before 2.7.2, 2.8.x before 2.8.2, and 2.9.x before 2.9.3 for WordPress does not properly restrict access to the XML-RPC service, which allows remote attackers to bypass intended restrictions and publish posts via unspecified vectors. NOTE: some of these details are obtained from third party information.

cpe:/a:redhat:enterprise_mrg:2.5

CVE-2014-0174

2014-07-11T10:55:03.617-04:00

2014-07-11T11:23:23.167-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-07-11T11:23:22.933-04:00

REDHAT RHSA-2014:0858 REDHAT RHSA-2014:0859 Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

cpe:/a:redhat:cloudforms_3.0_management_engine:5.2 cpe:/a:redhat:cloudforms_3.0_management_engine:5.2.1 cpe:/a:redhat:cloudforms_3.0_management_engine:5.2.1.6 cpe:/a:redhat:cloudforms_3.0_management_engine:5.2.2 cpe:/a:redhat:cloudforms_3.0_management_engine:5.2.3 cpe:/a:redhat:cloudforms_3.0_management_engine:5.2.3.2 cpe:/a:redhat:cloudforms_3.0_management_engine:5.2.4

CVE-2014-0176

2014-07-07T10:55:03.443-04:00

2014-07-08T09:39:52.743-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-07-08T09:39:52.540-04:00

REDHAT RHSA-2014:0816 Cross-site scripting (XSS) vulnerability in application/panel_control in CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:hub_project:hub:1.12.0

CVE-2014-0177

2014-05-27T10:55:10.540-04:00

2014-05-28T13:51:19.880-04:00

3.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-05-28T13:51:19.647-04:00

CONFIRM https://github.com/github/hub/commit/016ec99d25b1cb83cb4367e541177aa431beb600 The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary patch file.

cpe:/a:samba:samba:3.6.6 cpe:/a:samba:samba:3.6.7 cpe:/a:samba:samba:3.6.8 cpe:/a:samba:samba:3.6.9 cpe:/a:samba:samba:3.6.10 cpe:/a:samba:samba:3.6.11 cpe:/a:samba:samba:3.6.12 cpe:/a:samba:samba:3.6.13 cpe:/a:samba:samba:3.6.14 cpe:/a:samba:samba:3.6.15 cpe:/a:samba:samba:3.6.16 cpe:/a:samba:samba:3.6.17 cpe:/a:samba:samba:3.6.18 cpe:/a:samba:samba:3.6.19 cpe:/a:samba:samba:3.6.20 cpe:/a:samba:samba:3.6.21 cpe:/a:samba:samba:3.6.22 cpe:/a:samba:samba:3.6.23 cpe:/a:samba:samba:4.0.1 cpe:/a:samba:samba:4.0.2 cpe:/a:samba:samba:4.0.3 cpe:/a:samba:samba:4.0.4 cpe:/a:samba:samba:4.0.5 cpe:/a:samba:samba:4.0.6 cpe:/a:samba:samba:4.0.7 cpe:/a:samba:samba:4.0.8 cpe:/a:samba:samba:4.0.9 cpe:/a:samba:samba:4.0.10 cpe:/a:samba:samba:4.0.11 cpe:/a:samba:samba:4.0.12 cpe:/a:samba:samba:4.0.13 cpe:/a:samba:samba:4.0.14 cpe:/a:samba:samba:4.0.15 cpe:/a:samba:samba:4.0.16 cpe:/a:samba:samba:4.0.17 cpe:/a:samba:samba:4.1.0 cpe:/a:samba:samba:4.1.1 cpe:/a:samba:samba:4.1.2 cpe:/a:samba:samba:4.1.3 cpe:/a:samba:samba:4.1.4 cpe:/a:samba:samba:4.1.5 cpe:/a:samba:samba:4.1.6 cpe:/a:samba:samba:4.1.7

CVE-2014-0178

2014-05-28T00:58:32.690-04:00

2018-10-09T15:36:53.210-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://advisories.mageia.org/MGASA-2014-0279.html FEDORA FEDORA-2014-9132 FEDORA FEDORA-2014-7672 SECUNIA 59407 GENTOO GLSA-201502-15 MANDRIVA MDVSA-2014:136 MANDRIVA MDVSA-2015:082 CONFIRM http://www.samba.org/samba/security/CVE-2014-0178 BUGTRAQ 20140711 [ MDVSA-2014:136 ] samba BID 67686 SECTRACK 1030308 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993 Samba 3.6.6 through 3.6.23, 4.0.x before 4.0.18, and 4.1.x before 4.1.8, when a certain vfs shadow copy configuration is enabled, does not properly initialize the SRV_SNAPSHOT_ARRAY response field, which allows remote authenticated users to obtain potentially sensitive information from process memory via a (1) FSCTL_GET_SHADOW_COPY_DATA or (2) FSCTL_SRV_ENUMERATE_SNAPSHOTS request.

cpe:/a:redhat:enterprise_virtualization:3.0 cpe:/a:redhat:libvirt:0.7.5 cpe:/a:redhat:libvirt:0.7.6 cpe:/a:redhat:libvirt:0.7.7 cpe:/a:redhat:libvirt:0.8.0 cpe:/a:redhat:libvirt:0.8.1 cpe:/a:redhat:libvirt:0.8.2 cpe:/a:redhat:libvirt:0.8.3 cpe:/a:redhat:libvirt:0.8.4 cpe:/a:redhat:libvirt:0.8.5 cpe:/a:redhat:libvirt:0.8.6 cpe:/a:redhat:libvirt:0.8.7 cpe:/a:redhat:libvirt:0.8.8 cpe:/a:redhat:libvirt:0.9.0 cpe:/a:redhat:libvirt:0.9.1 cpe:/a:redhat:libvirt:0.9.2 cpe:/a:redhat:libvirt:0.9.3 cpe:/a:redhat:libvirt:0.9.4 cpe:/a:redhat:libvirt:0.9.5 cpe:/a:redhat:libvirt:0.9.6 cpe:/a:redhat:libvirt:0.9.6.1 cpe:/a:redhat:libvirt:0.9.6.2 cpe:/a:redhat:libvirt:0.9.6.3 cpe:/a:redhat:libvirt:0.9.7 cpe:/a:redhat:libvirt:0.9.8 cpe:/a:redhat:libvirt:0.9.9 cpe:/a:redhat:libvirt:0.9.10 cpe:/a:redhat:libvirt:0.9.11 cpe:/a:redhat:libvirt:0.9.11.1 cpe:/a:redhat:libvirt:0.9.11.2 cpe:/a:redhat:libvirt:0.9.11.3 cpe:/a:redhat:libvirt:0.9.11.4 cpe:/a:redhat:libvirt:0.9.11.5 cpe:/a:redhat:libvirt:0.9.11.6 cpe:/a:redhat:libvirt:0.9.11.7 cpe:/a:redhat:libvirt:0.9.11.8 cpe:/a:redhat:libvirt:0.9.12 cpe:/a:redhat:libvirt:0.9.13 cpe:/a:redhat:libvirt:0.10.0 cpe:/a:redhat:libvirt:0.10.1 cpe:/a:redhat:libvirt:0.10.2 cpe:/a:redhat:libvirt:0.10.2.1 cpe:/a:redhat:libvirt:0.10.2.2 cpe:/a:redhat:libvirt:0.10.2.3 cpe:/a:redhat:libvirt:0.10.2.4 cpe:/a:redhat:libvirt:0.10.2.5 cpe:/a:redhat:libvirt:0.10.2.6 cpe:/a:redhat:libvirt:0.10.2.7 cpe:/a:redhat:libvirt:0.10.2.8 cpe:/a:redhat:libvirt:1.0.0 cpe:/a:redhat:libvirt:1.0.1 cpe:/a:redhat:libvirt:1.0.2 cpe:/a:redhat:libvirt:1.0.3 cpe:/a:redhat:libvirt:1.0.4 cpe:/a:redhat:libvirt:1.0.5 cpe:/a:redhat:libvirt:1.0.5.1 cpe:/a:redhat:libvirt:1.0.5.2 cpe:/a:redhat:libvirt:1.0.5.3 cpe:/a:redhat:libvirt:1.0.5.4 cpe:/a:redhat:libvirt:1.0.5.5 cpe:/a:redhat:libvirt:1.0.5.6 cpe:/a:redhat:libvirt:1.0.6 cpe:/a:redhat:libvirt:1.1.0 cpe:/a:redhat:libvirt:1.1.1 cpe:/a:redhat:libvirt:1.1.2 cpe:/a:redhat:libvirt:1.1.3 cpe:/a:redhat:libvirt:1.1.4 cpe:/a:redhat:libvirt:1.2.0 cpe:/a:redhat:libvirt:1.2.1 cpe:/a:redhat:libvirt:1.2.2 cpe:/a:redhat:libvirt:1.2.3 cpe:/a:redhat:libvirt:1.2.4 cpe:/o:opensuse:opensuse:12.3 cpe:/o:opensuse:opensuse:13.1 cpe:/o:redhat:enterprise_linux:6.0

CVE-2014-0179

2014-08-03T14:55:05.630-04:00

2019-04-22T13:48:00.643-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://libvirt.org/news.html SUSE openSUSE-SU-2014:0650 SUSE openSUSE-SU-2014:0674 REDHAT RHSA-2014:0560 GENTOO GLSA-201412-04 CONFIRM http://security.libvirt.org/2014/0003.html DEBIAN DSA-3038 UBUNTU USN-2366-1 libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of service (read block and hang) via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virConnectCompareCPU or (2) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue. NOTE: this issue was SPLIT per ADT3 due to different affected versions of some vectors. CVE-2014-5177 is used for other API methods.

CVE-2014-0180

2014-07-07T10:55:03.490-04:00

2014-07-08T10:12:04.990-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-07-08T10:12:04.770-04:00

REDHAT RHSA-2014:0816 The wait_for_task function in app/controllers/application_controller.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via unspecified vectors.

cpe:/o:linux:linux_kernel:3.0:rc1 cpe:/o:linux:linux_kernel:3.0:rc2 cpe:/o:linux:linux_kernel:3.0:rc3 cpe:/o:linux:linux_kernel:3.0:rc4 cpe:/o:linux:linux_kernel:3.0:rc5 cpe:/o:linux:linux_kernel:3.0:rc6 cpe:/o:linux:linux_kernel:3.0:rc7 cpe:/o:linux:linux_kernel:3.0.1 cpe:/o:linux:linux_kernel:3.0.2 cpe:/o:linux:linux_kernel:3.0.3 cpe:/o:linux:linux_kernel:3.0.4 cpe:/o:linux:linux_kernel:3.0.5 cpe:/o:linux:linux_kernel:3.0.6 cpe:/o:linux:linux_kernel:3.0.7 cpe:/o:linux:linux_kernel:3.0.8 cpe:/o:linux:linux_kernel:3.0.9 cpe:/o:linux:linux_kernel:3.0.10 cpe:/o:linux:linux_kernel:3.0.11 cpe:/o:linux:linux_kernel:3.0.12 cpe:/o:linux:linux_kernel:3.0.13 cpe:/o:linux:linux_kernel:3.0.14 cpe:/o:linux:linux_kernel:3.0.15 cpe:/o:linux:linux_kernel:3.0.16 cpe:/o:linux:linux_kernel:3.0.17 cpe:/o:linux:linux_kernel:3.0.18 cpe:/o:linux:linux_kernel:3.0.19 cpe:/o:linux:linux_kernel:3.0.20 cpe:/o:linux:linux_kernel:3.0.21 cpe:/o:linux:linux_kernel:3.0.22 cpe:/o:linux:linux_kernel:3.0.23 cpe:/o:linux:linux_kernel:3.0.24 cpe:/o:linux:linux_kernel:3.0.25 cpe:/o:linux:linux_kernel:3.0.26 cpe:/o:linux:linux_kernel:3.0.27 cpe:/o:linux:linux_kernel:3.0.28 cpe:/o:linux:linux_kernel:3.0.29 cpe:/o:linux:linux_kernel:3.0.30 cpe:/o:linux:linux_kernel:3.0.31 cpe:/o:linux:linux_kernel:3.0.32 cpe:/o:linux:linux_kernel:3.0.33 cpe:/o:linux:linux_kernel:3.0.34 cpe:/o:linux:linux_kernel:3.0.35 cpe:/o:linux:linux_kernel:3.0.36 cpe:/o:linux:linux_kernel:3.0.37 cpe:/o:linux:linux_kernel:3.0.38 cpe:/o:linux:linux_kernel:3.0.39 cpe:/o:linux:linux_kernel:3.0.40 cpe:/o:linux:linux_kernel:3.0.41 cpe:/o:linux:linux_kernel:3.0.42 cpe:/o:linux:linux_kernel:3.0.43 cpe:/o:linux:linux_kernel:3.0.44 cpe:/o:linux:linux_kernel:3.0.45 cpe:/o:linux:linux_kernel:3.0.46 cpe:/o:linux:linux_kernel:3.0.47 cpe:/o:linux:linux_kernel:3.0.48 cpe:/o:linux:linux_kernel:3.0.49 cpe:/o:linux:linux_kernel:3.0.50 cpe:/o:linux:linux_kernel:3.0.51 cpe:/o:linux:linux_kernel:3.0.52 cpe:/o:linux:linux_kernel:3.0.53 cpe:/o:linux:linux_kernel:3.0.54 cpe:/o:linux:linux_kernel:3.0.55 cpe:/o:linux:linux_kernel:3.0.56 cpe:/o:linux:linux_kernel:3.0.57 cpe:/o:linux:linux_kernel:3.0.58 cpe:/o:linux:linux_kernel:3.0.59 cpe:/o:linux:linux_kernel:3.0.60 cpe:/o:linux:linux_kernel:3.0.61 cpe:/o:linux:linux_kernel:3.0.62 cpe:/o:linux:linux_kernel:3.0.63 cpe:/o:linux:linux_kernel:3.0.64 cpe:/o:linux:linux_kernel:3.0.65 cpe:/o:linux:linux_kernel:3.0.66 cpe:/o:linux:linux_kernel:3.0.67 cpe:/o:linux:linux_kernel:3.0.68 cpe:/o:linux:linux_kernel:3.1 cpe:/o:linux:linux_kernel:3.1:rc1 cpe:/o:linux:linux_kernel:3.1:rc2 cpe:/o:linux:linux_kernel:3.1:rc3 cpe:/o:linux:linux_kernel:3.1:rc4 cpe:/o:linux:linux_kernel:3.1.1 cpe:/o:linux:linux_kernel:3.1.2 cpe:/o:linux:linux_kernel:3.1.3 cpe:/o:linux:linux_kernel:3.1.4 cpe:/o:linux:linux_kernel:3.1.5 cpe:/o:linux:linux_kernel:3.1.6 cpe:/o:linux:linux_kernel:3.1.7 cpe:/o:linux:linux_kernel:3.1.8 cpe:/o:linux:linux_kernel:3.1.9 cpe:/o:linux:linux_kernel:3.1.10 cpe:/o:linux:linux_kernel:3.2 cpe:/o:linux:linux_kernel:3.2:rc2 cpe:/o:linux:linux_kernel:3.2:rc3 cpe:/o:linux:linux_kernel:3.2:rc4 cpe:/o:linux:linux_kernel:3.2:rc5 cpe:/o:linux:linux_kernel:3.2:rc6 cpe:/o:linux:linux_kernel:3.2:rc7 cpe:/o:linux:linux_kernel:3.2.1 cpe:/o:linux:linux_kernel:3.2.2 cpe:/o:linux:linux_kernel:3.2.3 cpe:/o:linux:linux_kernel:3.2.4 cpe:/o:linux:linux_kernel:3.2.5 cpe:/o:linux:linux_kernel:3.2.6 cpe:/o:linux:linux_kernel:3.2.7 cpe:/o:linux:linux_kernel:3.2.8 cpe:/o:linux:linux_kernel:3.2.9 cpe:/o:linux:linux_kernel:3.2.10 cpe:/o:linux:linux_kernel:3.2.11 cpe:/o:linux:linux_kernel:3.2.12 cpe:/o:linux:linux_kernel:3.2.13 cpe:/o:linux:linux_kernel:3.2.14 cpe:/o:linux:linux_kernel:3.2.15 cpe:/o:linux:linux_kernel:3.2.16 cpe:/o:linux:linux_kernel:3.2.17 cpe:/o:linux:linux_kernel:3.2.18 cpe:/o:linux:linux_kernel:3.2.19 cpe:/o:linux:linux_kernel:3.2.20 cpe:/o:linux:linux_kernel:3.2.21 cpe:/o:linux:linux_kernel:3.2.22 cpe:/o:linux:linux_kernel:3.2.23 cpe:/o:linux:linux_kernel:3.2.24 cpe:/o:linux:linux_kernel:3.2.25 cpe:/o:linux:linux_kernel:3.2.26 cpe:/o:linux:linux_kernel:3.2.27 cpe:/o:linux:linux_kernel:3.2.28 cpe:/o:linux:linux_kernel:3.2.29 cpe:/o:linux:linux_kernel:3.2.30 cpe:/o:linux:linux_kernel:3.3 cpe:/o:linux:linux_kernel:3.3:rc1 cpe:/o:linux:linux_kernel:3.3:rc2 cpe:/o:linux:linux_kernel:3.3:rc3 cpe:/o:linux:linux_kernel:3.3:rc4 cpe:/o:linux:linux_kernel:3.3:rc5 cpe:/o:linux:linux_kernel:3.3:rc6 cpe:/o:linux:linux_kernel:3.3:rc7 cpe:/o:linux:linux_kernel:3.3.1 cpe:/o:linux:linux_kernel:3.3.2 cpe:/o:linux:linux_kernel:3.3.3 cpe:/o:linux:linux_kernel:3.3.4 cpe:/o:linux:linux_kernel:3.3.5 cpe:/o:linux:linux_kernel:3.3.6 cpe:/o:linux:linux_kernel:3.3.7 cpe:/o:linux:linux_kernel:3.3.8 cpe:/o:linux:linux_kernel:3.4 cpe:/o:linux:linux_kernel:3.4:rc1 cpe:/o:linux:linux_kernel:3.4:rc2 cpe:/o:linux:linux_kernel:3.4:rc3 cpe:/o:linux:linux_kernel:3.4:rc4 cpe:/o:linux:linux_kernel:3.4:rc5 cpe:/o:linux:linux_kernel:3.4:rc6 cpe:/o:linux:linux_kernel:3.4:rc7 cpe:/o:linux:linux_kernel:3.4.1 cpe:/o:linux:linux_kernel:3.4.2 cpe:/o:linux:linux_kernel:3.4.3 cpe:/o:linux:linux_kernel:3.4.4 cpe:/o:linux:linux_kernel:3.4.5 cpe:/o:linux:linux_kernel:3.4.6 cpe:/o:linux:linux_kernel:3.4.7 cpe:/o:linux:linux_kernel:3.4.8 cpe:/o:linux:linux_kernel:3.4.9 cpe:/o:linux:linux_kernel:3.4.10 cpe:/o:linux:linux_kernel:3.4.11 cpe:/o:linux:linux_kernel:3.4.12 cpe:/o:linux:linux_kernel:3.4.13 cpe:/o:linux:linux_kernel:3.4.14 cpe:/o:linux:linux_kernel:3.4.15 cpe:/o:linux:linux_kernel:3.4.16 cpe:/o:linux:linux_kernel:3.4.17 cpe:/o:linux:linux_kernel:3.4.18 cpe:/o:linux:linux_kernel:3.4.19 cpe:/o:linux:linux_kernel:3.4.20 cpe:/o:linux:linux_kernel:3.4.21 cpe:/o:linux:linux_kernel:3.4.22 cpe:/o:linux:linux_kernel:3.4.23 cpe:/o:linux:linux_kernel:3.4.24 cpe:/o:linux:linux_kernel:3.4.25 cpe:/o:linux:linux_kernel:3.4.26 cpe:/o:linux:linux_kernel:3.4.27 cpe:/o:linux:linux_kernel:3.4.28 cpe:/o:linux:linux_kernel:3.4.29 cpe:/o:linux:linux_kernel:3.4.30 cpe:/o:linux:linux_kernel:3.4.31 cpe:/o:linux:linux_kernel:3.4.32 cpe:/o:linux:linux_kernel:3.4.33 cpe:/o:linux:linux_kernel:3.4.34 cpe:/o:linux:linux_kernel:3.4.35 cpe:/o:linux:linux_kernel:3.4.36 cpe:/o:linux:linux_kernel:3.4.37 cpe:/o:linux:linux_kernel:3.4.38 cpe:/o:linux:linux_kernel:3.4.39 cpe:/o:linux:linux_kernel:3.4.40 cpe:/o:linux:linux_kernel:3.4.41 cpe:/o:linux:linux_kernel:3.4.42 cpe:/o:linux:linux_kernel:3.4.43 cpe:/o:linux:linux_kernel:3.4.44 cpe:/o:linux:linux_kernel:3.4.45 cpe:/o:linux:linux_kernel:3.4.46 cpe:/o:linux:linux_kernel:3.4.47 cpe:/o:linux:linux_kernel:3.4.48 cpe:/o:linux:linux_kernel:3.4.49 cpe:/o:linux:linux_kernel:3.4.50 cpe:/o:linux:linux_kernel:3.4.51 cpe:/o:linux:linux_kernel:3.4.52 cpe:/o:linux:linux_kernel:3.4.53 cpe:/o:linux:linux_kernel:3.4.54 cpe:/o:linux:linux_kernel:3.4.55 cpe:/o:linux:linux_kernel:3.4.56 cpe:/o:linux:linux_kernel:3.4.57 cpe:/o:linux:linux_kernel:3.4.58 cpe:/o:linux:linux_kernel:3.4.59 cpe:/o:linux:linux_kernel:3.4.60 cpe:/o:linux:linux_kernel:3.4.61 cpe:/o:linux:linux_kernel:3.4.62 cpe:/o:linux:linux_kernel:3.4.63 cpe:/o:linux:linux_kernel:3.4.64 cpe:/o:linux:linux_kernel:3.4.65 cpe:/o:linux:linux_kernel:3.4.66 cpe:/o:linux:linux_kernel:3.4.67 cpe:/o:linux:linux_kernel:3.4.68 cpe:/o:linux:linux_kernel:3.4.69 cpe:/o:linux:linux_kernel:3.4.70 cpe:/o:linux:linux_kernel:3.4.71 cpe:/o:linux:linux_kernel:3.4.72 cpe:/o:linux:linux_kernel:3.4.73 cpe:/o:linux:linux_kernel:3.4.74 cpe:/o:linux:linux_kernel:3.4.75 cpe:/o:linux:linux_kernel:3.4.76 cpe:/o:linux:linux_kernel:3.4.77 cpe:/o:linux:linux_kernel:3.4.78 cpe:/o:linux:linux_kernel:3.4.79 cpe:/o:linux:linux_kernel:3.5.1 cpe:/o:linux:linux_kernel:3.5.2 cpe:/o:linux:linux_kernel:3.5.3 cpe:/o:linux:linux_kernel:3.5.4 cpe:/o:linux:linux_kernel:3.5.5 cpe:/o:linux:linux_kernel:3.5.6 cpe:/o:linux:linux_kernel:3.5.7 cpe:/o:linux:linux_kernel:3.6 cpe:/o:linux:linux_kernel:3.6.1 cpe:/o:linux:linux_kernel:3.6.2 cpe:/o:linux:linux_kernel:3.6.3 cpe:/o:linux:linux_kernel:3.6.4 cpe:/o:linux:linux_kernel:3.6.5 cpe:/o:linux:linux_kernel:3.6.6 cpe:/o:linux:linux_kernel:3.6.7 cpe:/o:linux:linux_kernel:3.6.8 cpe:/o:linux:linux_kernel:3.6.9 cpe:/o:linux:linux_kernel:3.6.10 cpe:/o:linux:linux_kernel:3.6.11 cpe:/o:linux:linux_kernel:3.7 cpe:/o:linux:linux_kernel:3.7.1 cpe:/o:linux:linux_kernel:3.7.2 cpe:/o:linux:linux_kernel:3.7.3 cpe:/o:linux:linux_kernel:3.7.4 cpe:/o:linux:linux_kernel:3.7.5 cpe:/o:linux:linux_kernel:3.7.6 cpe:/o:linux:linux_kernel:3.7.7 cpe:/o:linux:linux_kernel:3.7.8 cpe:/o:linux:linux_kernel:3.7.9 cpe:/o:linux:linux_kernel:3.7.10 cpe:/o:linux:linux_kernel:3.8.0 cpe:/o:linux:linux_kernel:3.8.1 cpe:/o:linux:linux_kernel:3.8.2 cpe:/o:linux:linux_kernel:3.8.3 cpe:/o:linux:linux_kernel:3.8.4 cpe:/o:linux:linux_kernel:3.8.5 cpe:/o:linux:linux_kernel:3.8.6 cpe:/o:linux:linux_kernel:3.8.7 cpe:/o:linux:linux_kernel:3.8.8 cpe:/o:linux:linux_kernel:3.8.9 cpe:/o:linux:linux_kernel:3.8.10 cpe:/o:linux:linux_kernel:3.8.11 cpe:/o:linux:linux_kernel:3.8.12 cpe:/o:linux:linux_kernel:3.8.13 cpe:/o:linux:linux_kernel:3.9:rc1 cpe:/o:linux:linux_kernel:3.9:rc2 cpe:/o:linux:linux_kernel:3.9:rc3 cpe:/o:linux:linux_kernel:3.9:rc4 cpe:/o:linux:linux_kernel:3.9:rc5 cpe:/o:linux:linux_kernel:3.9:rc6 cpe:/o:linux:linux_kernel:3.9:rc7 cpe:/o:linux:linux_kernel:3.9.0 cpe:/o:linux:linux_kernel:3.9.1 cpe:/o:linux:linux_kernel:3.9.2 cpe:/o:linux:linux_kernel:3.9.3 cpe:/o:linux:linux_kernel:3.9.4 cpe:/o:linux:linux_kernel:3.9.5 cpe:/o:linux:linux_kernel:3.9.6 cpe:/o:linux:linux_kernel:3.9.7 cpe:/o:linux:linux_kernel:3.9.8 cpe:/o:linux:linux_kernel:3.9.9 cpe:/o:linux:linux_kernel:3.9.10 cpe:/o:linux:linux_kernel:3.9.11 cpe:/o:linux:linux_kernel:3.10 cpe:/o:linux:linux_kernel:3.10.1 cpe:/o:linux:linux_kernel:3.10.2 cpe:/o:linux:linux_kernel:3.10.3 cpe:/o:linux:linux_kernel:3.10.4 cpe:/o:linux:linux_kernel:3.10.5 cpe:/o:linux:linux_kernel:3.10.6 cpe:/o:linux:linux_kernel:3.10.7 cpe:/o:linux:linux_kernel:3.10.8 cpe:/o:linux:linux_kernel:3.10.9 cpe:/o:linux:linux_kernel:3.10.10 cpe:/o:linux:linux_kernel:3.10.11 cpe:/o:linux:linux_kernel:3.10.12 cpe:/o:linux:linux_kernel:3.10.13 cpe:/o:linux:linux_kernel:3.10.14 cpe:/o:linux:linux_kernel:3.10.15 cpe:/o:linux:linux_kernel:3.10.16 cpe:/o:linux:linux_kernel:3.10.17 cpe:/o:linux:linux_kernel:3.10.18 cpe:/o:linux:linux_kernel:3.10.19 cpe:/o:linux:linux_kernel:3.10.20 cpe:/o:linux:linux_kernel:3.10.21 cpe:/o:linux:linux_kernel:3.10.22 cpe:/o:linux:linux_kernel:3.10.23 cpe:/o:linux:linux_kernel:3.10.24 cpe:/o:linux:linux_kernel:3.10.25 cpe:/o:linux:linux_kernel:3.10.26 cpe:/o:linux:linux_kernel:3.10.27 cpe:/o:linux:linux_kernel:3.10.28 cpe:/o:linux:linux_kernel:3.10.29 cpe:/o:linux:linux_kernel:3.11 cpe:/o:linux:linux_kernel:3.11.1 cpe:/o:linux:linux_kernel:3.11.2 cpe:/o:linux:linux_kernel:3.11.3 cpe:/o:linux:linux_kernel:3.11.4 cpe:/o:linux:linux_kernel:3.11.5 cpe:/o:linux:linux_kernel:3.11.6 cpe:/o:linux:linux_kernel:3.11.7 cpe:/o:linux:linux_kernel:3.11.8 cpe:/o:linux:linux_kernel:3.11.9 cpe:/o:linux:linux_kernel:3.11.10 cpe:/o:linux:linux_kernel:3.12 cpe:/o:linux:linux_kernel:3.12.1 cpe:/o:linux:linux_kernel:3.12.2 cpe:/o:linux:linux_kernel:3.12.3 cpe:/o:linux:linux_kernel:3.12.4 cpe:/o:linux:linux_kernel:3.12.5 cpe:/o:linux:linux_kernel:3.12.6 cpe:/o:linux:linux_kernel:3.12.7 cpe:/o:linux:linux_kernel:3.12.8 cpe:/o:linux:linux_kernel:3.12.9 cpe:/o:linux:linux_kernel:3.12.10 cpe:/o:linux:linux_kernel:3.12.11 cpe:/o:linux:linux_kernel:3.12.12 cpe:/o:linux:linux_kernel:3.12.13 cpe:/o:linux:linux_kernel:3.12.14 cpe:/o:linux:linux_kernel:3.12.15 cpe:/o:linux:linux_kernel:3.12.16 cpe:/o:linux:linux_kernel:3.12.17 cpe:/o:linux:linux_kernel:3.13 cpe:/o:linux:linux_kernel:3.13.1 cpe:/o:linux:linux_kernel:3.13.2 cpe:/o:linux:linux_kernel:3.13.3 cpe:/o:linux:linux_kernel:3.13.4 cpe:/o:linux:linux_kernel:3.13.5 cpe:/o:linux:linux_kernel:3.13.6 cpe:/o:linux:linux_kernel:3.13.7 cpe:/o:linux:linux_kernel:3.13.8 cpe:/o:linux:linux_kernel:3.13.9 cpe:/o:linux:linux_kernel:3.14.1 cpe:/o:opensuse:evergreen:11.4 cpe:/o:redhat:enterprise_linux_desktop:5 cpe:/o:redhat:enterprise_linux_server:5.0 cpe:/o:suse:linux_enterprise_real_time_extension:11:sp3 cpe:/o:suse:linux_enterprise_server:10:sp4:~~ltss~~~ cpe:/o:suse:linux_enterprise_server:11:sp1:~~ltss~~~ cpe:/o:suse:suse_linux_enterprise_server:11

CVE-2014-0181

2014-04-26T20:55:05.750-04:00

2018-10-30T12:27:37.687-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-11-17T14:14:09.817-05:00

SUSE SUSE-SU-2015:0481 SUSE openSUSE-SU-2015:0566 SUSE SUSE-SU-2015:0652 SUSE SUSE-SU-2015:0736 SUSE SUSE-SU-2015:0812 MLIST [netdev] 20140423 [PATCH 0/5]: Preventing abuse when passing file descriptors REDHAT RHSA-2014:1959 MLIST [oss-security] 20140423 Re: CVE-2014-0181: Linux network reconfiguration due to incorrect netlink checks CONFIRM https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=90f62cf30a78721641e08737bda787552428061e CONFIRM https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.45 CONFIRM https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.9 The Netlink implementation in the Linux kernel through 3.14.1 does not provide a mechanism for authorizing socket operations based on the opener of a socket, which allows local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the (1) stdout or (2) stderr of a setuid program.

CVE-2014-0182

2014-11-04T16:55:25.127-05:00

2014-11-05T10:28:04.113-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-11-05T10:28:03.787-05:00

CONFIRM http://git.qemu.org/?p=qemu.git;a=commitdiff;h=a890a2f9137ac3cf5b607649e66a6f3a5512d8dc FEDORA FEDORA-2014-6288 MLIST [Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released REDHAT RHSA-2014:0743 REDHAT RHSA-2014:0744 Heap-based buffer overflow in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted config length in a savevm image.

CVE-2014-0184

2014-07-07T10:55:03.537-04:00

2014-07-08T10:16:32.460-04:00

4.9

LOCAL

LOW

NONE

COMPLETE

NONE

http://nvd.nist.gov

2014-07-08T10:16:32.227-04:00

REDHAT RHSA-2014:0816 Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when deploying a VM, which allows local users to obtain sensitive information by reading the evm.log file.

cpe:/a:php:php:5.5.0:- cpe:/a:php:php:5.5.0:alpha1 cpe:/a:php:php:5.5.0:alpha2 cpe:/a:php:php:5.5.0:alpha3 cpe:/a:php:php:5.5.0:alpha4 cpe:/a:php:php:5.5.0:alpha5 cpe:/a:php:php:5.5.0:alpha6 cpe:/a:php:php:5.5.0:beta1 cpe:/a:php:php:5.5.0:beta2 cpe:/a:php:php:5.5.0:beta3 cpe:/a:php:php:5.5.0:beta4 cpe:/a:php:php:5.5.0:rc1 cpe:/a:php:php:5.5.0:rc2 cpe:/a:php:php:5.5.1 cpe:/a:php:php:5.5.2 cpe:/a:php:php:5.5.3 cpe:/a:php:php:5.5.4 cpe:/a:php:php:5.5.5 cpe:/a:php:php:5.5.6 cpe:/a:php:php:5.5.7 cpe:/a:php:php:5.5.8 cpe:/a:php:php:5.5.9 cpe:/a:php:php:5.5.10 cpe:/a:php:php:5.5.11

CVE-2014-0185

2014-05-06T06:44:02.987-04:00

2017-01-06T21:59:18.170-05:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE openSUSE-SU-2015:1685 SECUNIA 59061 SECUNIA 59329 CONFIRM http://support.apple.com/kb/HT6443 MLIST [oss-security] 20140429 Fwd: [vs] php-fpm: privilege escalation due to insecure default config (CVE-2014-0185) CONFIRM http://www.php.net/archive/2014.php#id2014-05-01-1 CONFIRM http://www.php.net/ChangeLog-5.php CONFIRM https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1307027 CONFIRM https://bugs.php.net/bug.php?id=67060 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1092815 CONFIRM https://github.com/php/php-src/commit/35ceea928b12373a3b1e3eecdc32ed323223a40d MISC https://hoffmann-christian.info/files/php-fpm/0001-Fix-bug-67060-use-default-mode-of-660.patch sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a crafted FastCGI client.

cpe:/o:redhat:enterprise_linux:7.0

CVE-2014-0186

2014-06-14T07:18:54.207-04:00

2014-06-16T10:52:54.827-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-06-16T10:52:54.623-04:00

CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1089884 REDHAT RHSA-2014:0686 MISC https://security-tracker.debian.org/tracker/CVE-2014-0186 A certain tomcat7 package for Apache Tomcat 7 in Red Hat Enterprise Linux (RHEL) 7 allows remote attackers to cause a denial of service (CPU consumption) via a crafted request. NOTE: this vulnerability exists because of an unspecified regression.

cpe:/a:openstack:neutron:2013.1 cpe:/a:openstack:neutron:2013.1.1 cpe:/a:openstack:neutron:2013.1.2 cpe:/a:openstack:neutron:2013.1.3 cpe:/a:openstack:neutron:2013.1.4 cpe:/a:openstack:neutron:2013.1.5 cpe:/a:openstack:neutron:2013.2 cpe:/a:openstack:neutron:2013.2.1 cpe:/a:openstack:neutron:2013.2.2 cpe:/a:openstack:neutron:2013.2.3 cpe:/a:openstack:neutron:2014.1 cpe:/o:canonical:ubuntu_linux:13.04 cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:opensuse:opensuse:13.1

CVE-2014-0187

2014-04-28T10:09:06.237-04:00

2018-10-30T12:27:34.687-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2015-12-14T13:49:22.677-05:00

SUSE openSUSE-SU-2014:1051 MLIST [oss-security] 20140422 [OSSA 2014-014] Neutron security groups bypass through invalid CIDR (CVE-2014-0187) UBUNTU USN-2255-1 CONFIRM https://bugs.launchpad.net/neutron/+bug/1300785 The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1 before 2014.1.1 allows remote authenticated users to bypass security group restrictions via an invalid CIDR in a security group rule, which prevents further rules from being applied.

cpe:/a:redhat:openshift:1.2.7::~~enterprise~~~ cpe:/a:redhat:openshift:2.0::~~enterprise~~~ cpe:/a:redhat:openshift:2.0.5::~~enterprise~~~

CVE-2014-0188

2014-04-24T10:55:04.263-04:00

2018-12-11T08:21:03.733-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-04-24T15:06:46.570-04:00

REDHAT RHSA-2014:0422 REDHAT RHSA-2014:0423 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1090120 The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to a passthrough trigger.

cpe:/a:virt-who_project:virt-who:- cpe:/o:redhat:enterprise_linux_desktop:7.0 cpe:/o:redhat:enterprise_linux_server:7.0 cpe:/o:redhat:enterprise_linux_workstation:7.0

CVE-2014-0189

2014-05-02T10:55:05.823-04:00

2016-08-26T08:02:58.810-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-08-25T13:15:53.190-04:00

REDHAT RHSA-2015:0430 MLIST [oss-security] 20140428 CVE-2014-0189: /etc/sysconfig/virt-who is world-readable (contains unencrypted passwords) BID 67089 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1081286 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1088732 virt-who uses world-readable permissions for /etc/sysconfig/virt-who, which allows local users to obtain password for hypervisors by reading the file.

cpe:/a:digia:qt:4.0.0 cpe:/a:digia:qt:4.0.1 cpe:/a:digia:qt:4.1.0 cpe:/a:digia:qt:4.1.1 cpe:/a:digia:qt:4.1.2 cpe:/a:digia:qt:4.1.3 cpe:/a:digia:qt:4.1.4 cpe:/a:digia:qt:4.1.5 cpe:/a:digia:qt:4.2.0 cpe:/a:digia:qt:4.2.1 cpe:/a:digia:qt:4.2.3 cpe:/a:digia:qt:4.3.0 cpe:/a:digia:qt:4.3.1 cpe:/a:digia:qt:4.3.2 cpe:/a:digia:qt:4.3.3 cpe:/a:digia:qt:4.3.4 cpe:/a:digia:qt:4.3.5 cpe:/a:digia:qt:4.4.0 cpe:/a:digia:qt:4.4.1 cpe:/a:digia:qt:4.4.2 cpe:/a:digia:qt:4.4.3 cpe:/a:digia:qt:4.5.0 cpe:/a:digia:qt:4.5.1 cpe:/a:digia:qt:4.5.2 cpe:/a:digia:qt:4.5.3 cpe:/a:digia:qt:4.6.0 cpe:/a:digia:qt:4.6.0:rc1 cpe:/a:digia:qt:4.6.1 cpe:/a:digia:qt:4.6.2 cpe:/a:digia:qt:4.6.3 cpe:/a:digia:qt:4.6.4 cpe:/a:digia:qt:4.6.5 cpe:/a:digia:qt:4.6.5:rc cpe:/a:digia:qt:4.7.0 cpe:/a:digia:qt:4.7.1 cpe:/a:digia:qt:4.7.2 cpe:/a:digia:qt:4.7.3 cpe:/a:digia:qt:4.7.4 cpe:/a:digia:qt:4.7.5 cpe:/a:digia:qt:4.7.6 cpe:/a:digia:qt:4.7.6:rc cpe:/a:digia:qt:4.8.0 cpe:/a:digia:qt:4.8.1 cpe:/a:digia:qt:4.8.2 cpe:/a:digia:qt:4.8.3 cpe:/a:digia:qt:4.8.4 cpe:/a:digia:qt:4.8.5 cpe:/a:digia:qt:5.0.0 cpe:/a:digia:qt:5.0.1 cpe:/a:digia:qt:5.0.2 cpe:/a:digia:qt:5.1.0 cpe:/a:digia:qt:5.2.0 cpe:/a:digia:qt:5.2.1 cpe:/o:fedoraproject:fedora:20 cpe:/o:opensuse:opensuse:13.1

CVE-2014-0190

2014-05-08T10:29:13.953-04:00

2018-10-30T12:27:34.687-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov FEDORA FEDORA-2014-6922 FEDORA FEDORA-2014-6896 FEDORA FEDORA-2014-5695 SUSE openSUSE-SU-2015:0573 MLIST [Announce] 20140424 Qt Security Advisory: DoS vulnerability in the GIF image handler BID 67087 UBUNTU USN-2626-1 CONFIRM https://bugs.kde.org/show_bug.cgi?id=333404 The GIF decoder in QtGui in Qt before 5.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via invalid width and height values in a GIF image.

cpe:/a:oracle:fusion_middleware:11.1.1.7.0 cpe:/a:oracle:fusion_middleware:12.1.2.0.0 cpe:/a:oracle:fusion_middleware:12.1.3.0.0

CVE-2014-0191

2015-01-21T09:59:00.053-05:00

2017-08-28T21:34:08.293-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov APPLE APPLE-SA-2015-08-13-2 APPLE APPLE-SA-2015-08-13-3 SUSE openSUSE-SU-2015:2372 REDHAT RHSA-2015:0749 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html BID 67233 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21678183 CONFIRM http://xmlsoft.org/news.html CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1090976 XF libxml2-cve20140191-dos(93092) CONFIRM https://git.gnome.org/browse/libxml2/commit/?id=9cd1c3cfbd32655d60572c0a413e017260c854df CONFIRM https://support.apple.com/kb/HT205030 CONFIRM https://support.apple.com/kb/HT205031 The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in Oracle HTTP Server in Oracle Fusion Middleware 11.1.1.7.0, 12.1.2.0, and 12.1.3.0 and other products, loads external parameter entities regardless of whether entity substitution or validation is enabled, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XML document.

cpe:/a:theforeman:foreman:1.4.0 cpe:/a:theforeman:foreman:1.4.1 cpe:/a:theforeman:foreman:1.4.2 cpe:/a:theforeman:foreman:1.4.3 cpe:/a:theforeman:foreman:1.4.4

CVE-2014-0192

2014-05-08T10:29:14.033-04:00

2014-05-08T14:21:06.343-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-05-08T11:16:08.487-04:00

CONFIRM http://projects.theforeman.org/issues/5436 CONFIRM http://theforeman.org/security.html MISC https://bugzilla.redhat.com/show_bug.cgi?id=1092354 Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote attackers to obtain sensitive information via the hostname parameter, related to "spoof."

cpe:/a:netty:netty:3.6.0 cpe:/a:netty:netty:3.6.1 cpe:/a:netty:netty:3.6.2 cpe:/a:netty:netty:3.6.3 cpe:/a:netty:netty:3.6.4 cpe:/a:netty:netty:3.6.5 cpe:/a:netty:netty:3.6.6 cpe:/a:netty:netty:3.6.7 cpe:/a:netty:netty:3.6.8 cpe:/a:netty:netty:3.7.0 cpe:/a:netty:netty:3.8.0 cpe:/a:netty:netty:3.8.1 cpe:/a:netty:netty:3.9.0 cpe:/a:netty:netty:4.0.0 cpe:/a:netty:netty:4.0.1 cpe:/a:netty:netty:4.0.2 cpe:/a:netty:netty:4.0.3 cpe:/a:netty:netty:4.0.4 cpe:/a:netty:netty:4.0.5 cpe:/a:netty:netty:4.0.6 cpe:/a:netty:netty:4.0.7 cpe:/a:netty:netty:4.0.8 cpe:/a:netty:netty:4.0.9 cpe:/a:netty:netty:4.0.10 cpe:/a:netty:netty:4.0.11 cpe:/a:netty:netty:4.0.12 cpe:/a:netty:netty:4.0.13 cpe:/a:netty:netty:4.0.14 cpe:/a:netty:netty:4.0.15 cpe:/a:netty:netty:4.0.16 cpe:/a:netty:netty:4.0.17 cpe:/a:netty:netty:4.0.18

CVE-2014-0193

2014-05-06T10:55:05.667-04:00

2019-09-30T07:55:18.607-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://netty.io/news/2014/04/30/release-day.html REDHAT RHSA-2014:1019 REDHAT RHSA-2014:1020 REDHAT RHSA-2014:1021 REDHAT RHSA-2014:1351 REDHAT RHSA-2015:0675 REDHAT RHSA-2015:0720 REDHAT RHSA-2015:0765 SECUNIA 59290 BID 67182 CONFIRM https://github.com/netty/netty/issues/2441 MLIST [pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1 WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stream of ContinuationWebSocketFrames.

CVE-2014-0194

2015-05-19T06:59:00.087-04:00

2015-05-19T06:59:00.133-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

cpe:/a:openssl:openssl:0.9.8 cpe:/a:openssl:openssl:0.9.8a cpe:/a:openssl:openssl:0.9.8b cpe:/a:openssl:openssl:0.9.8c cpe:/a:openssl:openssl:0.9.8d cpe:/a:openssl:openssl:0.9.8e cpe:/a:openssl:openssl:0.9.8f cpe:/a:openssl:openssl:0.9.8g cpe:/a:openssl:openssl:0.9.8h cpe:/a:openssl:openssl:0.9.8i cpe:/a:openssl:openssl:0.9.8j cpe:/a:openssl:openssl:0.9.8k cpe:/a:openssl:openssl:0.9.8l cpe:/a:openssl:openssl:0.9.8m cpe:/a:openssl:openssl:0.9.8m:beta1 cpe:/a:openssl:openssl:0.9.8n cpe:/a:openssl:openssl:0.9.8o cpe:/a:openssl:openssl:0.9.8p cpe:/a:openssl:openssl:0.9.8q cpe:/a:openssl:openssl:0.9.8r cpe:/a:openssl:openssl:0.9.8s cpe:/a:openssl:openssl:0.9.8t cpe:/a:openssl:openssl:0.9.8u cpe:/a:openssl:openssl:0.9.8v cpe:/a:openssl:openssl:0.9.8w cpe:/a:openssl:openssl:0.9.8x cpe:/a:openssl:openssl:0.9.8y cpe:/a:openssl:openssl:1.0.0 cpe:/a:openssl:openssl:1.0.0:beta1 cpe:/a:openssl:openssl:1.0.0:beta2 cpe:/a:openssl:openssl:1.0.0:beta3 cpe:/a:openssl:openssl:1.0.0:beta4 cpe:/a:openssl:openssl:1.0.0:beta5 cpe:/a:openssl:openssl:1.0.0a cpe:/a:openssl:openssl:1.0.0b cpe:/a:openssl:openssl:1.0.0c cpe:/a:openssl:openssl:1.0.0d cpe:/a:openssl:openssl:1.0.0e cpe:/a:openssl:openssl:1.0.0f cpe:/a:openssl:openssl:1.0.0g cpe:/a:openssl:openssl:1.0.0h cpe:/a:openssl:openssl:1.0.0i cpe:/a:openssl:openssl:1.0.0j cpe:/a:openssl:openssl:1.0.0k cpe:/a:openssl:openssl:1.0.0l cpe:/a:openssl:openssl:1.0.1 cpe:/a:openssl:openssl:1.0.1:beta1 cpe:/a:openssl:openssl:1.0.1:beta2 cpe:/a:openssl:openssl:1.0.1:beta3 cpe:/a:openssl:openssl:1.0.1a cpe:/a:openssl:openssl:1.0.1b cpe:/a:openssl:openssl:1.0.1c cpe:/a:openssl:openssl:1.0.1d cpe:/a:openssl:openssl:1.0.1e cpe:/a:openssl:openssl:1.0.1f cpe:/a:openssl:openssl:1.0.1g cpe:/a:redhat:storage:2.1 cpe:/o:fedoraproject:fedora cpe:/o:redhat:enterprise_linux:6.0

CVE-2014-0195

2014-06-05T17:55:06.147-04:00

2019-04-22T13:48:00.643-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc MISC http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Once-Bled-Twice-Shy-OpenSSL-CVE-2014-0195/ba-p/6501048 MISC http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/ZDI-14-173-CVE-2014-0195-OpenSSL-DTLS-Fragment-Out-of-Bounds/ba-p/6501002 CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629 FEDORA FEDORA-2014-9301 FEDORA FEDORA-2014-9308 SUSE SUSE-SU-2015:0743 SUSE openSUSE-SU-2016:0640 HP HPSBUX03046 HP HPSBOV03047 HP HPSBMU03057 HP HPSBMU03056 HP HPSBMU03055 HP HPSBMU03051 HP HPSBGN03050 HP HPSBMU03065 HP HPSBMU03069 HP HPSBMU03074 HP HPSBMU03062 HP HPSBMU03076 HP SSRT101846 FULLDISC 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities SECUNIA 58337 SECUNIA 58615 SECUNIA 58660 SECUNIA 58713 SECUNIA 58714 SECUNIA 58945 SECUNIA 58977 SECUNIA 59040 SECUNIA 59175 SECUNIA 59188 SECUNIA 59189 SECUNIA 59192 SECUNIA 59223 SECUNIA 59287 SECUNIA 59305 SECUNIA 59306 SECUNIA 59310 SECUNIA 59364 SECUNIA 59365 SECUNIA 59429 SECUNIA 59437 SECUNIA 59441 SECUNIA 59449 SECUNIA 59454 SECUNIA 59518 SECUNIA 61254 GENTOO GLSA-201407-05 CONFIRM http://support.apple.com/kb/HT6443 CONFIRM http://support.citrix.com/article/CTX140876 CONFIRM http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15356.html CISCO 20140605 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products CONFIRM http://www.blackberry.com/btsc/KB36051 CONFIRM http://www.fortiguard.com/advisory/FG-IR-14-018/ CONFIRM http://www.f-secure.com/en/web/labs_global/fsc-2014-6 CONFIRM http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htm CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21676356 CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21676793 CONFIRM http://www.ibm.com/support/docview.wss?uid=swg24037783 MANDRIVA MDVSA-2014:106 MANDRIVA MDVSA-2015:062 CONFIRM http://www.openssl.org/news/secadv_20140605.txt CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html BUGTRAQ 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities BID 67900 SECTRACK 1030337 CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0006.html CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0012.html CONFIRM http://www-01.ibm.com/support/docview.wss?uid=isg400001841 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=isg400001843 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=nas8N1020163 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21673137 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21675821 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676035 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676062 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676071 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676419 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676644 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676879 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676889 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677527 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677695 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677828 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21678167 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21678289 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21683332 CONFIRM http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095754 CONFIRM http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095755 CONFIRM http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095756 CONFIRM http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095757 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1103598 CONFIRM https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=1632ef744872edc2aa2a53d487d3e79c965a4ad3 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946 CONFIRM https://kb.bluecoat.com/index?page=content&id=SA80 CONFIRM https://kc.mcafee.com/corporate/index?page=content&id=SB10075 CONFIRM https://www.novell.com/support/kb/doc.php?id=7015271 The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.

cpe:/o:linux:linux_kernel:3.0:rc1 cpe:/o:linux:linux_kernel:3.0:rc2 cpe:/o:linux:linux_kernel:3.0:rc3 cpe:/o:linux:linux_kernel:3.0:rc4 cpe:/o:linux:linux_kernel:3.0:rc5 cpe:/o:linux:linux_kernel:3.0:rc6 cpe:/o:linux:linux_kernel:3.0:rc7 cpe:/o:linux:linux_kernel:3.0.1 cpe:/o:linux:linux_kernel:3.0.2 cpe:/o:linux:linux_kernel:3.0.3 cpe:/o:linux:linux_kernel:3.0.4 cpe:/o:linux:linux_kernel:3.0.5 cpe:/o:linux:linux_kernel:3.0.6 cpe:/o:linux:linux_kernel:3.0.7 cpe:/o:linux:linux_kernel:3.0.8 cpe:/o:linux:linux_kernel:3.0.9 cpe:/o:linux:linux_kernel:3.0.10 cpe:/o:linux:linux_kernel:3.0.11 cpe:/o:linux:linux_kernel:3.0.12 cpe:/o:linux:linux_kernel:3.0.13 cpe:/o:linux:linux_kernel:3.0.14 cpe:/o:linux:linux_kernel:3.0.15 cpe:/o:linux:linux_kernel:3.0.16 cpe:/o:linux:linux_kernel:3.0.17 cpe:/o:linux:linux_kernel:3.0.18 cpe:/o:linux:linux_kernel:3.0.19 cpe:/o:linux:linux_kernel:3.0.20 cpe:/o:linux:linux_kernel:3.0.21 cpe:/o:linux:linux_kernel:3.0.22 cpe:/o:linux:linux_kernel:3.0.23 cpe:/o:linux:linux_kernel:3.0.24 cpe:/o:linux:linux_kernel:3.0.25 cpe:/o:linux:linux_kernel:3.0.26 cpe:/o:linux:linux_kernel:3.0.27 cpe:/o:linux:linux_kernel:3.0.28 cpe:/o:linux:linux_kernel:3.0.29 cpe:/o:linux:linux_kernel:3.0.30 cpe:/o:linux:linux_kernel:3.0.31 cpe:/o:linux:linux_kernel:3.0.32 cpe:/o:linux:linux_kernel:3.0.33 cpe:/o:linux:linux_kernel:3.0.34 cpe:/o:linux:linux_kernel:3.0.35 cpe:/o:linux:linux_kernel:3.0.36 cpe:/o:linux:linux_kernel:3.0.37 cpe:/o:linux:linux_kernel:3.0.38 cpe:/o:linux:linux_kernel:3.0.39 cpe:/o:linux:linux_kernel:3.0.40 cpe:/o:linux:linux_kernel:3.0.41 cpe:/o:linux:linux_kernel:3.0.42 cpe:/o:linux:linux_kernel:3.0.43 cpe:/o:linux:linux_kernel:3.0.44 cpe:/o:linux:linux_kernel:3.0.45 cpe:/o:linux:linux_kernel:3.0.46 cpe:/o:linux:linux_kernel:3.0.47 cpe:/o:linux:linux_kernel:3.0.48 cpe:/o:linux:linux_kernel:3.0.49 cpe:/o:linux:linux_kernel:3.0.50 cpe:/o:linux:linux_kernel:3.0.51 cpe:/o:linux:linux_kernel:3.0.52 cpe:/o:linux:linux_kernel:3.0.53 cpe:/o:linux:linux_kernel:3.0.54 cpe:/o:linux:linux_kernel:3.0.55 cpe:/o:linux:linux_kernel:3.0.56 cpe:/o:linux:linux_kernel:3.0.57 cpe:/o:linux:linux_kernel:3.0.58 cpe:/o:linux:linux_kernel:3.0.59 cpe:/o:linux:linux_kernel:3.0.60 cpe:/o:linux:linux_kernel:3.0.61 cpe:/o:linux:linux_kernel:3.0.62 cpe:/o:linux:linux_kernel:3.0.63 cpe:/o:linux:linux_kernel:3.0.64 cpe:/o:linux:linux_kernel:3.0.65 cpe:/o:linux:linux_kernel:3.0.66 cpe:/o:linux:linux_kernel:3.0.67 cpe:/o:linux:linux_kernel:3.0.68 cpe:/o:linux:linux_kernel:3.1 cpe:/o:linux:linux_kernel:3.1:rc1 cpe:/o:linux:linux_kernel:3.1:rc2 cpe:/o:linux:linux_kernel:3.1:rc3 cpe:/o:linux:linux_kernel:3.1:rc4 cpe:/o:linux:linux_kernel:3.1.1 cpe:/o:linux:linux_kernel:3.1.2 cpe:/o:linux:linux_kernel:3.1.3 cpe:/o:linux:linux_kernel:3.1.4 cpe:/o:linux:linux_kernel:3.1.5 cpe:/o:linux:linux_kernel:3.1.6 cpe:/o:linux:linux_kernel:3.1.7 cpe:/o:linux:linux_kernel:3.1.8 cpe:/o:linux:linux_kernel:3.1.9 cpe:/o:linux:linux_kernel:3.1.10 cpe:/o:linux:linux_kernel:3.2 cpe:/o:linux:linux_kernel:3.2:rc2 cpe:/o:linux:linux_kernel:3.2:rc3 cpe:/o:linux:linux_kernel:3.2:rc4 cpe:/o:linux:linux_kernel:3.2:rc5 cpe:/o:linux:linux_kernel:3.2:rc6 cpe:/o:linux:linux_kernel:3.2:rc7 cpe:/o:linux:linux_kernel:3.2.1 cpe:/o:linux:linux_kernel:3.2.2 cpe:/o:linux:linux_kernel:3.2.3 cpe:/o:linux:linux_kernel:3.2.4 cpe:/o:linux:linux_kernel:3.2.5 cpe:/o:linux:linux_kernel:3.2.6 cpe:/o:linux:linux_kernel:3.2.7 cpe:/o:linux:linux_kernel:3.2.8 cpe:/o:linux:linux_kernel:3.2.9 cpe:/o:linux:linux_kernel:3.2.10 cpe:/o:linux:linux_kernel:3.2.11 cpe:/o:linux:linux_kernel:3.2.12 cpe:/o:linux:linux_kernel:3.2.13 cpe:/o:linux:linux_kernel:3.2.14 cpe:/o:linux:linux_kernel:3.2.15 cpe:/o:linux:linux_kernel:3.2.16 cpe:/o:linux:linux_kernel:3.2.17 cpe:/o:linux:linux_kernel:3.2.18 cpe:/o:linux:linux_kernel:3.2.19 cpe:/o:linux:linux_kernel:3.2.20 cpe:/o:linux:linux_kernel:3.2.21 cpe:/o:linux:linux_kernel:3.2.22 cpe:/o:linux:linux_kernel:3.2.23 cpe:/o:linux:linux_kernel:3.2.24 cpe:/o:linux:linux_kernel:3.2.25 cpe:/o:linux:linux_kernel:3.2.26 cpe:/o:linux:linux_kernel:3.2.27 cpe:/o:linux:linux_kernel:3.2.28 cpe:/o:linux:linux_kernel:3.2.29 cpe:/o:linux:linux_kernel:3.2.30 cpe:/o:linux:linux_kernel:3.3 cpe:/o:linux:linux_kernel:3.3:rc1 cpe:/o:linux:linux_kernel:3.3:rc2 cpe:/o:linux:linux_kernel:3.3:rc3 cpe:/o:linux:linux_kernel:3.3:rc4 cpe:/o:linux:linux_kernel:3.3:rc5 cpe:/o:linux:linux_kernel:3.3:rc6 cpe:/o:linux:linux_kernel:3.3:rc7 cpe:/o:linux:linux_kernel:3.3.1 cpe:/o:linux:linux_kernel:3.3.2 cpe:/o:linux:linux_kernel:3.3.3 cpe:/o:linux:linux_kernel:3.3.4 cpe:/o:linux:linux_kernel:3.3.5 cpe:/o:linux:linux_kernel:3.3.6 cpe:/o:linux:linux_kernel:3.3.7 cpe:/o:linux:linux_kernel:3.3.8 cpe:/o:linux:linux_kernel:3.4 cpe:/o:linux:linux_kernel:3.4:rc1 cpe:/o:linux:linux_kernel:3.4:rc2 cpe:/o:linux:linux_kernel:3.4:rc3 cpe:/o:linux:linux_kernel:3.4:rc4 cpe:/o:linux:linux_kernel:3.4:rc5 cpe:/o:linux:linux_kernel:3.4:rc6 cpe:/o:linux:linux_kernel:3.4:rc7 cpe:/o:linux:linux_kernel:3.4.1 cpe:/o:linux:linux_kernel:3.4.2 cpe:/o:linux:linux_kernel:3.4.3 cpe:/o:linux:linux_kernel:3.4.4 cpe:/o:linux:linux_kernel:3.4.5 cpe:/o:linux:linux_kernel:3.4.6 cpe:/o:linux:linux_kernel:3.4.7 cpe:/o:linux:linux_kernel:3.4.8 cpe:/o:linux:linux_kernel:3.4.9 cpe:/o:linux:linux_kernel:3.4.10 cpe:/o:linux:linux_kernel:3.4.11 cpe:/o:linux:linux_kernel:3.4.12 cpe:/o:linux:linux_kernel:3.4.13 cpe:/o:linux:linux_kernel:3.4.14 cpe:/o:linux:linux_kernel:3.4.15 cpe:/o:linux:linux_kernel:3.4.16 cpe:/o:linux:linux_kernel:3.4.17 cpe:/o:linux:linux_kernel:3.4.18 cpe:/o:linux:linux_kernel:3.4.19 cpe:/o:linux:linux_kernel:3.4.20 cpe:/o:linux:linux_kernel:3.4.21 cpe:/o:linux:linux_kernel:3.4.22 cpe:/o:linux:linux_kernel:3.4.23 cpe:/o:linux:linux_kernel:3.4.24 cpe:/o:linux:linux_kernel:3.4.25 cpe:/o:linux:linux_kernel:3.4.26 cpe:/o:linux:linux_kernel:3.4.27 cpe:/o:linux:linux_kernel:3.4.28 cpe:/o:linux:linux_kernel:3.4.29 cpe:/o:linux:linux_kernel:3.4.30 cpe:/o:linux:linux_kernel:3.4.31 cpe:/o:linux:linux_kernel:3.4.32 cpe:/o:linux:linux_kernel:3.4.33 cpe:/o:linux:linux_kernel:3.4.34 cpe:/o:linux:linux_kernel:3.4.35 cpe:/o:linux:linux_kernel:3.4.36 cpe:/o:linux:linux_kernel:3.4.37 cpe:/o:linux:linux_kernel:3.4.38 cpe:/o:linux:linux_kernel:3.4.39 cpe:/o:linux:linux_kernel:3.4.40 cpe:/o:linux:linux_kernel:3.4.41 cpe:/o:linux:linux_kernel:3.4.42 cpe:/o:linux:linux_kernel:3.4.43 cpe:/o:linux:linux_kernel:3.4.44 cpe:/o:linux:linux_kernel:3.4.45 cpe:/o:linux:linux_kernel:3.4.46 cpe:/o:linux:linux_kernel:3.4.47 cpe:/o:linux:linux_kernel:3.4.48 cpe:/o:linux:linux_kernel:3.4.49 cpe:/o:linux:linux_kernel:3.4.50 cpe:/o:linux:linux_kernel:3.4.51 cpe:/o:linux:linux_kernel:3.4.52 cpe:/o:linux:linux_kernel:3.4.53 cpe:/o:linux:linux_kernel:3.4.54 cpe:/o:linux:linux_kernel:3.4.55 cpe:/o:linux:linux_kernel:3.4.56 cpe:/o:linux:linux_kernel:3.4.57 cpe:/o:linux:linux_kernel:3.4.58 cpe:/o:linux:linux_kernel:3.4.59 cpe:/o:linux:linux_kernel:3.4.60 cpe:/o:linux:linux_kernel:3.4.61 cpe:/o:linux:linux_kernel:3.4.62 cpe:/o:linux:linux_kernel:3.4.63 cpe:/o:linux:linux_kernel:3.4.64 cpe:/o:linux:linux_kernel:3.4.65 cpe:/o:linux:linux_kernel:3.4.66 cpe:/o:linux:linux_kernel:3.4.67 cpe:/o:linux:linux_kernel:3.4.68 cpe:/o:linux:linux_kernel:3.4.69 cpe:/o:linux:linux_kernel:3.4.70 cpe:/o:linux:linux_kernel:3.4.71 cpe:/o:linux:linux_kernel:3.4.72 cpe:/o:linux:linux_kernel:3.4.73 cpe:/o:linux:linux_kernel:3.4.74 cpe:/o:linux:linux_kernel:3.4.75 cpe:/o:linux:linux_kernel:3.4.76 cpe:/o:linux:linux_kernel:3.4.77 cpe:/o:linux:linux_kernel:3.4.78 cpe:/o:linux:linux_kernel:3.4.79 cpe:/o:linux:linux_kernel:3.5.1 cpe:/o:linux:linux_kernel:3.5.2 cpe:/o:linux:linux_kernel:3.5.3 cpe:/o:linux:linux_kernel:3.5.4 cpe:/o:linux:linux_kernel:3.5.5 cpe:/o:linux:linux_kernel:3.5.6 cpe:/o:linux:linux_kernel:3.5.7 cpe:/o:linux:linux_kernel:3.6 cpe:/o:linux:linux_kernel:3.6.1 cpe:/o:linux:linux_kernel:3.6.2 cpe:/o:linux:linux_kernel:3.6.3 cpe:/o:linux:linux_kernel:3.6.4 cpe:/o:linux:linux_kernel:3.6.5 cpe:/o:linux:linux_kernel:3.6.6 cpe:/o:linux:linux_kernel:3.6.7 cpe:/o:linux:linux_kernel:3.6.8 cpe:/o:linux:linux_kernel:3.6.9 cpe:/o:linux:linux_kernel:3.6.10 cpe:/o:linux:linux_kernel:3.6.11 cpe:/o:linux:linux_kernel:3.7 cpe:/o:linux:linux_kernel:3.7.1 cpe:/o:linux:linux_kernel:3.7.2 cpe:/o:linux:linux_kernel:3.7.3 cpe:/o:linux:linux_kernel:3.7.4 cpe:/o:linux:linux_kernel:3.7.5 cpe:/o:linux:linux_kernel:3.7.6 cpe:/o:linux:linux_kernel:3.7.7 cpe:/o:linux:linux_kernel:3.7.8 cpe:/o:linux:linux_kernel:3.7.9 cpe:/o:linux:linux_kernel:3.7.10 cpe:/o:linux:linux_kernel:3.8.0 cpe:/o:linux:linux_kernel:3.8.1 cpe:/o:linux:linux_kernel:3.8.2 cpe:/o:linux:linux_kernel:3.8.3 cpe:/o:linux:linux_kernel:3.8.4 cpe:/o:linux:linux_kernel:3.8.5 cpe:/o:linux:linux_kernel:3.8.6 cpe:/o:linux:linux_kernel:3.8.7 cpe:/o:linux:linux_kernel:3.8.8 cpe:/o:linux:linux_kernel:3.8.9 cpe:/o:linux:linux_kernel:3.8.10 cpe:/o:linux:linux_kernel:3.8.11 cpe:/o:linux:linux_kernel:3.8.12 cpe:/o:linux:linux_kernel:3.8.13 cpe:/o:linux:linux_kernel:3.9:rc1 cpe:/o:linux:linux_kernel:3.9:rc2 cpe:/o:linux:linux_kernel:3.9:rc3 cpe:/o:linux:linux_kernel:3.9:rc4 cpe:/o:linux:linux_kernel:3.9:rc5 cpe:/o:linux:linux_kernel:3.9:rc6 cpe:/o:linux:linux_kernel:3.9:rc7 cpe:/o:linux:linux_kernel:3.9.0 cpe:/o:linux:linux_kernel:3.9.1 cpe:/o:linux:linux_kernel:3.9.2 cpe:/o:linux:linux_kernel:3.9.3 cpe:/o:linux:linux_kernel:3.9.4 cpe:/o:linux:linux_kernel:3.9.5 cpe:/o:linux:linux_kernel:3.9.6 cpe:/o:linux:linux_kernel:3.9.7 cpe:/o:linux:linux_kernel:3.9.8 cpe:/o:linux:linux_kernel:3.9.9 cpe:/o:linux:linux_kernel:3.9.10 cpe:/o:linux:linux_kernel:3.9.11 cpe:/o:linux:linux_kernel:3.10 cpe:/o:linux:linux_kernel:3.10.1 cpe:/o:linux:linux_kernel:3.10.2 cpe:/o:linux:linux_kernel:3.10.3 cpe:/o:linux:linux_kernel:3.10.4 cpe:/o:linux:linux_kernel:3.10.5 cpe:/o:linux:linux_kernel:3.10.6 cpe:/o:linux:linux_kernel:3.10.7 cpe:/o:linux:linux_kernel:3.10.8 cpe:/o:linux:linux_kernel:3.10.9 cpe:/o:linux:linux_kernel:3.10.10 cpe:/o:linux:linux_kernel:3.10.11 cpe:/o:linux:linux_kernel:3.10.12 cpe:/o:linux:linux_kernel:3.10.13 cpe:/o:linux:linux_kernel:3.10.14 cpe:/o:linux:linux_kernel:3.10.15 cpe:/o:linux:linux_kernel:3.10.16 cpe:/o:linux:linux_kernel:3.10.17 cpe:/o:linux:linux_kernel:3.10.18 cpe:/o:linux:linux_kernel:3.10.19 cpe:/o:linux:linux_kernel:3.10.20 cpe:/o:linux:linux_kernel:3.10.21 cpe:/o:linux:linux_kernel:3.10.22 cpe:/o:linux:linux_kernel:3.10.23 cpe:/o:linux:linux_kernel:3.10.24 cpe:/o:linux:linux_kernel:3.10.25 cpe:/o:linux:linux_kernel:3.10.26 cpe:/o:linux:linux_kernel:3.10.27 cpe:/o:linux:linux_kernel:3.10.28 cpe:/o:linux:linux_kernel:3.10.29 cpe:/o:linux:linux_kernel:3.11 cpe:/o:linux:linux_kernel:3.11.1 cpe:/o:linux:linux_kernel:3.11.2 cpe:/o:linux:linux_kernel:3.11.3 cpe:/o:linux:linux_kernel:3.11.4 cpe:/o:linux:linux_kernel:3.11.5 cpe:/o:linux:linux_kernel:3.11.6 cpe:/o:linux:linux_kernel:3.11.7 cpe:/o:linux:linux_kernel:3.11.8 cpe:/o:linux:linux_kernel:3.11.9 cpe:/o:linux:linux_kernel:3.11.10 cpe:/o:linux:linux_kernel:3.12 cpe:/o:linux:linux_kernel:3.12.1 cpe:/o:linux:linux_kernel:3.12.2 cpe:/o:linux:linux_kernel:3.12.3 cpe:/o:linux:linux_kernel:3.12.4 cpe:/o:linux:linux_kernel:3.12.5 cpe:/o:linux:linux_kernel:3.12.6 cpe:/o:linux:linux_kernel:3.12.7 cpe:/o:linux:linux_kernel:3.12.8 cpe:/o:linux:linux_kernel:3.12.9 cpe:/o:linux:linux_kernel:3.12.10 cpe:/o:linux:linux_kernel:3.12.11 cpe:/o:linux:linux_kernel:3.12.12 cpe:/o:linux:linux_kernel:3.12.13 cpe:/o:linux:linux_kernel:3.12.14 cpe:/o:linux:linux_kernel:3.12.15 cpe:/o:linux:linux_kernel:3.12.16 cpe:/o:linux:linux_kernel:3.12.17 cpe:/o:linux:linux_kernel:3.13 cpe:/o:linux:linux_kernel:3.13.1 cpe:/o:linux:linux_kernel:3.13.2 cpe:/o:linux:linux_kernel:3.13.3 cpe:/o:linux:linux_kernel:3.13.4 cpe:/o:linux:linux_kernel:3.13.5 cpe:/o:linux:linux_kernel:3.13.6 cpe:/o:linux:linux_kernel:3.13.7 cpe:/o:linux:linux_kernel:3.13.8 cpe:/o:linux:linux_kernel:3.13.9 cpe:/o:linux:linux_kernel:3.13.10 cpe:/o:linux:linux_kernel:3.13.11 cpe:/o:linux:linux_kernel:3.14:- cpe:/o:linux:linux_kernel:3.14:rc1 cpe:/o:linux:linux_kernel:3.14:rc2 cpe:/o:linux:linux_kernel:3.14:rc3 cpe:/o:linux:linux_kernel:3.14:rc4 cpe:/o:linux:linux_kernel:3.14:rc5 cpe:/o:linux:linux_kernel:3.14:rc6 cpe:/o:linux:linux_kernel:3.14:rc7 cpe:/o:linux:linux_kernel:3.14:rc8 cpe:/o:linux:linux_kernel:3.14.1 cpe:/o:linux:linux_kernel:3.14.2 cpe:/o:linux:linux_kernel:3.14.3

CVE-2014-0196

2014-05-07T06:55:04.337-04:00

2017-01-06T21:59:19.047-05:00

6.9

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://bugzilla.novell.com/show_bug.cgi?id=875690 CONFIRM http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4291086b1f081b869c6d79e5b7441633dc3ace00 CONFIRM http://linux.oracle.com/errata/ELSA-2014-0771.html SUSE SUSE-SU-2014:0667 SUSE SUSE-SU-2014:0683 MISC http://pastebin.com/raw.php?i=yTSFUBgZ REDHAT RHSA-2014:0512 SECUNIA 59218 CONFIRM http://source.android.com/security/bulletin/2016-07-01.html CONFIRM http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15319.html DEBIAN DSA-2926 DEBIAN DSA-2928 EXPLOIT-DB 33516 MLIST [oss-security] 20140429 CVE-2014-0196: Linux kernel pty layer race condition memory corruption OSVDB 106646 UBUNTU USN-2196-1 UBUNTU USN-2197-1 UBUNTU USN-2198-1 UBUNTU USN-2199-1 UBUNTU USN-2200-1 UBUNTU USN-2201-1 UBUNTU USN-2202-1 UBUNTU USN-2203-1 UBUNTU USN-2204-1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1094232 CONFIRM https://github.com/torvalds/linux/commit/4291086b1f081b869c6d79e5b7441633dc3ace00 The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.

cpe:/a:openssl:openssl:1.0.0 cpe:/a:openssl:openssl:1.0.0:beta1 cpe:/a:openssl:openssl:1.0.0:beta2 cpe:/a:openssl:openssl:1.0.0:beta3 cpe:/a:openssl:openssl:1.0.0:beta4 cpe:/a:openssl:openssl:1.0.0:beta5 cpe:/a:openssl:openssl:1.0.0a cpe:/a:openssl:openssl:1.0.0b cpe:/a:openssl:openssl:1.0.0c cpe:/a:openssl:openssl:1.0.0d cpe:/a:openssl:openssl:1.0.0e cpe:/a:openssl:openssl:1.0.0f cpe:/a:openssl:openssl:1.0.0g cpe:/a:openssl:openssl:1.0.0h cpe:/a:openssl:openssl:1.0.0i cpe:/a:openssl:openssl:1.0.0j cpe:/a:openssl:openssl:1.0.0k cpe:/a:openssl:openssl:1.0.0l cpe:/a:openssl:openssl:1.0.1 cpe:/a:openssl:openssl:1.0.1:beta1 cpe:/a:openssl:openssl:1.0.1:beta2 cpe:/a:openssl:openssl:1.0.1:beta3 cpe:/a:openssl:openssl:1.0.1a cpe:/a:openssl:openssl:1.0.1b cpe:/a:openssl:openssl:1.0.1c cpe:/a:openssl:openssl:1.0.1d cpe:/a:openssl:openssl:1.0.1e cpe:/a:openssl:openssl:1.0.1f cpe:/a:openssl:openssl:1.0.1g

CVE-2014-0198

2014-05-06T06:44:05.470-04:00

2018-10-09T15:37:33.147-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://advisories.mageia.org/MGASA-2014-0204.html CONFIRM http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629 CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=KB29195 FEDORA FEDORA-2014-9301 FEDORA FEDORA-2014-9308 SUSE SUSE-SU-2015:0743 SUSE openSUSE-SU-2014:0634 SUSE openSUSE-SU-2014:0635 HP HPSBMU03057 HP HPSBMU03056 HP HPSBMU03055 HP HPSBMU03051 HP HPSBGN03068 HP HPSBMU03074 HP HPSBMU03062 HP HPSBMU03076 HP HPSBHF03052 CONFIRM http://puppetlabs.com/security/cve/cve-2014-0198 FULLDISC 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities SECUNIA 58337 SECUNIA 58667 SECUNIA 58713 SECUNIA 58714 SECUNIA 58945 SECUNIA 58977 SECUNIA 59163 SECUNIA 59190 SECUNIA 59202 SECUNIA 59264 SECUNIA 59282 SECUNIA 59284 SECUNIA 59287 SECUNIA 59306 SECUNIA 59310 SECUNIA 59374 SECUNIA 59398 SECUNIA 59437 SECUNIA 59440 SECUNIA 59449 SECUNIA 59525 SECUNIA 59529 SECUNIA 61254 GENTOO GLSA-201407-05 CONFIRM http://support.citrix.com/article/CTX140876 CONFIRM http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15329.html CISCO 20140605 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products CONFIRM http://www.blackberry.com/btsc/KB36051 DEBIAN DSA-2931 CONFIRM http://www.fortiguard.com/advisory/FG-IR-14-018/ CONFIRM http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htm CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21676356 CONFIRM http://www.ibm.com/support/docview.wss?uid=swg24037783 MANDRIVA MDVSA-2014:080 MANDRIVA MDVSA-2015:062 OPENBSD [5.5] 005: RELIABILITY FIX: May 1, 2014 CONFIRM http://www.openssl.org/news/secadv_20140605.txt CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html BUGTRAQ 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities BID 67193 CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0006.html CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0012.html CONFIRM http://www-01.ibm.com/support/docview.wss?uid=nas8N1020163 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21673137 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676035 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676062 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676419 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676529 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676655 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676879 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676889 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677527 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677695 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677828 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677836 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21678167 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21683332 CONFIRM http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095754 CONFIRM http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095755 CONFIRM http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095756 CONFIRM http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095757 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1093837 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946 CONFIRM https://kb.bluecoat.com/index?page=content&id=SA80 CONFIRM https://kc.mcafee.com/corporate/index?page=content&id=SB10075 CONFIRM https://rt.openssl.org/Ticket/Display.html?user=guest&pass=guest&id=3321 CONFIRM https://www.novell.com/support/kb/doc.php?id=7015271 The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors that trigger an alert condition.

cpe:/a:redhat:rhevm-reports:3.0 cpe:/a:redhat:rhevm-reports:3.1 cpe:/a:redhat:rhevm-reports:3.2 cpe:/a:redhat:rhevm-reports:3.3

CVE-2014-0199

2014-05-29T10:19:07.487-04:00

2014-05-30T09:44:09.750-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-05-30T09:44:09.530-04:00

REDHAT RHSA-2014:0558 BID 67682 The setup script in ovirt-engine-reports, as used in the Red Hat Enterprise Virtualization reports (rhevm-reports) package before 3.3.3, stores the reports database password in cleartext, which allows local users to obtain sensitive information by reading an unspecified file.

cpe:/a:redhat:rhevm-reports:3.0 cpe:/a:redhat:rhevm-reports:3.1 cpe:/a:redhat:rhevm-reports:3.2 cpe:/a:redhat:rhevm-reports:3.3 cpe:/a:redhat:rhevm-reports:3.3.3

CVE-2014-0200

2014-05-29T10:19:07.567-04:00

2014-05-30T09:46:13.080-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-05-30T09:46:12.877-04:00

REDHAT RHSA-2014:0558 BID 67684 The Red Hat Enterprise Virtualization Manager reports (rhevm-reports) package before 3.3.3-1 uses world-readable permissions on the datasource configuration file (js-jboss7-ds.xml), which allows local users to obtain sensitive information by reading the file.

cpe:/a:redhat:rhevm-reports:3.0 cpe:/a:redhat:rhevm-reports:3.1 cpe:/a:redhat:rhevm-reports:3.2 cpe:/a:redhat:rhevm-reports:3.3

CVE-2014-0201

2014-05-29T10:19:07.627-04:00

2014-05-30T09:47:17.347-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-05-30T09:47:17.143-04:00

REDHAT RHSA-2014:0558 ovirt-engine-reports, as used in the Red Hat Enterprise Virtualization reports package (rhevm-reports) before 3.3.3, uses world-readable permissions on configuration files, which allows local users to obtain sensitive information by reading the files.

cpe:/a:redhat:rhevm-dwh:3.3.2

CVE-2014-0202

2014-05-30T10:55:08.817-04:00

2014-06-26T11:46:06.273-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-06-02T12:49:20.413-04:00

REDHAT RHSA-2014:0559 The setup script in ovirt-engine-dwh, as used in the Red Hat Enterprise Virtualization Manager data warehouse (rhevm-dwh) package before 3.3.3, stores the history database password in cleartext, which allows local users to obtain sensitive information by reading an unspecified file.

cpe:/o:linux:linux_kernel:2.6.1 cpe:/o:linux:linux_kernel:2.6.1:rc1 cpe:/o:linux:linux_kernel:2.6.1:rc2 cpe:/o:linux:linux_kernel:2.6.1:rc3 cpe:/o:linux:linux_kernel:2.6.2 cpe:/o:linux:linux_kernel:2.6.2:rc1 cpe:/o:linux:linux_kernel:2.6.2:rc2 cpe:/o:linux:linux_kernel:2.6.2:rc3 cpe:/o:linux:linux_kernel:2.6.4 cpe:/o:linux:linux_kernel:2.6.4:rc1 cpe:/o:linux:linux_kernel:2.6.4:rc2 cpe:/o:linux:linux_kernel:2.6.4:rc3 cpe:/o:linux:linux_kernel:2.6.5 cpe:/o:linux:linux_kernel:2.6.5:rc1 cpe:/o:linux:linux_kernel:2.6.5:rc2 cpe:/o:linux:linux_kernel:2.6.5:rc3 cpe:/o:linux:linux_kernel:2.6.6 cpe:/o:linux:linux_kernel:2.6.6:rc1 cpe:/o:linux:linux_kernel:2.6.6:rc2 cpe:/o:linux:linux_kernel:2.6.6:rc3 cpe:/o:linux:linux_kernel:2.6.7 cpe:/o:linux:linux_kernel:2.6.7:rc1 cpe:/o:linux:linux_kernel:2.6.7:rc2 cpe:/o:linux:linux_kernel:2.6.7:rc3 cpe:/o:linux:linux_kernel:2.6.8 cpe:/o:linux:linux_kernel:2.6.8:rc1 cpe:/o:linux:linux_kernel:2.6.8:rc2 cpe:/o:linux:linux_kernel:2.6.8:rc3 cpe:/o:linux:linux_kernel:2.6.8:rc4 cpe:/o:linux:linux_kernel:2.6.8.1 cpe:/o:linux:linux_kernel:2.6.9 cpe:/o:linux:linux_kernel:2.6.9:rc1 cpe:/o:linux:linux_kernel:2.6.9:rc2 cpe:/o:linux:linux_kernel:2.6.9:rc3 cpe:/o:linux:linux_kernel:2.6.9:rc4 cpe:/o:linux:linux_kernel:2.6.10 cpe:/o:linux:linux_kernel:2.6.10:rc1 cpe:/o:linux:linux_kernel:2.6.10:rc2 cpe:/o:linux:linux_kernel:2.6.10:rc3 cpe:/o:linux:linux_kernel:2.6.11 cpe:/o:linux:linux_kernel:2.6.11:rc1 cpe:/o:linux:linux_kernel:2.6.11:rc2 cpe:/o:linux:linux_kernel:2.6.11:rc3 cpe:/o:linux:linux_kernel:2.6.11:rc4 cpe:/o:linux:linux_kernel:2.6.11:rc5 cpe:/o:linux:linux_kernel:2.6.11.1 cpe:/o:linux:linux_kernel:2.6.11.2 cpe:/o:linux:linux_kernel:2.6.11.3 cpe:/o:linux:linux_kernel:2.6.11.4 cpe:/o:linux:linux_kernel:2.6.11.5 cpe:/o:linux:linux_kernel:2.6.11.6 cpe:/o:linux:linux_kernel:2.6.11.7 cpe:/o:linux:linux_kernel:2.6.11.8 cpe:/o:linux:linux_kernel:2.6.11.9 cpe:/o:linux:linux_kernel:2.6.11.10 cpe:/o:linux:linux_kernel:2.6.11.11 cpe:/o:linux:linux_kernel:2.6.11.12 cpe:/o:linux:linux_kernel:2.6.12 cpe:/o:linux:linux_kernel:2.6.12:rc1 cpe:/o:linux:linux_kernel:2.6.12:rc2 cpe:/o:linux:linux_kernel:2.6.12:rc3 cpe:/o:linux:linux_kernel:2.6.12:rc4 cpe:/o:linux:linux_kernel:2.6.12:rc5 cpe:/o:linux:linux_kernel:2.6.12:rc6 cpe:/o:linux:linux_kernel:2.6.12.1 cpe:/o:linux:linux_kernel:2.6.12.2 cpe:/o:linux:linux_kernel:2.6.12.3 cpe:/o:linux:linux_kernel:2.6.12.4 cpe:/o:linux:linux_kernel:2.6.12.5 cpe:/o:linux:linux_kernel:2.6.12.6 cpe:/o:linux:linux_kernel:2.6.13 cpe:/o:linux:linux_kernel:2.6.13:rc1 cpe:/o:linux:linux_kernel:2.6.13:rc2 cpe:/o:linux:linux_kernel:2.6.13:rc3 cpe:/o:linux:linux_kernel:2.6.13:rc4 cpe:/o:linux:linux_kernel:2.6.13:rc5 cpe:/o:linux:linux_kernel:2.6.13:rc6 cpe:/o:linux:linux_kernel:2.6.13:rc7 cpe:/o:linux:linux_kernel:2.6.13.1 cpe:/o:linux:linux_kernel:2.6.13.2 cpe:/o:linux:linux_kernel:2.6.13.3 cpe:/o:linux:linux_kernel:2.6.13.4 cpe:/o:linux:linux_kernel:2.6.13.5 cpe:/o:linux:linux_kernel:2.6.14 cpe:/o:linux:linux_kernel:2.6.14:rc1 cpe:/o:linux:linux_kernel:2.6.14:rc2 cpe:/o:linux:linux_kernel:2.6.14:rc3 cpe:/o:linux:linux_kernel:2.6.14:rc4 cpe:/o:linux:linux_kernel:2.6.14:rc5 cpe:/o:linux:linux_kernel:2.6.14.1 cpe:/o:linux:linux_kernel:2.6.14.2 cpe:/o:linux:linux_kernel:2.6.14.3 cpe:/o:linux:linux_kernel:2.6.14.4 cpe:/o:linux:linux_kernel:2.6.14.5 cpe:/o:linux:linux_kernel:2.6.14.6 cpe:/o:linux:linux_kernel:2.6.14.7 cpe:/o:linux:linux_kernel:2.6.15 cpe:/o:linux:linux_kernel:2.6.15:rc1 cpe:/o:linux:linux_kernel:2.6.15:rc2 cpe:/o:linux:linux_kernel:2.6.15:rc3 cpe:/o:linux:linux_kernel:2.6.15:rc4 cpe:/o:linux:linux_kernel:2.6.15:rc5 cpe:/o:linux:linux_kernel:2.6.15:rc6 cpe:/o:linux:linux_kernel:2.6.15:rc7 cpe:/o:linux:linux_kernel:2.6.15.1 cpe:/o:linux:linux_kernel:2.6.15.2 cpe:/o:linux:linux_kernel:2.6.15.3 cpe:/o:linux:linux_kernel:2.6.15.4 cpe:/o:linux:linux_kernel:2.6.15.5 cpe:/o:linux:linux_kernel:2.6.15.6 cpe:/o:linux:linux_kernel:2.6.15.7 cpe:/o:linux:linux_kernel:2.6.15.8 cpe:/o:linux:linux_kernel:2.6.15.9 cpe:/o:linux:linux_kernel:2.6.15.10 cpe:/o:linux:linux_kernel:2.6.15.11 cpe:/o:linux:linux_kernel:2.6.16 cpe:/o:linux:linux_kernel:2.6.16:rc1 cpe:/o:linux:linux_kernel:2.6.16:rc2 cpe:/o:linux:linux_kernel:2.6.16:rc3 cpe:/o:linux:linux_kernel:2.6.16:rc4 cpe:/o:linux:linux_kernel:2.6.16:rc5 cpe:/o:linux:linux_kernel:2.6.16:rc6 cpe:/o:linux:linux_kernel:2.6.16:rc7 cpe:/o:linux:linux_kernel:2.6.16.1 cpe:/o:linux:linux_kernel:2.6.16.2 cpe:/o:linux:linux_kernel:2.6.16.3 cpe:/o:linux:linux_kernel:2.6.16.4 cpe:/o:linux:linux_kernel:2.6.16.5 cpe:/o:linux:linux_kernel:2.6.16.6 cpe:/o:linux:linux_kernel:2.6.16.7 cpe:/o:linux:linux_kernel:2.6.16.8 cpe:/o:linux:linux_kernel:2.6.16.9 cpe:/o:linux:linux_kernel:2.6.16.10 cpe:/o:linux:linux_kernel:2.6.16.11 cpe:/o:linux:linux_kernel:2.6.16.12 cpe:/o:linux:linux_kernel:2.6.16.13 cpe:/o:linux:linux_kernel:2.6.16.14 cpe:/o:linux:linux_kernel:2.6.16.15 cpe:/o:linux:linux_kernel:2.6.16.16 cpe:/o:linux:linux_kernel:2.6.16.17 cpe:/o:linux:linux_kernel:2.6.16.18 cpe:/o:linux:linux_kernel:2.6.16.19 cpe:/o:linux:linux_kernel:2.6.16.20 cpe:/o:linux:linux_kernel:2.6.16.21 cpe:/o:linux:linux_kernel:2.6.16.22 cpe:/o:linux:linux_kernel:2.6.16.23 cpe:/o:linux:linux_kernel:2.6.16.24 cpe:/o:linux:linux_kernel:2.6.16.25 cpe:/o:linux:linux_kernel:2.6.16.26 cpe:/o:linux:linux_kernel:2.6.16.27 cpe:/o:linux:linux_kernel:2.6.16.28 cpe:/o:linux:linux_kernel:2.6.16.29 cpe:/o:linux:linux_kernel:2.6.16.30 cpe:/o:linux:linux_kernel:2.6.16.31 cpe:/o:linux:linux_kernel:2.6.16.32 cpe:/o:linux:linux_kernel:2.6.16.33 cpe:/o:linux:linux_kernel:2.6.16.34 cpe:/o:linux:linux_kernel:2.6.16.35 cpe:/o:linux:linux_kernel:2.6.16.36 cpe:/o:linux:linux_kernel:2.6.16.37 cpe:/o:linux:linux_kernel:2.6.16.38 cpe:/o:linux:linux_kernel:2.6.16.39 cpe:/o:linux:linux_kernel:2.6.16.40 cpe:/o:linux:linux_kernel:2.6.16.41 cpe:/o:linux:linux_kernel:2.6.16.42 cpe:/o:linux:linux_kernel:2.6.16.43 cpe:/o:linux:linux_kernel:2.6.16.44 cpe:/o:linux:linux_kernel:2.6.16.45 cpe:/o:linux:linux_kernel:2.6.16.46 cpe:/o:linux:linux_kernel:2.6.16.47 cpe:/o:linux:linux_kernel:2.6.16.48 cpe:/o:linux:linux_kernel:2.6.16.49 cpe:/o:linux:linux_kernel:2.6.16.50 cpe:/o:linux:linux_kernel:2.6.16.51 cpe:/o:linux:linux_kernel:2.6.16.52 cpe:/o:linux:linux_kernel:2.6.16.53 cpe:/o:linux:linux_kernel:2.6.16.54 cpe:/o:linux:linux_kernel:2.6.16.55 cpe:/o:linux:linux_kernel:2.6.16.56 cpe:/o:linux:linux_kernel:2.6.16.57 cpe:/o:linux:linux_kernel:2.6.16.58 cpe:/o:linux:linux_kernel:2.6.16.59 cpe:/o:linux:linux_kernel:2.6.16.60 cpe:/o:linux:linux_kernel:2.6.16.61 cpe:/o:linux:linux_kernel:2.6.16.62 cpe:/o:linux:linux_kernel:2.6.17 cpe:/o:linux:linux_kernel:2.6.17:rc1 cpe:/o:linux:linux_kernel:2.6.17:rc2 cpe:/o:linux:linux_kernel:2.6.17:rc3 cpe:/o:linux:linux_kernel:2.6.17:rc4 cpe:/o:linux:linux_kernel:2.6.17:rc5 cpe:/o:linux:linux_kernel:2.6.17:rc6 cpe:/o:linux:linux_kernel:2.6.17.1 cpe:/o:linux:linux_kernel:2.6.17.2 cpe:/o:linux:linux_kernel:2.6.17.3 cpe:/o:linux:linux_kernel:2.6.17.4 cpe:/o:linux:linux_kernel:2.6.17.5 cpe:/o:linux:linux_kernel:2.6.17.6 cpe:/o:linux:linux_kernel:2.6.17.7 cpe:/o:linux:linux_kernel:2.6.17.8 cpe:/o:linux:linux_kernel:2.6.17.9 cpe:/o:linux:linux_kernel:2.6.17.10 cpe:/o:linux:linux_kernel:2.6.17.11 cpe:/o:linux:linux_kernel:2.6.17.12 cpe:/o:linux:linux_kernel:2.6.17.13 cpe:/o:linux:linux_kernel:2.6.17.14 cpe:/o:linux:linux_kernel:2.6.18 cpe:/o:linux:linux_kernel:2.6.18:rc1 cpe:/o:linux:linux_kernel:2.6.18:rc2 cpe:/o:linux:linux_kernel:2.6.18:rc3 cpe:/o:linux:linux_kernel:2.6.18:rc4 cpe:/o:linux:linux_kernel:2.6.18:rc5 cpe:/o:linux:linux_kernel:2.6.18:rc6 cpe:/o:linux:linux_kernel:2.6.18:rc7 cpe:/o:linux:linux_kernel:2.6.18.1 cpe:/o:linux:linux_kernel:2.6.18.2 cpe:/o:linux:linux_kernel:2.6.18.3 cpe:/o:linux:linux_kernel:2.6.18.4 cpe:/o:linux:linux_kernel:2.6.18.5 cpe:/o:linux:linux_kernel:2.6.18.6 cpe:/o:linux:linux_kernel:2.6.18.7 cpe:/o:linux:linux_kernel:2.6.18.8 cpe:/o:linux:linux_kernel:2.6.19 cpe:/o:linux:linux_kernel:2.6.19:rc1 cpe:/o:linux:linux_kernel:2.6.19:rc2 cpe:/o:linux:linux_kernel:2.6.19:rc3 cpe:/o:linux:linux_kernel:2.6.19:rc4 cpe:/o:linux:linux_kernel:2.6.19:rc5 cpe:/o:linux:linux_kernel:2.6.19:rc6 cpe:/o:linux:linux_kernel:2.6.19.1 cpe:/o:linux:linux_kernel:2.6.19.2 cpe:/o:linux:linux_kernel:2.6.19.3 cpe:/o:linux:linux_kernel:2.6.19.4 cpe:/o:linux:linux_kernel:2.6.19.5 cpe:/o:linux:linux_kernel:2.6.19.6 cpe:/o:linux:linux_kernel:2.6.19.7 cpe:/o:linux:linux_kernel:2.6.20 cpe:/o:linux:linux_kernel:2.6.20:rc1 cpe:/o:linux:linux_kernel:2.6.20:rc2 cpe:/o:linux:linux_kernel:2.6.20:rc3 cpe:/o:linux:linux_kernel:2.6.20:rc4 cpe:/o:linux:linux_kernel:2.6.20:rc5 cpe:/o:linux:linux_kernel:2.6.20:rc6 cpe:/o:linux:linux_kernel:2.6.20:rc7 cpe:/o:linux:linux_kernel:2.6.20.1 cpe:/o:linux:linux_kernel:2.6.20.2 cpe:/o:linux:linux_kernel:2.6.20.3 cpe:/o:linux:linux_kernel:2.6.20.4 cpe:/o:linux:linux_kernel:2.6.20.5 cpe:/o:linux:linux_kernel:2.6.20.6 cpe:/o:linux:linux_kernel:2.6.20.7 cpe:/o:linux:linux_kernel:2.6.20.8 cpe:/o:linux:linux_kernel:2.6.20.9 cpe:/o:linux:linux_kernel:2.6.20.10 cpe:/o:linux:linux_kernel:2.6.20.11 cpe:/o:linux:linux_kernel:2.6.20.12 cpe:/o:linux:linux_kernel:2.6.20.13 cpe:/o:linux:linux_kernel:2.6.20.14 cpe:/o:linux:linux_kernel:2.6.20.15 cpe:/o:linux:linux_kernel:2.6.20.16 cpe:/o:linux:linux_kernel:2.6.20.17 cpe:/o:linux:linux_kernel:2.6.20.18 cpe:/o:linux:linux_kernel:2.6.20.19 cpe:/o:linux:linux_kernel:2.6.20.20 cpe:/o:linux:linux_kernel:2.6.20.21 cpe:/o:linux:linux_kernel:2.6.21 cpe:/o:linux:linux_kernel:2.6.21:git1 cpe:/o:linux:linux_kernel:2.6.21:git2 cpe:/o:linux:linux_kernel:2.6.21:git3 cpe:/o:linux:linux_kernel:2.6.21:git4 cpe:/o:linux:linux_kernel:2.6.21:git5 cpe:/o:linux:linux_kernel:2.6.21:git6 cpe:/o:linux:linux_kernel:2.6.21:git7 cpe:/o:linux:linux_kernel:2.6.21:rc1 cpe:/o:linux:linux_kernel:2.6.21:rc2 cpe:/o:linux:linux_kernel:2.6.21:rc3 cpe:/o:linux:linux_kernel:2.6.21:rc4 cpe:/o:linux:linux_kernel:2.6.21:rc5 cpe:/o:linux:linux_kernel:2.6.21:rc6 cpe:/o:linux:linux_kernel:2.6.21:rc7 cpe:/o:linux:linux_kernel:2.6.21.1 cpe:/o:linux:linux_kernel:2.6.21.2 cpe:/o:linux:linux_kernel:2.6.21.3 cpe:/o:linux:linux_kernel:2.6.21.4 cpe:/o:linux:linux_kernel:2.6.21.5 cpe:/o:linux:linux_kernel:2.6.21.6 cpe:/o:linux:linux_kernel:2.6.21.7 cpe:/o:linux:linux_kernel:2.6.22 cpe:/o:linux:linux_kernel:2.6.22:rc1 cpe:/o:linux:linux_kernel:2.6.22:rc2 cpe:/o:linux:linux_kernel:2.6.22:rc3 cpe:/o:linux:linux_kernel:2.6.22:rc4 cpe:/o:linux:linux_kernel:2.6.22:rc5 cpe:/o:linux:linux_kernel:2.6.22:rc6 cpe:/o:linux:linux_kernel:2.6.22:rc7 cpe:/o:linux:linux_kernel:2.6.22.1 cpe:/o:linux:linux_kernel:2.6.22.2 cpe:/o:linux:linux_kernel:2.6.22.3 cpe:/o:linux:linux_kernel:2.6.22.4 cpe:/o:linux:linux_kernel:2.6.22.5 cpe:/o:linux:linux_kernel:2.6.22.6 cpe:/o:linux:linux_kernel:2.6.22.7 cpe:/o:linux:linux_kernel:2.6.22.8 cpe:/o:linux:linux_kernel:2.6.22.9 cpe:/o:linux:linux_kernel:2.6.22.10 cpe:/o:linux:linux_kernel:2.6.22.11 cpe:/o:linux:linux_kernel:2.6.22.12 cpe:/o:linux:linux_kernel:2.6.22.13 cpe:/o:linux:linux_kernel:2.6.22.14 cpe:/o:linux:linux_kernel:2.6.22.15 cpe:/o:linux:linux_kernel:2.6.22.16 cpe:/o:linux:linux_kernel:2.6.22.17 cpe:/o:linux:linux_kernel:2.6.22.18 cpe:/o:linux:linux_kernel:2.6.22.19 cpe:/o:linux:linux_kernel:2.6.22.20 cpe:/o:linux:linux_kernel:2.6.22.21 cpe:/o:linux:linux_kernel:2.6.22.22 cpe:/o:linux:linux_kernel:2.6.23 cpe:/o:linux:linux_kernel:2.6.23:rc1 cpe:/o:linux:linux_kernel:2.6.23:rc2 cpe:/o:linux:linux_kernel:2.6.23:rc3 cpe:/o:linux:linux_kernel:2.6.23:rc4 cpe:/o:linux:linux_kernel:2.6.23:rc5 cpe:/o:linux:linux_kernel:2.6.23:rc6 cpe:/o:linux:linux_kernel:2.6.23:rc7 cpe:/o:linux:linux_kernel:2.6.23:rc8 cpe:/o:linux:linux_kernel:2.6.23:rc9 cpe:/o:linux:linux_kernel:2.6.23.1 cpe:/o:linux:linux_kernel:2.6.23.2 cpe:/o:linux:linux_kernel:2.6.23.3 cpe:/o:linux:linux_kernel:2.6.23.4 cpe:/o:linux:linux_kernel:2.6.23.5 cpe:/o:linux:linux_kernel:2.6.23.6 cpe:/o:linux:linux_kernel:2.6.23.7 cpe:/o:linux:linux_kernel:2.6.23.8 cpe:/o:linux:linux_kernel:2.6.23.9 cpe:/o:linux:linux_kernel:2.6.23.10 cpe:/o:linux:linux_kernel:2.6.23.11 cpe:/o:linux:linux_kernel:2.6.23.12 cpe:/o:linux:linux_kernel:2.6.23.13 cpe:/o:linux:linux_kernel:2.6.23.14 cpe:/o:linux:linux_kernel:2.6.23.15 cpe:/o:linux:linux_kernel:2.6.23.16 cpe:/o:linux:linux_kernel:2.6.23.17 cpe:/o:linux:linux_kernel:2.6.24 cpe:/o:linux:linux_kernel:2.6.24:rc1 cpe:/o:linux:linux_kernel:2.6.24:rc2 cpe:/o:linux:linux_kernel:2.6.24:rc3 cpe:/o:linux:linux_kernel:2.6.24:rc4 cpe:/o:linux:linux_kernel:2.6.24:rc5 cpe:/o:linux:linux_kernel:2.6.24:rc6 cpe:/o:linux:linux_kernel:2.6.24:rc7 cpe:/o:linux:linux_kernel:2.6.24:rc8 cpe:/o:linux:linux_kernel:2.6.24.1 cpe:/o:linux:linux_kernel:2.6.24.2 cpe:/o:linux:linux_kernel:2.6.24.3 cpe:/o:linux:linux_kernel:2.6.24.4 cpe:/o:linux:linux_kernel:2.6.24.5 cpe:/o:linux:linux_kernel:2.6.24.6 cpe:/o:linux:linux_kernel:2.6.24.7 cpe:/o:linux:linux_kernel:2.6.25 cpe:/o:linux:linux_kernel:2.6.25:rc1 cpe:/o:linux:linux_kernel:2.6.25:rc2 cpe:/o:linux:linux_kernel:2.6.25:rc3 cpe:/o:linux:linux_kernel:2.6.25:rc4 cpe:/o:linux:linux_kernel:2.6.25:rc5 cpe:/o:linux:linux_kernel:2.6.25:rc6 cpe:/o:linux:linux_kernel:2.6.25:rc7 cpe:/o:linux:linux_kernel:2.6.25:rc8 cpe:/o:linux:linux_kernel:2.6.25:rc9 cpe:/o:linux:linux_kernel:2.6.25.1 cpe:/o:linux:linux_kernel:2.6.25.2 cpe:/o:linux:linux_kernel:2.6.25.3 cpe:/o:linux:linux_kernel:2.6.25.4 cpe:/o:linux:linux_kernel:2.6.25.5 cpe:/o:linux:linux_kernel:2.6.25.6 cpe:/o:linux:linux_kernel:2.6.25.7 cpe:/o:linux:linux_kernel:2.6.25.8 cpe:/o:linux:linux_kernel:2.6.25.9 cpe:/o:linux:linux_kernel:2.6.25.10 cpe:/o:linux:linux_kernel:2.6.25.11 cpe:/o:linux:linux_kernel:2.6.25.12 cpe:/o:linux:linux_kernel:2.6.25.13 cpe:/o:linux:linux_kernel:2.6.25.14 cpe:/o:linux:linux_kernel:2.6.25.15 cpe:/o:linux:linux_kernel:2.6.25.16 cpe:/o:linux:linux_kernel:2.6.25.17 cpe:/o:linux:linux_kernel:2.6.25.18 cpe:/o:linux:linux_kernel:2.6.25.19 cpe:/o:linux:linux_kernel:2.6.25.20 cpe:/o:linux:linux_kernel:2.6.26 cpe:/o:linux:linux_kernel:2.6.26:rc1 cpe:/o:linux:linux_kernel:2.6.26:rc2 cpe:/o:linux:linux_kernel:2.6.26:rc3 cpe:/o:linux:linux_kernel:2.6.26:rc4 cpe:/o:linux:linux_kernel:2.6.26:rc5 cpe:/o:linux:linux_kernel:2.6.26:rc6 cpe:/o:linux:linux_kernel:2.6.26:rc7 cpe:/o:linux:linux_kernel:2.6.26:rc8 cpe:/o:linux:linux_kernel:2.6.26:rc9 cpe:/o:linux:linux_kernel:2.6.26.1 cpe:/o:linux:linux_kernel:2.6.26.2 cpe:/o:linux:linux_kernel:2.6.26.3 cpe:/o:linux:linux_kernel:2.6.26.4 cpe:/o:linux:linux_kernel:2.6.26.5 cpe:/o:linux:linux_kernel:2.6.26.6 cpe:/o:linux:linux_kernel:2.6.26.7 cpe:/o:linux:linux_kernel:2.6.26.8 cpe:/o:linux:linux_kernel:2.6.27 cpe:/o:linux:linux_kernel:2.6.27:rc1 cpe:/o:linux:linux_kernel:2.6.27:rc2 cpe:/o:linux:linux_kernel:2.6.27:rc3 cpe:/o:linux:linux_kernel:2.6.27:rc4 cpe:/o:linux:linux_kernel:2.6.27:rc5 cpe:/o:linux:linux_kernel:2.6.27:rc6 cpe:/o:linux:linux_kernel:2.6.27:rc7 cpe:/o:linux:linux_kernel:2.6.27:rc8 cpe:/o:linux:linux_kernel:2.6.27:rc9 cpe:/o:linux:linux_kernel:2.6.27.1 cpe:/o:linux:linux_kernel:2.6.27.2 cpe:/o:linux:linux_kernel:2.6.27.10 cpe:/o:linux:linux_kernel:2.6.27.11 cpe:/o:linux:linux_kernel:2.6.27.12 cpe:/o:linux:linux_kernel:2.6.27.13 cpe:/o:linux:linux_kernel:2.6.27.14 cpe:/o:linux:linux_kernel:2.6.27.15 cpe:/o:linux:linux_kernel:2.6.27.16 cpe:/o:linux:linux_kernel:2.6.27.17 cpe:/o:linux:linux_kernel:2.6.27.18 cpe:/o:linux:linux_kernel:2.6.27.19 cpe:/o:linux:linux_kernel:2.6.27.20 cpe:/o:linux:linux_kernel:2.6.27.21 cpe:/o:linux:linux_kernel:2.6.30 cpe:/o:linux:linux_kernel:2.6.30:rc1 cpe:/o:linux:linux_kernel:2.6.30:rc2 cpe:/o:linux:linux_kernel:2.6.30:rc3 cpe:/o:linux:linux_kernel:2.6.30:rc4 cpe:/o:linux:linux_kernel:2.6.30:rc5 cpe:/o:linux:linux_kernel:2.6.30:rc6 cpe:/o:linux:linux_kernel:2.6.30:rc7 cpe:/o:linux:linux_kernel:2.6.30:rc8 cpe:/o:linux:linux_kernel:2.6.30.1 cpe:/o:linux:linux_kernel:2.6.30.2 cpe:/o:linux:linux_kernel:2.6.30.3 cpe:/o:linux:linux_kernel:2.6.30.4 cpe:/o:linux:linux_kernel:2.6.30.5 cpe:/o:linux:linux_kernel:2.6.30.6 cpe:/o:linux:linux_kernel:2.6.30.7 cpe:/o:linux:linux_kernel:2.6.30.8 cpe:/o:linux:linux_kernel:2.6.30.9 cpe:/o:linux:linux_kernel:2.6.30.10 cpe:/o:linux:linux_kernel:2.6.31 cpe:/o:linux:linux_kernel:2.6.31:rc1 cpe:/o:linux:linux_kernel:2.6.31:rc2 cpe:/o:linux:linux_kernel:2.6.31:rc3 cpe:/o:linux:linux_kernel:2.6.31:rc4 cpe:/o:linux:linux_kernel:2.6.31:rc5 cpe:/o:linux:linux_kernel:2.6.31:rc6 cpe:/o:linux:linux_kernel:2.6.31:rc7 cpe:/o:linux:linux_kernel:2.6.31:rc8 cpe:/o:linux:linux_kernel:2.6.31:rc9 cpe:/o:linux:linux_kernel:2.6.31.1 cpe:/o:linux:linux_kernel:2.6.31.2 cpe:/o:linux:linux_kernel:2.6.31.3 cpe:/o:linux:linux_kernel:2.6.31.4 cpe:/o:linux:linux_kernel:2.6.31.5 cpe:/o:linux:linux_kernel:2.6.31.6 cpe:/o:linux:linux_kernel:2.6.31.7 cpe:/o:linux:linux_kernel:2.6.31.8 cpe:/o:linux:linux_kernel:2.6.31.9 cpe:/o:linux:linux_kernel:2.6.31.10 cpe:/o:linux:linux_kernel:2.6.31.11 cpe:/o:linux:linux_kernel:2.6.31.12 cpe:/o:linux:linux_kernel:2.6.31.13 cpe:/o:linux:linux_kernel:2.6.31.14 cpe:/o:linux:linux_kernel:2.6.32 cpe:/o:linux:linux_kernel:2.6.32:rc1 cpe:/o:linux:linux_kernel:2.6.32:rc3 cpe:/o:linux:linux_kernel:2.6.32:rc4 cpe:/o:linux:linux_kernel:2.6.32:rc5 cpe:/o:linux:linux_kernel:2.6.32:rc6 cpe:/o:linux:linux_kernel:2.6.32:rc7 cpe:/o:linux:linux_kernel:2.6.32:rc8 cpe:/o:linux:linux_kernel:2.6.32.1 cpe:/o:linux:linux_kernel:2.6.32.2 cpe:/o:linux:linux_kernel:2.6.32.3 cpe:/o:linux:linux_kernel:2.6.32.4 cpe:/o:linux:linux_kernel:2.6.32.5 cpe:/o:linux:linux_kernel:2.6.32.6 cpe:/o:linux:linux_kernel:2.6.32.7 cpe:/o:linux:linux_kernel:2.6.32.8 cpe:/o:linux:linux_kernel:2.6.32.9 cpe:/o:linux:linux_kernel:2.6.32.10 cpe:/o:linux:linux_kernel:2.6.32.11 cpe:/o:linux:linux_kernel:2.6.32.12 cpe:/o:linux:linux_kernel:2.6.32.13 cpe:/o:linux:linux_kernel:2.6.32.14 cpe:/o:linux:linux_kernel:2.6.32.15 cpe:/o:linux:linux_kernel:2.6.32.16 cpe:/o:linux:linux_kernel:2.6.32.17 cpe:/o:linux:linux_kernel:2.6.32.18 cpe:/o:linux:linux_kernel:2.6.32.19 cpe:/o:linux:linux_kernel:2.6.32.20 cpe:/o:linux:linux_kernel:2.6.32.21 cpe:/o:linux:linux_kernel:2.6.32.22 cpe:/o:linux:linux_kernel:2.6.32.23 cpe:/o:linux:linux_kernel:2.6.32.24 cpe:/o:linux:linux_kernel:2.6.32.25 cpe:/o:linux:linux_kernel:2.6.32.26 cpe:/o:linux:linux_kernel:2.6.32.27 cpe:/o:linux:linux_kernel:2.6.32.28 cpe:/o:linux:linux_kernel:2.6.32.29 cpe:/o:linux:linux_kernel:2.6.32.30 cpe:/o:linux:linux_kernel:2.6.32.31 cpe:/o:linux:linux_kernel:2.6.32.32 cpe:/o:linux:linux_kernel:2.6.32.33 cpe:/o:linux:linux_kernel:2.6.32.34 cpe:/o:linux:linux_kernel:2.6.32.35 cpe:/o:linux:linux_kernel:2.6.32.36 cpe:/o:linux:linux_kernel:2.6.32.37 cpe:/o:linux:linux_kernel:2.6.32.38 cpe:/o:linux:linux_kernel:2.6.32.39 cpe:/o:linux:linux_kernel:2.6.32.40 cpe:/o:linux:linux_kernel:2.6.32.41 cpe:/o:linux:linux_kernel:2.6.32.42 cpe:/o:linux:linux_kernel:2.6.32.43 cpe:/o:linux:linux_kernel:2.6.32.44 cpe:/o:linux:linux_kernel:2.6.32.45 cpe:/o:linux:linux_kernel:2.6.32.46 cpe:/o:linux:linux_kernel:2.6.32.47 cpe:/o:linux:linux_kernel:2.6.32.48 cpe:/o:linux:linux_kernel:2.6.32.49 cpe:/o:linux:linux_kernel:2.6.32.50 cpe:/o:linux:linux_kernel:2.6.32.51 cpe:/o:linux:linux_kernel:2.6.32.52 cpe:/o:linux:linux_kernel:2.6.32.53 cpe:/o:linux:linux_kernel:2.6.32.54 cpe:/o:linux:linux_kernel:2.6.32.55 cpe:/o:linux:linux_kernel:2.6.32.56 cpe:/o:linux:linux_kernel:2.6.32.57 cpe:/o:linux:linux_kernel:2.6.32.58 cpe:/o:linux:linux_kernel:2.6.33:rc1 cpe:/o:linux:linux_kernel:2.6.33:rc2 cpe:/o:linux:linux_kernel:2.6.33:rc3 cpe:/o:linux:linux_kernel:2.6.33:rc4 cpe:/o:linux:linux_kernel:2.6.33:rc5 cpe:/o:linux:linux_kernel:2.6.33:rc6 cpe:/o:linux:linux_kernel:2.6.33:rc7 cpe:/o:linux:linux_kernel:2.6.33:rc8

CVE-2014-0203

2014-06-23T07:21:17.170-04:00

2017-01-06T21:59:19.827-05:00

4.9

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=86acdca1b63e6890540fa19495cfc708beff3d8b CONFIRM http://linux.oracle.com/errata/ELSA-2014-0771.html CONFIRM http://linux.oracle.com/errata/ELSA-2014-3043.html CONFIRM http://mirror.linux.org.au/linux/kernel/v2.6/ChangeLog-2.6.33 BID 68125 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1094363 CONFIRM https://github.com/torvalds/linux/commit/86acdca1b63e6890540fa19495cfc708beff3d8b The __do_follow_link function in fs/namei.c in the Linux kernel before 2.6.33 does not properly handle the last pathname component during use of certain filesystems, which allows local users to cause a denial of service (incorrect free operations and system crash) via an open system call.

cpe:/a:openstack:keystone:2012.1 cpe:/a:openstack:keystone:2012.1.1 cpe:/a:openstack:keystone:2012.1.2 cpe:/a:openstack:keystone:2012.1.3 cpe:/a:openstack:keystone:2012.2 cpe:/a:openstack:keystone:2012.2.1 cpe:/a:openstack:keystone:2012.2.2 cpe:/a:openstack:keystone:2012.2.3 cpe:/a:openstack:keystone:2012.2.4 cpe:/a:openstack:keystone:2013 cpe:/a:openstack:keystone:2013.1 cpe:/a:openstack:keystone:2013.1.1 cpe:/a:openstack:keystone:2013.1.2 cpe:/a:openstack:keystone:2013.1.3 cpe:/a:openstack:keystone:2013.1.4 cpe:/a:openstack:keystone:2013.2 cpe:/a:openstack:keystone:2013.2.1 cpe:/a:openstack:keystone:2013.2.2 cpe:/a:openstack:keystone:2013.2.3 cpe:/a:openstack:keystone:2013.2.4 cpe:/a:openstack:keystone:2014.1

CVE-2014-0204

2014-11-03T18:55:05.297-05:00

2014-11-04T16:30:54.353-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2014-11-04T09:50:42.000-05:00

MLIST [oss-security] 20140521 [OSSA 2014-015] Keystone user and group id mismatch (CVE-2014-0204) CONFIRM https://bugs.launchpad.net/keystone/+bug/1309228 CONFIRM https://review.openstack.org/#/c/94396/ OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with the same ID.

cpe:/o:linux:linux_kernel:2.6.36 cpe:/o:linux:linux_kernel:2.6.36:rc1 cpe:/o:linux:linux_kernel:2.6.36:rc2 cpe:/o:linux:linux_kernel:2.6.36:rc3 cpe:/o:linux:linux_kernel:2.6.36:rc4 cpe:/o:linux:linux_kernel:2.6.36:rc5 cpe:/o:linux:linux_kernel:2.6.36:rc6 cpe:/o:linux:linux_kernel:2.6.36:rc7 cpe:/o:linux:linux_kernel:2.6.36:rc8 cpe:/o:linux:linux_kernel:2.6.36.1 cpe:/o:linux:linux_kernel:2.6.36.2 cpe:/o:linux:linux_kernel:2.6.36.3 cpe:/o:linux:linux_kernel:2.6.36.4

CVE-2014-0205

2014-09-28T15:55:05.550-04:00

2014-11-18T21:59:26.210-05:00

6.9

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7ada876a8703f23befbb20a7465a702ee39b1704 CONFIRM http://mirror.linux.org.au/linux/kernel/v2.6/ChangeLog-2.6.37 REDHAT RHSA-2014:1365 REDHAT RHSA-2014:1763 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1094455 CONFIRM https://github.com/torvalds/linux/commit/7ada876a8703f23befbb20a7465a702ee39b1704 The futex_wait function in kernel/futex.c in the Linux kernel before 2.6.37 does not properly maintain a certain reference count during requeue operations, which allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that triggers a zero count.

cpe:/o:linux:linux_kernel:3.15.1

CVE-2014-0206

2014-06-25T07:19:21.387-04:00

2018-12-13T13:24:53.983-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-12-11T08:22:49.703-05:00

CONFIRM http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=edfbbf388f293d70bf4b7c0bc38774d05e6f711a SECUNIA 59278 BID 68176 SECTRACK 1030479 SECTRACK 1038201 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1094602 CONFIRM https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=edfbbf388f29 CONFIRM https://github.com/torvalds/linux/commit/edfbbf388f293d70bf4b7c0bc38774d05e6f711a CONFIRM https://source.android.com/security/bulletin/2017-04-01 CONFIRM https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.46 CONFIRM https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.24 CONFIRM https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.10 CONFIRM https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.15.3 Array index error in the aio_read_events_ring function in fs/aio.c in the Linux kernel through 3.15.1 allows local users to obtain sensitive information from kernel memory via a large head value.

cpe:/a:christos_zoulas:file:5.00 cpe:/a:christos_zoulas:file:5.01 cpe:/a:christos_zoulas:file:5.02 cpe:/a:christos_zoulas:file:5.03 cpe:/a:christos_zoulas:file:5.04 cpe:/a:christos_zoulas:file:5.05 cpe:/a:christos_zoulas:file:5.06 cpe:/a:christos_zoulas:file:5.07 cpe:/a:christos_zoulas:file:5.08 cpe:/a:christos_zoulas:file:5.09 cpe:/a:christos_zoulas:file:5.10 cpe:/a:christos_zoulas:file:5.11 cpe:/a:christos_zoulas:file:5.12 cpe:/a:christos_zoulas:file:5.13 cpe:/a:christos_zoulas:file:5.14 cpe:/a:christos_zoulas:file:5.15 cpe:/a:christos_zoulas:file:5.16 cpe:/a:christos_zoulas:file:5.17 cpe:/a:christos_zoulas:file:5.18 cpe:/a:php:php:5.4.0 cpe:/a:php:php:5.4.1 cpe:/a:php:php:5.4.2 cpe:/a:php:php:5.4.3 cpe:/a:php:php:5.4.4 cpe:/a:php:php:5.4.5 cpe:/a:php:php:5.4.6 cpe:/a:php:php:5.4.7 cpe:/a:php:php:5.4.8 cpe:/a:php:php:5.4.9 cpe:/a:php:php:5.4.10 cpe:/a:php:php:5.4.11 cpe:/a:php:php:5.4.12 cpe:/a:php:php:5.4.12:rc1 cpe:/a:php:php:5.4.12:rc2 cpe:/a:php:php:5.4.13 cpe:/a:php:php:5.4.13:rc1 cpe:/a:php:php:5.4.14 cpe:/a:php:php:5.4.14:rc1 cpe:/a:php:php:5.4.15:rc1 cpe:/a:php:php:5.4.16:rc1 cpe:/a:php:php:5.4.17 cpe:/a:php:php:5.4.18 cpe:/a:php:php:5.4.19 cpe:/a:php:php:5.4.20 cpe:/a:php:php:5.4.21 cpe:/a:php:php:5.4.22 cpe:/a:php:php:5.4.23 cpe:/a:php:php:5.4.24 cpe:/a:php:php:5.4.25 cpe:/a:php:php:5.4.26 cpe:/a:php:php:5.4.27 cpe:/a:php:php:5.4.28 cpe:/a:php:php:5.4.29 cpe:/a:php:php:5.5.0 cpe:/a:php:php:5.5.0:alpha1 cpe:/a:php:php:5.5.0:alpha2 cpe:/a:php:php:5.5.0:alpha3 cpe:/a:php:php:5.5.0:alpha4 cpe:/a:php:php:5.5.0:alpha5 cpe:/a:php:php:5.5.0:alpha6 cpe:/a:php:php:5.5.0:beta1 cpe:/a:php:php:5.5.0:beta2 cpe:/a:php:php:5.5.0:beta3 cpe:/a:php:php:5.5.0:beta4 cpe:/a:php:php:5.5.0:rc1 cpe:/a:php:php:5.5.0:rc2 cpe:/a:php:php:5.5.1 cpe:/a:php:php:5.5.2 cpe:/a:php:php:5.5.3 cpe:/a:php:php:5.5.4 cpe:/a:php:php:5.5.5 cpe:/a:php:php:5.5.6 cpe:/a:php:php:5.5.7 cpe:/a:php:php:5.5.8 cpe:/a:php:php:5.5.9 cpe:/a:php:php:5.5.10 cpe:/a:php:php:5.5.11 cpe:/a:php:php:5.5.12 cpe:/a:php:php:5.5.13

CVE-2014-0207

2014-07-09T07:07:01.243-04:00

2016-11-28T14:10:28.657-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov APPLE APPLE-SA-2015-04-08-2 SUSE openSUSE-SU-2014:1236 HP SSRT101681 MLIST [file] 20140612 file-5.19 is now available REDHAT RHSA-2014:1765 REDHAT RHSA-2014:1766 CONFIRM http://support.apple.com/kb/HT6443 DEBIAN DSA-2974 DEBIAN DSA-3021 CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html CONFIRM http://www.php.net/ChangeLog-5.php BID 68243 CONFIRM https://bugs.php.net/bug.php?id=67326 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1091842 CONFIRM https://github.com/file/file/commit/6d209c1c489457397a5763bca4b28e43aac90391 CONFIRM https://support.apple.com/HT204659 The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.

cpe:/a:theforeman:foreman:1.4.3

CVE-2014-0208

2017-10-16T14:29:00.203-04:00

2017-11-01T07:47:13.240-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-10-27T22:58:52.040-04:00

CONFIRM http://projects.theforeman.org/issues/5471 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1094642 CONFIRM https://theforeman.org/security.html#2014-0208 Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted key name.

cpe:/a:x:libxfont:1.2.3 cpe:/a:x:libxfont:1.2.4 cpe:/a:x:libxfont:1.2.5 cpe:/a:x:libxfont:1.2.6 cpe:/a:x:libxfont:1.2.7 cpe:/a:x:libxfont:1.2.8 cpe:/a:x:libxfont:1.2.9 cpe:/a:x:libxfont:1.3.0 cpe:/a:x:libxfont:1.3.1 cpe:/a:x:libxfont:1.3.2 cpe:/a:x:libxfont:1.3.3 cpe:/a:x:libxfont:1.3.4 cpe:/a:x:libxfont:1.4.0 cpe:/a:x:libxfont:1.4.1 cpe:/a:x:libxfont:1.4.2 cpe:/a:x:libxfont:1.4.3 cpe:/a:x:libxfont:1.4.4 cpe:/a:x:libxfont:1.4.5 cpe:/a:x:libxfont:1.4.6 cpe:/a:x:libxfont:1.4.7 cpe:/a:x:libxfont:1.4.99 cpe:/o:canonical:ubuntu_linux:10.04:-:lts cpe:/o:canonical:ubuntu_linux:12.04:-:lts cpe:/o:canonical:ubuntu_linux:12.10 cpe:/o:canonical:ubuntu_linux:13.10 cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~

CVE-2014-0209

2014-05-15T10:55:07.247-04:00

2018-10-09T15:38:03.790-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://advisories.mageia.org/MGASA-2014-0278.html SUSE openSUSE-SU-2014:0711 MLIST [xorg-announce] 20140513 [ANNOUNCE] X.Org Security Advisory: Multiple issues in libXfont REDHAT RHSA-2014:1893 FULLDISC 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities SECUNIA 59154 DEBIAN DSA-2927 MANDRIVA MDVSA-2015:145 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html BUGTRAQ 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities BID 67382 UBUNTU USN-2211-1 CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0012.html Multiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 might allow local users to gain privileges by adding a directory with a large fonts.dir or fonts.alias file to the font path, which triggers a heap-based buffer overflow, related to metadata.

CVE-2014-0210

2014-05-15T10:55:07.323-04:00

2018-10-09T15:38:05.040-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://advisories.mageia.org/MGASA-2014-0278.html SUSE openSUSE-SU-2014:0711 MLIST [xorg-announce] 20140513 [ANNOUNCE] X.Org Security Advisory: Multiple issues in libXfont REDHAT RHSA-2014:1893 FULLDISC 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities SECUNIA 59154 DEBIAN DSA-2927 MANDRIVA MDVSA-2015:145 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html BUGTRAQ 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities BID 67382 UBUNTU USN-2211-1 CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0012.html Multiple buffer overflows in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs protocol reply to the (1) _fs_recv_conn_setup, (2) fs_read_open_font, (3) fs_read_query_info, (4) fs_read_extent_info, (5) fs_read_glyphs, (6) fs_read_list, or (7) fs_read_list_info function.

CVE-2014-0211

2014-05-15T10:55:07.403-04:00

2018-10-09T15:38:06.243-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://advisories.mageia.org/MGASA-2014-0278.html SUSE openSUSE-SU-2014:0711 MLIST [xorg-announce] 20140513 [ANNOUNCE] X.Org Security Advisory: Multiple issues in libXfont REDHAT RHSA-2014:1893 FULLDISC 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities SECUNIA 59154 DEBIAN DSA-2927 MANDRIVA MDVSA-2015:145 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html BUGTRAQ 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities BID 67382 UBUNTU USN-2211-1 CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0012.html Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow.

cpe:/a:moodle:moodle:2.0 cpe:/a:moodle:moodle:2.0.1 cpe:/a:moodle:moodle:2.0.2 cpe:/a:moodle:moodle:2.0.3 cpe:/a:moodle:moodle:2.0.4 cpe:/a:moodle:moodle:2.0.5 cpe:/a:moodle:moodle:2.0.6 cpe:/a:moodle:moodle:2.0.7 cpe:/a:moodle:moodle:2.0.8 cpe:/a:moodle:moodle:2.0.9 cpe:/a:moodle:moodle:2.1 cpe:/a:moodle:moodle:2.1.1 cpe:/a:moodle:moodle:2.1.2 cpe:/a:moodle:moodle:2.1.3 cpe:/a:moodle:moodle:2.1.4 cpe:/a:moodle:moodle:2.1.5 cpe:/a:moodle:moodle:2.1.6 cpe:/a:moodle:moodle:2.1.7 cpe:/a:moodle:moodle:2.1.8 cpe:/a:moodle:moodle:2.1.9 cpe:/a:moodle:moodle:2.1.10 cpe:/a:moodle:moodle:2.2 cpe:/a:moodle:moodle:2.2.1 cpe:/a:moodle:moodle:2.2.2 cpe:/a:moodle:moodle:2.2.3 cpe:/a:moodle:moodle:2.2.4 cpe:/a:moodle:moodle:2.2.5 cpe:/a:moodle:moodle:2.2.6 cpe:/a:moodle:moodle:2.2.7 cpe:/a:moodle:moodle:2.2.8 cpe:/a:moodle:moodle:2.2.9 cpe:/a:moodle:moodle:2.2.10 cpe:/a:moodle:moodle:2.2.11 cpe:/a:moodle:moodle:2.3 cpe:/a:moodle:moodle:2.3.1 cpe:/a:moodle:moodle:2.3.2 cpe:/a:moodle:moodle:2.3.3 cpe:/a:moodle:moodle:2.3.4 cpe:/a:moodle:moodle:2.3.5 cpe:/a:moodle:moodle:2.3.6 cpe:/a:moodle:moodle:2.3.7 cpe:/a:moodle:moodle:2.3.8 cpe:/a:moodle:moodle:2.3.9 cpe:/a:moodle:moodle:2.3.10 cpe:/a:moodle:moodle:2.3.11 cpe:/a:moodle:moodle:2.4 cpe:/a:moodle:moodle:2.4.1 cpe:/a:moodle:moodle:2.4.2 cpe:/a:moodle:moodle:2.4.3 cpe:/a:moodle:moodle:2.4.4 cpe:/a:moodle:moodle:2.4.5 cpe:/a:moodle:moodle:2.4.6 cpe:/a:moodle:moodle:2.4.7 cpe:/a:moodle:moodle:2.4.8 cpe:/a:moodle:moodle:2.4.9 cpe:/a:moodle:moodle:2.5 cpe:/a:moodle:moodle:2.5.1 cpe:/a:moodle:moodle:2.5.2 cpe:/a:moodle:moodle:2.5.3 cpe:/a:moodle:moodle:2.5.4 cpe:/a:moodle:moodle:2.5.5 cpe:/a:moodle:moodle:2.6 cpe:/a:moodle:moodle:2.6.1 cpe:/a:moodle:moodle:2.6.2

CVE-2014-0213

2014-05-26T20:55:02.357-04:00

2014-05-29T19:34:08.950-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2014-05-27T14:01:50.577-04:00

ALLOWS_OTHER_ACCESS

CONFIRM http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-44606 MLIST [oss-security] 20140519 Moodle security notifications public CONFIRM https://moodle.org/mod/forum/discuss.php?d=260361 Multiple cross-site request forgery (CSRF) vulnerabilities in mod/assign/locallib.php in the Assignment subsystem in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allow remote attackers to hijack the authentication of teachers for quick-grading requests.

cpe:/a:moodle:moodle:2.0 cpe:/a:moodle:moodle:2.0.1 cpe:/a:moodle:moodle:2.0.2 cpe:/a:moodle:moodle:2.0.3 cpe:/a:moodle:moodle:2.0.4 cpe:/a:moodle:moodle:2.0.5 cpe:/a:moodle:moodle:2.0.6 cpe:/a:moodle:moodle:2.0.7 cpe:/a:moodle:moodle:2.0.8 cpe:/a:moodle:moodle:2.0.9 cpe:/a:moodle:moodle:2.1 cpe:/a:moodle:moodle:2.1.1 cpe:/a:moodle:moodle:2.1.2 cpe:/a:moodle:moodle:2.1.3 cpe:/a:moodle:moodle:2.1.4 cpe:/a:moodle:moodle:2.1.5 cpe:/a:moodle:moodle:2.1.6 cpe:/a:moodle:moodle:2.1.7 cpe:/a:moodle:moodle:2.1.8 cpe:/a:moodle:moodle:2.1.9 cpe:/a:moodle:moodle:2.1.10 cpe:/a:moodle:moodle:2.2 cpe:/a:moodle:moodle:2.2.1 cpe:/a:moodle:moodle:2.2.2 cpe:/a:moodle:moodle:2.2.3 cpe:/a:moodle:moodle:2.2.4 cpe:/a:moodle:moodle:2.2.5 cpe:/a:moodle:moodle:2.2.6 cpe:/a:moodle:moodle:2.2.7 cpe:/a:moodle:moodle:2.2.8 cpe:/a:moodle:moodle:2.2.9 cpe:/a:moodle:moodle:2.2.10 cpe:/a:moodle:moodle:2.2.11 cpe:/a:moodle:moodle:2.3 cpe:/a:moodle:moodle:2.3.1 cpe:/a:moodle:moodle:2.3.2 cpe:/a:moodle:moodle:2.3.3 cpe:/a:moodle:moodle:2.3.4 cpe:/a:moodle:moodle:2.3.5 cpe:/a:moodle:moodle:2.3.6 cpe:/a:moodle:moodle:2.3.7 cpe:/a:moodle:moodle:2.3.8 cpe:/a:moodle:moodle:2.3.9 cpe:/a:moodle:moodle:2.3.10 cpe:/a:moodle:moodle:2.3.11 cpe:/a:moodle:moodle:2.4 cpe:/a:moodle:moodle:2.4.1 cpe:/a:moodle:moodle:2.4.2 cpe:/a:moodle:moodle:2.4.3 cpe:/a:moodle:moodle:2.4.4 cpe:/a:moodle:moodle:2.4.5 cpe:/a:moodle:moodle:2.4.6 cpe:/a:moodle:moodle:2.4.7 cpe:/a:moodle:moodle:2.4.8 cpe:/a:moodle:moodle:2.4.9 cpe:/a:moodle:moodle:2.5 cpe:/a:moodle:moodle:2.5.1 cpe:/a:moodle:moodle:2.5.2 cpe:/a:moodle:moodle:2.5.3 cpe:/a:moodle:moodle:2.5.4 cpe:/a:moodle:moodle:2.5.5 cpe:/a:moodle:moodle:2.6 cpe:/a:moodle:moodle:2.6.1 cpe:/a:moodle:moodle:2.6.2

CVE-2014-0214

2014-05-26T20:55:02.417-04:00

2014-05-29T19:32:40.637-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2014-05-27T14:06:46.927-04:00

CONFIRM http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43119 MLIST [oss-security] 20140519 Moodle security notifications public CONFIRM https://moodle.org/mod/forum/discuss.php?d=260362 login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service token with an infinite lifetime, which makes it easier for remote attackers to hijack sessions via a brute-force attack.

cpe:/a:moodle:moodle:2.0 cpe:/a:moodle:moodle:2.0.1 cpe:/a:moodle:moodle:2.0.2 cpe:/a:moodle:moodle:2.0.3 cpe:/a:moodle:moodle:2.0.4 cpe:/a:moodle:moodle:2.0.5 cpe:/a:moodle:moodle:2.0.6 cpe:/a:moodle:moodle:2.0.7 cpe:/a:moodle:moodle:2.0.8 cpe:/a:moodle:moodle:2.0.9 cpe:/a:moodle:moodle:2.1 cpe:/a:moodle:moodle:2.1.1 cpe:/a:moodle:moodle:2.1.2 cpe:/a:moodle:moodle:2.1.3 cpe:/a:moodle:moodle:2.1.4 cpe:/a:moodle:moodle:2.1.5 cpe:/a:moodle:moodle:2.1.6 cpe:/a:moodle:moodle:2.1.7 cpe:/a:moodle:moodle:2.1.8 cpe:/a:moodle:moodle:2.1.9 cpe:/a:moodle:moodle:2.1.10 cpe:/a:moodle:moodle:2.2 cpe:/a:moodle:moodle:2.2.1 cpe:/a:moodle:moodle:2.2.2 cpe:/a:moodle:moodle:2.2.3 cpe:/a:moodle:moodle:2.2.4 cpe:/a:moodle:moodle:2.2.5 cpe:/a:moodle:moodle:2.2.6 cpe:/a:moodle:moodle:2.2.7 cpe:/a:moodle:moodle:2.2.8 cpe:/a:moodle:moodle:2.2.9 cpe:/a:moodle:moodle:2.2.10 cpe:/a:moodle:moodle:2.2.11 cpe:/a:moodle:moodle:2.3 cpe:/a:moodle:moodle:2.3.1 cpe:/a:moodle:moodle:2.3.2 cpe:/a:moodle:moodle:2.3.3 cpe:/a:moodle:moodle:2.3.4 cpe:/a:moodle:moodle:2.3.5 cpe:/a:moodle:moodle:2.3.6 cpe:/a:moodle:moodle:2.3.7 cpe:/a:moodle:moodle:2.3.8 cpe:/a:moodle:moodle:2.3.9 cpe:/a:moodle:moodle:2.3.10 cpe:/a:moodle:moodle:2.3.11 cpe:/a:moodle:moodle:2.4 cpe:/a:moodle:moodle:2.4.1 cpe:/a:moodle:moodle:2.4.2 cpe:/a:moodle:moodle:2.4.3 cpe:/a:moodle:moodle:2.4.4 cpe:/a:moodle:moodle:2.4.5 cpe:/a:moodle:moodle:2.4.6 cpe:/a:moodle:moodle:2.4.7 cpe:/a:moodle:moodle:2.4.8 cpe:/a:moodle:moodle:2.4.9 cpe:/a:moodle:moodle:2.5 cpe:/a:moodle:moodle:2.5.1 cpe:/a:moodle:moodle:2.5.2 cpe:/a:moodle:moodle:2.5.3 cpe:/a:moodle:moodle:2.5.4 cpe:/a:moodle:moodle:2.5.5 cpe:/a:moodle:moodle:2.6 cpe:/a:moodle:moodle:2.6.1 cpe:/a:moodle:moodle:2.6.2

CVE-2014-0215

2014-05-26T20:55:02.480-04:00

2014-05-29T19:30:34.443-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2014-05-27T14:08:11.037-04:00

CONFIRM http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-44750 MLIST [oss-security] 20140519 Moodle security notifications public CONFIRM https://moodle.org/mod/forum/discuss.php?d=260363 The blind-marking implementation in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows remote authenticated users to de-anonymize student identities by (1) using a screen reader or (2) reading the HTML source.

cpe:/a:moodle:moodle:2.0 cpe:/a:moodle:moodle:2.0.1 cpe:/a:moodle:moodle:2.0.2 cpe:/a:moodle:moodle:2.0.3 cpe:/a:moodle:moodle:2.0.4 cpe:/a:moodle:moodle:2.0.5 cpe:/a:moodle:moodle:2.0.6 cpe:/a:moodle:moodle:2.0.7 cpe:/a:moodle:moodle:2.0.8 cpe:/a:moodle:moodle:2.0.9 cpe:/a:moodle:moodle:2.1 cpe:/a:moodle:moodle:2.1.1 cpe:/a:moodle:moodle:2.1.2 cpe:/a:moodle:moodle:2.1.3 cpe:/a:moodle:moodle:2.1.4 cpe:/a:moodle:moodle:2.1.5 cpe:/a:moodle:moodle:2.1.6 cpe:/a:moodle:moodle:2.1.7 cpe:/a:moodle:moodle:2.1.8 cpe:/a:moodle:moodle:2.1.9 cpe:/a:moodle:moodle:2.1.10 cpe:/a:moodle:moodle:2.2 cpe:/a:moodle:moodle:2.2.1 cpe:/a:moodle:moodle:2.2.2 cpe:/a:moodle:moodle:2.2.3 cpe:/a:moodle:moodle:2.2.4 cpe:/a:moodle:moodle:2.2.5 cpe:/a:moodle:moodle:2.2.6 cpe:/a:moodle:moodle:2.2.7 cpe:/a:moodle:moodle:2.2.8 cpe:/a:moodle:moodle:2.2.9 cpe:/a:moodle:moodle:2.2.10 cpe:/a:moodle:moodle:2.2.11 cpe:/a:moodle:moodle:2.3 cpe:/a:moodle:moodle:2.3.1 cpe:/a:moodle:moodle:2.3.2 cpe:/a:moodle:moodle:2.3.3 cpe:/a:moodle:moodle:2.3.4 cpe:/a:moodle:moodle:2.3.5 cpe:/a:moodle:moodle:2.3.6 cpe:/a:moodle:moodle:2.3.7 cpe:/a:moodle:moodle:2.3.8 cpe:/a:moodle:moodle:2.3.9 cpe:/a:moodle:moodle:2.3.10 cpe:/a:moodle:moodle:2.3.11 cpe:/a:moodle:moodle:2.4 cpe:/a:moodle:moodle:2.4.1 cpe:/a:moodle:moodle:2.4.2 cpe:/a:moodle:moodle:2.4.3 cpe:/a:moodle:moodle:2.4.4 cpe:/a:moodle:moodle:2.4.5 cpe:/a:moodle:moodle:2.4.6 cpe:/a:moodle:moodle:2.4.7 cpe:/a:moodle:moodle:2.4.8 cpe:/a:moodle:moodle:2.4.9 cpe:/a:moodle:moodle:2.5 cpe:/a:moodle:moodle:2.5.1 cpe:/a:moodle:moodle:2.5.2 cpe:/a:moodle:moodle:2.5.3 cpe:/a:moodle:moodle:2.5.4 cpe:/a:moodle:moodle:2.5.5 cpe:/a:moodle:moodle:2.6 cpe:/a:moodle:moodle:2.6.1 cpe:/a:moodle:moodle:2.6.2

CVE-2014-0216

2014-05-26T20:55:02.557-04:00

2014-05-29T19:26:18.940-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-05-27T10:09:14.000-04:00

CONFIRM http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43877 MLIST [oss-security] 20140519 Moodle security notifications public CONFIRM https://moodle.org/mod/forum/discuss.php?d=260364 The My Home implementation in the block_html_pluginfile function in blocks/html/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 does not properly restrict file access, which allows remote attackers to obtain sensitive information by visiting an HTML block.

cpe:/a:moodle:moodle:2.6 cpe:/a:moodle:moodle:2.6.1 cpe:/a:moodle:moodle:2.6.2

CVE-2014-0217

2014-05-26T20:55:02.620-04:00

2014-05-29T19:24:59.110-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-05-27T14:11:43.043-04:00

CONFIRM http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45126 MLIST [oss-security] 20140519 Moodle security notifications public CONFIRM https://moodle.org/mod/forum/discuss.php?d=260365 enrol/index.php in Moodle 2.6.x before 2.6.3 does not check for the moodle/course:viewhiddencourses capability before listing hidden courses, which allows remote attackers to obtain sensitive name and summary information about these courses by leveraging the guest role and visiting a crafted URL.

cpe:/a:moodle:moodle:2.0 cpe:/a:moodle:moodle:2.0.1 cpe:/a:moodle:moodle:2.0.2 cpe:/a:moodle:moodle:2.0.3 cpe:/a:moodle:moodle:2.0.4 cpe:/a:moodle:moodle:2.0.5 cpe:/a:moodle:moodle:2.0.6 cpe:/a:moodle:moodle:2.0.7 cpe:/a:moodle:moodle:2.0.8 cpe:/a:moodle:moodle:2.0.9 cpe:/a:moodle:moodle:2.1 cpe:/a:moodle:moodle:2.1.1 cpe:/a:moodle:moodle:2.1.2 cpe:/a:moodle:moodle:2.1.3 cpe:/a:moodle:moodle:2.1.4 cpe:/a:moodle:moodle:2.1.5 cpe:/a:moodle:moodle:2.1.6 cpe:/a:moodle:moodle:2.1.7 cpe:/a:moodle:moodle:2.1.8 cpe:/a:moodle:moodle:2.1.9 cpe:/a:moodle:moodle:2.1.10 cpe:/a:moodle:moodle:2.2 cpe:/a:moodle:moodle:2.2.1 cpe:/a:moodle:moodle:2.2.2 cpe:/a:moodle:moodle:2.2.3 cpe:/a:moodle:moodle:2.2.4 cpe:/a:moodle:moodle:2.2.5 cpe:/a:moodle:moodle:2.2.6 cpe:/a:moodle:moodle:2.2.7 cpe:/a:moodle:moodle:2.2.8 cpe:/a:moodle:moodle:2.2.9 cpe:/a:moodle:moodle:2.2.10 cpe:/a:moodle:moodle:2.2.11 cpe:/a:moodle:moodle:2.3 cpe:/a:moodle:moodle:2.3.1 cpe:/a:moodle:moodle:2.3.2 cpe:/a:moodle:moodle:2.3.3 cpe:/a:moodle:moodle:2.3.4 cpe:/a:moodle:moodle:2.3.5 cpe:/a:moodle:moodle:2.3.6 cpe:/a:moodle:moodle:2.3.7 cpe:/a:moodle:moodle:2.3.8 cpe:/a:moodle:moodle:2.3.9 cpe:/a:moodle:moodle:2.3.10 cpe:/a:moodle:moodle:2.3.11 cpe:/a:moodle:moodle:2.4 cpe:/a:moodle:moodle:2.4.1 cpe:/a:moodle:moodle:2.4.2 cpe:/a:moodle:moodle:2.4.3 cpe:/a:moodle:moodle:2.4.4 cpe:/a:moodle:moodle:2.4.5 cpe:/a:moodle:moodle:2.4.6 cpe:/a:moodle:moodle:2.4.7 cpe:/a:moodle:moodle:2.4.8 cpe:/a:moodle:moodle:2.4.9 cpe:/a:moodle:moodle:2.5 cpe:/a:moodle:moodle:2.5.1 cpe:/a:moodle:moodle:2.5.2 cpe:/a:moodle:moodle:2.5.3 cpe:/a:moodle:moodle:2.5.4 cpe:/a:moodle:moodle:2.5.5 cpe:/a:moodle:moodle:2.6 cpe:/a:moodle:moodle:2.6.1 cpe:/a:moodle:moodle:2.6.2

CVE-2014-0218

2014-05-26T20:55:02.683-04:00

2015-07-24T14:31:21.047-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2015-07-24T14:25:40.340-04:00

CONFIRM http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45332 MLIST [oss-security] 20140519 Moodle security notifications public BID 67479 CONFIRM https://moodle.org/mod/forum/discuss.php?d=260366 Cross-site scripting (XSS) vulnerability in the URL downloader repository in repository/url/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:apache:karaf:2.0.0 cpe:/a:apache:karaf:2.1.0 cpe:/a:apache:karaf:2.1.1 cpe:/a:apache:karaf:2.1.2 cpe:/a:apache:karaf:2.1.3 cpe:/a:apache:karaf:2.1.4 cpe:/a:apache:karaf:2.1.5 cpe:/a:apache:karaf:2.1.6 cpe:/a:apache:karaf:2.2.0 cpe:/a:apache:karaf:2.2.1 cpe:/a:apache:karaf:2.2.2 cpe:/a:apache:karaf:2.2.3 cpe:/a:apache:karaf:2.2.4 cpe:/a:apache:karaf:2.2.5 cpe:/a:apache:karaf:2.2.6 cpe:/a:apache:karaf:2.2.7 cpe:/a:apache:karaf:2.2.8 cpe:/a:apache:karaf:2.2.9 cpe:/a:apache:karaf:2.2.10 cpe:/a:apache:karaf:2.2.11 cpe:/a:apache:karaf:2.3.0 cpe:/a:apache:karaf:2.3.1 cpe:/a:apache:karaf:2.3.2 cpe:/a:apache:karaf:2.3.3 cpe:/a:apache:karaf:2.3.4 cpe:/a:apache:karaf:2.3.5 cpe:/a:apache:karaf:2.3.6 cpe:/a:apache:karaf:2.3.7 cpe:/a:apache:karaf:2.3.8 cpe:/a:apache:karaf:2.3.9 cpe:/a:apache:karaf:2.3.10 cpe:/a:apache:karaf:2.3.11 cpe:/a:apache:karaf:2.3.12 cpe:/a:apache:karaf:2.4.0 cpe:/a:apache:karaf:2.4.1 cpe:/a:apache:karaf:2.4.2 cpe:/a:apache:karaf:2.4.3 cpe:/a:apache:karaf:2.4.4 cpe:/a:apache:karaf:3.0.0 cpe:/a:apache:karaf:3.0.0:rc1 cpe:/a:apache:karaf:3.0.1 cpe:/a:apache:karaf:3.0.2 cpe:/a:apache:karaf:3.0.3 cpe:/a:apache:karaf:3.0.4 cpe:/a:apache:karaf:3.0.5 cpe:/a:apache:karaf:3.0.6 cpe:/a:apache:karaf:3.0.7 cpe:/a:apache:karaf:3.0.8 cpe:/a:apache:karaf:3.0.9 cpe:/a:apache:karaf:4.0.0 cpe:/a:apache:karaf:4.0.0:milestone1 cpe:/a:apache:karaf:4.0.0:milestone2 cpe:/a:apache:karaf:4.0.0:milestone3 cpe:/a:apache:karaf:4.0.1 cpe:/a:apache:karaf:4.0.2 cpe:/a:apache:karaf:4.0.3 cpe:/a:apache:karaf:4.0.4 cpe:/a:apache:karaf:4.0.5 cpe:/a:apache:karaf:4.0.6 cpe:/a:apache:karaf:4.0.7 cpe:/a:apache:karaf:4.0.8 cpe:/a:apache:karaf:4.0.9

CVE-2014-0219

2017-11-15T13:29:00.233-05:00

2019-01-08T09:14:27.957-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-01-08T08:44:59.923-05:00

CONFIRM http://karaf.apache.org/security/cve-2014-0219.txt BID 101872 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1095974 Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service (shutdown) by sending a shutdown command to all listening high ports.

cpe:/a:cloudera:cloudera_manager:4.0.1 cpe:/a:cloudera:cloudera_manager:4.0.2 cpe:/a:cloudera:cloudera_manager:4.0.3 cpe:/a:cloudera:cloudera_manager:4.1 cpe:/a:cloudera:cloudera_manager:4.1.1 cpe:/a:cloudera:cloudera_manager:4.1.2 cpe:/a:cloudera:cloudera_manager:4.1.3 cpe:/a:cloudera:cloudera_manager:4.1.4 cpe:/a:cloudera:cloudera_manager:4.5.0 cpe:/a:cloudera:cloudera_manager:4.5.1 cpe:/a:cloudera:cloudera_manager:4.5.2 cpe:/a:cloudera:cloudera_manager:4.5.3 cpe:/a:cloudera:cloudera_manager:4.5.4 cpe:/a:cloudera:cloudera_manager:4.6.0 cpe:/a:cloudera:cloudera_manager:4.6.1 cpe:/a:cloudera:cloudera_manager:4.6.2 cpe:/a:cloudera:cloudera_manager:4.6.3 cpe:/a:cloudera:cloudera_manager:4.7.2 cpe:/a:cloudera:cloudera_manager:4.8.1 cpe:/a:cloudera:cloudera_manager:4.8.2 cpe:/a:cloudera:cloudera_manager:5.0.0

CVE-2014-0220

2014-06-10T10:55:09.273-04:00

2018-10-09T15:38:07.493-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/126956/Cloudera-Manager-4.8.2-5.0.0-Information-Disclosure.html CONFIRM http://www.cloudera.com/content/cloudera-content/cloudera-docs/SecurityBulletins/Security-Bulletin/csb_topic_2.html BUGTRAQ 20140605 Details for CVE-2014-0220 BID 67912 Cloudera Manager before 4.8.3 and 5.x before 5.0.1 allows remote authenticated users to obtain sensitive configuration information via the API.

CVE-2014-0221

2014-06-05T17:55:06.207-04:00

2019-04-22T13:48:00.643-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629 CONFIRM http://linux.oracle.com/errata/ELSA-2014-1053.html FEDORA FEDORA-2014-9301 FEDORA FEDORA-2014-9308 SUSE SUSE-SU-2015:0743 SUSE openSUSE-SU-2016:0640 HP HPSBUX03046 HP HPSBOV03047 HP HPSBMU03057 HP HPSBMU03056 HP HPSBMU03055 HP HPSBMU03051 HP HPSBGN03050 HP HPSBMU03065 HP HPSBMU03069 HP HPSBMU03074 HP HPSBMU03062 HP HPSBMU03076 REDHAT RHSA-2014:1021 FULLDISC 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities SECUNIA 58337 SECUNIA 58615 SECUNIA 58713 SECUNIA 58714 SECUNIA 58945 SECUNIA 58977 SECUNIA 59027 SECUNIA 59167 SECUNIA 59175 SECUNIA 59189 SECUNIA 59192 SECUNIA 59284 SECUNIA 59287 SECUNIA 59306 SECUNIA 59310 SECUNIA 59364 SECUNIA 59365 SECUNIA 59429 SECUNIA 59437 SECUNIA 59441 SECUNIA 59449 SECUNIA 59454 SECUNIA 59460 SECUNIA 59518 SECUNIA 61254 GENTOO GLSA-201407-05 CONFIRM http://support.apple.com/kb/HT6443 CONFIRM http://support.citrix.com/article/CTX140876 CISCO 20140605 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products CONFIRM http://www.blackberry.com/btsc/KB36051 CONFIRM http://www.fortiguard.com/advisory/FG-IR-14-018/ CONFIRM http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htm CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21676226 CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21676356 CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21676793 CONFIRM http://www.ibm.com/support/docview.wss?uid=swg24037783 MANDRIVA MDVSA-2014:105 MANDRIVA MDVSA-2014:106 MANDRIVA MDVSA-2015:062 CONFIRM http://www.novell.com/support/kb/doc.php?id=7015264 CONFIRM http://www.novell.com/support/kb/doc.php?id=7015300 CONFIRM http://www.openssl.org/news/secadv_20140605.txt CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html BUGTRAQ 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities BID 67901 SECTRACK 1030337 CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0006.html CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0012.html CONFIRM http://www-01.ibm.com/support/docview.wss?uid=isg400001841 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=isg400001843 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=nas8N1020163 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21673137 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21675821 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676035 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676062 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676071 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676419 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676879 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676889 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677527 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677695 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677828 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21678167 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21678289 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21683332 CONFIRM http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=6060&myns=phmc&mync=E CONFIRM http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=6061&myns=phmc&mync=E CONFIRM http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095754 CONFIRM http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095755 CONFIRM http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095756 CONFIRM http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095757 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1103593 CONFIRM https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=d3152655d5319ce883c8e3ac4b99f8de4c59d846 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946 CONFIRM https://kb.bluecoat.com/index?page=content&id=SA80 CONFIRM https://kc.mcafee.com/corporate/index?page=content&id=SB10075 CONFIRM https://www.novell.com/support/kb/doc.php?id=7015271 The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.

CVE-2014-0222

2014-11-04T16:55:25.187-05:00

2017-11-03T21:29:00.600-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov FEDORA FEDORA-2014-6970 FEDORA FEDORA-2014-6288 MLIST [Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released SUSE SUSE-SU-2015:0929 SUSE openSUSE-SU-2015:1965 DEBIAN DSA-3044 BID 67357 MLIST [Qemu-devel] 20140512 [PATCH 3/5] qcow1: Validate L2 table size (CVE-2014-0222) Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image.

CVE-2014-0223

2014-11-04T16:55:25.237-05:00

2017-11-03T21:29:00.677-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov FEDORA FEDORA-2014-6970 MLIST [Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released SUSE SUSE-SU-2015:0929 DEBIAN DSA-3044 BID 67391 MLIST [Qemu-devel] 20140512 [PATCH 4/5] qcow1: Validate image size (CVE-2014-0223) Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a large image size, which triggers a buffer overflow or out-of-bounds read.

cpe:/a:openssl:openssl:0.9.8y cpe:/a:openssl:openssl:1.0.0 cpe:/a:openssl:openssl:1.0.0:beta1 cpe:/a:openssl:openssl:1.0.0:beta2 cpe:/a:openssl:openssl:1.0.0:beta3 cpe:/a:openssl:openssl:1.0.0:beta4 cpe:/a:openssl:openssl:1.0.0:beta5 cpe:/a:openssl:openssl:1.0.0a cpe:/a:openssl:openssl:1.0.0b cpe:/a:openssl:openssl:1.0.0c cpe:/a:openssl:openssl:1.0.0d cpe:/a:openssl:openssl:1.0.0e cpe:/a:openssl:openssl:1.0.0f cpe:/a:openssl:openssl:1.0.0g cpe:/a:openssl:openssl:1.0.0h cpe:/a:openssl:openssl:1.0.0i cpe:/a:openssl:openssl:1.0.0j cpe:/a:openssl:openssl:1.0.0k cpe:/a:openssl:openssl:1.0.0l cpe:/a:openssl:openssl:1.0.1 cpe:/a:openssl:openssl:1.0.1:beta1 cpe:/a:openssl:openssl:1.0.1:beta2 cpe:/a:openssl:openssl:1.0.1:beta3 cpe:/a:openssl:openssl:1.0.1a cpe:/a:openssl:openssl:1.0.1b cpe:/a:openssl:openssl:1.0.1c cpe:/a:openssl:openssl:1.0.1d cpe:/a:openssl:openssl:1.0.1e cpe:/a:openssl:openssl:1.0.1f cpe:/a:openssl:openssl:1.0.1g cpe:/a:redhat:jboss_enterprise_application_platform:5.2.0 cpe:/a:redhat:jboss_enterprise_application_platform:6.2.3 cpe:/a:redhat:jboss_enterprise_web_platform:5.2.0 cpe:/a:redhat:jboss_enterprise_web_server:2.0.1 cpe:/a:redhat:storage:2.1 cpe:/o:fedoraproject:fedora cpe:/o:opensuse:opensuse:13.1 cpe:/o:opensuse:opensuse:13.2 cpe:/o:redhat:enterprise_linux:4 cpe:/o:redhat:enterprise_linux:5 cpe:/o:redhat:enterprise_linux:6.0

CVE-2014-0224

2014-06-05T17:55:07.817-04:00

2019-10-09T19:09:24.477-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc MISC http://ccsinjection.lepidum.co.jp CONFIRM http://dev.mysql.com/doc/relnotes/workbench/en/wb-news-6-1-7.html CONFIRM http://esupport.trendmicro.com/solution/en-US/1103813.aspx CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629 CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=KB29195 CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=KB29217 CONFIRM http://linux.oracle.com/errata/ELSA-2014-1053.html FEDORA FEDORA-2014-9301 FEDORA FEDORA-2014-9308 SUSE SUSE-SU-2015:0578 SUSE SUSE-SU-2015:0743 SUSE openSUSE-SU-2016:0640 SUSE openSUSE-SU-2015:0229 HP HPSBUX03046 HP HPSBOV03047 HP HPSBMU03053 HP HPSBMU03058 HP HPSBMU03057 HP HPSBMU03056 HP HPSBMU03055 HP HPSBMU03051 HP HPSBGN03050 HP HPSBMU03065 HP HPSBMU03070 HP HPSBGN03068 HP HPSBMU03071 HP HPSBMU03074 HP HPSBMU03078 HP HPSBMU03062 HP HPSBMU03089 HP HPSBHF03088 HP HPSBMU03094 HP HPSBMU03101 HP HPSBST03098 HP HPSBMU03076 HP HPSBMU03083 HP HPSBST03106 HP HPSBPI03107 HP HPSBST03103 HP HPSBST03097 HP HPSBHF03145 HP HPSBHF03052 HP SSRT101818 HP HPSBST03265 HP HPSBST03195 CONFIRM http://puppetlabs.com/security/cve/cve-2014-0224 REDHAT RHSA-2014:0624 REDHAT RHSA-2014:0626 REDHAT RHSA-2014:0627 REDHAT RHSA-2014:0630 REDHAT RHSA-2014:0631 REDHAT RHSA-2014:0632 REDHAT RHSA-2014:0633 REDHAT RHSA-2014:0680 FULLDISC 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities FULLDISC 20140607 Re: More OpenSSL issues SECUNIA 58337 SECUNIA 58433 SECUNIA 58492 SECUNIA 58615 SECUNIA 58660 SECUNIA 58667 SECUNIA 58713 SECUNIA 58714 SECUNIA 58716 SECUNIA 58719 SECUNIA 58742 SECUNIA 58945 SECUNIA 58977 SECUNIA 59004 SECUNIA 59040 SECUNIA 59093 SECUNIA 59101 SECUNIA 59132 SECUNIA 59135 SECUNIA 59142 SECUNIA 59163 SECUNIA 59167 SECUNIA 59175 SECUNIA 59186 SECUNIA 59188 SECUNIA 59189 SECUNIA 59190 SECUNIA 59192 SECUNIA 59202 SECUNIA 59211 SECUNIA 59214 SECUNIA 59215 SECUNIA 59223 SECUNIA 59231 SECUNIA 59264 SECUNIA 59282 SECUNIA 59284 SECUNIA 59287 SECUNIA 59305 SECUNIA 59306 SECUNIA 59310 SECUNIA 59338 SECUNIA 59347 SECUNIA 59362 SECUNIA 59364 SECUNIA 59365 SECUNIA 59368 SECUNIA 59374 SECUNIA 59375 SECUNIA 59380 SECUNIA 59389 SECUNIA 59429 SECUNIA 59435 SECUNIA 59437 SECUNIA 59440 SECUNIA 59441 SECUNIA 59444 SECUNIA 59445 SECUNIA 59446 SECUNIA 59447 SECUNIA 59448 SECUNIA 59449 SECUNIA 59454 SECUNIA 59460 SECUNIA 59483 SECUNIA 59502 SECUNIA 59518 SECUNIA 59525 SECUNIA 59529 SECUNIA 59661 SECUNIA 59677 SECUNIA 61254 GENTOO GLSA-201407-05 CONFIRM http://support.apple.com/kb/HT6443 CONFIRM http://support.citrix.com/article/CTX140876 CONFIRM http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15325.html CISCO 20140605 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products CONFIRM http://www.blackberry.com/btsc/KB36051 CONFIRM http://www.fortiguard.com/advisory/FG-IR-14-018/ CONFIRM http://www.f-secure.com/en/web/labs_global/fsc-2014-6 CONFIRM http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htm CONFIRM http://www.ibm.com/support/docview.wss?uid=isg3T1020948 CONFIRM http://www.ibm.com/support/docview.wss?uid=ssg1S1004678 AIXAPAR IT02314 CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21676356 CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21676793 CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21676877 CONFIRM http://www.ibm.com/support/docview.wss?uid=swg24037783 CONFIRM http://www.innominate.com/data/downloads/manuals/mdm_1.5.2.1_Release_Notes.pdf CERT-VN VU#978508 CONFIRM http://www.kerio.com/support/kerio-control/release-history MANDRIVA MDVSA-2014:105 MANDRIVA MDVSA-2014:106 MANDRIVA MDVSA-2015:062 CONFIRM http://www.novell.com/support/kb/doc.php?id=7015264 CONFIRM http://www.novell.com/support/kb/doc.php?id=7015300 CONFIRM http://www.openssl.org/news/secadv_20140605.txt CONFIRM http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html BUGTRAQ 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities SECTRACK 1031032 SECTRACK 1031594 CONFIRM http://www.splunk.com/view/SP-CAAAM2D CONFIRM http://www.tenable.com/blog/nessus-527-and-pvs-403-are-available-for-download CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0006.html CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0012.html CONFIRM http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=isg400001841 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=isg400001843 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=nas8N1020163 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=nas8N1020172 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004690 AIXAPAR IV61506 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21673137 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21675626 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21675821 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676035 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676062 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676071 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676333 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676334 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676419 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676478 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676496 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676501 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676529 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676536 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676615 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676644 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676655 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676786 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676833 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676845 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676879 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676889 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677080 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677131 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677390 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677527 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677567 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677695 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677828 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677836 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21678167 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21678233 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21678289 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21683332 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg24037727 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg24037729 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg24037730 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg24037731 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg24037732 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg24037761 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg24037870 CONFIRM http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=6060&myns=phmc&mync=E CONFIRM http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=6061&myns=phmc&mync=E CONFIRM http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5095737 CONFIRM http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095740 CONFIRM http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095754 CONFIRM http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095755 CONFIRM http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095756 CONFIRM http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095757 CONFIRM https://access.redhat.com/site/blogs/766093/posts/908133 CONFIRM https://blogs.oracle.com/sunsecurity/entry/cve_2014_0224_cryptographic_issues CONFIRM https://blogs.oracle.com/sunsecurity/entry/cve_2014_0224_cryptographic_issues1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1103586 CONFIRM https://discussions.nessus.org/thread/7517 CONFIRM https://filezilla-project.org/versions.php?type=server CONFIRM https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=bc8923b1ec9c467755cd86f7848c50ee8812e441 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946 CONFIRM https://kb.bluecoat.com/index?page=content&id=SA80 CONFIRM https://kc.mcafee.com/corporate/index?page=content&id=SB10075 CONFIRM https://www.ibm.com/support/docview.wss?uid=ssg1S1004670 CONFIRM https://www.ibm.com/support/docview.wss?uid=ssg1S1004671 MISC https://www.imperialviolet.org/2014/06/05/earlyccs.html CONFIRM https://www.intersectalliance.com/wp-content/uploads/release_notes/ReleaseNotes_for_SNARE_for_MSSQL.pdf CONFIRM https://www.intersectalliance.com/wp-content/uploads/release_notes/ReleaseNotes_for_Snare_for_Windows.pdf CONFIRM https://www.novell.com/support/kb/doc.php?id=7015271 OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

cpe:/a:pivotal_software:spring_framework:3.0.0 cpe:/a:pivotal_software:spring_framework:3.0.1 cpe:/a:pivotal_software:spring_framework:3.0.2 cpe:/a:pivotal_software:spring_framework:3.0.3 cpe:/a:pivotal_software:spring_framework:3.0.4 cpe:/a:pivotal_software:spring_framework:3.0.5 cpe:/a:pivotal_software:spring_framework:3.0.6 cpe:/a:pivotal_software:spring_framework:3.0.7 cpe:/a:pivotal_software:spring_framework:3.1.0 cpe:/a:pivotal_software:spring_framework:3.1.0:rc1 cpe:/a:pivotal_software:spring_framework:3.1.0:rc2 cpe:/a:pivotal_software:spring_framework:3.1.1 cpe:/a:pivotal_software:spring_framework:3.1.2 cpe:/a:pivotal_software:spring_framework:3.1.3 cpe:/a:pivotal_software:spring_framework:3.1.4 cpe:/a:pivotal_software:spring_framework:3.2.0 cpe:/a:pivotal_software:spring_framework:3.2.0:rc1 cpe:/a:pivotal_software:spring_framework:3.2.0:rc2 cpe:/a:pivotal_software:spring_framework:3.2.0:rc2-a cpe:/a:pivotal_software:spring_framework:3.2.1 cpe:/a:pivotal_software:spring_framework:3.2.2 cpe:/a:pivotal_software:spring_framework:3.2.3 cpe:/a:pivotal_software:spring_framework:3.2.4 cpe:/a:pivotal_software:spring_framework:3.2.5 cpe:/a:pivotal_software:spring_framework:3.2.6 cpe:/a:pivotal_software:spring_framework:3.2.7 cpe:/a:pivotal_software:spring_framework:3.2.8 cpe:/a:pivotal_software:spring_framework:4.0.0 cpe:/a:pivotal_software:spring_framework:4.0.0:rc1 cpe:/a:pivotal_software:spring_framework:4.0.0:rc2 cpe:/a:pivotal_software:spring_framework:4.0.1 cpe:/a:pivotal_software:spring_framework:4.0.2 cpe:/a:pivotal_software:spring_framework:4.0.3 cpe:/a:pivotal_software:spring_framework:4.0.4

CVE-2014-0225

2017-05-25T13:29:00.207-04:00

2017-06-07T10:58:46.520-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2017-06-07T10:25:25.627-04:00

CONFIRM https://pivotal.io/security/cve-2014-0225 When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.

CVE-2014-0226

2014-07-20T07:12:48.933-04:00

2017-12-08T21:29:02.967-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://advisories.mageia.org/MGASA-2014-0304.html CONFIRM http://advisories.mageia.org/MGASA-2014-0305.html CONFIRM http://httpd.apache.org/security/vulnerabilities_24.html APPLE APPLE-SA-2015-04-08-2 HP SSRT102066 HP HPSBMU03380 HP HPSBMU03409 HP HPSBUX03512 REDHAT RHSA-2014:1019 REDHAT RHSA-2014:1020 REDHAT RHSA-2014:1021 FULLDISC 20140721 Apache HTTPd - description of the CVE-2014-0226. GENTOO GLSA-201408-12 CONFIRM http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES CONFIRM http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_status.c CONFIRM http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_status.c?r1=1450998&r2=1610491&diff_format=h CONFIRM http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/lua/lua_request.c CONFIRM http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/lua/lua_request.c?r1=1588989&r2=1610491&diff_format=h DEBIAN DSA-2989 EXPLOIT-DB 34133 MANDRIVA MDVSA-2014:142 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html BID 68678 MISC http://zerodayinitiative.com/advisories/ZDI-14-236/ CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1120603 CONFIRM https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246 MLIST [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html CONFIRM https://puppet.com/security/cve/cve-2014-0226 GENTOO GLSA-201504-03 CONFIRM https://support.apple.com/HT204659 Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.

cpe:/a:apache:tomcat:6.0.0 cpe:/a:apache:tomcat:6.0.0:alpha cpe:/a:apache:tomcat:6.0.1 cpe:/a:apache:tomcat:6.0.1:alpha cpe:/a:apache:tomcat:6.0.2 cpe:/a:apache:tomcat:6.0.2:alpha cpe:/a:apache:tomcat:6.0.2:beta cpe:/a:apache:tomcat:6.0.3 cpe:/a:apache:tomcat:6.0.4 cpe:/a:apache:tomcat:6.0.4:alpha cpe:/a:apache:tomcat:6.0.5 cpe:/a:apache:tomcat:6.0.6 cpe:/a:apache:tomcat:6.0.6:alpha cpe:/a:apache:tomcat:6.0.7 cpe:/a:apache:tomcat:6.0.7:alpha cpe:/a:apache:tomcat:6.0.7:beta cpe:/a:apache:tomcat:6.0.8 cpe:/a:apache:tomcat:6.0.8:alpha cpe:/a:apache:tomcat:6.0.9 cpe:/a:apache:tomcat:6.0.9:beta cpe:/a:apache:tomcat:6.0.10 cpe:/a:apache:tomcat:6.0.11 cpe:/a:apache:tomcat:6.0.12 cpe:/a:apache:tomcat:6.0.13 cpe:/a:apache:tomcat:6.0.14 cpe:/a:apache:tomcat:6.0.15 cpe:/a:apache:tomcat:6.0.16 cpe:/a:apache:tomcat:6.0.17 cpe:/a:apache:tomcat:6.0.18 cpe:/a:apache:tomcat:6.0.19 cpe:/a:apache:tomcat:6.0.20 cpe:/a:apache:tomcat:6.0.24 cpe:/a:apache:tomcat:6.0.26 cpe:/a:apache:tomcat:6.0.27 cpe:/a:apache:tomcat:6.0.28 cpe:/a:apache:tomcat:6.0.29 cpe:/a:apache:tomcat:6.0.30 cpe:/a:apache:tomcat:6.0.31 cpe:/a:apache:tomcat:6.0.32 cpe:/a:apache:tomcat:6.0.33 cpe:/a:apache:tomcat:6.0.35 cpe:/a:apache:tomcat:6.0.36 cpe:/a:apache:tomcat:6.0.37 cpe:/a:apache:tomcat:6.0.39 cpe:/a:apache:tomcat:6.0.41 cpe:/a:apache:tomcat:7.0.0 cpe:/a:apache:tomcat:7.0.0:beta cpe:/a:apache:tomcat:7.0.1 cpe:/a:apache:tomcat:7.0.2 cpe:/a:apache:tomcat:7.0.2:beta cpe:/a:apache:tomcat:7.0.3 cpe:/a:apache:tomcat:7.0.4 cpe:/a:apache:tomcat:7.0.4:beta cpe:/a:apache:tomcat:7.0.5 cpe:/a:apache:tomcat:7.0.6 cpe:/a:apache:tomcat:7.0.7 cpe:/a:apache:tomcat:7.0.8 cpe:/a:apache:tomcat:7.0.9 cpe:/a:apache:tomcat:7.0.10 cpe:/a:apache:tomcat:7.0.11 cpe:/a:apache:tomcat:7.0.12 cpe:/a:apache:tomcat:7.0.13 cpe:/a:apache:tomcat:7.0.14 cpe:/a:apache:tomcat:7.0.15 cpe:/a:apache:tomcat:7.0.16 cpe:/a:apache:tomcat:7.0.17 cpe:/a:apache:tomcat:7.0.18 cpe:/a:apache:tomcat:7.0.19 cpe:/a:apache:tomcat:7.0.20 cpe:/a:apache:tomcat:7.0.21 cpe:/a:apache:tomcat:7.0.22 cpe:/a:apache:tomcat:7.0.23 cpe:/a:apache:tomcat:7.0.24 cpe:/a:apache:tomcat:7.0.25 cpe:/a:apache:tomcat:7.0.26 cpe:/a:apache:tomcat:7.0.27 cpe:/a:apache:tomcat:7.0.28 cpe:/a:apache:tomcat:7.0.29 cpe:/a:apache:tomcat:7.0.30 cpe:/a:apache:tomcat:7.0.31 cpe:/a:apache:tomcat:7.0.32 cpe:/a:apache:tomcat:7.0.33 cpe:/a:apache:tomcat:7.0.34 cpe:/a:apache:tomcat:7.0.35 cpe:/a:apache:tomcat:7.0.36 cpe:/a:apache:tomcat:7.0.37 cpe:/a:apache:tomcat:7.0.38 cpe:/a:apache:tomcat:7.0.39 cpe:/a:apache:tomcat:7.0.40 cpe:/a:apache:tomcat:7.0.41 cpe:/a:apache:tomcat:7.0.42 cpe:/a:apache:tomcat:7.0.43 cpe:/a:apache:tomcat:7.0.44 cpe:/a:apache:tomcat:7.0.45 cpe:/a:apache:tomcat:7.0.46 cpe:/a:apache:tomcat:7.0.47 cpe:/a:apache:tomcat:7.0.48 cpe:/a:apache:tomcat:7.0.49 cpe:/a:apache:tomcat:7.0.50 cpe:/a:apache:tomcat:7.0.52 cpe:/a:apache:tomcat:7.0.53 cpe:/a:apache:tomcat:7.0.54 cpe:/a:apache:tomcat:8.0.0:rc1 cpe:/a:apache:tomcat:8.0.0:rc10 cpe:/a:apache:tomcat:8.0.0:rc2 cpe:/a:apache:tomcat:8.0.0:rc5 cpe:/a:apache:tomcat:8.0.1 cpe:/a:apache:tomcat:8.0.3 cpe:/a:apache:tomcat:8.0.5 cpe:/a:apache:tomcat:8.0.8

CVE-2014-0227

2015-02-15T19:59:00.057-05:00

2019-04-15T12:29:58.087-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://advisories.mageia.org/MGASA-2015-0081.html BUGTRAQ 20150209 [SECURITY] CVE-2014-0227 Apache Tomcat Request Smuggling FEDORA FEDORA-2015-2109 HP HPSBUX03341 HP SSRT102066 REDHAT RHSA-2015:0675 REDHAT RHSA-2015:0720 REDHAT RHSA-2015:0765 REDHAT RHSA-2015:0983 REDHAT RHSA-2015:0991 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1600984 CONFIRM http://tomcat.apache.org/security-6.html CONFIRM http://tomcat.apache.org/security-7.html CONFIRM http://tomcat.apache.org/security-8.html DEBIAN DSA-3447 DEBIAN DSA-3530 MANDRIVA MDVSA-2015:052 MANDRIVA MDVSA-2015:053 MANDRIVA MDVSA-2015:084 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html BID 72717 SECTRACK 1032791 UBUNTU USN-2654-1 UBUNTU USN-2655-1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1109196 MLIST [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ MLIST [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ MLIST [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ MLIST [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ CONFIRM https://source.jboss.org/changelog/JBossWeb?cs=2455 java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.

cpe:/a:apache:hive:0.13.0

CVE-2014-0228

2014-11-16T12:59:00.127-05:00

2018-10-09T15:41:58.093-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [hive-user] 20140612 CVE-2014-0228: Apache Hive Authorization vulnerability MISC http://packetstormsecurity.com/files/127091/Apache-Hive-0.13.0-Authorization-Failure.html BUGTRAQ 20140612 CVE-2014-0228: Apache Hive Authorization vulnerability Apache Hive before 0.13.1, when in SQL standards based authorization mode, does not properly check the file permissions for (1) import and (2) export statements, which allows remote authenticated users to obtain sensitive information via a crafted URI.

cpe:/a:apache:hadoop:0.23.0 cpe:/a:apache:hadoop:0.23.1 cpe:/a:apache:hadoop:0.23.3 cpe:/a:apache:hadoop:0.23.4 cpe:/a:apache:hadoop:0.23.5 cpe:/a:apache:hadoop:0.23.6 cpe:/a:apache:hadoop:0.23.7 cpe:/a:apache:hadoop:0.23.8 cpe:/a:apache:hadoop:0.23.9 cpe:/a:apache:hadoop:0.23.10 cpe:/a:apache:hadoop:2.0.0:alpha cpe:/a:apache:hadoop:2.0.1:alpha cpe:/a:apache:hadoop:2.0.2:alpha cpe:/a:apache:hadoop:2.0.3:alpha cpe:/a:apache:hadoop:2.0.4:alpha cpe:/a:apache:hadoop:2.0.5:alpha cpe:/a:apache:hadoop:2.0.6:alpha cpe:/a:apache:hadoop:2.1.0:beta cpe:/a:apache:hadoop:2.1.1:beta cpe:/a:apache:hadoop:2.2.0 cpe:/a:apache:hadoop:2.3.0 cpe:/a:apache:hadoop:2.4.0 cpe:/a:cloudera:cdh:5.0.0 cpe:/a:cloudera:cdh:5.0.0:beta cpe:/a:cloudera:cdh:5.0.0:beta2

CVE-2014-0229

2017-03-23T16:59:00.203-04:00

2017-03-28T14:03:31.947-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2017-03-28T13:19:41.783-04:00

CONFIRM https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#concept_i1q_xvk_2r Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the (1) refreshNamenodes, (2) deleteBlockPool, and (3) shutdownDatanode HDFS admin commands, which allows remote authenticated users to cause a denial of service (DataNodes shutdown) or perform unnecessary operations by issuing a command.

cpe:/a:apache:tomcat:6.0.0 cpe:/a:apache:tomcat:6.0.0:alpha cpe:/a:apache:tomcat:6.0.1 cpe:/a:apache:tomcat:6.0.1:alpha cpe:/a:apache:tomcat:6.0.2 cpe:/a:apache:tomcat:6.0.2:alpha cpe:/a:apache:tomcat:6.0.2:beta cpe:/a:apache:tomcat:6.0.3 cpe:/a:apache:tomcat:6.0.4 cpe:/a:apache:tomcat:6.0.4:alpha cpe:/a:apache:tomcat:6.0.5 cpe:/a:apache:tomcat:6.0.6 cpe:/a:apache:tomcat:6.0.6:alpha cpe:/a:apache:tomcat:6.0.7 cpe:/a:apache:tomcat:6.0.7:alpha cpe:/a:apache:tomcat:6.0.7:beta cpe:/a:apache:tomcat:6.0.8 cpe:/a:apache:tomcat:6.0.8:alpha cpe:/a:apache:tomcat:6.0.9 cpe:/a:apache:tomcat:6.0.9:beta cpe:/a:apache:tomcat:6.0.10 cpe:/a:apache:tomcat:6.0.11 cpe:/a:apache:tomcat:6.0.12 cpe:/a:apache:tomcat:6.0.13 cpe:/a:apache:tomcat:6.0.14 cpe:/a:apache:tomcat:6.0.15 cpe:/a:apache:tomcat:6.0.16 cpe:/a:apache:tomcat:6.0.17 cpe:/a:apache:tomcat:6.0.18 cpe:/a:apache:tomcat:6.0.19 cpe:/a:apache:tomcat:6.0.20 cpe:/a:apache:tomcat:6.0.24 cpe:/a:apache:tomcat:6.0.26 cpe:/a:apache:tomcat:6.0.27 cpe:/a:apache:tomcat:6.0.28 cpe:/a:apache:tomcat:6.0.29 cpe:/a:apache:tomcat:6.0.30 cpe:/a:apache:tomcat:6.0.31 cpe:/a:apache:tomcat:6.0.32 cpe:/a:apache:tomcat:6.0.33 cpe:/a:apache:tomcat:6.0.35 cpe:/a:apache:tomcat:6.0.36 cpe:/a:apache:tomcat:6.0.37 cpe:/a:apache:tomcat:6.0.39 cpe:/a:apache:tomcat:6.0.41 cpe:/a:apache:tomcat:6.0.43 cpe:/a:apache:tomcat:7.0.0 cpe:/a:apache:tomcat:7.0.0:beta cpe:/a:apache:tomcat:7.0.1 cpe:/a:apache:tomcat:7.0.2 cpe:/a:apache:tomcat:7.0.2:beta cpe:/a:apache:tomcat:7.0.3 cpe:/a:apache:tomcat:7.0.4 cpe:/a:apache:tomcat:7.0.4:beta cpe:/a:apache:tomcat:7.0.5 cpe:/a:apache:tomcat:7.0.6 cpe:/a:apache:tomcat:7.0.7 cpe:/a:apache:tomcat:7.0.8 cpe:/a:apache:tomcat:7.0.9 cpe:/a:apache:tomcat:7.0.10 cpe:/a:apache:tomcat:7.0.11 cpe:/a:apache:tomcat:7.0.12 cpe:/a:apache:tomcat:7.0.13 cpe:/a:apache:tomcat:7.0.14 cpe:/a:apache:tomcat:7.0.15 cpe:/a:apache:tomcat:7.0.16 cpe:/a:apache:tomcat:7.0.17 cpe:/a:apache:tomcat:7.0.18 cpe:/a:apache:tomcat:7.0.19 cpe:/a:apache:tomcat:7.0.20 cpe:/a:apache:tomcat:7.0.21 cpe:/a:apache:tomcat:7.0.22 cpe:/a:apache:tomcat:7.0.23 cpe:/a:apache:tomcat:7.0.24 cpe:/a:apache:tomcat:7.0.25 cpe:/a:apache:tomcat:7.0.26 cpe:/a:apache:tomcat:7.0.27 cpe:/a:apache:tomcat:7.0.28 cpe:/a:apache:tomcat:7.0.29 cpe:/a:apache:tomcat:7.0.30 cpe:/a:apache:tomcat:7.0.31 cpe:/a:apache:tomcat:7.0.32 cpe:/a:apache:tomcat:7.0.33 cpe:/a:apache:tomcat:7.0.34 cpe:/a:apache:tomcat:7.0.35 cpe:/a:apache:tomcat:7.0.36 cpe:/a:apache:tomcat:7.0.37 cpe:/a:apache:tomcat:7.0.38 cpe:/a:apache:tomcat:7.0.39 cpe:/a:apache:tomcat:7.0.40 cpe:/a:apache:tomcat:7.0.41 cpe:/a:apache:tomcat:7.0.42 cpe:/a:apache:tomcat:7.0.43 cpe:/a:apache:tomcat:7.0.44 cpe:/a:apache:tomcat:7.0.45 cpe:/a:apache:tomcat:7.0.46 cpe:/a:apache:tomcat:7.0.47 cpe:/a:apache:tomcat:7.0.48 cpe:/a:apache:tomcat:7.0.49 cpe:/a:apache:tomcat:7.0.50 cpe:/a:apache:tomcat:7.0.52 cpe:/a:apache:tomcat:7.0.53 cpe:/a:apache:tomcat:7.0.54 cpe:/a:apache:tomcat:8.0.0:rc1 cpe:/a:apache:tomcat:8.0.0:rc10 cpe:/a:apache:tomcat:8.0.0:rc2 cpe:/a:apache:tomcat:8.0.0:rc5 cpe:/a:apache:tomcat:8.0.1 cpe:/a:apache:tomcat:8.0.3 cpe:/a:apache:tomcat:8.0.5 cpe:/a:apache:tomcat:8.0.8 cpe:/a:oracle:virtualization:4.63 cpe:/a:oracle:virtualization:4.71 cpe:/a:oracle:virtualization:5.1

CVE-2014-0230

2015-06-07T19:59:02.690-04:00

2019-04-15T12:30:01.117-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov MLIST [tomcat-announce] 20150505 [SECURITY] CVE-2014-0230: Apache Tomcat DoS HP HPSBOV03503 HP HPSBUX03561 MLIST [oss-security] 20150409 Apache Tomcat partial file upload DoS CVE-2014-0230 REDHAT RHSA-2015:1621 REDHAT RHSA-2015:1622 REDHAT RHSA-2015:2661 REDHAT RHSA-2016:0595 REDHAT RHSA-2016:0596 REDHAT RHSA-2016:0597 REDHAT RHSA-2016:0598 REDHAT RHSA-2016:0599 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1603770 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1603775 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1603779 CONFIRM http://tomcat.apache.org/security-6.html CONFIRM http://tomcat.apache.org/security-7.html CONFIRM http://tomcat.apache.org/security-8.html DEBIAN DSA-3447 DEBIAN DSA-3530 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html BID 74475 UBUNTU USN-2654-1 UBUNTU USN-2655-1 REDHAT RHSA-2015:2659 REDHAT RHSA-2015:2660 CONFIRM https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964 CONFIRM https://issues.jboss.org/browse/JWS-219 CONFIRM https://issues.jboss.org/browse/JWS-220 MLIST [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ MLIST [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ MLIST [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ MLIST [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts.

cpe:/a:apache:http_server:- cpe:/a:apache:http_server:2.2.0 cpe:/a:apache:http_server:2.2.2 cpe:/a:apache:http_server:2.2.3 cpe:/a:apache:http_server:2.2.4 cpe:/a:apache:http_server:2.2.6 cpe:/a:apache:http_server:2.2.8 cpe:/a:apache:http_server:2.2.9 cpe:/a:apache:http_server:2.2.10 cpe:/a:apache:http_server:2.2.11 cpe:/a:apache:http_server:2.2.12 cpe:/a:apache:http_server:2.2.13 cpe:/a:apache:http_server:2.2.14 cpe:/a:apache:http_server:2.2.15 cpe:/a:apache:http_server:2.2.16 cpe:/a:apache:http_server:2.2.17 cpe:/a:apache:http_server:2.2.18 cpe:/a:apache:http_server:2.2.19 cpe:/a:apache:http_server:2.2.20 cpe:/a:apache:http_server:2.2.21 cpe:/a:apache:http_server:2.2.22 cpe:/a:apache:http_server:2.2.23 cpe:/a:apache:http_server:2.2.24 cpe:/a:apache:http_server:2.2.25 cpe:/a:apache:http_server:2.2.26 cpe:/a:apache:http_server:2.2.27 cpe:/a:apache:http_server:2.4.1 cpe:/a:apache:http_server:2.4.2 cpe:/a:apache:http_server:2.4.3 cpe:/a:apache:http_server:2.4.4 cpe:/a:apache:http_server:2.4.6 cpe:/a:apache:http_server:2.4.7 cpe:/a:apache:http_server:2.4.8 cpe:/a:apache:http_server:2.4.9

CVE-2014-0231

2014-07-20T07:12:48.980-04:00

2018-10-30T12:25:27.497-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://advisories.mageia.org/MGASA-2014-0304.html CONFIRM http://advisories.mageia.org/MGASA-2014-0305.html CONFIRM http://httpd.apache.org/security/vulnerabilities_24.html APPLE APPLE-SA-2015-04-08-2 HP SSRT102066 HP HPSBMU03380 HP HPSBMU03409 HP HPSBUX03512 MISC http://packetstormsecurity.com/files/130769/RSA-Digital-Certificate-Solution-XSS-Denial-Of-Service.html REDHAT RHSA-2014:1019 REDHAT RHSA-2014:1020 REDHAT RHSA-2014:1021 CONFIRM http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES CONFIRM http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_cgid.c CONFIRM http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_cgid.c?r1=1482522&r2=1535125&diff_format=h CONFIRM http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_cgid.c?r1=1565711&r2=1610509&diff_format=h DEBIAN DSA-2989 MANDRIVA MDVSA-2014:142 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html BID 68742 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1120596 CONFIRM https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246 MLIST [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html CONFIRM https://puppet.com/security/cve/cve-2014-0231 GENTOO GLSA-201504-03 CONFIRM https://support.apple.com/HT204659 The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.

cpe:/a:apache:ofbiz:11.04.01 cpe:/a:apache:ofbiz:11.04.02 cpe:/a:apache:ofbiz:11.04.03 cpe:/a:apache:ofbiz:11.04.04 cpe:/a:apache:ofbiz:12.04.01 cpe:/a:apache:ofbiz:12.04.02 cpe:/a:apache:ofbiz:12.04.03

CVE-2014-0232

2014-08-22T10:55:07.127-04:00

2018-10-09T15:41:58.373-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://ofbiz.apache.org/download.html#vulnerabilities MISC http://packetstormsecurity.com/files/127929/Apache-OFBiz-11.04.04-12.04.03-Cross-Site-Scripting.html MLIST [oss-security] 20140819 [CVE-2014-0232] Apache OFBiz Cross-site scripting (XSS) vulnerability CONFIRM http://svn.apache.org/viewvc?view=revision&revision=r1608698 BUGTRAQ 20140819 [CVE-2014-0232] Apache OFBiz Cross-site scripting (XSS) vulnerability BID 69286 SECTRACK 1030739 XF apache-ofbiz-cve20140232-xss(95356) Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a (1) result or (2) error message.

cpe:/a:redhat:openshift:2.0::enterprise cpe:/a:redhat:openshift:2.1::~~enterprise~~~

CVE-2014-0233

2014-11-16T06:59:01.603-05:00

2014-11-17T12:24:13.720-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2014-11-17T12:24:13.317-05:00

REDHAT RHSA-2014:0529 REDHAT RHSA-2014:0530 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1096955 Red Hat OpenShift Enterprise 2.0 and 2.1 and OpenShift Origin allow remote authenticated users to execute arbitrary commands via shell metacharacters in a directory name that is referenced by a cartridge using the file: URI scheme.

CVE-2014-0235

2014-04-08T19:55:05.400-04:00

2014-07-08T00:07:29.860-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-0325, CVE-2014-3538. Reason: This candidate is a duplicate of CVE-2014-0325 and/or CVE-2014-3538. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2014-0325 instead of this candidate for the issue in the Internet Explorer product, and should reference CVE-2014-3538 instead of this candidate for the issue in the file product. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:php:php:5.5.35

CVE-2014-0236

2016-05-16T06:59:00.127-04:00

2016-05-18T14:26:24.427-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2016-05-17T16:57:00.100-04:00

CONFIRM http://git.php.net/?p=php-src.git;a=commit;h=f3f22ff5c697aef854ffc1918bce708b37481b0f CONFIRM http://php.net/ChangeLog-5.php CONFIRM https://bugs.php.net/bug.php?id=67329 file before 5.18, as used in the Fileinfo component in PHP before 5.6.0, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a zero root_storage value in a CDF file, related to cdf.c and readcdf.c.

cpe:/a:php:php:5.0.0 cpe:/a:php:php:5.0.0:beta1 cpe:/a:php:php:5.0.0:beta2 cpe:/a:php:php:5.0.0:beta3 cpe:/a:php:php:5.0.0:beta4 cpe:/a:php:php:5.0.0:rc1 cpe:/a:php:php:5.0.0:rc2 cpe:/a:php:php:5.0.0:rc3 cpe:/a:php:php:5.0.1 cpe:/a:php:php:5.0.2 cpe:/a:php:php:5.0.3 cpe:/a:php:php:5.0.4 cpe:/a:php:php:5.0.5 cpe:/a:php:php:5.1.0 cpe:/a:php:php:5.1.1 cpe:/a:php:php:5.1.2 cpe:/a:php:php:5.1.3 cpe:/a:php:php:5.1.4 cpe:/a:php:php:5.1.5 cpe:/a:php:php:5.1.6 cpe:/a:php:php:5.2.0 cpe:/a:php:php:5.2.1 cpe:/a:php:php:5.2.2 cpe:/a:php:php:5.2.3 cpe:/a:php:php:5.2.4 cpe:/a:php:php:5.2.5 cpe:/a:php:php:5.2.6 cpe:/a:php:php:5.2.7 cpe:/a:php:php:5.2.8 cpe:/a:php:php:5.2.9 cpe:/a:php:php:5.2.10 cpe:/a:php:php:5.2.11 cpe:/a:php:php:5.2.12 cpe:/a:php:php:5.2.13 cpe:/a:php:php:5.2.14 cpe:/a:php:php:5.2.15 cpe:/a:php:php:5.2.16 cpe:/a:php:php:5.2.17 cpe:/a:php:php:5.3.0 cpe:/a:php:php:5.3.1 cpe:/a:php:php:5.3.2 cpe:/a:php:php:5.3.3 cpe:/a:php:php:5.3.4 cpe:/a:php:php:5.3.5 cpe:/a:php:php:5.3.6 cpe:/a:php:php:5.3.7 cpe:/a:php:php:5.3.8 cpe:/a:php:php:5.3.9 cpe:/a:php:php:5.3.10 cpe:/a:php:php:5.3.11 cpe:/a:php:php:5.3.12 cpe:/a:php:php:5.3.13 cpe:/a:php:php:5.3.14 cpe:/a:php:php:5.3.15 cpe:/a:php:php:5.3.16 cpe:/a:php:php:5.3.17 cpe:/a:php:php:5.3.18 cpe:/a:php:php:5.3.19 cpe:/a:php:php:5.3.20 cpe:/a:php:php:5.3.21 cpe:/a:php:php:5.3.22 cpe:/a:php:php:5.3.23 cpe:/a:php:php:5.3.24 cpe:/a:php:php:5.3.25 cpe:/a:php:php:5.3.26 cpe:/a:php:php:5.3.27 cpe:/a:php:php:5.3.28 cpe:/a:php:php:5.4.0 cpe:/a:php:php:5.4.1 cpe:/a:php:php:5.4.2 cpe:/a:php:php:5.4.3 cpe:/a:php:php:5.4.4 cpe:/a:php:php:5.4.5 cpe:/a:php:php:5.4.6 cpe:/a:php:php:5.4.7 cpe:/a:php:php:5.4.8 cpe:/a:php:php:5.4.9 cpe:/a:php:php:5.4.10 cpe:/a:php:php:5.4.11 cpe:/a:php:php:5.4.12 cpe:/a:php:php:5.4.12:rc1 cpe:/a:php:php:5.4.12:rc2 cpe:/a:php:php:5.4.13 cpe:/a:php:php:5.4.13:rc1 cpe:/a:php:php:5.4.14 cpe:/a:php:php:5.4.14:rc1 cpe:/a:php:php:5.4.15:rc1 cpe:/a:php:php:5.4.16:rc1 cpe:/a:php:php:5.4.17 cpe:/a:php:php:5.4.18 cpe:/a:php:php:5.4.19 cpe:/a:php:php:5.4.20 cpe:/a:php:php:5.4.21 cpe:/a:php:php:5.4.22 cpe:/a:php:php:5.4.23 cpe:/a:php:php:5.4.24 cpe:/a:php:php:5.4.25 cpe:/a:php:php:5.4.26 cpe:/a:php:php:5.5.0:alpha1 cpe:/a:php:php:5.5.0:alpha2 cpe:/a:php:php:5.5.0:alpha3 cpe:/a:php:php:5.5.0:alpha4 cpe:/a:php:php:5.5.0:alpha5 cpe:/a:php:php:5.5.0:alpha6 cpe:/a:php:php:5.5.0:beta1 cpe:/a:php:php:5.5.0:beta2 cpe:/a:php:php:5.5.0:beta3 cpe:/a:php:php:5.5.0:beta4 cpe:/a:php:php:5.5.0:rc1 cpe:/a:php:php:5.5.0:rc2 cpe:/a:php:php:5.5.1 cpe:/a:php:php:5.5.2 cpe:/a:php:php:5.5.3 cpe:/a:php:php:5.5.4 cpe:/a:php:php:5.5.5 cpe:/a:php:php:5.5.6 cpe:/a:php:php:5.5.7 cpe:/a:php:php:5.5.8 cpe:/a:php:php:5.5.9 cpe:/a:php:php:5.5.10 cpe:/a:php:php:5.5.11 cpe:/a:php:php:5.5.12

CVE-2014-0237

2014-06-01T00:29:34.720-04:00

2017-01-06T21:59:24.623-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov APPLE APPLE-SA-2015-04-08-2 SUSE SUSE-SU-2014:0869 REDHAT RHSA-2014:1765 REDHAT RHSA-2014:1766 SECUNIA 59061 SECUNIA 59329 SECUNIA 59418 SECUNIA 60998 CONFIRM http://support.apple.com/kb/HT6443 DEBIAN DSA-3021 CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html CONFIRM http://www.php.net/ChangeLog-5.php BID 67759 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21683486 CONFIRM https://bugs.php.net/bug.php?id=67328 CONFIRM https://github.com/file/file/commit/b8acc83781d5a24cc5101e525d15efe0482c280d CONFIRM https://support.apple.com/HT204659 The cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (performance degradation) by triggering many file_printf calls.

CVE-2014-0238

2014-06-01T00:29:34.783-04:00

2017-01-06T21:59:24.717-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov APPLE APPLE-SA-2015-04-08-2 SUSE SUSE-SU-2014:0869 REDHAT RHSA-2014:1765 REDHAT RHSA-2014:1766 SECUNIA 59061 SECUNIA 59329 SECUNIA 59418 SECUNIA 60998 CONFIRM http://support.apple.com/kb/HT6443 DEBIAN DSA-3021 CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html CONFIRM http://www.php.net/ChangeLog-5.php BID 67765 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21683486 CONFIRM https://bugs.php.net/bug.php?id=67327 CONFIRM https://github.com/file/file/commit/f97486ef5dc3e8735440edc4fc8808c63e1a3ef0 CONFIRM https://support.apple.com/HT204659 The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long.

cpe:/a:samba:samba:4.0.1 cpe:/a:samba:samba:4.0.2 cpe:/a:samba:samba:4.0.3 cpe:/a:samba:samba:4.0.4 cpe:/a:samba:samba:4.0.5 cpe:/a:samba:samba:4.0.6 cpe:/a:samba:samba:4.0.7 cpe:/a:samba:samba:4.0.8 cpe:/a:samba:samba:4.0.9 cpe:/a:samba:samba:4.0.10 cpe:/a:samba:samba:4.0.11 cpe:/a:samba:samba:4.0.12 cpe:/a:samba:samba:4.0.13 cpe:/a:samba:samba:4.0.14 cpe:/a:samba:samba:4.0.15 cpe:/a:samba:samba:4.0.16 cpe:/a:samba:samba:4.0.17

CVE-2014-0239

2014-05-28T00:58:32.750-04:00

2017-01-06T21:59:24.797-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov GENTOO GLSA-201502-15 CONFIRM http://www.samba.org/samba/security/CVE-2014-0239 BID 67691 SECTRACK 1030309 The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sending a response, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged response packet that triggers a communication loop, a related issue to CVE-1999-0103.

cpe:/a:modwsgi:mod_wsgi:1.0 cpe:/a:modwsgi:mod_wsgi:1.1 cpe:/a:modwsgi:mod_wsgi:1.2 cpe:/a:modwsgi:mod_wsgi:1.3 cpe:/a:modwsgi:mod_wsgi:1.4 cpe:/a:modwsgi:mod_wsgi:1.5 cpe:/a:modwsgi:mod_wsgi:1.6 cpe:/a:modwsgi:mod_wsgi:2.0 cpe:/a:modwsgi:mod_wsgi:2.1 cpe:/a:modwsgi:mod_wsgi:2.2 cpe:/a:modwsgi:mod_wsgi:2.3 cpe:/a:modwsgi:mod_wsgi:2.4 cpe:/a:modwsgi:mod_wsgi:2.5 cpe:/a:modwsgi:mod_wsgi:2.6 cpe:/a:modwsgi:mod_wsgi:2.7 cpe:/a:modwsgi:mod_wsgi:2.8 cpe:/a:modwsgi:mod_wsgi:3.0 cpe:/a:modwsgi:mod_wsgi:3.1 cpe:/a:modwsgi:mod_wsgi:3.2 cpe:/a:modwsgi:mod_wsgi:3.3 cpe:/a:modwsgi:mod_wsgi:3.4

CVE-2014-0240

2014-05-27T10:55:12.197-04:00

2017-12-20T21:29:00.373-05:00

6.2

LOCAL

HIGH

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://blog.dscpl.com.au/2014/05/security-release-for-modwsgi-version-35.html CONFIRM http://modwsgi.readthedocs.org/en/latest/release-notes/version-3.5.html REDHAT RHSA-2014:0789 SECUNIA 59551 SECUNIA 60094 MLIST [oss-security] 20140521 Security release for mod_wsgi (version 3.5) BID 67532 The mod_wsgi module before 3.5 for Apache, when daemon mode is enabled, does not properly handle error codes returned by setuid when run on certain Linux kernels, which allows local users to gain privileges via vectors related to the number of running processes.

cpe:/a:check_mk_project:check_mk:1.2.5 cpe:/a:check_mk_project:check_mk:1.2.5:i2p1

CVE-2014-0243

2018-07-19T13:29:00.233-04:00

2018-09-17T14:04:41.577-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-09-17T12:45:31.257-04:00

CONFIRM http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=0426323df1641596c4f01ef5a716a3b65276f01c CONFIRM http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=a2ef8d00c53ec9cbd05c4ae2f09b50761130e7ce FEDORA FEDORA-2014-6818 FEDORA FEDORA-2014-6810 MISC http://packetstormsecurity.com/files/126857/Check_MK-Arbitrary-File-Disclosure.html FULLDISC 20140528 LSE Leading Security Experts GmbH - LSE-2014-05-21 - Check_MK - Arbitrary File Disclosure Vulnerability MLIST [oss-security] 20140528 LSE Leading Security Experts GmbH - LSE-2014-05-21 - Check_MK - Arbitrary File Disclosure Vulnerability BID 67674 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1101669 SECUNIA 58536 BUGTRAQ 20140528 LSE Leading Security Experts GmbH - LSE-2014-05-21 - Check_MK - Arbitrary File Disclosure Vulnerability Check_MK through 1.2.5i2p1 allows local users to read arbitrary files via a symlink attack to a file in /var/lib/check_mk_agent/job.

cpe:/a:samba:samba:3.6.0 cpe:/a:samba:samba:3.6.1 cpe:/a:samba:samba:3.6.2 cpe:/a:samba:samba:3.6.3 cpe:/a:samba:samba:3.6.4 cpe:/a:samba:samba:3.6.5 cpe:/a:samba:samba:3.6.6 cpe:/a:samba:samba:3.6.7 cpe:/a:samba:samba:3.6.8 cpe:/a:samba:samba:3.6.9 cpe:/a:samba:samba:3.6.10 cpe:/a:samba:samba:3.6.11 cpe:/a:samba:samba:3.6.12 cpe:/a:samba:samba:3.6.13 cpe:/a:samba:samba:3.6.14 cpe:/a:samba:samba:3.6.15 cpe:/a:samba:samba:3.6.16 cpe:/a:samba:samba:3.6.17 cpe:/a:samba:samba:3.6.18 cpe:/a:samba:samba:3.6.19 cpe:/a:samba:samba:3.6.20 cpe:/a:samba:samba:3.6.21 cpe:/a:samba:samba:3.6.22 cpe:/a:samba:samba:3.6.23 cpe:/a:samba:samba:4.0.0 cpe:/a:samba:samba:4.0.1 cpe:/a:samba:samba:4.0.2 cpe:/a:samba:samba:4.0.3 cpe:/a:samba:samba:4.0.4 cpe:/a:samba:samba:4.0.5 cpe:/a:samba:samba:4.0.6 cpe:/a:samba:samba:4.0.7 cpe:/a:samba:samba:4.0.8 cpe:/a:samba:samba:4.0.9 cpe:/a:samba:samba:4.0.10 cpe:/a:samba:samba:4.0.11 cpe:/a:samba:samba:4.0.12 cpe:/a:samba:samba:4.0.13 cpe:/a:samba:samba:4.0.14 cpe:/a:samba:samba:4.0.15 cpe:/a:samba:samba:4.0.16 cpe:/a:samba:samba:4.0.17 cpe:/a:samba:samba:4.0.18 cpe:/a:samba:samba:4.1.0 cpe:/a:samba:samba:4.1.1 cpe:/a:samba:samba:4.1.2 cpe:/a:samba:samba:4.1.3 cpe:/a:samba:samba:4.1.4 cpe:/a:samba:samba:4.1.5 cpe:/a:samba:samba:4.1.6 cpe:/a:samba:samba:4.1.7 cpe:/a:samba:samba:4.1.8

CVE-2014-0244

2014-06-23T10:55:05.277-04:00

2018-10-09T15:41:59.263-04:00

3.3

ADJACENT_NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://advisories.mageia.org/MGASA-2014-0279.html CONFIRM http://linux.oracle.com/errata/ELSA-2014-0866.html FEDORA FEDORA-2014-9132 FEDORA FEDORA-2014-7672 REDHAT RHSA-2014:0866 SECUNIA 59407 SECUNIA 59433 SECUNIA 61218 GENTOO GLSA-201502-15 MANDRIVA MDVSA-2014:136 MANDRIVA MDVSA-2015:082 CONFIRM http://www.samba.org/samba/security/CVE-2014-0244 BUGTRAQ 20140711 [ MDVSA-2014:136 ] samba BID 68148 SECTRACK 1030455 CONFIRM https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_samba1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1097815 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993 The sys_recvfrom function in nmbd in Samba 3.6.x before 3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed UDP packet.

cpe:/a:sosreport_project:sosreport:-

CVE-2014-0246

2014-05-29T10:19:07.877-04:00

2014-05-30T09:59:52.487-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-05-30T09:59:52.270-04:00

MLIST [oss-security] 20140527 CVE-2014-0246 sos: md5 hash of GRUB password collected when running sosreport BID 67634 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1101393 SOSreport stores the md5 hash of the GRUB bootloader password in an archive, which allows local users to obtain sensitive information by reading the archive.

cpe:/a:libreoffice:libreoffice:4.2.4 cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:fedoraproject:fedora:19 cpe:/o:opensuse:opensuse:13.1 cpe:/o:redhat:enterprise_linux_desktop:7.0 cpe:/o:redhat:enterprise_linux_server:7.0 cpe:/o:redhat:enterprise_linux_workstation:7.0

CVE-2014-0247

2014-07-03T13:55:05.780-04:00

2018-10-30T12:27:34.687-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-08-26T14:15:13.270-04:00

FEDORA FEDORA-2014-7679 SUSE openSUSE-SU-2014:0860 MISC http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-0247.html REDHAT RHSA-2015:0377 GENTOO GLSA-201408-19 BID 68151 UBUNTU USN-2253-1 MISC https://bugs.mageia.org/show_bug.cgi?id=13580 MISC https://gerrit.libreoffice.org/gitweb?p=core.git;a=blobdiff;f=sfx2/source/doc/docmacromode.cxx;h=4d4ae52b4339582a039744d03671c1db0633d6c3;hp=2108d1920f8148ff60fd4a57684f295d6d733e7b;hb=1b0402f87c9b17fef2141130bfaa1798ece6ba0d;hpb=4d2113250fa7ed62fe2c53ed0f76e3de5875cb81 CONFIRM https://www.libreoffice.org/about-us/security/advisories/cve-2014-0247/ LibreOffice 4.2.4 executes unspecified VBA macros automatically, which has unspecified impact and attack vectors, possibly related to doc/docmacromode.cxx.

cpe:/a:redhat:jboss_enterprise_application_platform:5.2.0 cpe:/a:redhat:jboss_enterprise_web_platform:5.2.0 cpe:/a:redhat:jboss_web_framework_kit:2.5.0

CVE-2014-0248

2014-07-07T10:55:03.787-04:00

2018-01-04T21:29:46.210-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2014:0785 REDHAT RHSA-2014:0791 REDHAT RHSA-2014:0792 REDHAT RHSA-2014:0793 REDHAT RHSA-2014:0794 REDHAT RHSA-2015:1888 SECUNIA 59554 SECTRACK 1030457 org.jboss.seam.web.AuthenticationFilter in Red Hat JBoss Web Framework Kit 2.5.0, JBoss Enterprise Application Platform (JBEAP) 5.2.0, and JBoss Enterprise Web Platform (JBEWP) 5.2.0 allows remote attackers to execute arbitrary code via a crafted authentication header, related to Seam logging.

cpe:/a:fedoraproject:sssd:1.11.6 cpe:/o:redhat:enterprise_linux:5 cpe:/o:redhat:enterprise_linux:6.0

CVE-2014-0249

2014-06-11T10:55:07.190-04:00

2019-04-22T13:48:00.643-04:00

3.3

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-06-12T10:12:12.413-04:00

CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1101751 MLIST [SSSD] 20140513 On POSIX and non-POSIX groups The System Security Services Daemon (SSSD) 1.11.6 does not properly identify group membership when a non-POSIX group is in a group membership chain, which allows local users to bypass access restrictions via unspecified vectors.

cpe:/a:freerdp_project:freerdp:1.0.0 cpe:/a:freerdp_project:freerdp:1.0.1 cpe:/a:freerdp_project:freerdp:1.0.2 cpe:/o:opensuse:opensuse:12.3 cpe:/o:opensuse:opensuse:13.1

CVE-2014-0250

2014-11-16T12:59:01.720-05:00

2018-10-30T12:27:34.687-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2015-11-23T12:06:43.623-05:00

CONFIRM http://advisories.mageia.org/MGASA-2014-0287.html SUSE openSUSE-SU-2014:0862 MLIST [oss-security] 20140528 freerdp: integer overflows in memory allocations in client/X11/xf_graphics.c GENTOO GLSA-201412-18 MANDRIVA MDVSA-2015:171 BID 67670 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=998934 MISC https://github.com/FreeRDP/FreeRDP/issues/1871 CONFIRM https://github.com/FreeRDP/FreeRDP/pull/1874 Multiple integer overflows in client/X11/xf_graphics.c in FreeRDP allow remote attackers to have an unspecified impact via the width and height to the (1) xf_Pointer_New or (2) xf_Bitmap_Decompress function, which causes an incorrect amount of memory to be allocated.

cpe:/a:microsoft:office_web_apps_server:2013 cpe:/a:microsoft:office_web_apps_server:2013:sp1 cpe:/a:microsoft:project_server:2010:sp1 cpe:/a:microsoft:project_server:2010:sp2 cpe:/a:microsoft:project_server:2013 cpe:/a:microsoft:project_server:2013:sp1 cpe:/a:microsoft:sharepoint_designer:2007:sp3 cpe:/a:microsoft:sharepoint_designer:2010:sp1 cpe:/a:microsoft:sharepoint_designer:2010:sp2 cpe:/a:microsoft:sharepoint_designer:2013 cpe:/a:microsoft:sharepoint_designer:2013:sp1 cpe:/a:microsoft:sharepoint_foundation:2010:sp1 cpe:/a:microsoft:sharepoint_foundation:2010:sp2 cpe:/a:microsoft:sharepoint_foundation:2013 cpe:/a:microsoft:sharepoint_foundation:2013:sp1 cpe:/a:microsoft:sharepoint_server:2007:sp3 cpe:/a:microsoft:sharepoint_server:2010:sp1 cpe:/a:microsoft:sharepoint_server:2010:sp2 cpe:/a:microsoft:sharepoint_server:2013 cpe:/a:microsoft:sharepoint_server:2013:sp1 cpe:/a:microsoft:sharepoint_server_client_components_sdk:2013 cpe:/a:microsoft:sharepoint_services:3.0:sp3 cpe:/a:microsoft:web_applications:2010:sp1 cpe:/a:microsoft:web_applications:2010:sp2

CVE-2014-0251

2014-05-14T07:13:04.177-04:00

2018-10-12T18:05:27.510-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov SECTRACK 1030227 MS MS14-022 Microsoft Windows SharePoint Services 3.0 SP3; SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 Gold and SP1; SharePoint Foundation 2010 SP1 and SP2 and 2013 Gold and SP1; Project Server 2010 SP1 and SP2 and 2013 Gold and SP1; Web Applications 2010 SP1 and SP2; Office Web Apps Server 2013 Gold and SP1; SharePoint Server 2013 Client Components SDK; and SharePoint Designer 2007 SP3, 2010 SP1 and SP2, and 2013 Gold and SP1 allow remote authenticated users to execute arbitrary code via crafted page content, aka "SharePoint Page Content Vulnerability."

CVE-2014-0252

2017-05-11T10:29:32.950-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.

cpe:/a:microsoft:.net_framework:1.1:sp1 cpe:/a:microsoft:.net_framework:2.0:sp2 cpe:/a:microsoft:.net_framework:3.5 cpe:/a:microsoft:.net_framework:3.5.1 cpe:/a:microsoft:.net_framework:4.0 cpe:/a:microsoft:.net_framework:4.5 cpe:/a:microsoft:.net_framework:4.5.1

CVE-2014-0253

2014-02-11T23:50:39.937-05:00

2018-10-12T18:05:27.777-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov OSVDB 103162 SECUNIA 56793 BID 65415 SECTRACK 1029745 MS MS14-009 Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine TCP connection states, which allows remote attackers to cause a denial of service (ASP.NET daemon hang) via crafted HTTP requests that trigger persistent resource consumption for a (1) stale or (2) closed connection, as exploited in the wild in February 2014, aka "POST Request DoS Vulnerability."

cpe:/o:microsoft:windows_8:-:-:x64 cpe:/o:microsoft:windows_8:-:-:x86 cpe:/o:microsoft:windows_rt:- cpe:/o:microsoft:windows_server_2012:-

CVE-2014-0254

2014-02-11T23:50:39.970-05:00

2018-10-12T18:05:28.353-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov OSVDB 103159 SECUNIA 56775 BID 65409 SECTRACK 1029747 MS MS14-006 XF ms-ipv6-cve20140254-dos(90755) The IPv6 implementation in Microsoft Windows 8, Windows Server 2012, and Windows RT does not properly validate packets, which allows remote attackers to cause a denial of service (system hang) via crafted ICMPv6 Router Advertisement packets, aka "TCP/IP Version 6 (IPv6) Denial of Service Vulnerability."

cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:-:sp2:datacenter cpe:/o:microsoft:windows_server_2008:-:sp2:enterprise cpe:/o:microsoft:windows_server_2008:-:sp2:enterprise_x64 cpe:/o:microsoft:windows_server_2008:-:sp2:hpc cpe:/o:microsoft:windows_server_2008:-:sp2:itanium cpe:/o:microsoft:windows_server_2008:-:sp2:standard cpe:/o:microsoft:windows_server_2008:-:sp2:storage cpe:/o:microsoft:windows_server_2008:-:sp2:web cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2::~~datacenter~~~ cpe:/o:microsoft:windows_server_2012:r2::~~essentials~~~ cpe:/o:microsoft:windows_server_2012:r2::~~standard~~~

CVE-2014-0255

2014-05-14T07:13:04.257-04:00

2019-05-08T18:03:15.720-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MS MS14-028 Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allow remote attackers to cause a denial of service (iSCSI service outage) by sending many crafted packets, aka "iSCSI Target Remote Denial of Service Vulnerability."

CVE-2014-0256

2014-05-14T07:13:04.320-04:00

2018-10-12T18:05:29.057-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MS MS14-028 Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold allow remote attackers to cause a denial of service (iSCSI service outage) by sending many crafted packets, aka "iSCSI Target Remote Denial of Service Vulnerability."

cpe:/a:microsoft:.net_framework:1.0:sp3 cpe:/a:microsoft:.net_framework:1.1:sp1 cpe:/a:microsoft:.net_framework:2.0:sp2 cpe:/a:microsoft:.net_framework:3.5 cpe:/a:microsoft:.net_framework:3.5.1 cpe:/a:microsoft:.net_framework:4.0 cpe:/a:microsoft:.net_framework:4.5 cpe:/a:microsoft:.net_framework:4.5.1

CVE-2014-0257

2014-02-11T23:50:39.987-05:00

2018-10-12T18:05:29.260-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/127246/MS14-009-.NET-Deployment-Service-IE-Sandbox-Escape.html SECUNIA 56793 EXPLOIT-DB 33892 OSVDB 103163 BID 65417 SECTRACK 1029745 MS MS14-009 Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it is safe to execute a method, which allows remote attackers to execute arbitrary code via (1) a crafted web site or (2) a crafted .NET Framework application that exposes a COM server endpoint, aka "Type Traversal Vulnerability."

cpe:/a:microsoft:office_compatibility_pack::sp3 cpe:/a:microsoft:word:2003:sp3 cpe:/a:microsoft:word:2007:sp3 cpe:/a:microsoft:word_viewer

CVE-2014-0258

2014-01-15T11:13:03.837-05:00

2018-10-12T18:05:29.947-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1029598 SECTRACK 1029599 MS MS14-001 Microsoft Word 2003 SP3 and 2007 SP3, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability."

cpe:/a:microsoft:office_compatibility_pack::sp3 cpe:/a:microsoft:word:2007:sp3

CVE-2014-0259

2014-01-15T11:13:03.850-05:00

2018-10-12T18:05:30.247-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1029598 SECTRACK 1029599 MS MS14-001 Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability."

cpe:/a:microsoft:office_compatibility_pack::sp3 cpe:/a:microsoft:office_web_apps:2010:sp1 cpe:/a:microsoft:office_web_apps:2010:sp2 cpe:/a:microsoft:office_web_apps_server:2013 cpe:/a:microsoft:sharepoint_server:2010:sp1 cpe:/a:microsoft:sharepoint_server:2010:sp2 cpe:/a:microsoft:sharepoint_server:2013 cpe:/a:microsoft:word:2003:sp3 cpe:/a:microsoft:word:2007:sp3 cpe:/a:microsoft:word:2010:sp1 cpe:/a:microsoft:word:2010:sp2 cpe:/a:microsoft:word:2013 cpe:/a:microsoft:word_viewer

CVE-2014-0260

2014-01-15T11:13:03.883-05:00

2018-10-30T12:27:52.407-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1029598 SECTRACK 1029599 MS MS14-001 Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office Compatibility Pack SP3; Word Viewer; SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability."

cpe:/a:microsoft:dynamics_ax:4.0:sp2 cpe:/a:microsoft:dynamics_ax:2009:sp1 cpe:/a:microsoft:dynamics_ax:2012 cpe:/a:microsoft:dynamics_ax:2012:r2

CVE-2014-0261

2014-01-15T11:13:03.913-05:00

2018-10-12T18:05:30.917-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1029601 MS MS14-004 Microsoft Dynamics AX 4.0 SP2, 2009 SP1, 2012, and 2012 R2 allows remote authenticated users to cause a denial of service (instance outage) via crafted data to an Application Object Server (AOS) instance, aka "Query Filter DoS Vulnerability."

cpe:/o:microsoft:windows_7::sp1:x64 cpe:/o:microsoft:windows_7::sp1:x86 cpe:/o:microsoft:windows_server_2008:r2:sp1:itanium cpe:/o:microsoft:windows_server_2008:r2:sp1:x64

CVE-2014-0262

2014-01-15T11:13:03.930-05:00

2018-10-12T18:05:31.153-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 64725 SECTRACK 1029600 MS MS14-003 win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1 and Server 2008 R2 SP1 does not properly consider thread-owned objects during the processing of window handles, which allows local users to gain privileges via a crafted application, aka "Win32k Window Handle Vulnerability."

CVE-2014-0263

2014-02-11T23:50:40.033-05:00

2019-05-14T10:10:17.773-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-13T12:06:23.467-04:00

SECUNIA 56781 BID 65393 SECTRACK 1029743 MS MS14-007 The Direct2D implementation in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a large 2D geometric figure that is encountered with Internet Explorer, aka "Microsoft Graphics Component Memory Corruption Vulnerability."

CVE-2014-0264

2017-05-11T10:29:32.983-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.

CVE-2014-0265

2017-05-11T10:29:32.997-04:00

2017-05-11T10:29:33.013-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.

cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8:- cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2003:-:sp2 cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_vista:-:sp2 cpe:/o:microsoft:windows_xp:-:sp2:~~professional~~~ cpe:/o:microsoft:windows_xp:-:sp3

CVE-2014-0266

2014-02-11T23:50:40.063-05:00

2019-05-13T15:19:24.603-04:00

7.1

NETWORK

MEDIUM

NONE

COMPLETE

NONE

http://nvd.nist.gov

2019-05-13T12:13:29.467-04:00

SECUNIA 56771 SECTRACK 1029746 MS MS14-005 The XMLHTTP ActiveX controls in XML Core Services 3.0 in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to bypass the Same Origin Policy via a web page that is visited in Internet Explorer, aka "MSXML Information Disclosure Vulnerability."

cpe:/a:microsoft:internet_explorer:11:-

CVE-2014-0267

2014-02-11T23:50:40.077-05:00

2018-10-12T18:05:32.433-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov OSVDB 103168 SECUNIA 56796 BID 65361 SECTRACK 1029741 MS MS14-010 XF ms-ie-cve20140267-code-exec(90759) Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0289 and CVE-2014-0290.

cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2014-0268

2014-02-11T23:50:40.110-05:00

2018-10-12T18:05:32.917-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov OSVDB 103165 SECUNIA 56796 BID 65392 SECTRACK 1029741 MS MS14-010 XF ms-ie-cve20140268-priv-esc(90756) Microsoft Internet Explorer 8 through 11 does not properly restrict file installation and registry-key creation, which allows remote attackers to bypass the Mandatory Integrity Control protection mechanism via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."

cpe:/a:microsoft:internet_explorer:6 cpe:/a:microsoft:internet_explorer:7 cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10

CVE-2014-0269

2014-02-11T23:50:40.140-05:00

2018-10-12T18:05:33.450-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov OSVDB 103169 SECUNIA 56796 BID 65363 SECTRACK 1029741 MS MS14-010 XF ms-ie-cve20140269-code-exec(90760) Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2014-0270

2014-02-11T23:50:40.157-05:00

2018-10-12T18:05:34.073-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov OSVDB 103170 SECUNIA 56796 BID 65367 SECTRACK 1029741 MS MS14-010 XF ms-ie-cve20140270-code-exec(90761) Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0273, CVE-2014-0274, and CVE-2014-0288.

cpe:/a:microsoft:internet_explorer:6 cpe:/a:microsoft:internet_explorer:7 cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:- cpe:/a:microsoft:vbscript:5.6 cpe:/a:microsoft:vbscript:5.7 cpe:/a:microsoft:vbscript:5.8

CVE-2014-0271

2014-02-11T23:50:40.187-05:00

2018-10-12T18:05:34.637-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov OSVDB 103166 SECUNIA 56796 SECUNIA 56814 BID 65395 SECTRACK 1029741 MS MS14-010 MS MS14-011 XF ms-ie-cve20140271-code-exec(90757) The VBScript engine in Microsoft Internet Explorer 6 through 11, and VBScript 5.6 through 5.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "VBScript Memory Corruption Vulnerability."

cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10

CVE-2014-0272

2014-02-11T23:50:40.220-05:00

2018-10-12T18:05:35.607-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov OSVDB 103171 SECUNIA 56796 BID 65370 SECTRACK 1029741 MS MS14-010 XF ms-ie-cve20140272-code-exec(90762) Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2014-0273

2014-02-11T23:50:40.237-05:00

2018-10-12T18:05:36.137-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov OSVDB 103172 SECUNIA 56796 BID 65371 SECTRACK 1029741 MS MS14-010 XF ms-ie-cve20140273-code-exec(90763) Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0270, CVE-2014-0274, and CVE-2014-0288.

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2014-0274

2014-02-11T23:50:40.267-05:00

2018-10-12T18:05:36.857-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov OSVDB 103173 SECUNIA 56796 BID 65372 SECTRACK 1029741 MS MS14-010 XF ms-ie-cve20140274-code-exec(90764) Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0270, CVE-2014-0273, and CVE-2014-0288.

CVE-2014-0275

2014-02-11T23:50:40.283-05:00

2018-10-12T18:05:37.607-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov OSVDB 103174 SECUNIA 56796 BID 65373 SECTRACK 1029741 MS MS14-010 XF ms-ie-cve20140275-code-exec(90765) Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0285 and CVE-2014-0286.

cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9

CVE-2014-0276

2014-02-11T23:50:40.313-05:00

2018-10-12T18:05:38.167-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov OSVDB 103175 SECUNIA 56796 BID 65375 SECTRACK 1029741 MS MS14-010 XF ms-ie-cve20140276-code-exec(90766) Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

cpe:/a:microsoft:internet_explorer:8

CVE-2014-0277

2014-02-11T23:50:40.327-05:00

2018-10-12T18:05:38.840-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov HP HPSBOV03503 OSVDB 103176 SECUNIA 56796 BID 65376 SECTRACK 1029741 MS MS14-010 XF ms-ie-cve20140277-code-exec(90767) CONFIRM https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013 Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0278 and CVE-2014-0279.

cpe:/a:microsoft:internet_explorer:8

CVE-2014-0278

2014-02-11T23:50:40.360-05:00

2018-10-12T18:05:39.620-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov OSVDB 103177 SECUNIA 56796 BID 65377 SECTRACK 1029741 MS MS14-010 XF ms-ie-cve20140278-code-exec(90768) Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0277 and CVE-2014-0279.

cpe:/a:microsoft:internet_explorer:8

CVE-2014-0279

2014-02-11T23:50:40.377-05:00

2018-10-12T18:05:40.277-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov OSVDB 103178 SECUNIA 56796 BID 65378 SECTRACK 1029741 MS MS14-010 XF ms-ie-cve20140279-code-exec(90769) Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0277 and CVE-2014-0278.

cpe:/a:microsoft:internet_explorer:6 cpe:/a:microsoft:internet_explorer:7 cpe:/a:microsoft:internet_explorer:8

CVE-2014-0280

2014-02-11T23:50:40.407-05:00

2018-10-12T18:05:40.933-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov OSVDB 103179 SECUNIA 56796 BID 65380 SECTRACK 1029741 MS MS14-010 XF ms-ie-cve20140280-code-exec(90770) Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2014-0281

2014-02-11T23:50:40.423-05:00

2018-10-12T18:05:41.513-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov OSVDB 103180 SECUNIA 56796 BID 65381 SECTRACK 1029741 MS MS14-010 XF ms-ie-cve20140281-code-exec(90771) Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0287.

CVE-2014-0282

2014-06-11T00:56:16.350-04:00

2018-10-12T18:05:42.090-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov EXPLOIT-DB 33860 OSVDB 107851 BID 67862 SECTRACK 1030370 MS MS14-035 Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1775, CVE-2014-1779, CVE-2014-1799, CVE-2014-1803, and CVE-2014-2757.

cpe:/a:microsoft:internet_explorer:9

CVE-2014-0283

2014-02-11T23:50:40.453-05:00

2018-10-12T18:05:42.560-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov OSVDB 103181 SECUNIA 56796 BID 65382 SECTRACK 1029741 MS MS14-010 XF ms-ie-cve20140283-code-exec(90773) Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10

CVE-2014-0284

2014-02-11T23:50:40.470-05:00

2018-10-12T18:05:43.073-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov OSVDB 103182 SECUNIA 56796 BID 65383 SECTRACK 1029741 MS MS14-010 XF ms-ie-cve20140284-code-exec(90774) Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

CVE-2014-0285

2014-02-11T23:50:40.500-05:00

2018-10-12T18:05:43.527-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov OSVDB 103183 SECUNIA 56796 BID 65384 SECTRACK 1029741 MS MS14-010 XF ms-ie-cve20140285-code-exec(90775) Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0275 and CVE-2014-0286.

CVE-2014-0286

2014-02-11T23:50:40.517-05:00

2018-10-12T18:05:44.090-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov OSVDB 103184 SECUNIA 56796 BID 65385 SECTRACK 1029741 MS MS14-010 XF ms-ie-cve20140286-code-exec(90776) Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0275 and CVE-2014-0285.

cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2014-0287

2014-02-11T23:50:40.547-05:00

2018-10-12T18:05:44.620-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov OSVDB 103185 SECUNIA 56796 BID 65386 SECTRACK 1029741 MS MS14-010 XF ms-ie-cve20140287-code-exec(90777) Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0281.

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2014-0288

2014-02-11T23:50:40.563-05:00

2018-10-12T18:05:45.230-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov OSVDB 103186 SECUNIA 56796 BID 65388 SECTRACK 1029741 MS MS14-010 XF ms-ie-cve20140288-code-exec(90778) Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0270, CVE-2014-0273, and CVE-2014-0274.

cpe:/a:microsoft:internet_explorer:11:-

CVE-2014-0289

2014-02-11T23:50:40.593-05:00

2018-10-12T18:05:45.903-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov OSVDB 103187 SECUNIA 56796 BID 65389 SECTRACK 1029741 MS MS14-010 XF ms-ie-cve20140289-code-exec(90779) Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0267 and CVE-2014-0290.

cpe:/a:microsoft:internet_explorer:11:-

CVE-2014-0290

2014-02-11T23:50:40.627-05:00

2018-10-12T18:05:46.433-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov OSVDB 103188 SECUNIA 56796 BID 65390 SECTRACK 1029741 MS MS14-010 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0267 and CVE-2014-0289.

CVE-2014-0291

2017-05-11T10:29:33.027-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.

CVE-2014-0292

2016-02-23T00:59:00.107-05:00

2016-02-23T00:59:00.200-05:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue requiring a CVE ID. Notes: none.

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2014-0293

2014-02-11T23:50:40.640-05:00

2018-10-12T18:05:46.917-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov OSVDB 103167 SECUNIA 56796 BID 65394 SECTRACK 1029741 MS MS14-010 XF ms-ie-cve20140293-info-disc(90758) Microsoft Internet Explorer 9 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability."

cpe:/a:microsoft:microsoft_forefront_protection_2010:-::~~~exchange_server~~

CVE-2014-0294

2014-02-11T23:50:40.673-05:00

2018-10-12T18:05:47.497-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov OSVDB 103161 SECUNIA 56788 BID 65397 SECTRACK 1029744 MS MS14-008 Microsoft Forefront Protection 2010 for Exchange Server does not properly parse e-mail content, which might allow remote attackers to execute arbitrary code via a crafted message, aka "RCE Vulnerability."

cpe:/a:microsoft:.net_framework:2.0:sp2 cpe:/a:microsoft:.net_framework:3.5.1

CVE-2014-0295

2014-02-11T23:50:41.283-05:00

2018-10-12T18:05:47.917-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov OSVDB 103164 SECUNIA 56793 MISC http://www.greyhathacker.net/?p=585 BID 65418 SECTRACK 1029745 MS MS14-009 VsaVb7rt.dll in Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not implement the ASLR protection mechanism, which makes it easier for remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in February 2014, aka "VSAVB7RT ASLR Vulnerability."

cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8:- cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2

CVE-2014-0296

2014-06-11T00:56:16.430-04:00

2019-05-15T10:11:24.843-04:00

5.1

NETWORK

HIGH

NONE

PARTIAL

http://nvd.nist.gov

2019-05-15T09:41:39.620-04:00

CONFIRM http://blogs.technet.com/b/srd/archive/2014/06/10/assessing-risk-for-the-june-2014-security-updates.aspx BID 67865 MS MS14-030 The Remote Desktop Protocol (RDP) implementation in Microsoft Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly encrypt sessions, which makes it easier for man-in-the-middle attackers to obtain sensitive information by sniffing the network or modify session content by sending crafted RDP packets, aka "RDP MAC Vulnerability."

cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2014-0297

2014-03-12T01:15:19.333-04:00

2018-10-12T18:05:49.043-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MS MS14-012 Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0308, CVE-2014-0312, and CVE-2014-0324.

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2014-0298

2014-03-12T01:15:19.367-04:00

2018-10-12T18:05:49.217-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MS MS14-012 Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

CVE-2014-0299

2014-03-12T01:15:19.397-04:00

2018-10-12T18:05:49.373-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MS MS14-012 Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0305 and CVE-2014-0311.

CVE-2014-0300

2014-03-12T01:15:19.413-04:00

2019-05-13T14:21:07.957-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-05-13T13:00:10.060-04:00

MS MS14-015 win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."

cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8:- cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_server_2003:-:sp2 cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_vista:-:sp2 cpe:/o:microsoft:windows_xp:-:sp2:~~professional~~~ cpe:/o:microsoft:windows_xp:-:sp3

CVE-2014-0301

2014-03-12T01:15:19.443-04:00

2019-05-13T15:22:30.857-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-13T12:47:14.183-04:00

MS MS14-013 Double free vulnerability in qedit.dll in DirectShow in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via a crafted JPEG image, aka "DirectShow Memory Corruption Vulnerability."

cpe:/a:microsoft:internet_explorer:6 cpe:/a:microsoft:internet_explorer:7 cpe:/a:microsoft:internet_explorer:8

CVE-2014-0302

2014-03-12T01:15:19.460-04:00

2018-10-12T18:05:49.873-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MS MS14-012 Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0303.

cpe:/a:microsoft:internet_explorer:6 cpe:/a:microsoft:internet_explorer:7 cpe:/a:microsoft:internet_explorer:8

CVE-2014-0303

2014-03-12T01:15:19.473-04:00

2018-10-12T18:05:49.997-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

cpe:/a:microsoft:internet_explorer:11:-

CVE-2014-0304

2014-03-12T01:15:19.507-04:00

2018-10-12T18:05:50.170-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MS MS14-012 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

CVE-2014-0305

2014-03-12T01:15:19.520-04:00

2018-10-12T18:05:50.357-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9

CVE-2014-0306

2014-03-12T01:15:19.553-04:00

2018-10-12T18:05:50.527-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MS MS14-012 Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

cpe:/a:microsoft:internet_explorer:9

CVE-2014-0307

2014-03-12T01:15:19.567-04:00

2018-10-12T18:05:50.717-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov EXPLOIT-DB 32438 MS MS14-012 Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a certain sequence of manipulations of a TextRange element, aka "Internet Explorer Memory Corruption Vulnerability."

cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2014-0308

2014-03-12T01:15:19.600-04:00

2018-10-12T18:05:50.933-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10

CVE-2014-0309

2014-03-12T01:15:19.630-04:00

2018-10-12T18:05:51.107-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MS MS14-012 Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

CVE-2014-0310

2014-05-14T07:13:04.380-04:00

2018-10-12T18:05:51.277-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MS MS14-029 Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1815.

CVE-2014-0311

2014-03-12T01:15:19.677-04:00

2018-10-12T18:05:51.420-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2014-0312

2014-03-12T01:15:19.723-04:00

2018-10-12T18:05:51.560-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2014-0313

2014-03-12T01:15:19.770-04:00

2018-10-12T18:05:51.747-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MS MS14-012 Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0321.

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10

CVE-2014-0314

2014-03-12T01:15:19.833-04:00

2018-10-12T18:05:51.950-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MS MS14-012 Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

CVE-2014-0315

2014-04-08T19:55:05.853-04:00

2019-05-13T15:29:32.910-04:00

6.9

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-13T12:53:47.960-04:00

CONFIRM http://blogs.technet.com/b/srd/archive/2014/04/08/ms14-019-fixing-a-binary-hijacking-via-cmd-or-bat-file.aspx MS MS14-019 Untrusted search path vulnerability in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a Trojan horse cmd.exe file in the current working directory, as demonstrated by a directory that contains a .bat or .cmd file, aka "Windows File Handling Vulnerability."

CVE-2014-0316

2014-08-12T17:55:06.117-04:00

2019-05-13T14:35:54.480-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-05-13T13:06:53.647-04:00

SECTRACK 1030722 MS MS14-047 Memory leak in the Local RPC (LRPC) server implementation in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to cause a denial of service (memory consumption) and bypass the ASLR protection mechanism via a crafted client that sends messages with an invalid data view, aka "LRPC ASLR Bypass Vulnerability."

cpe:/o:microsoft:windows_server_2003::sp2 cpe:/o:microsoft:windows_server_2008::sp2:x64 cpe:/o:microsoft:windows_server_2008::sp2:x86 cpe:/o:microsoft:windows_server_2008:r2:sp1:x64 cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2::~~datacenter~~~ cpe:/o:microsoft:windows_server_2012:r2::~~essentials~~~ cpe:/o:microsoft:windows_server_2012:r2::~~standard~~~ cpe:/o:microsoft:windows_vista::sp2 cpe:/o:microsoft:windows_vista::sp2:x64 cpe:/o:microsoft:windows_xp::sp3 cpe:/o:microsoft:windows_xp:-:sp2:x64

CVE-2014-0317

2014-03-12T01:15:19.897-04:00

2019-05-08T18:03:15.720-04:00

5.4

NETWORK

HIGH

NONE

COMPLETE

NONE

http://nvd.nist.gov MS MS14-016 The Security Account Manager Remote (SAMR) protocol implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2 does not properly determine the user-lockout state, which makes it easier for remote attackers to bypass the account lockout policy and obtain access via a brute-force attack, aka "SAMR Security Feature Bypass Vulnerability."

CVE-2014-0318

2014-08-12T17:55:06.163-04:00

2019-05-15T13:29:30.173-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-05-15T09:18:10.827-04:00

SECUNIA 60673 BID 69142 MS MS14-045 win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly control access to thread-owned objects, which allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."

cpe:/a:microsoft:silverlight:5.0.60401.0 cpe:/a:microsoft:silverlight:5.0.60818.0 cpe:/a:microsoft:silverlight:5.0.60818.0:rc cpe:/a:microsoft:silverlight:5.0.61118.0 cpe:/a:microsoft:silverlight:5.1.10411.0 cpe:/a:microsoft:silverlight:5.1.20125.0 cpe:/a:microsoft:silverlight:5.1.20513.0 cpe:/a:microsoft:silverlight:5.1.20913.0

CVE-2014-0319

2014-03-12T01:15:19.943-04:00

2018-10-12T18:05:53.263-04:00

7.1

NETWORK

MEDIUM

NONE

COMPLETE

NONE

http://nvd.nist.gov MS MS14-014 Microsoft Silverlight 5 before 5.1.30214.0 and Silverlight 5 Developer Runtime before 5.1.30214.0 allow attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors, aka "Silverlight DEP/ASLR Bypass Vulnerability."

CVE-2014-0320

2017-05-11T10:29:33.060-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.

cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2014-0321

2014-03-12T01:15:20.007-04:00

2018-10-12T18:05:53.403-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10

CVE-2014-0322

2014-02-14T11:55:07.500-05:00

2018-10-12T18:05:53.590-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MISC http://community.websense.com/blogs/securitylabs/archive/2014/02/13/msie-0-day-exploit-cve-2014-0322-possibly-targeting-french-aerospace-organization.aspx CONFIRM http://technet.microsoft.com/security/advisory/2934088 MISC http://twitter.com/nanoc0re/statuses/434251658344673281 EXPLOIT-DB 32851 EXPLOIT-DB 32904 MISC http://www.fireeye.com/blog/technical/cyber-exploits/2014/02/new-ie-zero-day-found-in-watering-hole-attack-2.html MISC http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html CERT-VN VU#732479 MS MS14-012 MISC https://www.dropbox.com/s/pyxjgycmudirbqe/CVE-2014-0322.zip Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014.

CVE-2014-0323

2014-03-12T01:15:20.037-04:00

2019-05-13T14:31:16.110-04:00

6.6

LOCAL

LOW

NONE

COMPLETE

NONE

COMPLETE

http://nvd.nist.gov

2019-05-13T12:59:51.717-04:00

MS MS14-015 win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (system hang) via a crafted application, aka "Win32k Information Disclosure Vulnerability."

cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2014-0324

2014-03-12T01:15:20.067-04:00

2018-10-12T18:05:55.107-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

cpe:/a:microsoft:internet_explorer:9

CVE-2014-0325

2014-07-03T10:55:06.440-04:00

2018-10-12T18:05:55.247-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 66646 MISC http://zerodayinitiative.com/advisories/ZDI-14-078/ MS MS14-018 Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site that triggers improper processing of CElement objects, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1751 and CVE-2014-1755. NOTE: MS14-018 originally had a typo of CVE-2014-0235 for this.

cpe:/h:iridium:open_port:- cpe:/h:iridium:pilot_below_deck_equipment:-

CVE-2014-0326

2014-08-17T19:55:04.027-04:00

2014-08-28T14:57:10.853-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2014-08-18T11:34:09.467-04:00

CERT-VN VU#578598 The Pilot Below Deck Equipment (BDE) and OpenPort implementations on Iridium satellite terminals allow remote attackers to read hardcoded credentials via the web interface.

cpe:/h:iridium:open_port:- cpe:/h:iridium:pilot_below_deck_equipment:-

CVE-2014-0327

2014-08-17T19:55:04.087-04:00

2014-08-28T14:57:45.373-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2014-08-18T11:33:52.983-04:00

CERT-VN VU#578598 The Terminal Upgrade Tool in the Pilot Below Deck Equipment (BDE) and OpenPort implementations on Iridium satellite terminals allows remote attackers to execute arbitrary code by uploading new firmware to TCP port 54321.

cpe:/h:cobham:ailor_6110_mini-c_gmdss:- cpe:/h:cobham:sailor_6006_message_terminal:- cpe:/h:cobham:sailor_6222_vhf:- cpe:/h:cobham:sailor_6300_mf_%2f_hf:-

CVE-2014-0328

2014-08-15T07:15:42.903-04:00

2014-08-15T12:58:29.930-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2014-08-15T12:58:29.727-04:00

CERT-VN VU#179732 The thraneLINK protocol implementation on Cobham devices does not verify firmware signatures, which allows attackers to execute arbitrary code by leveraging physical access or terminal access to send an SNMP request and a TFTP response.

cpe:/h:zte:zxv10_w300:2.1.0

CVE-2014-0329

2014-02-04T00:39:08.450-05:00

2017-08-28T21:34:08.437-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MISC http://blog.alguien.at/2014/02/hackeando-el-router-zte-zxv10-w300-v21.html MISC http://packetstormsecurity.com/files/125142/ZTE-ZXV10-W300-Hardcoded-Credentials.html CERT-VN VU#228886 BID 65310 XF zxv10-w300-cve20140329-sec-bypass(90958) The TELNET service on the ZTE ZXV10 W300 router 2.1.0 has a hardcoded password ending with airocon for the admin account, which allows remote attackers to obtain administrative access by leveraging knowledge of the MAC address characters present at the beginning of the password.

cpe:/a:dell:kace_k1000_systems_management_appliance_software:5.5.90545 cpe:/h:dell:kace_k1000_systems_management_appliance:-

CVE-2014-0330

2014-02-06T18:55:03.993-05:00

2018-01-02T21:29:02.880-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov OSVDB 102855 CERT-VN VU#813382 BID 65333 XF kace-cve20140330-xss(90954) Cross-site scripting (XSS) vulnerability in adminui/user_list.php on the Dell KACE K1000 management appliance 5.5.90545 allows remote attackers to inject arbitrary web script or HTML via the LABEL_ID parameter.

cpe:/h:fortinet:fortiadc-1000e:- cpe:/h:fortinet:fortiadc-1500d:- cpe:/h:fortinet:fortiadc-2000d:- cpe:/h:fortinet:fortiadc-200d:- cpe:/h:fortinet:fortiadc-300e:- cpe:/h:fortinet:fortiadc-4000d:- cpe:/h:fortinet:fortiadc-400e:- cpe:/h:fortinet:fortiadc-600e:- cpe:/o:fortinet:fortiadc_firmware:3.2.0

CVE-2014-0331

2014-04-10T16:29:20.440-04:00

2017-12-15T21:29:03.793-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov FULLDISC 20140403 XSS Reflected vulnerabilities in OS of FortiADC v3.2 (CVE-2014-0331) CONFIRM http://www.fortiguard.com/advisory/FG-IR-14-004 CERT-VN VU#667340 BID 66642 SECTRACK 1030018 Cross-site scripting (XSS) vulnerability in the web administration interface in FortiADC with firmware before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via the locale parameter to gui_partA/.

cpe:/a:sonicwall:analyzer:7.0 cpe:/a:sonicwall:analyzer:7.1 cpe:/a:sonicwall:analyzer:7.1:sp1 cpe:/a:sonicwall:global_management_system:7.0 cpe:/a:sonicwall:global_management_system:7.1 cpe:/a:sonicwall:global_management_system:7.1:sp1

CVE-2014-0332

2014-02-14T11:55:08.030-05:00

2018-03-12T13:23:19.040-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-03-08T12:35:59.600-05:00

CERT-VN VU#727318 BID 65498 CONFIRM http://www.sonicwall.com/us/shared/download/Support_Bulletin_GMS_Vulnerability_XSS_Resolved_in_7.1_SP2_and_7.2.pdf XF sonicwall-cve20140332-nodeid-xss(91062) Cross-site scripting (XSS) vulnerability in mainPage in Dell SonicWALL GMS before 7.1 SP2, SonicWALL Analyzer before 7.1 SP2, and SonicWALL UMA E5000 before 7.1 SP2 might allow remote attackers to inject arbitrary web script or HTML via the node_id parameter in a ScreenDisplayManager genNetwork action.

cpe:/a:libpng:libpng:1.6.0 cpe:/a:libpng:libpng:1.6.0:beta cpe:/a:libpng:libpng:1.6.1 cpe:/a:libpng:libpng:1.6.1:beta cpe:/a:libpng:libpng:1.6.2 cpe:/a:libpng:libpng:1.6.2:beta cpe:/a:libpng:libpng:1.6.3 cpe:/a:libpng:libpng:1.6.3:beta cpe:/a:libpng:libpng:1.6.4 cpe:/a:libpng:libpng:1.6.4:beta cpe:/a:libpng:libpng:1.6.5 cpe:/a:libpng:libpng:1.6.6 cpe:/a:libpng:libpng:1.6.7 cpe:/a:libpng:libpng:1.6.7:beta cpe:/a:libpng:libpng:1.6.8 cpe:/a:libpng:libpng:1.6.8:beta cpe:/a:libpng:libpng:1.6.9 cpe:/a:libpng:libpng:1.6.9:beta

CVE-2014-0333

2014-02-27T15:55:04.850-05:00

2014-03-26T00:56:09.813-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM ftp://ftp.simplesystems.org/pub/png/src/libpng16/patch-libpng16-vu684412.diff SUSE openSUSE-SU-2014:0358 CERT-VN VU#684412 CONFIRM https://sourceforge.net/projects/libpng/files/libpng16/patch-libpng16-vu684412.diff The png_push_read_chunk function in pngpread.c in the progressive decoder in libpng 1.6.x through 1.6.9 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an IDAT chunk with a length of zero.

cpe:/a:cmsmadesimple:cms_made_simple

CVE-2014-0334

2014-03-02T12:55:02.720-05:00

2015-07-24T14:32:18.403-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2015-07-24T14:23:40.927-04:00

CERT-VN VU#526062 BID 65898 Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via (1) the group parameter to admin/addgroup.php, (2) the htmlblob parameter to admin/addhtmlblob.php, the (3) title or (4) url parameter to admin/addbookmark.php, (5) the stylesheet_name parameter to admin/copystylesheet.php, (6) the template_name parameter to admin/copytemplate.php, the (7) title or (8) url parameter to admin/editbookmark.php, (9) the template parameter to admin/listtemplates.php, or (10) the css_name parameter to admin/listcss.php, a different issue than CVE-2014-2092.

cpe:/a:serena:dimensions_cm:12.2:build7.199.0

CVE-2014-0335

2014-03-06T06:55:05.130-05:00

2014-03-07T14:19:21.430-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-03-06T11:21:03.383-05:00

CERT-VN VU#823452 Multiple cross-site scripting (XSS) vulnerabilities in the web client in Serena Dimensions CM 12.2 build 7.199.0 allow remote attackers to inject arbitrary web script or HTML via the (1) DB_CONN, (2) DB_NAME, (3) DM_HOST, (4) MAN_DB_NAME, (5) framecmd, (6) identifier, (7) merant.adm.adapters.AdmDialogPropertyMgr, (8) nav_frame, (9) nav_jsp, (10) target_frame, (11) id, or (12) type parameter to the dimensions/ URI.

cpe:/a:serena:dimensions_cm:12.2:build7.199.0

CVE-2014-0336

2014-03-06T06:55:05.147-05:00

2014-03-07T14:19:02.663-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2014-03-06T11:24:31.217-05:00

CERT-VN VU#823452 Cross-site request forgery (CSRF) vulnerability in the web client in Serena Dimensions CM 12.2 build 7.199.0 allows remote attackers to hijack the authentication of administrators for requests that use the user_new_master parameter to the adminconsole/ URI.

cpe:/h:huawei:echo_life:hg8247 cpe:/o:huawei:echo_life_hg8247_firmware:v1r006c00s120

CVE-2014-0337

2014-04-05T00:01:37.547-04:00

2014-04-07T10:36:28.637-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-04-07T10:36:28.573-04:00

CERT-VN VU#917700 Cross-site scripting (XSS) vulnerability in the web interface on Huawei Echo Life HG8247 routers with software before V100R006C00SPC127 allows remote attackers to inject arbitrary web script or HTML via an invalid TELNET connection attempt with a crafted username that is not properly handled during construction of the "failed log-in attempts over telnet" log view.

cpe:/o:watchguard:fireware:11.6 cpe:/o:watchguard:fireware:11.6.1 cpe:/o:watchguard:fireware:11.6.3 cpe:/o:watchguard:fireware:11.6.5 cpe:/o:watchguard:fireware:11.6.6 cpe:/o:watchguard:fireware:11.7 cpe:/o:watchguard:fireware:11.7.2 cpe:/o:watchguard:fireware:11.7.3 cpe:/o:watchguard:fireware:11.7.4 cpe:/o:watchguard:fireware:11.8 cpe:/o:watchguard:fireware:11.8.1

CVE-2014-0338

2014-03-16T10:06:45.117-04:00

2015-07-24T14:33:14.490-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2015-07-24T14:23:04.977-04:00

FULLDISC 20140313 WatchGuard Fireware XTM devices contain a cross-site scripting vulnerability (CVE-2014-0338) CONFIRM http://watchguardsecuritycenter.com/2014/03/13/fireware-xtm-11-8-3-update-corrects-xss-flaw/ CERT-VN VU#807134 BID 66210 SECTRACK 1029924 Multiple cross-site scripting (XSS) vulnerabilities in the firewall policy management pages in WatchGuard Fireware XTM before 11.8.3 allow remote attackers to inject arbitrary web script or HTML via the pol_name parameter.

cpe:/a:webmin:webmin:1.600 cpe:/a:webmin:webmin:1.610 cpe:/a:webmin:webmin:1.620 cpe:/a:webmin:webmin:1.630 cpe:/a:webmin:webmin:1.640 cpe:/a:webmin:webmin:1.650 cpe:/a:webmin:webmin:1.660 cpe:/a:webmin:webmin:1.670

CVE-2014-0339

2014-03-16T10:06:45.147-04:00

2015-07-24T14:35:18.840-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2015-07-24T14:22:26.683-04:00

FULLDISC 20140315 Reflected XSS Attacks XSS vulnerabilities in Webmin 1.670 (CVE-2014-0339) CERT-VN VU#381692 BID 66248 CONFIRM http://www.webmin.com/changes.html CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21679713 Cross-site scripting (XSS) vulnerability in view.cgi in Webmin before 1.680 allows remote attackers to inject arbitrary web script or HTML via the search parameter.

cpe:/a:pivotx:pivotx:2.1.0 cpe:/a:pivotx:pivotx:2.1.1 cpe:/a:pivotx:pivotx:2.1.2 cpe:/a:pivotx:pivotx:2.2.0 cpe:/a:pivotx:pivotx:2.2.0:b1 cpe:/a:pivotx:pivotx:2.2.0:b2 cpe:/a:pivotx:pivotx:2.2.0:rc cpe:/a:pivotx:pivotx:2.2.1 cpe:/a:pivotx:pivotx:2.2.2 cpe:/a:pivotx:pivotx:2.2.3 cpe:/a:pivotx:pivotx:2.2.5 cpe:/a:pivotx:pivotx:2.3.0 cpe:/a:pivotx:pivotx:2.3.2 cpe:/a:pivotx:pivotx:2.3.3 cpe:/a:pivotx:pivotx:2.3.5 cpe:/a:pivotx:pivotx:2.3.6 cpe:/a:pivotx:pivotx:2.3.7 cpe:/a:pivotx:pivotx:2.3.8

CVE-2014-0341

2014-04-15T06:55:11.870-04:00

2015-07-24T14:35:38.277-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2015-07-24T14:21:07.077-04:00

CONFIRM http://blog.pivotx.net/archive/2014/03/03/pivotx-239-released CONFIRM http://pivotx.net/page/security CONFIRM http://sourceforge.net/p/pivot-weblog/code/4345/ CONFIRM http://sourceforge.net/p/pivot-weblog/code/4349/ CERT-VN VU#901156 BID 66800 Multiple cross-site scripting (XSS) vulnerabilities in PivotX before 2.3.9 allow remote authenticated users to inject arbitrary web script or HTML via the title field to (1) templates_internal/pages.tpl, (2) templates_internal/home.tpl, or (3) templates_internal/entries.tpl; (4) an event field to objects.php; or the (5) email or (6) nickname field to pages.php, related to templates_internal/users.tpl.

CVE-2014-0342

2014-04-15T06:55:11.900-04:00

2014-04-15T12:39:56.837-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-04-15T12:39:56.727-04:00

CONFIRM http://blog.pivotx.net/archive/2014/03/03/pivotx-239-released CONFIRM http://pivotx.net/page/security CONFIRM http://sourceforge.net/p/pivot-weblog/code/4347/ CERT-VN VU#901156 Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .php or (2) .php# extension, and then accessing it via unspecified vectors.

cpe:/h:virtualaccess:gw6110a:- cpe:/o:virtualaccess:gw6110a_firmware:9.00 cpe:/o:virtualaccess:gw6110a_firmware:9.50 cpe:/o:virtualaccess:gw6110a_firmware:10.00

CVE-2014-0343

2014-03-25T16:55:07.027-04:00

2014-03-26T11:48:18.507-04:00

4.9

ADJACENT_NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2014-03-26T11:48:18.443-04:00

CERT-VN VU#213046 The web interface on Virtual Access GW6110A routers with software 9.00 before 9.09.27, 9.50 before 9.50.21, and 10.00 before 10.00.21 allows remote authenticated users to gain privileges via a modified JavaScript variable.

cpe:/a:zohocorp:manageengine_opstor:8.3

CVE-2014-0344

2014-03-29T16:55:04.060-04:00

2015-07-24T14:38:21.077-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2015-07-24T14:20:55.347-04:00

CERT-VN VU#140886 BID 66499 Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter.

CVE-2014-0346

2014-04-07T18:55:03.940-04:00

2014-04-07T18:55:04.020-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-0160. Reason: This candidate is a reservation duplicate of CVE-2014-0160. Notes: All CVE users should reference CVE-2014-0160 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:websense:triton_unified_security_center:7.7.3 cpe:/a:websense:triton_web_filter:7.7.3 cpe:/a:websense:triton_web_security:7.7.3 cpe:/a:websense:triton_web_security_gateway:7.7.3 cpe:/a:websense:triton_web_security_gateway_anywhere:7.7.3

CVE-2014-0347

2014-04-12T00:37:31.377-04:00

2014-04-14T13:39:34.860-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2014-04-14T13:39:23.983-04:00

CERT-VN VU#568252 CONFIRM https://www.websense.com/content/mywebsense-hotfixes.aspx?patchid=894&prodidx=20&osidx=0&intidx=0&versionidx=0 The Settings module in Websense Triton Unified Security Center 7.7.3 before Hotfix 31, Web Filter 7.7.3 before Hotfix 31, Web Security 7.7.3 before Hotfix 31, Web Security Gateway 7.7.3 before Hotfix 31, and Web Security Gateway Anywhere 7.7.3 before Hotfix 31 allows remote authenticated users to read cleartext passwords by replacing type="password" with type="text" in an INPUT element in the (1) Log Database or (2) User Directories component.

cpe:/a:ontariosystems:artiva_architect:3.2:mr5 cpe:/a:ontariosystems:artiva_healthcare:5.2:mr5 cpe:/a:ontariosystems:artiva_rm:3.1:mr7 cpe:/a:ontariosystems:artiva_workstation:1.3.0

CVE-2014-0348

2014-04-15T06:55:11.947-04:00

2014-04-15T12:57:11.933-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2014-04-15T12:57:11.637-04:00

CERT-VN VU#215284 The Artiva Agency Single Sign-On (SSO) implementation in Artiva Workstation 1.3.x before 1.3.9, Artiva Rm 3.1 MR7, Artiva Healthcare 5.2 MR5, and Artiva Architect 3.2 MR5, when the domain-name option is enabled, allows remote attackers to login to arbitrary domain accounts by using the corresponding username on a Windows client machine.

cpe:/a:j2k-codec:j2k-codec:-

CVE-2014-0349

2014-04-12T00:37:31.423-04:00

2014-04-14T13:47:35.313-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2014-04-14T13:47:35.283-04:00

CERT-VN VU#345337 Multiple unspecified vulnerabilities in J2k-Codec allow remote attackers to execute arbitrary code via a crafted JPEG 2000 file.

cpe:/a:pocoproject:poco_c%2b%2b_libraries:1.4.5 cpe:/a:pocoproject:poco_c%2b%2b_libraries:1.4.6:- cpe:/a:pocoproject:poco_c%2b%2b_libraries:1.4.6:p1 cpe:/a:pocoproject:poco_c%2b%2b_libraries:1.4.6:p2 cpe:/a:pocoproject:poco_c%2b%2b_libraries:1.4.6:p3

CVE-2014-0350

2014-04-25T21:55:04.967-04:00

2016-12-05T21:59:20.927-05:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov FEDORA FEDORA-2016-0b3a611401 FEDORA FEDORA-2016-4a3e5618eb CERT-VN VU#118748 CONFIRM https://raw.githubusercontent.com/pocoproject/poco/poco-1.4.6p4-release/CHANGELOG The Poco::Net::X509Certificate::verify method in the NetSSL library in POCO C++ Libraries before 1.4.6p4 allows man-in-the-middle attackers to spoof SSL servers via crafted DNS PTR records that are requested during comparison of a server name to a wildcard domain name in an X.509 certificate.

cpe:/o:fortinet:fortios:4.3.10 cpe:/o:fortinet:fortios:4.3.12 cpe:/o:fortinet:fortios:4.3.13 cpe:/o:fortinet:fortios:4.3.14 cpe:/o:fortinet:fortios:4.3.15 cpe:/o:fortinet:fortios:5.0.0 cpe:/o:fortinet:fortios:5.0.3 cpe:/o:fortinet:fortios:5.0.4 cpe:/o:fortinet:fortios:5.0.5 cpe:/o:fortinet:fortios:5.0.6 cpe:/o:fortinet:fortios:5.0.7

CVE-2014-0351

2014-09-10T14:55:02.643-04:00

2017-08-28T21:34:08.623-04:00

5.4

ADJACENT_NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.fortiguard.com/advisory/FG-IR-14-006/ CERT-VN VU#730964 BID 69754 XF fortios-cve20140351-mitm(96119) The FortiManager protocol service in Fortinet FortiOS before 4.3.16 and 5.x before 5.0.8 on FortiGate devices does not prevent use of anonymous ciphersuites, which makes it easier for man-in-the-middle attackers to obtain sensitive information or interfere with communications by modifying the client-server data stream.

CVE-2014-0352

2014-09-10T14:55:02.690-04:00

2014-09-10T14:55:02.753-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-2216. Reason: This candidate is a reservation duplicate of CVE-2014-2216. Notes: All CVE users should reference CVE-2014-2216 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/h:zyxel:n300_netusb_nbg-419n:- cpe:/o:zyxel:n300_netusb_nbg-419n_firmware:1.00%28bfq_6%29c0

CVE-2014-0353

2014-04-15T06:55:11.963-04:00

2014-04-15T13:55:05.707-04:00

6.1

ADJACENT_NETWORK

LOW

NONE

COMPLETE

NONE

http://nvd.nist.gov

2014-04-15T13:55:01.190-04:00

CERT-VN VU#939260 The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to bypass authentication by using %2F sequences in place of / (slash) characters.

cpe:/h:zyxel:n300_netusb_nbg-419n:- cpe:/o:zyxel:n300_netusb_nbg-419n_firmware:1.00%28bfq_6%29c0

CVE-2014-0354

2014-04-15T06:55:11.993-04:00

2014-04-15T13:56:13.817-04:00

7.8

ADJACENT_NETWORK

LOW

NONE

COMPLETE

NONE

http://nvd.nist.gov

2014-04-15T13:56:13.740-04:00

CERT-VN VU#939260 The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 has a hardcoded password of qweasdzxc for an unspecified account, which allows remote attackers to obtain index.asp login access via an HTTP request.

cpe:/h:zyxel:n300_netusb_nbg-419n:- cpe:/o:zyxel:n300_netusb_nbg-419n_firmware:1.00%28bfq_6%29c0

CVE-2014-0355

2014-04-15T06:55:12.027-04:00

2014-04-15T13:56:33.943-04:00

7.9

ADJACENT_NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2014-04-15T13:56:33.850-04:00

CERT-VN VU#939260 Multiple stack-based buffer overflows on the ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allow man-in-the-middle attackers to execute arbitrary code via (1) a long temp attribute in a yweather:condition element in a forecastrss file that is processed by the checkWeather function; the (2) WeatherCity or (3) WeatherDegree variable to the detectWeather function; unspecified input to the (4) UpnpAddRunRLQoS, (5) UpnpDeleteRunRLQoS, or (6) UpnpDeletePortCheckType function; or (7) the SET COUNTRY udps command.

cpe:/h:zyxel:n300_netusb_nbg-419n:- cpe:/o:zyxel:n300_netusb_nbg-419n_firmware:1.00%28bfq_6%29c0

CVE-2014-0356

2014-04-15T06:55:12.057-04:00

2014-04-15T13:56:38.117-04:00

7.9

ADJACENT_NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2014-04-15T13:56:38.067-04:00

CERT-VN VU#939260 The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to execute arbitrary code via shell metacharacters in input to the (1) detectWeather, (2) set_language, (3) SystemCommand, or (4) NTPSyncWithHost function in management.c, or a (5) SET COUNTRY, (6) SET WLAN SSID, (7) SET WLAN CHANNEL, (8) SET WLAN STATUS, or (9) SET WLAN COUNTRY udps command.

cpe:/a:amtelco:misecuremessages:-

CVE-2014-0357

2014-04-15T06:55:12.087-04:00

2014-05-10T00:02:08.380-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://ics-cert.us-cert.gov/advisories/ICSA-14-121-01 CERT-VN VU#251628 MISC https://service.amtelco.com/INFINITY/MSM/MSM6.2SecurityBriefing.pdf Amtelco miSecureMessages allows remote attackers to read the messages of arbitrary users via an XML request containing a valid license key and a modified contactID value, as demonstrated by a request from the iOS or Android application.

cpe:/a:xangati:xangati_software_release:- cpe:/a:xangati:xangati_xnr:-

CVE-2014-0358

2014-04-15T06:55:12.120-04:00

2014-04-15T15:07:08.633-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

NONE

http://nvd.nist.gov

2014-04-15T15:07:08.600-04:00

CERT-VN VU#657622 Multiple directory traversal vulnerabilities in Xangati XSR before 11 and XNR before 7 allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the file parameter in a getUpgradeStatus action to servlet/MGConfigData, (2) the download parameter in a download action to servlet/MGConfigData, (3) the download parameter in a port_svc action to servlet/MGConfigData, (4) the file parameter in a getfile action to servlet/Installer, or (5) the binfile parameter to servlet/MGConfigData.

cpe:/a:xangati:xangati_software_release:- cpe:/a:xangati:xangati_xnr:-

CVE-2014-0359

2014-04-15T06:55:12.150-04:00

2014-04-15T15:11:04.623-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2014-04-15T15:11:04.563-04:00

CERT-VN VU#657622 Xangati XSR before 11 and XNR before 7 allows remote attackers to execute arbitrary commands via shell metacharacters in a gui_input_test.pl params parameter to servlet/Installer.

CVE-2014-0360

2014-04-23T16:55:06.703-04:00

2014-04-23T16:55:06.890-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-2741. Reason: This candidate is a duplicate of CVE-2014-2741. Notes: All CVE users should reference CVE-2014-2741 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/o:toshibacommerce:4690_point_of_sale_operating_system:6.2 cpe:/o:toshibacommerce:4690_point_of_sale_operating_system:6.3 cpe:/o:toshibacommerce:4690_point_of_sale_operating_system:6.4

CVE-2014-0361

2014-04-21T18:55:08.240-04:00

2014-05-05T01:31:48.717-04:00

3.0

LOCAL

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CERT-VN VU#622950 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=pos1R1005054 The default configuration of IBM 4690 OS, as used in Toshiba Global Commerce Solutions 4690 POS and other products, hashes passwords with the ADXCRYPT algorithm, which makes it easier for context-dependent attackers to obtain sensitive information via unspecified cryptanalysis of an ADXCSOUF.DAT file.

cpe:/a:google:search_appliance_software:7.0 cpe:/a:google:search_appliance_software:7.0.14 cpe:/a:google:search_appliance_software:7.2 cpe:/a:google:search_appliance_software:7.2.0

CVE-2014-0362

2014-05-08T06:55:03.107-04:00

2019-07-18T08:27:48.130-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-17T12:21:54.603-04:00

CERT-VN VU#673313 BID 67176 Cross-site scripting (XSS) vulnerability on Google Search Appliance (GSA) devices before 7.0.14.G.216 and 7.2 before 7.2.0.G.114, when dynamic navigation is configured, allows remote attackers to inject arbitrary web script or HTML via input included in a SCRIPT element.

cpe:/a:igniterealtime:smack:2.2.0 cpe:/a:igniterealtime:smack:2.2.1 cpe:/a:igniterealtime:smack:3.0.0 cpe:/a:igniterealtime:smack:3.0.1 cpe:/a:igniterealtime:smack:3.0.2 cpe:/a:igniterealtime:smack:3.0.3 cpe:/a:igniterealtime:smack:3.1.0 cpe:/a:igniterealtime:smack:3.2.0 cpe:/a:igniterealtime:smack:3.2.1 cpe:/a:igniterealtime:smack:3.2.2 cpe:/a:igniterealtime:smack:3.3.0 cpe:/a:igniterealtime:smack:3.3.1 cpe:/a:igniterealtime:smack:3.4.0 cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-16 cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-18 cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-19 cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-20 cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-21 cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-02-23 cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-02 cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-03 cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-10 cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-11 cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-12 cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-13 cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-16 cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-18 cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-21 cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-25 cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-26 cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-03-29 cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-04-06 cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-04-09 cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-04-13 cpe:/a:igniterealtime:smack:4.0.0:snapshot-2014-04-15 cpe:/a:redhat:jboss_fuse:6.1.0

CVE-2014-0363

2014-04-30T06:49:04.490-04:00

2017-01-06T21:59:25.717-05:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-released CONFIRM http://issues.igniterealtime.org/browse/SMACK-410 REDHAT RHSA-2015:1176 SECUNIA 59290 SECUNIA 59291 CERT-VN VU#489228 BID 67119 The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate chain.

CVE-2014-0364

2014-04-30T06:49:04.520-04:00

2017-01-06T21:59:25.763-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-released REDHAT RHSA-2015:1176 SECUNIA 59290 SECUNIA 59291 CERT-VN VU#489228 BID 67124 The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute.

cpe:/a:oracle:e-business_suite:11.5.10.2 cpe:/a:oracle:e-business_suite:12.0.6 cpe:/a:oracle:e-business_suite:12.1.3 cpe:/a:oracle:e-business_suite:12.2.2

CVE-2014-0366

2014-01-15T11:08:06.610-05:00

2014-02-06T23:51:40.737-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64828 SECTRACK 1029619 Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, and 12.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Attachments.

cpe:/a:oracle:hyperion:11.1.2.1 cpe:/a:oracle:hyperion:11.1.2.2 cpe:/a:oracle:hyperion:11.1.2.3

CVE-2014-0367

2014-01-15T11:08:06.657-05:00

2014-02-06T23:51:40.833-05:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64814 Unspecified vulnerability in the Hyperion Essbase Administration Services component in Oracle Hyperion 11.1.2.1, 11.1.2.2, and 11.1.2.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Admin Console.

cpe:/a:oracle:jdk:1.5.0:update_55 cpe:/a:oracle:jdk:1.6.0:update_65 cpe:/a:oracle:jdk:1.7.0:update_45 cpe:/a:oracle:jre:1.5.0:update_55 cpe:/a:oracle:jre:1.6.0:update_65 cpe:/a:oracle:jre:1.7.0:update_45

CVE-2014-0368

2014-01-15T11:08:06.687-05:00

2018-01-04T21:29:46.307-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/e6160aedadd5 SUSE SUSE-SU-2014:0246 SUSE SUSE-SU-2014:0266 SUSE SUSE-SU-2014:0451 SUSE openSUSE-SU-2014:0174 SUSE openSUSE-SU-2014:0177 SUSE openSUSE-SU-2014:0180 HP SSRT101454 HP SSRT101455 REDHAT RHSA-2014:0026 REDHAT RHSA-2014:0027 REDHAT RHSA-2014:0030 REDHAT RHSA-2014:0097 REDHAT RHSA-2014:0134 REDHAT RHSA-2014:0135 REDHAT RHSA-2014:0136 SECUNIA 59235 SECUNIA 59339 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64930 SECTRACK 1029608 UBUNTU USN-2089-1 UBUNTU USN-2124-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676978 REDHAT RHSA-2014:0414 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1052919 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45, and Java SE Embedded 7u45, allows remote attackers to affect confidentiality via unknown vectors related to Networking. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to incorrect permission checks when listening on a socket, which allows attackers to escape the sandbox.

cpe:/a:oracle:siebel_crm:8.1.1 cpe:/a:oracle:siebel_crm:8.2.2

CVE-2014-0369

2014-01-15T11:08:06.720-05:00

2016-11-18T22:02:35.753-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64832 SECTRACK 1029622 Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Java Integration, a different vulnerability than CVE-2015-0366.

cpe:/a:oracle:siebel_crm:8.1.1 cpe:/a:oracle:siebel_crm:8.2.2

CVE-2014-0370

2014-01-15T11:08:06.767-05:00

2014-02-06T23:51:41.083-05:00

2.8

NETWORK

MEDIUM

MULTIPLE_INSTANCES

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64837 SECTRACK 1029622 Unspecified vulnerability in the Siebel Life Sciences component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect availability via unknown vectors related to Clinical Trip Report.

cpe:/a:oracle:supply_chain_products_suite:7.2.0.3 cpe:/a:oracle:supply_chain_products_suite_sql-server:7.3.0 cpe:/a:oracle:supply_chain_products_suite_sql-server:7.3.1 cpe:/a:oracle:supply_chain_products_suite_sql-server:12.2.0 cpe:/a:oracle:supply_chain_products_suite_sql-server:12.2.1 cpe:/a:oracle:supply_chain_products_suite_sql-server:12.2.2

CVE-2014-0371

2014-01-15T11:08:06.797-05:00

2014-02-06T23:51:41.177-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64886 SECTRACK 1029620 Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0.x, 7.3.1.x, 12.2.0, 12.2.1, and 12.2.2 allows remote authenticated users to affect integrity via unknown vectors related to DM Others.

CVE-2014-0372

2014-01-15T11:08:06.830-05:00

2018-10-09T15:42:02.157-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov EXPLOIT-DB 31993 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BUGTRAQ 20140228 CVE-2014-0372 - SQL Injection in Oracle Demantra BID 64758 BID 64826 SECTRACK 1029620 Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0, 7.3.1, 12.2.1, and 12.2.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to DM Others.

CVE-2014-0373

2014-01-15T11:08:06.860-05:00

2018-01-04T21:29:46.400-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/496c51673dec SUSE SUSE-SU-2014:0246 SUSE SUSE-SU-2014:0266 SUSE SUSE-SU-2014:0451 SUSE openSUSE-SU-2014:0174 SUSE openSUSE-SU-2014:0177 SUSE openSUSE-SU-2014:0180 HP SSRT101454 HP SSRT101455 REDHAT RHSA-2014:0026 REDHAT RHSA-2014:0027 REDHAT RHSA-2014:0030 REDHAT RHSA-2014:0097 REDHAT RHSA-2014:0134 REDHAT RHSA-2014:0135 REDHAT RHSA-2014:0136 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64922 SECTRACK 1029608 UBUNTU USN-2089-1 UBUNTU USN-2124-1 REDHAT RHSA-2014:0414 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1051699 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to throwing of an incorrect exception when SnmpStatusException should have been used in the SNMP implementation, which allows attackers to escape the sandbox.

cpe:/a:oracle:fusion_middleware:11.1.1.6.0

CVE-2014-0374

2014-01-15T11:08:06.890-05:00

2014-02-06T23:51:41.427-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64830 SECTRACK 1029613 Unspecified vulnerability in the Oracle Portal component in Oracle Fusion Middleware 11.1.1.6 allows remote attackers to affect integrity via unknown vectors related to Page Parameters and Events.

cpe:/a:oracle:jdk:1.6.0:update_65 cpe:/a:oracle:jdk:1.7.0:update_45 cpe:/a:oracle:jre:1.6.0:update_65 cpe:/a:oracle:jre:1.7.0:update_45

CVE-2014-0375

2014-01-15T11:08:06.923-05:00

2018-01-04T21:29:46.477-05:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov SUSE SUSE-SU-2014:0246 SUSE SUSE-SU-2014:0266 SUSE SUSE-SU-2014:0451 HP SSRT101454 HP SSRT101455 REDHAT RHSA-2014:0030 REDHAT RHSA-2014:0134 REDHAT RHSA-2014:0135 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64916 SECTRACK 1029608 REDHAT RHSA-2014:0414 XF oracle-cpujan2014-cve20140375(90339) CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5898 and CVE-2014-0403.

CVE-2014-0376

2014-01-15T11:08:06.953-05:00

2018-01-04T21:29:46.557-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/rev/42be8e6266ab MISC http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/rev/783ceae9b736 SUSE SUSE-SU-2014:0246 SUSE SUSE-SU-2014:0266 SUSE SUSE-SU-2014:0451 SUSE openSUSE-SU-2014:0174 SUSE openSUSE-SU-2014:0177 SUSE openSUSE-SU-2014:0180 HP SSRT101454 HP SSRT101455 REDHAT RHSA-2014:0026 REDHAT RHSA-2014:0027 REDHAT RHSA-2014:0030 REDHAT RHSA-2014:0097 REDHAT RHSA-2014:0134 REDHAT RHSA-2014:0135 REDHAT RHSA-2014:0136 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64907 SECTRACK 1029608 UBUNTU USN-2089-1 UBUNTU USN-2124-1 REDHAT RHSA-2014:0414 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1051923 XF oracle-cpujan2014-cve20140376(90350) CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAXP. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to an improper check for "code permissions when creating document builder factories."

cpe:/a:oracle:database_server:11.1.0.7 cpe:/a:oracle:database_server:11.2.0.3 cpe:/a:oracle:database_server:11.2.0.4 cpe:/a:oracle:database_server:12.1.0.1

CVE-2014-0377

2014-01-15T11:08:06.987-05:00

2014-03-05T23:50:24.753-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov SUSE SUSE-SU-2014:0130 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64824 SECTRACK 1029607 Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote authenticated users to affect confidentiality via vectors related to SYS tables.

cpe:/a:oracle:database_server:11.1.0.7 cpe:/a:oracle:database_server:11.2.0.3 cpe:/a:oracle:database_server:11.2.0.4 cpe:/a:oracle:database_server:12.1.0.1

CVE-2014-0378

2014-01-15T11:08:07.033-05:00

2014-03-05T23:50:24.830-05:00

4.1

LOCAL

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov SUSE SUSE-SU-2014:0130 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64812 SECTRACK 1029607 Unspecified vulnerability in the Spatial component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors.

CVE-2014-0379

2014-01-15T11:08:07.080-05:00

2017-11-07T21:29:00.693-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov EXPLOIT-DB 31994 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64857 SECTRACK 1029620 Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0.x, 7.3.1.x, 12.2.0, 12.2.1, and 12.2.2 allows remote attackers to affect integrity via unknown vectors related to DM Others.

cpe:/a:oracle:peoplesoft_products:8.52 cpe:/a:oracle:peoplesoft_products:8.53

CVE-2014-0380

2014-01-15T11:08:07.110-05:00

2014-02-06T23:51:41.943-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64865 SECTRACK 1029623 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect integrity via vectors related to MultiChannel Framework (MCF).

cpe:/a:oracle:peoplesoft_products:8.52 cpe:/a:oracle:peoplesoft_products:8.53

CVE-2014-0381

2014-01-15T11:08:07.127-05:00

2014-02-06T23:51:42.020-05:00

2.6

NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64892 SECTRACK 1029623 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect integrity via vectors related to PIA Core Technology, a different vulnerability than CVE-2014-0445.

cpe:/a:hp:jdk:7.0.08 cpe:/a:hp:jre:7.0.08 cpe:/a:oracle:javafx:2.2.45 cpe:/a:oracle:jdk:1.7.0:update_45 cpe:/a:oracle:jre:1.7.0:update_45 cpe:/o:redhat:enterprise_linux_desktop_supplementary:5.0 cpe:/o:redhat:enterprise_linux_desktop_supplementary:6.0 cpe:/o:redhat:enterprise_linux_hpc_node_supplementary:6.0 cpe:/o:redhat:enterprise_linux_server_supplementary:5.0 cpe:/o:redhat:enterprise_linux_server_supplementary:6.0 cpe:/o:redhat:enterprise_linux_server_supplementary_aus:6.5 cpe:/o:redhat:enterprise_linux_server_supplementary_eus:6.5.z cpe:/o:redhat:enterprise_linux_workstation_supplementary:6.0

CVE-2014-0382

2014-01-15T11:08:07.157-05:00

2017-08-28T21:34:08.920-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov HP SSRT101454 REDHAT RHSA-2014:0030 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64936 SECTRACK 1029608 XF oracle-cpujan2014-cve20140382(90355) CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 Unspecified vulnerability in Oracle Java SE 7u45 and JavaFX 2.2.45 allows remote attackers to affect availability via unknown vectors related to JavaFX.

cpe:/a:oracle:fusion_middleware:11.1.2.0 cpe:/a:oracle:fusion_middleware:11.1.2.1.0

CVE-2014-0383

2014-01-15T11:08:07.203-05:00

2014-02-06T23:51:42.193-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64842 SECTRACK 1029613 Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.2.0 and 11.1.2.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Identity Console.

cpe:/a:mysql:mysql:5.5.0 cpe:/a:mysql:mysql:5.5.1 cpe:/a:mysql:mysql:5.5.2 cpe:/a:mysql:mysql:5.5.3 cpe:/a:mysql:mysql:5.5.4 cpe:/a:mysql:mysql:5.5.5 cpe:/a:mysql:mysql:5.5.6 cpe:/a:mysql:mysql:5.5.7 cpe:/a:mysql:mysql:5.5.8 cpe:/a:mysql:mysql:5.5.9 cpe:/a:oracle:mysql:5.5.10 cpe:/a:oracle:mysql:5.5.11 cpe:/a:oracle:mysql:5.5.12 cpe:/a:oracle:mysql:5.5.13 cpe:/a:oracle:mysql:5.5.14 cpe:/a:oracle:mysql:5.5.15 cpe:/a:oracle:mysql:5.5.16 cpe:/a:oracle:mysql:5.5.17 cpe:/a:oracle:mysql:5.5.18 cpe:/a:oracle:mysql:5.5.19 cpe:/a:oracle:mysql:5.5.20 cpe:/a:oracle:mysql:5.5.21 cpe:/a:oracle:mysql:5.5.22 cpe:/a:oracle:mysql:5.5.23 cpe:/a:oracle:mysql:5.5.24 cpe:/a:oracle:mysql:5.5.25 cpe:/a:oracle:mysql:5.5.25:a cpe:/a:oracle:mysql:5.5.26 cpe:/a:oracle:mysql:5.5.27 cpe:/a:oracle:mysql:5.5.28 cpe:/a:oracle:mysql:5.5.29 cpe:/a:oracle:mysql:5.5.30 cpe:/a:oracle:mysql:5.5.31 cpe:/a:oracle:mysql:5.5.32 cpe:/a:oracle:mysql:5.5.33 cpe:/a:oracle:mysql:5.5.34 cpe:/a:oracle:mysql:5.5.35 cpe:/a:oracle:mysql:5.6.0 cpe:/a:oracle:mysql:5.6.1 cpe:/a:oracle:mysql:5.6.2 cpe:/a:oracle:mysql:5.6.3 cpe:/a:oracle:mysql:5.6.4 cpe:/a:oracle:mysql:5.6.5 cpe:/a:oracle:mysql:5.6.6 cpe:/a:oracle:mysql:5.6.7 cpe:/a:oracle:mysql:5.6.8 cpe:/a:oracle:mysql:5.6.9 cpe:/a:oracle:mysql:5.6.10 cpe:/a:oracle:mysql:5.6.11 cpe:/a:oracle:mysql:5.6.12 cpe:/a:oracle:mysql:5.6.13 cpe:/a:oracle:mysql:5.6.14 cpe:/a:oracle:mysql:5.6.15

CVE-2014-0384

2014-04-15T20:55:23.777-04:00

2017-12-20T21:29:00.513-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2014:0522 REDHAT RHSA-2014:0536 REDHAT RHSA-2014:0537 REDHAT RHSA-2014:0702 GENTOO GLSA-201409-04 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via vectors related to XML.

cpe:/a:oracle:jdk:1.7.0:update_45 cpe:/a:oracle:jre:1.7.0:update_45

CVE-2014-0385

2014-01-15T11:08:07.237-05:00

2014-02-06T23:51:42.287-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64901 SECTRACK 1029608 Unspecified vulnerability in Oracle Java SE 7u45, when installing on OS X, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install.

cpe:/a:mysql:mysql:5.1 cpe:/a:mysql:mysql:5.1.1 cpe:/a:mysql:mysql:5.1.2 cpe:/a:mysql:mysql:5.1.3 cpe:/a:mysql:mysql:5.1.4 cpe:/a:mysql:mysql:5.1.5 cpe:/a:mysql:mysql:5.1.5a cpe:/a:mysql:mysql:5.1.6 cpe:/a:mysql:mysql:5.1.7 cpe:/a:mysql:mysql:5.1.8 cpe:/a:mysql:mysql:5.1.9 cpe:/a:mysql:mysql:5.1.10 cpe:/a:mysql:mysql:5.1.11 cpe:/a:mysql:mysql:5.1.12 cpe:/a:mysql:mysql:5.1.13 cpe:/a:mysql:mysql:5.1.14 cpe:/a:mysql:mysql:5.1.15 cpe:/a:mysql:mysql:5.1.16 cpe:/a:mysql:mysql:5.1.17 cpe:/a:mysql:mysql:5.1.18 cpe:/a:mysql:mysql:5.1.19 cpe:/a:mysql:mysql:5.1.20 cpe:/a:mysql:mysql:5.1.21 cpe:/a:mysql:mysql:5.1.22 cpe:/a:mysql:mysql:5.1.23 cpe:/a:mysql:mysql:5.1.23:a cpe:/a:mysql:mysql:5.1.23_bk cpe:/a:mysql:mysql:5.1.23a cpe:/a:mysql:mysql:5.1.24 cpe:/a:mysql:mysql:5.1.25 cpe:/a:mysql:mysql:5.1.26 cpe:/a:mysql:mysql:5.1.27 cpe:/a:mysql:mysql:5.1.28 cpe:/a:mysql:mysql:5.1.29 cpe:/a:mysql:mysql:5.1.30 cpe:/a:mysql:mysql:5.1.31 cpe:/a:mysql:mysql:5.1.31:sp1 cpe:/a:mysql:mysql:5.1.32 cpe:/a:mysql:mysql:5.1.32-bzr cpe:/a:mysql:mysql:5.1.33 cpe:/a:mysql:mysql:5.1.34 cpe:/a:mysql:mysql:5.1.34:sp1 cpe:/a:mysql:mysql:5.1.35 cpe:/a:mysql:mysql:5.1.36 cpe:/a:mysql:mysql:5.1.37 cpe:/a:mysql:mysql:5.1.37:sp1 cpe:/a:mysql:mysql:5.1.38 cpe:/a:mysql:mysql:5.1.39 cpe:/a:mysql:mysql:5.1.40 cpe:/a:mysql:mysql:5.1.40:sp1 cpe:/a:mysql:mysql:5.1.41 cpe:/a:mysql:mysql:5.1.42 cpe:/a:mysql:mysql:5.1.43 cpe:/a:mysql:mysql:5.1.43:sp1 cpe:/a:mysql:mysql:5.1.44 cpe:/a:mysql:mysql:5.1.45 cpe:/a:mysql:mysql:5.1.46 cpe:/a:mysql:mysql:5.1.46:sp1 cpe:/a:mysql:mysql:5.1.47 cpe:/a:mysql:mysql:5.1.48 cpe:/a:mysql:mysql:5.1.49 cpe:/a:mysql:mysql:5.1.49:sp1 cpe:/a:mysql:mysql:5.1.50 cpe:/a:mysql:mysql:5.5.0 cpe:/a:mysql:mysql:5.5.1 cpe:/a:mysql:mysql:5.5.2 cpe:/a:mysql:mysql:5.5.3 cpe:/a:mysql:mysql:5.5.4 cpe:/a:mysql:mysql:5.5.5 cpe:/a:mysql:mysql:5.5.6 cpe:/a:mysql:mysql:5.5.7 cpe:/a:mysql:mysql:5.5.8 cpe:/a:mysql:mysql:5.5.9 cpe:/a:oracle:mysql:5.1.51 cpe:/a:oracle:mysql:5.1.52 cpe:/a:oracle:mysql:5.1.52:sp1 cpe:/a:oracle:mysql:5.1.53 cpe:/a:oracle:mysql:5.1.54 cpe:/a:oracle:mysql:5.1.55 cpe:/a:oracle:mysql:5.1.56 cpe:/a:oracle:mysql:5.1.57 cpe:/a:oracle:mysql:5.1.58 cpe:/a:oracle:mysql:5.1.59 cpe:/a:oracle:mysql:5.1.60 cpe:/a:oracle:mysql:5.1.61 cpe:/a:oracle:mysql:5.1.62 cpe:/a:oracle:mysql:5.1.63 cpe:/a:oracle:mysql:5.1.64 cpe:/a:oracle:mysql:5.1.65 cpe:/a:oracle:mysql:5.1.66 cpe:/a:oracle:mysql:5.1.67 cpe:/a:oracle:mysql:5.1.68 cpe:/a:oracle:mysql:5.1.69 cpe:/a:oracle:mysql:5.1.70 cpe:/a:oracle:mysql:5.1.71 cpe:/a:oracle:mysql:5.5.10 cpe:/a:oracle:mysql:5.5.11 cpe:/a:oracle:mysql:5.5.12 cpe:/a:oracle:mysql:5.5.13 cpe:/a:oracle:mysql:5.5.14 cpe:/a:oracle:mysql:5.5.15 cpe:/a:oracle:mysql:5.5.16 cpe:/a:oracle:mysql:5.5.17 cpe:/a:oracle:mysql:5.5.18 cpe:/a:oracle:mysql:5.5.19 cpe:/a:oracle:mysql:5.5.20 cpe:/a:oracle:mysql:5.5.21 cpe:/a:oracle:mysql:5.5.22 cpe:/a:oracle:mysql:5.5.23 cpe:/a:oracle:mysql:5.5.24 cpe:/a:oracle:mysql:5.5.25 cpe:/a:oracle:mysql:5.5.25:a cpe:/a:oracle:mysql:5.5.26 cpe:/a:oracle:mysql:5.5.27 cpe:/a:oracle:mysql:5.5.28 cpe:/a:oracle:mysql:5.5.29 cpe:/a:oracle:mysql:5.5.30 cpe:/a:oracle:mysql:5.5.31 cpe:/a:oracle:mysql:5.5.32 cpe:/a:oracle:mysql:5.5.33 cpe:/a:oracle:mysql:5.6.0 cpe:/a:oracle:mysql:5.6.1 cpe:/a:oracle:mysql:5.6.2 cpe:/a:oracle:mysql:5.6.3 cpe:/a:oracle:mysql:5.6.4 cpe:/a:oracle:mysql:5.6.5 cpe:/a:oracle:mysql:5.6.6 cpe:/a:oracle:mysql:5.6.7 cpe:/a:oracle:mysql:5.6.8 cpe:/a:oracle:mysql:5.6.9 cpe:/a:oracle:mysql:5.6.10 cpe:/a:oracle:mysql:5.6.11 cpe:/a:oracle:mysql:5.6.12 cpe:/a:oracle:mysql:5.6.13

CVE-2014-0386

2014-01-15T11:08:07.267-05:00

2017-08-28T21:34:08.997-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2014:0164 REDHAT RHSA-2014:0173 REDHAT RHSA-2014:0186 REDHAT RHSA-2014:0189 GENTOO GLSA-201409-04 UBUNTU USN-2086-1 DEBIAN DSA-2845 DEBIAN DSA-2848 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64904 XF oracle-cpujan2014-cve20140386(90380) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

cpe:/a:oracle:jdk:1.6.0:update_65 cpe:/a:oracle:jdk:1.7.0:update_45 cpe:/a:oracle:jre:1.6.0:update_65 cpe:/a:oracle:jre:1.7.0:update_45

CVE-2014-0387

2014-01-15T11:08:07.330-05:00

2018-01-04T21:29:46.633-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2014:0246 SUSE SUSE-SU-2014:0266 SUSE SUSE-SU-2014:0451 HP SSRT101454 HP SSRT101455 REDHAT RHSA-2014:0030 REDHAT RHSA-2014:0134 REDHAT RHSA-2014:0135 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64882 SECTRACK 1029608 REDHAT RHSA-2014:0414 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 Unspecified vulnerability in Oracle Java SE 6u65 and Java SE 7u45, when running on Firefox, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

cpe:/a:oracle:peoplesoft_products:9.1 cpe:/a:oracle:peoplesoft_products:9.2

CVE-2014-0388

2014-01-15T11:08:07.360-05:00

2014-02-06T23:51:42.550-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64878 SECTRACK 1029623 Unspecified vulnerability in the PeopleSoft Enterprise HRMS Human Resources component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Org and Workforce Dev.

cpe:/a:oracle:ilearning:6.0

CVE-2014-0389

2014-01-15T11:08:07.390-05:00

2016-11-17T14:50:27.430-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-11-17T11:20:18.603-05:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64845 SECTRACK 1029621 Unspecified vulnerability in Oracle iLearning 6.0 allows remote attackers to affect integrity via unknown vectors related to Learner Pages.

cpe:/o:sun:sunos:5.10

CVE-2014-0390

2014-01-15T11:08:07.423-05:00

2017-08-28T21:34:09.060-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64859 XF oracle-cpujan2014-cve20140390(90362) Unspecified vulnerability in Oracle Solaris 10 allows remote attackers to affect integrity via unknown vectors related to Java Web Console.

cpe:/a:oracle:fusion_middleware:11.1.1.5.0 cpe:/a:oracle:fusion_middleware:11.1.1.7.0 cpe:/a:oracle:fusion_middleware:11.1.2.0 cpe:/a:oracle:fusion_middleware:11.1.2.1.0

CVE-2014-0391

2014-01-15T11:08:07.437-05:00

2016-11-17T12:07:40.557-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-11-17T11:04:59.430-05:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64829 SECTRACK 1029613 Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.0, and 11.1.2.1 allows remote attackers to affect confidentiality via unknown vectors related to End User Self Service.

cpe:/a:oracle:peoplesoft_products:9.1 cpe:/a:oracle:peoplesoft_products:9.2

CVE-2014-0392

2014-01-15T11:08:07.470-05:00

2016-11-17T12:08:19.297-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2016-11-17T11:21:19.347-05:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64874 SECTRACK 1029623 Unspecified vulnerability in the PeopleSoft Enterprise HRMS component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.

CVE-2014-0393

2014-01-15T11:08:07.500-05:00

2017-08-28T21:34:09.153-04:00

3.3

NETWORK

LOW

MULTIPLE_INSTANCES

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2014:0164 REDHAT RHSA-2014:0173 REDHAT RHSA-2014:0186 REDHAT RHSA-2014:0189 GENTOO GLSA-201409-04 UBUNTU USN-2086-1 DEBIAN DSA-2845 DEBIAN DSA-2848 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64877 XF oracle-cpujan2014-cve20140393(90386) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect integrity via unknown vectors related to InnoDB.

cpe:/a:oracle:peoplesoft_products:8.52 cpe:/a:oracle:peoplesoft_products:8.53

CVE-2014-0394

2014-01-15T11:08:07.533-05:00

2016-11-17T12:08:00.217-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-11-17T10:50:05.683-05:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64848 SECTRACK 1029623 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Updates Environment Mgmt, a different vulnerability than CVE-2014-0395.

cpe:/a:oracle:peoplesoft_products:8.52 cpe:/a:oracle:peoplesoft_products:8.53

CVE-2014-0395

2014-01-15T11:08:07.563-05:00

2016-11-17T12:04:50.233-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-11-17T10:58:41.107-05:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64852 SECTRACK 1029623 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Updates Environment Mgmt, a different vulnerability than CVE-2014-0394.

cpe:/a:oracle:peoplesoft_products:8.52 cpe:/a:oracle:peoplesoft_products:8.53

CVE-2014-0396

2014-01-15T11:08:07.627-05:00

2016-11-17T12:04:43.840-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-11-17T11:20:45.733-05:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64841 SECTRACK 1029623 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Portal - Web Services.

cpe:/o:oracle:solaris:10 cpe:/o:oracle:solaris:11.1

CVE-2014-0397

2014-10-06T19:55:06.780-04:00

2017-08-28T21:34:09.233-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 65819 CONFIRM https://blogs.oracle.com/sunsecurity/entry/cve_2014_0397_buffer_errors XF libxtsol-cve20140397-bo(91482) Multiple unspecified vulnerabilities in libXtsol in Oracle Solaris 10 and 11.1 have unspecified impact and attack vectors related to "Buffer errors."

cpe:/a:oracle:e-business_suite:11.5.10.2 cpe:/a:oracle:e-business_suite:12.0.6 cpe:/a:oracle:e-business_suite:12.1.3 cpe:/a:oracle:e-business_suite:12.2.2

CVE-2014-0398

2014-01-15T11:08:07.657-05:00

2014-02-06T23:51:43.333-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64818 SECTRACK 1029619 Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, and 12.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Discoverer.

cpe:/a:oracle:supply_chain_products_suite:6.2.0 cpe:/a:oracle:supply_chain_products_suite:6.3.0 cpe:/a:oracle:supply_chain_products_suite:6.3.1 cpe:/a:oracle:supply_chain_products_suite:6.3.2

CVE-2014-0399

2014-01-15T11:08:07.687-05:00

2014-02-06T23:51:43.410-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64861 SECTRACK 1029620 Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.2, 6.3, 6.3.1, and 6.3.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Data, Domain & Function Security.

cpe:/a:oracle:fusion_middleware:11.1.1.6.0 cpe:/a:oracle:fusion_middleware:11.1.1.7.0

CVE-2014-0400

2014-01-15T11:08:09.673-05:00

2014-02-06T23:51:43.487-05:00

6.3

NETWORK

MEDIUM

SINGLE_INSTANCE

COMPLETE

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64822 SECTRACK 1029618 Unspecified vulnerability in the Oracle Internet Directory component in Oracle Fusion Middleware 11.1.1.6 and 11.1.1.7 allows remote authenticated users to affect confidentiality via vectors related to OID LDAP server.

cpe:/a:mysql:mysql:5.1 cpe:/a:mysql:mysql:5.1.1 cpe:/a:mysql:mysql:5.1.2 cpe:/a:mysql:mysql:5.1.3 cpe:/a:mysql:mysql:5.1.4 cpe:/a:mysql:mysql:5.1.5 cpe:/a:mysql:mysql:5.1.5a cpe:/a:mysql:mysql:5.1.6 cpe:/a:mysql:mysql:5.1.7 cpe:/a:mysql:mysql:5.1.8 cpe:/a:mysql:mysql:5.1.9 cpe:/a:mysql:mysql:5.1.10 cpe:/a:mysql:mysql:5.1.11 cpe:/a:mysql:mysql:5.1.12 cpe:/a:mysql:mysql:5.1.13 cpe:/a:mysql:mysql:5.1.14 cpe:/a:mysql:mysql:5.1.15 cpe:/a:mysql:mysql:5.1.16 cpe:/a:mysql:mysql:5.1.17 cpe:/a:mysql:mysql:5.1.18 cpe:/a:mysql:mysql:5.1.19 cpe:/a:mysql:mysql:5.1.20 cpe:/a:mysql:mysql:5.1.21 cpe:/a:mysql:mysql:5.1.22 cpe:/a:mysql:mysql:5.1.23 cpe:/a:mysql:mysql:5.1.23:a cpe:/a:mysql:mysql:5.1.23_bk cpe:/a:mysql:mysql:5.1.23a cpe:/a:mysql:mysql:5.1.24 cpe:/a:mysql:mysql:5.1.25 cpe:/a:mysql:mysql:5.1.26 cpe:/a:mysql:mysql:5.1.27 cpe:/a:mysql:mysql:5.1.28 cpe:/a:mysql:mysql:5.1.29 cpe:/a:mysql:mysql:5.1.30 cpe:/a:mysql:mysql:5.1.31 cpe:/a:mysql:mysql:5.1.31:sp1 cpe:/a:mysql:mysql:5.1.32 cpe:/a:mysql:mysql:5.1.32-bzr cpe:/a:mysql:mysql:5.1.33 cpe:/a:mysql:mysql:5.1.34 cpe:/a:mysql:mysql:5.1.34:sp1 cpe:/a:mysql:mysql:5.1.35 cpe:/a:mysql:mysql:5.1.36 cpe:/a:mysql:mysql:5.1.37 cpe:/a:mysql:mysql:5.1.37:sp1 cpe:/a:mysql:mysql:5.1.38 cpe:/a:mysql:mysql:5.1.39 cpe:/a:mysql:mysql:5.1.40 cpe:/a:mysql:mysql:5.1.40:sp1 cpe:/a:mysql:mysql:5.1.41 cpe:/a:mysql:mysql:5.1.42 cpe:/a:mysql:mysql:5.1.43 cpe:/a:mysql:mysql:5.1.43:sp1 cpe:/a:mysql:mysql:5.1.44 cpe:/a:mysql:mysql:5.1.45 cpe:/a:mysql:mysql:5.1.46 cpe:/a:mysql:mysql:5.1.46:sp1 cpe:/a:mysql:mysql:5.1.47 cpe:/a:mysql:mysql:5.1.48 cpe:/a:mysql:mysql:5.1.49 cpe:/a:mysql:mysql:5.1.49:sp1 cpe:/a:mysql:mysql:5.1.50 cpe:/a:mysql:mysql:5.5.0 cpe:/a:mysql:mysql:5.5.1 cpe:/a:mysql:mysql:5.5.2 cpe:/a:mysql:mysql:5.5.3 cpe:/a:mysql:mysql:5.5.4 cpe:/a:mysql:mysql:5.5.5 cpe:/a:mysql:mysql:5.5.6 cpe:/a:mysql:mysql:5.5.7 cpe:/a:mysql:mysql:5.5.8 cpe:/a:mysql:mysql:5.5.9 cpe:/a:oracle:mysql:5.1.51 cpe:/a:oracle:mysql:5.1.52 cpe:/a:oracle:mysql:5.1.52:sp1 cpe:/a:oracle:mysql:5.1.53 cpe:/a:oracle:mysql:5.1.54 cpe:/a:oracle:mysql:5.1.55 cpe:/a:oracle:mysql:5.1.56 cpe:/a:oracle:mysql:5.1.57 cpe:/a:oracle:mysql:5.1.58 cpe:/a:oracle:mysql:5.1.59 cpe:/a:oracle:mysql:5.1.60 cpe:/a:oracle:mysql:5.1.61 cpe:/a:oracle:mysql:5.1.62 cpe:/a:oracle:mysql:5.1.63 cpe:/a:oracle:mysql:5.1.64 cpe:/a:oracle:mysql:5.1.65 cpe:/a:oracle:mysql:5.1.66 cpe:/a:oracle:mysql:5.1.67 cpe:/a:oracle:mysql:5.1.68 cpe:/a:oracle:mysql:5.1.69 cpe:/a:oracle:mysql:5.1.70 cpe:/a:oracle:mysql:5.1.71 cpe:/a:oracle:mysql:5.1.72 cpe:/a:oracle:mysql:5.5.10 cpe:/a:oracle:mysql:5.5.11 cpe:/a:oracle:mysql:5.5.12 cpe:/a:oracle:mysql:5.5.13 cpe:/a:oracle:mysql:5.5.14 cpe:/a:oracle:mysql:5.5.15 cpe:/a:oracle:mysql:5.5.16 cpe:/a:oracle:mysql:5.5.17 cpe:/a:oracle:mysql:5.5.18 cpe:/a:oracle:mysql:5.5.19 cpe:/a:oracle:mysql:5.5.20 cpe:/a:oracle:mysql:5.5.21 cpe:/a:oracle:mysql:5.5.22 cpe:/a:oracle:mysql:5.5.23 cpe:/a:oracle:mysql:5.5.24 cpe:/a:oracle:mysql:5.5.25 cpe:/a:oracle:mysql:5.5.25:a cpe:/a:oracle:mysql:5.5.26 cpe:/a:oracle:mysql:5.5.27 cpe:/a:oracle:mysql:5.5.28 cpe:/a:oracle:mysql:5.5.29 cpe:/a:oracle:mysql:5.5.30 cpe:/a:oracle:mysql:5.5.31 cpe:/a:oracle:mysql:5.5.32 cpe:/a:oracle:mysql:5.5.33 cpe:/a:oracle:mysql:5.5.34 cpe:/a:oracle:mysql:5.6.0 cpe:/a:oracle:mysql:5.6.1 cpe:/a:oracle:mysql:5.6.2 cpe:/a:oracle:mysql:5.6.3 cpe:/a:oracle:mysql:5.6.4 cpe:/a:oracle:mysql:5.6.5 cpe:/a:oracle:mysql:5.6.6 cpe:/a:oracle:mysql:5.6.7 cpe:/a:oracle:mysql:5.6.8 cpe:/a:oracle:mysql:5.6.9 cpe:/a:oracle:mysql:5.6.10 cpe:/a:oracle:mysql:5.6.11 cpe:/a:oracle:mysql:5.6.12 cpe:/a:oracle:mysql:5.6.13 cpe:/a:oracle:mysql:5.6.14

CVE-2014-0401

2014-01-15T11:08:09.703-05:00

2017-08-28T21:34:09.327-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2014:0164 REDHAT RHSA-2014:0173 REDHAT RHSA-2014:0186 REDHAT RHSA-2014:0189 GENTOO GLSA-201409-04 UBUNTU USN-2086-1 DEBIAN DSA-2845 DEBIAN DSA-2848 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64898 XF oracle-cpujan2014-cve20140401(90382) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors.

CVE-2014-0402

2014-01-15T11:08:09.737-05:00

2017-08-28T21:34:09.403-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2014:0164 REDHAT RHSA-2014:0173 REDHAT RHSA-2014:0186 REDHAT RHSA-2014:0189 GENTOO GLSA-201409-04 UBUNTU USN-2086-1 DEBIAN DSA-2845 DEBIAN DSA-2848 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64908 XF oracle-cpujan2014-cve20140402(90379) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Locking.

cpe:/a:oracle:jdk:1.6.0:update_65 cpe:/a:oracle:jdk:1.7.0:update_45 cpe:/a:oracle:jre:1.6.0:update_65 cpe:/a:oracle:jre:1.7.0:update_45

CVE-2014-0403

2014-01-15T11:08:09.767-05:00

2018-01-04T21:29:46.697-05:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov SUSE SUSE-SU-2014:0246 SUSE SUSE-SU-2014:0266 SUSE SUSE-SU-2014:0451 HP SSRT101454 HP SSRT101455 REDHAT RHSA-2014:0030 REDHAT RHSA-2014:0134 REDHAT RHSA-2014:0135 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64920 SECTRACK 1029608 REDHAT RHSA-2014:0414 XF oracle-cpujan2014-cve20140403(90338) CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5898 and CVE-2014-0375.

cpe:/a:oracle:vm_virtualbox:3.2.0 cpe:/a:oracle:vm_virtualbox:3.2.2 cpe:/a:oracle:vm_virtualbox:3.2.4 cpe:/a:oracle:vm_virtualbox:3.2.6 cpe:/a:oracle:vm_virtualbox:3.2.8 cpe:/a:oracle:vm_virtualbox:3.2.10 cpe:/a:oracle:vm_virtualbox:3.2.12 cpe:/a:oracle:vm_virtualbox:3.2.14 cpe:/a:oracle:vm_virtualbox:3.2.16 cpe:/a:oracle:vm_virtualbox:3.2.18 cpe:/a:oracle:vm_virtualbox:4.0 cpe:/a:oracle:vm_virtualbox:4.0.0 cpe:/a:oracle:vm_virtualbox:4.0.2 cpe:/a:oracle:vm_virtualbox:4.0.4 cpe:/a:oracle:vm_virtualbox:4.0.6 cpe:/a:oracle:vm_virtualbox:4.0.8 cpe:/a:oracle:vm_virtualbox:4.0.10 cpe:/a:oracle:vm_virtualbox:4.0.12 cpe:/a:oracle:vm_virtualbox:4.0.14 cpe:/a:oracle:vm_virtualbox:4.0.16 cpe:/a:oracle:vm_virtualbox:4.0.18 cpe:/a:oracle:vm_virtualbox:4.0.20 cpe:/a:oracle:vm_virtualbox:4.1.0 cpe:/a:oracle:vm_virtualbox:4.1.2 cpe:/a:oracle:vm_virtualbox:4.1.4 cpe:/a:oracle:vm_virtualbox:4.1.6 cpe:/a:oracle:vm_virtualbox:4.1.8 cpe:/a:oracle:vm_virtualbox:4.1.10 cpe:/a:oracle:vm_virtualbox:4.1.12 cpe:/a:oracle:vm_virtualbox:4.1.14 cpe:/a:oracle:vm_virtualbox:4.1.16 cpe:/a:oracle:vm_virtualbox:4.1.18 cpe:/a:oracle:vm_virtualbox:4.1.20 cpe:/a:oracle:vm_virtualbox:4.1.22 cpe:/a:oracle:vm_virtualbox:4.1.24 cpe:/a:oracle:vm_virtualbox:4.1.26 cpe:/a:oracle:vm_virtualbox:4.1.28 cpe:/a:oracle:vm_virtualbox:4.2.0 cpe:/a:oracle:vm_virtualbox:4.2.2 cpe:/a:oracle:vm_virtualbox:4.2.4 cpe:/a:oracle:vm_virtualbox:4.2.6 cpe:/a:oracle:vm_virtualbox:4.2.8 cpe:/a:oracle:vm_virtualbox:4.2.10 cpe:/a:oracle:vm_virtualbox:4.2.12 cpe:/a:oracle:vm_virtualbox:4.2.14 cpe:/a:oracle:vm_virtualbox:4.2.16 cpe:/a:oracle:vm_virtualbox:4.2.18 cpe:/a:oracle:vm_virtualbox:4.3.0 cpe:/a:oracle:vm_virtualbox:4.3.2

CVE-2014-0404

2014-01-15T11:08:09.797-05:00

2017-08-28T21:34:09.560-04:00

2.4

LOCAL

HIGH

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov DEBIAN DSA-2878 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64911 SECTRACK 1029610 XF oracle-cpujan2014-cve20140404(90372) Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0406.

CVE-2014-0405

2014-01-15T11:08:09.813-05:00

2017-08-28T21:34:09.637-04:00

3.5

LOCAL

HIGH

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64900 SECTRACK 1029610 XF oracle-cpujan2014-cve20140405(90370) Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0407.

CVE-2014-0406

2014-01-15T11:08:09.843-05:00

2017-08-28T21:34:09.717-04:00

2.4

LOCAL

HIGH

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov DEBIAN DSA-2878 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64905 SECTRACK 1029610 XF oracle-cpujan2014-cve20140406(90371) Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0404.

CVE-2014-0407

2014-01-15T11:08:09.877-05:00

2017-08-28T21:34:09.810-04:00

3.5

LOCAL

HIGH

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov DEBIAN DSA-2878 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64913 SECTRACK 1029610 XF oracle-cpujan2014-cve20140407(90369) Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0405.

cpe:/a:oracle:jdk:1.7.0:update_45 cpe:/a:oracle:jre:1.7.0:update_45

CVE-2014-0408

2014-01-15T11:08:09.907-05:00

2014-03-05T23:50:27.127-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SUSE openSUSE-SU-2014:0174 SUSE openSUSE-SU-2014:0177 SUSE openSUSE-SU-2014:0180 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64910 SECTRACK 1029608 UBUNTU USN-2089-1 Unspecified vulnerability in Oracle Java SE 7u45, when running on OS X, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

CVE-2014-0409

2017-05-11T10:29:33.077-04:00

2017-05-11T10:29:33.090-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.

cpe:/a:oracle:jdk:1.6.0:update_65 cpe:/a:oracle:jdk:1.7.0:update_45 cpe:/a:oracle:jre:1.6.0:update_65 cpe:/a:oracle:jre:1.7.0:update_45

CVE-2014-0410

2014-01-15T11:08:09.953-05:00

2018-01-04T21:29:46.757-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2014:0246 SUSE SUSE-SU-2014:0266 SUSE SUSE-SU-2014:0451 HP SSRT101454 HP SSRT101455 REDHAT RHSA-2014:0030 REDHAT RHSA-2014:0134 REDHAT RHSA-2014:0135 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64915 SECTRACK 1029608 REDHAT RHSA-2014:0414 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0415, CVE-2014-0418, and CVE-2014-0424.

CVE-2014-0411

2014-01-15T11:08:10.017-05:00

2018-01-04T21:29:46.883-05:00

4.0

NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/d533e96c7acc SUSE SUSE-SU-2014:0246 SUSE SUSE-SU-2014:0266 SUSE SUSE-SU-2014:0451 SUSE openSUSE-SU-2014:0174 SUSE openSUSE-SU-2014:0177 SUSE openSUSE-SU-2014:0180 HP SSRT101454 HP SSRT101455 REDHAT RHSA-2014:0026 REDHAT RHSA-2014:0027 REDHAT RHSA-2014:0030 REDHAT RHSA-2014:0097 REDHAT RHSA-2014:0134 REDHAT RHSA-2014:0135 REDHAT RHSA-2014:0136 SECUNIA 59194 SECUNIA 59235 SECUNIA 59283 SECUNIA 59324 SECUNIA 59339 SECUNIA 59705 SECUNIA 60833 SECUNIA 60835 SECUNIA 60836 CONFIRM http://www.ibm.com/support/docview.wss?uid=ssg1S1004745 CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21672078 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64918 SECTRACK 1029608 UBUNTU USN-2089-1 UBUNTU USN-2124-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004656 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21669519 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21675938 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676190 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676373 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676978 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677388 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21680234 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21680387 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21682668 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21682669 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21682670 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21682671 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21682904 CONFIRM http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096132 REDHAT RHSA-2014:0414 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1053010 XF oracle-cpujan2014-cve20140411(90357) CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 CONFIRM https://www.ibm.com/support/docview.wss?uid=swg21675223 CONFIRM https://www.ibm.com/support/docview.wss?uid=swg21677913 Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue allows remote attackers to obtain sensitive information about encryption keys via a timing discrepancy during the TLS/SSL handshake.

cpe:/a:mysql:mysql:5.1 cpe:/a:mysql:mysql:5.1.1 cpe:/a:mysql:mysql:5.1.2 cpe:/a:mysql:mysql:5.1.3 cpe:/a:mysql:mysql:5.1.4 cpe:/a:mysql:mysql:5.1.5 cpe:/a:mysql:mysql:5.1.5a cpe:/a:mysql:mysql:5.1.6 cpe:/a:mysql:mysql:5.1.7 cpe:/a:mysql:mysql:5.1.8 cpe:/a:mysql:mysql:5.1.9 cpe:/a:mysql:mysql:5.1.10 cpe:/a:mysql:mysql:5.1.11 cpe:/a:mysql:mysql:5.1.12 cpe:/a:mysql:mysql:5.1.13 cpe:/a:mysql:mysql:5.1.14 cpe:/a:mysql:mysql:5.1.15 cpe:/a:mysql:mysql:5.1.16 cpe:/a:mysql:mysql:5.1.17 cpe:/a:mysql:mysql:5.1.18 cpe:/a:mysql:mysql:5.1.19 cpe:/a:mysql:mysql:5.1.20 cpe:/a:mysql:mysql:5.1.21 cpe:/a:mysql:mysql:5.1.22 cpe:/a:mysql:mysql:5.1.23 cpe:/a:mysql:mysql:5.1.23:a cpe:/a:mysql:mysql:5.1.23_bk cpe:/a:mysql:mysql:5.1.23a cpe:/a:mysql:mysql:5.1.24 cpe:/a:mysql:mysql:5.1.25 cpe:/a:mysql:mysql:5.1.26 cpe:/a:mysql:mysql:5.1.27 cpe:/a:mysql:mysql:5.1.28 cpe:/a:mysql:mysql:5.1.29 cpe:/a:mysql:mysql:5.1.30 cpe:/a:mysql:mysql:5.1.31 cpe:/a:mysql:mysql:5.1.31:sp1 cpe:/a:mysql:mysql:5.1.32 cpe:/a:mysql:mysql:5.1.32-bzr cpe:/a:mysql:mysql:5.1.33 cpe:/a:mysql:mysql:5.1.34 cpe:/a:mysql:mysql:5.1.34:sp1 cpe:/a:mysql:mysql:5.1.35 cpe:/a:mysql:mysql:5.1.36 cpe:/a:mysql:mysql:5.1.37 cpe:/a:mysql:mysql:5.1.37:sp1 cpe:/a:mysql:mysql:5.1.38 cpe:/a:mysql:mysql:5.1.39 cpe:/a:mysql:mysql:5.1.40 cpe:/a:mysql:mysql:5.1.40:sp1 cpe:/a:mysql:mysql:5.1.41 cpe:/a:mysql:mysql:5.1.42 cpe:/a:mysql:mysql:5.1.43 cpe:/a:mysql:mysql:5.1.43:sp1 cpe:/a:mysql:mysql:5.1.44 cpe:/a:mysql:mysql:5.1.45 cpe:/a:mysql:mysql:5.1.46 cpe:/a:mysql:mysql:5.1.46:sp1 cpe:/a:mysql:mysql:5.1.47 cpe:/a:mysql:mysql:5.1.48 cpe:/a:mysql:mysql:5.1.49 cpe:/a:mysql:mysql:5.1.49:sp1 cpe:/a:mysql:mysql:5.1.50 cpe:/a:mysql:mysql:5.5.0 cpe:/a:mysql:mysql:5.5.1 cpe:/a:mysql:mysql:5.5.2 cpe:/a:mysql:mysql:5.5.3 cpe:/a:mysql:mysql:5.5.4 cpe:/a:mysql:mysql:5.5.5 cpe:/a:mysql:mysql:5.5.6 cpe:/a:mysql:mysql:5.5.7 cpe:/a:mysql:mysql:5.5.8 cpe:/a:mysql:mysql:5.5.9 cpe:/a:oracle:mysql:5.1.51 cpe:/a:oracle:mysql:5.1.52 cpe:/a:oracle:mysql:5.1.52:sp1 cpe:/a:oracle:mysql:5.1.53 cpe:/a:oracle:mysql:5.1.54 cpe:/a:oracle:mysql:5.1.55 cpe:/a:oracle:mysql:5.1.56 cpe:/a:oracle:mysql:5.1.57 cpe:/a:oracle:mysql:5.1.58 cpe:/a:oracle:mysql:5.1.59 cpe:/a:oracle:mysql:5.1.60 cpe:/a:oracle:mysql:5.1.61 cpe:/a:oracle:mysql:5.1.62 cpe:/a:oracle:mysql:5.1.63 cpe:/a:oracle:mysql:5.1.64 cpe:/a:oracle:mysql:5.1.65 cpe:/a:oracle:mysql:5.1.66 cpe:/a:oracle:mysql:5.1.67 cpe:/a:oracle:mysql:5.1.68 cpe:/a:oracle:mysql:5.1.69 cpe:/a:oracle:mysql:5.1.70 cpe:/a:oracle:mysql:5.1.71 cpe:/a:oracle:mysql:5.1.72 cpe:/a:oracle:mysql:5.5.10 cpe:/a:oracle:mysql:5.5.11 cpe:/a:oracle:mysql:5.5.12 cpe:/a:oracle:mysql:5.5.13 cpe:/a:oracle:mysql:5.5.14 cpe:/a:oracle:mysql:5.5.15 cpe:/a:oracle:mysql:5.5.16 cpe:/a:oracle:mysql:5.5.17 cpe:/a:oracle:mysql:5.5.18 cpe:/a:oracle:mysql:5.5.19 cpe:/a:oracle:mysql:5.5.20 cpe:/a:oracle:mysql:5.5.21 cpe:/a:oracle:mysql:5.5.22 cpe:/a:oracle:mysql:5.5.23 cpe:/a:oracle:mysql:5.5.24 cpe:/a:oracle:mysql:5.5.25 cpe:/a:oracle:mysql:5.5.25:a cpe:/a:oracle:mysql:5.5.26 cpe:/a:oracle:mysql:5.5.27 cpe:/a:oracle:mysql:5.5.28 cpe:/a:oracle:mysql:5.5.29 cpe:/a:oracle:mysql:5.5.30 cpe:/a:oracle:mysql:5.5.31 cpe:/a:oracle:mysql:5.5.32 cpe:/a:oracle:mysql:5.5.33 cpe:/a:oracle:mysql:5.5.34 cpe:/a:oracle:mysql:5.6.0 cpe:/a:oracle:mysql:5.6.1 cpe:/a:oracle:mysql:5.6.2 cpe:/a:oracle:mysql:5.6.3 cpe:/a:oracle:mysql:5.6.4 cpe:/a:oracle:mysql:5.6.5 cpe:/a:oracle:mysql:5.6.6 cpe:/a:oracle:mysql:5.6.7 cpe:/a:oracle:mysql:5.6.8 cpe:/a:oracle:mysql:5.6.9 cpe:/a:oracle:mysql:5.6.10 cpe:/a:oracle:mysql:5.6.11 cpe:/a:oracle:mysql:5.6.12 cpe:/a:oracle:mysql:5.6.13 cpe:/a:oracle:mysql:5.6.14

CVE-2014-0412

2014-01-15T11:08:10.033-05:00

2017-08-28T21:34:10.077-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2014:0164 REDHAT RHSA-2014:0173 REDHAT RHSA-2014:0186 REDHAT RHSA-2014:0189 GENTOO GLSA-201409-04 UBUNTU USN-2086-1 DEBIAN DSA-2845 DEBIAN DSA-2848 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64880 XF oracle-cpujan2014-cve20140412(90378) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB.

cpe:/a:oracle:fusion_middleware:10.1.3.5

CVE-2014-0413

2014-04-15T20:55:23.810-04:00

2014-04-16T11:45:14.457-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-04-16T11:45:14.407-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect integrity via vectors related to HTTP Request Handling, a different vulnerability than CVE-2014-0426.

cpe:/a:oracle:fusion_middleware:10.1.3.5

CVE-2014-0414

2014-04-15T20:55:23.840-04:00

2014-04-16T11:50:00.637-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-04-16T11:50:00.607-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality via vectors related to HTTP Request Handling.

cpe:/a:oracle:jdk:1.6.0:update_65 cpe:/a:oracle:jdk:1.7.0:update_45 cpe:/a:oracle:jre:1.6.0:update_65 cpe:/a:oracle:jre:1.7.0:update_45

CVE-2014-0415

2014-01-15T11:08:10.063-05:00

2018-01-04T21:29:46.960-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2014:0246 SUSE SUSE-SU-2014:0266 SUSE SUSE-SU-2014:0451 HP SSRT101454 HP SSRT101455 REDHAT RHSA-2014:0030 REDHAT RHSA-2014:0134 REDHAT RHSA-2014:0135 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64899 SECTRACK 1029608 REDHAT RHSA-2014:0414 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0410, CVE-2014-0418, and CVE-2014-0424.

CVE-2014-0416

2014-01-15T11:08:10.093-05:00

2018-01-04T21:29:47.040-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/abe1cb2d27cb SUSE SUSE-SU-2014:0246 SUSE SUSE-SU-2014:0266 SUSE SUSE-SU-2014:0451 SUSE openSUSE-SU-2014:0174 SUSE openSUSE-SU-2014:0177 SUSE openSUSE-SU-2014:0180 HP SSRT101454 HP SSRT101455 REDHAT RHSA-2014:0026 REDHAT RHSA-2014:0027 REDHAT RHSA-2014:0030 REDHAT RHSA-2014:0097 REDHAT RHSA-2014:0134 REDHAT RHSA-2014:0135 REDHAT RHSA-2014:0136 SECUNIA 59235 SECUNIA 59283 SECUNIA 59307 SECUNIA 59339 SECUNIA 60568 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64937 SECTRACK 1029608 UBUNTU USN-2089-1 UBUNTU USN-2124-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676978 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677294 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677388 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21679287 REDHAT RHSA-2014:0414 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1051912 XF oracle-cpujan2014-cve20140416(90349) CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAAS. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to how principals are set for the Subject class, which allows attackers to escape the sandbox using deserialization of a crafted Subject instance.

cpe:/a:oracle:javafx:2.2.45 cpe:/a:oracle:jdk:1.5.0:update_55 cpe:/a:oracle:jdk:1.6.0:update_65 cpe:/a:oracle:jdk:1.7.0:update_45 cpe:/a:oracle:jre:1.5.0:update_55 cpe:/a:oracle:jre:1.6.0:update_65 cpe:/a:oracle:jre:1.7.0:update_45

CVE-2014-0417

2014-01-15T11:08:10.127-05:00

2018-01-04T21:29:47.117-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2014:0246 SUSE SUSE-SU-2014:0266 SUSE SUSE-SU-2014:0451 HP SSRT101454 HP SSRT101455 REDHAT RHSA-2014:0030 REDHAT RHSA-2014:0134 REDHAT RHSA-2014:0135 REDHAT RHSA-2014:0136 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64932 SECTRACK 1029608 REDHAT RHSA-2014:0414 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JavaFX 2.2.45; and Java SE Embedded 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

cpe:/a:hp:jdk:7.0.08 cpe:/a:hp:jre:7.0.08 cpe:/a:oracle:jdk:1.6.0:update_65 cpe:/a:oracle:jdk:1.7.0:update_45 cpe:/a:oracle:jre:1.6.0:update_65 cpe:/a:oracle:jre:1.7.0:update_45 cpe:/o:redhat:enterprise_linux_desktop_supplementary:5.0 cpe:/o:redhat:enterprise_linux_desktop_supplementary:6.0 cpe:/o:redhat:enterprise_linux_hpc_node_supplementary:6.0 cpe:/o:redhat:enterprise_linux_server_supplementary:5.0 cpe:/o:redhat:enterprise_linux_server_supplementary:6.0 cpe:/o:redhat:enterprise_linux_server_supplementary_aus:6.5 cpe:/o:redhat:enterprise_linux_server_supplementary_eus:6.5.z cpe:/o:redhat:enterprise_linux_workstation_supplementary:6.0

CVE-2014-0418

2014-01-15T11:08:10.157-05:00

2018-01-04T21:29:47.197-05:00

5.1

NETWORK

HIGH

NONE

PARTIAL

http://nvd.nist.gov HP SSRT101454 HP SSRT101455 REDHAT RHSA-2014:0030 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64917 SECTRACK 1029608 REDHAT RHSA-2014:0414 XF oracle-cpujan2014-cve20140418(90344) CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0410, CVE-2014-0415, and CVE-2014-0424.

cpe:/a:oracle:virtualization_secure_global_desktop:4.63 cpe:/a:oracle:virtualization_secure_global_desktop:4.71 cpe:/a:oracle:virtualization_secure_global_desktop:5.0 cpe:/a:oracle:virtualization_secure_global_desktop:5.10

CVE-2014-0419

2014-01-15T11:08:10.187-05:00

2017-08-28T21:34:10.293-04:00

5.1

NETWORK

HIGH

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64902 SECTRACK 1029610 XF oracle-cpujan2014-cve20140419(90367) Unspecified vulnerability in the Oracle Secure Global Desktop (SGD) component in Oracle Virtualization SGD before 4.63 with December 2013 PSU, 4.71, 5.0 with December 2013 PSU, and 5.10 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Administration Console and Workspace Web Applications.

cpe:/a:mysql:mysql:5.5.0 cpe:/a:mysql:mysql:5.5.1 cpe:/a:mysql:mysql:5.5.2 cpe:/a:mysql:mysql:5.5.3 cpe:/a:mysql:mysql:5.5.4 cpe:/a:mysql:mysql:5.5.5 cpe:/a:mysql:mysql:5.5.6 cpe:/a:mysql:mysql:5.5.7 cpe:/a:mysql:mysql:5.5.8 cpe:/a:mysql:mysql:5.5.9 cpe:/a:oracle:mysql:5.5.10 cpe:/a:oracle:mysql:5.5.11 cpe:/a:oracle:mysql:5.5.12 cpe:/a:oracle:mysql:5.5.13 cpe:/a:oracle:mysql:5.5.14 cpe:/a:oracle:mysql:5.5.15 cpe:/a:oracle:mysql:5.5.16 cpe:/a:oracle:mysql:5.5.17 cpe:/a:oracle:mysql:5.5.18 cpe:/a:oracle:mysql:5.5.19 cpe:/a:oracle:mysql:5.5.20 cpe:/a:oracle:mysql:5.5.21 cpe:/a:oracle:mysql:5.5.22 cpe:/a:oracle:mysql:5.5.23 cpe:/a:oracle:mysql:5.5.24 cpe:/a:oracle:mysql:5.5.25 cpe:/a:oracle:mysql:5.5.25:a cpe:/a:oracle:mysql:5.5.26 cpe:/a:oracle:mysql:5.5.27 cpe:/a:oracle:mysql:5.5.28 cpe:/a:oracle:mysql:5.5.29 cpe:/a:oracle:mysql:5.5.30 cpe:/a:oracle:mysql:5.5.31 cpe:/a:oracle:mysql:5.5.32 cpe:/a:oracle:mysql:5.5.33 cpe:/a:oracle:mysql:5.5.34 cpe:/a:oracle:mysql:5.6.0 cpe:/a:oracle:mysql:5.6.1 cpe:/a:oracle:mysql:5.6.2 cpe:/a:oracle:mysql:5.6.3 cpe:/a:oracle:mysql:5.6.4 cpe:/a:oracle:mysql:5.6.5 cpe:/a:oracle:mysql:5.6.6 cpe:/a:oracle:mysql:5.6.7 cpe:/a:oracle:mysql:5.6.8 cpe:/a:oracle:mysql:5.6.9 cpe:/a:oracle:mysql:5.6.10 cpe:/a:oracle:mysql:5.6.11 cpe:/a:oracle:mysql:5.6.12 cpe:/a:oracle:mysql:5.6.13 cpe:/a:oracle:mysql:5.6.14 cpe:/o:canonical:ubuntu_linux:10.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:12.10 cpe:/o:canonical:ubuntu_linux:13.10 cpe:/o:oracle:solaris:11.3 cpe:/o:redhat:enterprise_linux_desktop:5.0 cpe:/o:redhat:enterprise_linux_server:5.0 cpe:/o:redhat:enterprise_linux_workstation:5.0

CVE-2014-0420

2014-01-15T11:08:10.203-05:00

2017-08-28T21:34:10.403-04:00

2.8

NETWORK

MEDIUM

MULTIPLE_INSTANCES

NONE

PARTIAL

http://nvd.nist.gov OSVDB 102077 REDHAT RHSA-2014:0173 REDHAT RHSA-2014:0186 REDHAT RHSA-2014:0189 GENTOO GLSA-201409-04 UBUNTU USN-2086-1 DEBIAN DSA-2848 CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64888 XF oracle-cpujan2014-cve20140420(90388) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.34 and earlier, and 5.6.14 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Replication.

cpe:/o:sun:sunos:5.10:-:sparc

CVE-2014-0421

2014-04-15T20:55:23.873-04:00

2014-04-16T12:05:48.247-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-04-16T12:05:48.230-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html Unspecified vulnerability in Oracle Solaris 10, when running on the SPARC64-X Platform, allows local users to affect confidentiality, integrity, and availability via unknown vectors.

CVE-2014-0422

2014-01-15T11:08:10.237-05:00

2018-01-04T21:29:47.273-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2014:0246 SUSE SUSE-SU-2014:0266 SUSE SUSE-SU-2014:0451 SUSE openSUSE-SU-2014:0174 SUSE openSUSE-SU-2014:0177 SUSE openSUSE-SU-2014:0180 HP SSRT101454 HP SSRT101455 REDHAT RHSA-2014:0026 REDHAT RHSA-2014:0027 REDHAT RHSA-2014:0030 REDHAT RHSA-2014:0097 REDHAT RHSA-2014:0134 REDHAT RHSA-2014:0135 REDHAT RHSA-2014:0136 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64921 SECTRACK 1029608 UBUNTU USN-2089-1 UBUNTU USN-2124-1 REDHAT RHSA-2014:0414 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1051528 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JNDI. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to missing package access checks in the Naming / JNDI component, which allows attackers to escape the sandbox.

CVE-2014-0423

2014-01-15T11:08:10.267-05:00

2018-01-04T21:29:47.400-05:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/995b32f013f5 SUSE SUSE-SU-2014:0246 SUSE SUSE-SU-2014:0266 SUSE SUSE-SU-2014:0451 SUSE openSUSE-SU-2014:0174 SUSE openSUSE-SU-2014:0177 SUSE openSUSE-SU-2014:0180 HP SSRT101454 HP SSRT101455 REDHAT RHSA-2014:0026 REDHAT RHSA-2014:0027 REDHAT RHSA-2014:0030 REDHAT RHSA-2014:0097 REDHAT RHSA-2014:0134 REDHAT RHSA-2014:0135 REDHAT RHSA-2014:0136 SECUNIA 59283 SECUNIA 60568 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64914 SECTRACK 1029608 UBUNTU USN-2089-1 UBUNTU USN-2124-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677388 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21679287 REDHAT RHSA-2014:0414 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1053066 XF oracle-cpujan2014-cve20140423(90340) CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote authenticated users to affect confidentiality and availability via unknown vectors related to Beans. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability in DocumentHandler.java, related to Beans decoding.

cpe:/a:oracle:jdk:1.6.0:update_65 cpe:/a:oracle:jdk:1.7.0:update_45 cpe:/a:oracle:jre:1.6.0:update_65 cpe:/a:oracle:jre:1.7.0:update_45

CVE-2014-0424

2014-01-15T11:08:10.297-05:00

2018-01-04T21:29:47.493-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SUSE SUSE-SU-2014:0246 SUSE SUSE-SU-2014:0266 SUSE SUSE-SU-2014:0451 HP SSRT101454 HP SSRT101455 REDHAT RHSA-2014:0030 REDHAT RHSA-2014:0134 REDHAT RHSA-2014:0135 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64919 SECTRACK 1029608 REDHAT RHSA-2014:0414 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0410, CVE-2014-0415, and CVE-2014-0418.

cpe:/a:oracle:peoplesoft_products:9.2

CVE-2014-0425

2014-01-15T11:08:10.330-05:00

2014-02-06T23:51:45.363-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64889 SECTRACK 1029623 Unspecified vulnerability in the PeopleSoft Enterprise SCM Services Procurement component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.

cpe:/a:oracle:fusion_middleware:10.1.3.5

CVE-2014-0426

2014-04-15T20:55:23.903-04:00

2014-04-16T12:13:36.887-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-04-16T12:13:36.840-04:00

cpe:/a:oracle:mysql:5.6.0 cpe:/a:oracle:mysql:5.6.1 cpe:/a:oracle:mysql:5.6.2 cpe:/a:oracle:mysql:5.6.3 cpe:/a:oracle:mysql:5.6.4 cpe:/a:oracle:mysql:5.6.5 cpe:/a:oracle:mysql:5.6.6 cpe:/a:oracle:mysql:5.6.7 cpe:/a:oracle:mysql:5.6.8 cpe:/a:oracle:mysql:5.6.9 cpe:/a:oracle:mysql:5.6.10 cpe:/a:oracle:mysql:5.6.11 cpe:/a:oracle:mysql:5.6.12 cpe:/a:oracle:mysql:5.6.13

CVE-2014-0427

2014-01-15T11:08:10.360-05:00

2017-08-28T21:34:10.577-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov GENTOO GLSA-201409-04 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64868 XF oracle-cpujan2014-cve20140427(90383) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.13 and earlier allows remote authenticated users to affect availability via vectors related to FTS.

CVE-2014-0428

2014-01-15T11:08:10.377-05:00

2018-01-04T21:29:47.570-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov MISC http://hg.openjdk.java.net/jdk7u/jdk7u/corba/rev/0a879f00b698 SUSE SUSE-SU-2014:0246 SUSE SUSE-SU-2014:0266 SUSE SUSE-SU-2014:0451 SUSE openSUSE-SU-2014:0174 SUSE openSUSE-SU-2014:0177 SUSE openSUSE-SU-2014:0180 HP SSRT101454 HP SSRT101455 REDHAT RHSA-2014:0026 REDHAT RHSA-2014:0027 REDHAT RHSA-2014:0030 REDHAT RHSA-2014:0097 REDHAT RHSA-2014:0134 REDHAT RHSA-2014:0135 REDHAT RHSA-2014:0136 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64935 SECTRACK 1029608 UBUNTU USN-2089-1 UBUNTU USN-2124-1 REDHAT RHSA-2014:0414 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1051519 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to "insufficient security checks in IIOP streams," which allows attackers to escape the sandbox.

cpe:/a:juniper:junos_space:15.1 cpe:/a:oracle:jdk:1.5.0:update_61 cpe:/a:oracle:jdk:1.6.0:update_71 cpe:/a:oracle:jdk:1.7.0:update_51 cpe:/a:oracle:jdk:1.8.0 cpe:/a:oracle:jre:1.5.0:update_61 cpe:/a:oracle:jre:1.6.0:update_71 cpe:/a:oracle:jre:1.7.0:update_51 cpe:/a:oracle:jre:1.8.0 cpe:/a:oracle:jrockit:r27.8.1 cpe:/a:oracle:jrockit:r28.3.1 cpe:/o:canonical:ubuntu_linux:10.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:12.10 cpe:/o:canonical:ubuntu_linux:13.10 cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:debian:debian_linux:7.0 cpe:/o:debian:debian_linux:8.0

CVE-2014-0429

2014-04-15T20:55:23.920-04:00

2018-01-04T21:29:47.650-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698 HP SSRT101668 REDHAT RHSA-2014:0675 REDHAT RHSA-2014:0685 GENTOO GLSA-201406-32 GENTOO GLSA-201502-12 DEBIAN DSA-2912 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html BID 66856 UBUNTU USN-2187-1 UBUNTU USN-2191-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21672080 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676746 REDHAT RHSA-2014:0413 REDHAT RHSA-2014:0414 CONFIRM https://www.ibm.com/support/docview.wss?uid=swg21675973 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVE-2014-0430

2014-01-15T11:08:10.407-05:00

2017-08-28T21:34:10.637-04:00

2.8

NETWORK

MEDIUM

MULTIPLE_INSTANCES

NONE

PARTIAL

http://nvd.nist.gov GENTOO GLSA-201409-04 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64893 XF oracle-cpujan2014-cve20140430(90387) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Performance Schema.

CVE-2014-0431

2014-01-15T11:08:10.437-05:00

2017-08-28T21:34:10.700-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov GENTOO GLSA-201409-04 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64897 XF oracle-cpujan2014-cve20140431(90384) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB, a different vulnerability than CVE-2013-5881.

cpe:/a:oracle:jdk:1.7.0:update_51 cpe:/a:oracle:jdk:1.8.0 cpe:/a:oracle:jre:1.7.0:update_51 cpe:/a:oracle:jre:1.8.0

CVE-2014-0432

2014-04-15T20:55:23.967-04:00

2018-01-04T21:29:47.710-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov HP SSRT101667 GENTOO GLSA-201502-12 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html BID 66897 REDHAT RHSA-2014:0413 Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-0455 and CVE-2014-2402.

CVE-2014-0433

2014-01-15T11:08:10.453-05:00

2017-08-28T21:34:10.763-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov GENTOO GLSA-201409-04 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64895 XF oracle-cpujan2014-cve20140433(90375) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.13 and earlier allows remote attackers to affect availability via unknown vectors related to Thread Pooling.

cpe:/a:oracle:supply_chain_products_suite:6.0.0 cpe:/a:oracle:supply_chain_products_suite:6.1.0 cpe:/a:oracle:supply_chain_products_suite:6.1.1.0

CVE-2014-0434

2014-01-15T11:08:10.487-05:00

2014-02-06T23:51:45.863-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64851 SECTRACK 1029620 Unspecified vulnerability in the Oracle Agile Product Lifecycle Management for Process component in Oracle Supply Chain Products Suite 6.0, 6.1, and 6.1.1 allows remote attackers to affect integrity via unknown vectors related to Installation.

cpe:/a:oracle:supply_chain_products_suite:6.1.0 cpe:/a:oracle:supply_chain_products_suite:6.2.0 cpe:/a:oracle:supply_chain_products_suite:6.3.0 cpe:/a:oracle:supply_chain_products_suite:6.3.1 cpe:/a:oracle:supply_chain_products_suite:6.3.2

CVE-2014-0435

2014-01-15T11:08:10.517-05:00

2014-02-06T23:51:45.957-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64869 SECTRACK 1029620 Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3, 6.3.1, and 6.3.2 allows remote authenticated users to affect availability via unknown vectors related to Data, Domain & Function Security.

cpe:/a:oracle:hyperion:11.1.2.2 cpe:/a:oracle:hyperion:11.1.2.3

CVE-2014-0436

2014-07-17T01:10:13.997-04:00

2018-10-09T15:42:02.827-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov FULLDISC 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities CONFIRM http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html BUGTRAQ 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities BID 68595 SECTRACK 1030579 CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0012.html Unspecified vulnerability in the Hyperion BI+ component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote attackers to affect integrity via unknown vectors related to Web Analysis.

cpe:/a:mysql:mysql:5.1 cpe:/a:mysql:mysql:5.1.1 cpe:/a:mysql:mysql:5.1.2 cpe:/a:mysql:mysql:5.1.3 cpe:/a:mysql:mysql:5.1.4 cpe:/a:mysql:mysql:5.1.5 cpe:/a:mysql:mysql:5.1.5a cpe:/a:mysql:mysql:5.1.6 cpe:/a:mysql:mysql:5.1.7 cpe:/a:mysql:mysql:5.1.8 cpe:/a:mysql:mysql:5.1.9 cpe:/a:mysql:mysql:5.1.10 cpe:/a:mysql:mysql:5.1.11 cpe:/a:mysql:mysql:5.1.12 cpe:/a:mysql:mysql:5.1.13 cpe:/a:mysql:mysql:5.1.14 cpe:/a:mysql:mysql:5.1.15 cpe:/a:mysql:mysql:5.1.16 cpe:/a:mysql:mysql:5.1.17 cpe:/a:mysql:mysql:5.1.18 cpe:/a:mysql:mysql:5.1.19 cpe:/a:mysql:mysql:5.1.20 cpe:/a:mysql:mysql:5.1.21 cpe:/a:mysql:mysql:5.1.22 cpe:/a:mysql:mysql:5.1.23 cpe:/a:mysql:mysql:5.1.23:a cpe:/a:mysql:mysql:5.1.23_bk cpe:/a:mysql:mysql:5.1.23a cpe:/a:mysql:mysql:5.1.24 cpe:/a:mysql:mysql:5.1.25 cpe:/a:mysql:mysql:5.1.26 cpe:/a:mysql:mysql:5.1.27 cpe:/a:mysql:mysql:5.1.28 cpe:/a:mysql:mysql:5.1.29 cpe:/a:mysql:mysql:5.1.30 cpe:/a:mysql:mysql:5.1.31 cpe:/a:mysql:mysql:5.1.31:sp1 cpe:/a:mysql:mysql:5.1.32 cpe:/a:mysql:mysql:5.1.32-bzr cpe:/a:mysql:mysql:5.1.33 cpe:/a:mysql:mysql:5.1.34 cpe:/a:mysql:mysql:5.1.34:sp1 cpe:/a:mysql:mysql:5.1.35 cpe:/a:mysql:mysql:5.1.36 cpe:/a:mysql:mysql:5.1.37 cpe:/a:mysql:mysql:5.1.37:sp1 cpe:/a:mysql:mysql:5.1.38 cpe:/a:mysql:mysql:5.1.39 cpe:/a:mysql:mysql:5.1.40 cpe:/a:mysql:mysql:5.1.40:sp1 cpe:/a:mysql:mysql:5.1.41 cpe:/a:mysql:mysql:5.1.42 cpe:/a:mysql:mysql:5.1.43 cpe:/a:mysql:mysql:5.1.43:sp1 cpe:/a:mysql:mysql:5.1.44 cpe:/a:mysql:mysql:5.1.45 cpe:/a:mysql:mysql:5.1.46 cpe:/a:mysql:mysql:5.1.46:sp1 cpe:/a:mysql:mysql:5.1.47 cpe:/a:mysql:mysql:5.1.48 cpe:/a:mysql:mysql:5.1.49 cpe:/a:mysql:mysql:5.1.49:sp1 cpe:/a:mysql:mysql:5.1.50 cpe:/a:mysql:mysql:5.5.0 cpe:/a:mysql:mysql:5.5.1 cpe:/a:mysql:mysql:5.5.2 cpe:/a:mysql:mysql:5.5.3 cpe:/a:mysql:mysql:5.5.4 cpe:/a:mysql:mysql:5.5.5 cpe:/a:mysql:mysql:5.5.6 cpe:/a:mysql:mysql:5.5.7 cpe:/a:mysql:mysql:5.5.8 cpe:/a:mysql:mysql:5.5.9 cpe:/a:oracle:mysql:5.1.51 cpe:/a:oracle:mysql:5.1.52 cpe:/a:oracle:mysql:5.1.52:sp1 cpe:/a:oracle:mysql:5.1.53 cpe:/a:oracle:mysql:5.1.54 cpe:/a:oracle:mysql:5.1.55 cpe:/a:oracle:mysql:5.1.56 cpe:/a:oracle:mysql:5.1.57 cpe:/a:oracle:mysql:5.1.58 cpe:/a:oracle:mysql:5.1.59 cpe:/a:oracle:mysql:5.1.60 cpe:/a:oracle:mysql:5.1.61 cpe:/a:oracle:mysql:5.1.62 cpe:/a:oracle:mysql:5.1.63 cpe:/a:oracle:mysql:5.1.64 cpe:/a:oracle:mysql:5.1.65 cpe:/a:oracle:mysql:5.1.66 cpe:/a:oracle:mysql:5.1.67 cpe:/a:oracle:mysql:5.1.68 cpe:/a:oracle:mysql:5.1.69 cpe:/a:oracle:mysql:5.1.70 cpe:/a:oracle:mysql:5.1.71 cpe:/a:oracle:mysql:5.1.72 cpe:/a:oracle:mysql:5.5.10 cpe:/a:oracle:mysql:5.5.11 cpe:/a:oracle:mysql:5.5.12 cpe:/a:oracle:mysql:5.5.13 cpe:/a:oracle:mysql:5.5.14 cpe:/a:oracle:mysql:5.5.15 cpe:/a:oracle:mysql:5.5.16 cpe:/a:oracle:mysql:5.5.17 cpe:/a:oracle:mysql:5.5.18 cpe:/a:oracle:mysql:5.5.19 cpe:/a:oracle:mysql:5.5.20 cpe:/a:oracle:mysql:5.5.21 cpe:/a:oracle:mysql:5.5.22 cpe:/a:oracle:mysql:5.5.23 cpe:/a:oracle:mysql:5.5.24 cpe:/a:oracle:mysql:5.5.25 cpe:/a:oracle:mysql:5.5.25:a cpe:/a:oracle:mysql:5.5.26 cpe:/a:oracle:mysql:5.5.27 cpe:/a:oracle:mysql:5.5.28 cpe:/a:oracle:mysql:5.5.29 cpe:/a:oracle:mysql:5.5.30 cpe:/a:oracle:mysql:5.5.31 cpe:/a:oracle:mysql:5.5.32 cpe:/a:oracle:mysql:5.5.33 cpe:/a:oracle:mysql:5.5.34 cpe:/a:oracle:mysql:5.6.0 cpe:/a:oracle:mysql:5.6.1 cpe:/a:oracle:mysql:5.6.2 cpe:/a:oracle:mysql:5.6.3 cpe:/a:oracle:mysql:5.6.4 cpe:/a:oracle:mysql:5.6.5 cpe:/a:oracle:mysql:5.6.6 cpe:/a:oracle:mysql:5.6.7 cpe:/a:oracle:mysql:5.6.8 cpe:/a:oracle:mysql:5.6.9 cpe:/a:oracle:mysql:5.6.10 cpe:/a:oracle:mysql:5.6.11 cpe:/a:oracle:mysql:5.6.12 cpe:/a:oracle:mysql:5.6.13 cpe:/a:oracle:mysql:5.6.14

CVE-2014-0437

2014-01-15T11:08:10.547-05:00

2017-08-28T21:34:10.857-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2014:0164 REDHAT RHSA-2014:0173 REDHAT RHSA-2014:0186 REDHAT RHSA-2014:0189 GENTOO GLSA-201409-04 UBUNTU USN-2086-1 DEBIAN DSA-2845 DEBIAN DSA-2848 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64849 XF oracle-cpujan2014-cve20140437(90385) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

cpe:/a:oracle:peoplesoft_products:8.52 cpe:/a:oracle:peoplesoft_products:8.53

CVE-2014-0438

2014-01-15T11:08:10.580-05:00

2014-02-06T23:51:46.130-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64887 SECTRACK 1029623 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect confidentiality via unknown vectors related to Panel Processor.

cpe:/a:oracle:peoplesoft_products:8.52 cpe:/a:oracle:peoplesoft_products:8.53

CVE-2014-0439

2014-01-15T11:08:10.593-05:00

2014-02-06T23:51:46.207-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64884 SECTRACK 1029623 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect integrity via unknown vectors related to Report Distribution.

cpe:/a:oracle:peoplesoft_products:8.52 cpe:/a:oracle:peoplesoft_products:8.53

CVE-2014-0440

2014-01-15T11:08:10.627-05:00

2014-02-06T23:51:46.287-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64881 SECTRACK 1029623 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect availability via vectors related to PIA Core Technology.

cpe:/a:oracle:peoplesoft_products:8.52 cpe:/a:oracle:peoplesoft_products:8.53

CVE-2014-0441

2014-01-15T11:08:10.657-05:00

2014-02-06T23:51:46.363-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64839 SECTRACK 1029623 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect availability via unknown vectors related to Integration Broker.

cpe:/o:oracle:sunos:5.11.1 cpe:/o:sun:sunos:5.9 cpe:/o:sun:sunos:5.10 cpe:/o:sun:sunos:5.11

CVE-2014-0442

2014-04-15T20:55:23.980-04:00

2014-04-16T12:02:12.850-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-04-16T12:02:12.757-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html Unspecified vulnerability in Oracle Solaris 9, 10, and 11.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Print Filter Utility.

cpe:/a:oracle:peoplesoft_products:8.52

CVE-2014-0443

2014-01-15T11:08:10.687-05:00

2014-02-06T23:51:46.457-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64844 SECTRACK 1029623 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 allows remote attackers to affect integrity via unknown vectors related to Security.

cpe:/a:oracle:supply_chain_products_suite:20.1.1

CVE-2014-0444

2014-01-15T11:08:10.720-05:00

2014-02-06T23:51:46.550-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64883 SECTRACK 1029620 Unspecified vulnerability in the Oracle AutoVue Electro-Mechanical Professional component in Oracle Supply Chain Products Suite 20.1.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Web General, a different vulnerability than CVE-2013-5868 and CVE-2013-5871.

cpe:/a:oracle:peoplesoft_products:8.52 cpe:/a:oracle:peoplesoft_products:8.53

CVE-2014-0445

2014-01-15T11:08:10.737-05:00

2014-02-06T23:51:46.647-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 64758 BID 64867 SECTRACK 1029623 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect integrity via vectors related to PIA Core Technology, a different vulnerability than CVE-2014-0381.

CVE-2014-0446

2014-04-15T20:55:24.027-04:00

2018-01-04T21:29:47.773-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov HP SSRT101667 HP SSRT101668 REDHAT RHSA-2014:0675 REDHAT RHSA-2014:0685 GENTOO GLSA-201406-32 GENTOO GLSA-201502-12 DEBIAN DSA-2912 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html BID 66903 UBUNTU USN-2187-1 UBUNTU USN-2191-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21672080 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676746 REDHAT RHSA-2014:0413 REDHAT RHSA-2014:0414 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

cpe:/o:oracle:sunos:5.11.1 cpe:/o:sun:sunos:5.10

CVE-2014-0447

2014-04-15T20:55:24.060-04:00

2016-11-22T10:52:17.770-05:00

4.9

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-11-22T09:52:36.603-05:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html Unspecified vulnerability in Oracle Solaris 10 and 11.1 allows local users to affect availability via unknown vectors related to Kernel, a different vulnerability than CVE-2013-5876.

cpe:/a:oracle:jdk:1.7.0:update_51 cpe:/a:oracle:jdk:1.8.0 cpe:/a:oracle:jre:1.7.0:update_51 cpe:/a:oracle:jre:1.8.0

CVE-2014-0448

2014-04-15T20:55:24.090-04:00

2018-01-04T21:29:47.837-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov HP SSRT101667 GENTOO GLSA-201502-12 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html BID 66904 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21672080 REDHAT RHSA-2014:0413 Unspecified vulnerability in Oracle Java SE 7u51 and 8 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

cpe:/a:oracle:jdk:1.6.0:update_71 cpe:/a:oracle:jdk:1.7.0:update_51 cpe:/a:oracle:jdk:1.8.0 cpe:/a:oracle:jre:1.6.0:update_71 cpe:/a:oracle:jre:1.7.0:update_51 cpe:/a:oracle:jre:1.8.0

CVE-2014-0449

2014-04-15T20:55:24.123-04:00

2018-01-04T21:29:47.900-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov HP SSRT101667 HP SSRT101668 GENTOO GLSA-201502-12 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html BID 66907 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21672080 REDHAT RHSA-2014:0413 REDHAT RHSA-2014:0414 Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality via unknown vectors related to Deployment.

cpe:/a:oracle:fusion_middleware:11.1.1.7.0 cpe:/a:oracle:fusion_middleware:11.1.1.8.0

CVE-2014-0450

2014-04-15T20:55:24.153-04:00

2014-04-16T12:10:45.397-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-04-16T12:10:45.350-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.7 and 11.1.1.8 allows remote attackers to affect confidentiality via unknown vectors related to People Connection.

CVE-2014-0451

2014-04-15T21:55:09.650-04:00

2018-01-04T21:29:47.977-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov HP SSRT101667 HP SSRT101668 REDHAT RHSA-2014:0675 REDHAT RHSA-2014:0685 GENTOO GLSA-201406-32 GENTOO GLSA-201502-12 DEBIAN DSA-2912 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html BID 66879 UBUNTU USN-2187-1 UBUNTU USN-2191-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21672080 REDHAT RHSA-2014:0413 REDHAT RHSA-2014:0414 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT, a different vulnerability than CVE-2014-2412.

cpe:/a:oracle:jdk:1.6.0:update_71 cpe:/a:oracle:jdk:1.7.0:update_51 cpe:/a:oracle:jdk:1.8.0 cpe:/a:oracle:jre:1.6.0:update_71 cpe:/a:oracle:jre:1.7.0:update_51 cpe:/a:oracle:jre:1.8.0

CVE-2014-0452

2014-04-15T21:55:09.680-04:00

2018-01-04T21:29:48.057-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov HP SSRT101667 HP SSRT101668 REDHAT RHSA-2014:0675 REDHAT RHSA-2014:0685 GENTOO GLSA-201406-32 GENTOO GLSA-201502-12 DEBIAN DSA-2912 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html BID 66891 UBUNTU USN-2187-1 UBUNTU USN-2191-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21672080 REDHAT RHSA-2014:0413 REDHAT RHSA-2014:0414 Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0458 and CVE-2014-2423.

cpe:/a:oracle:jdk:1.5.0:update_61 cpe:/a:oracle:jdk:1.6.0:update_71 cpe:/a:oracle:jdk:1.7.0:update_51 cpe:/a:oracle:jdk:1.8.0 cpe:/a:oracle:jre:1.5.0:update_61 cpe:/a:oracle:jre:1.6.0:update_71 cpe:/a:oracle:jre:1.7.0:update_51 cpe:/a:oracle:jre:1.8.0 cpe:/a:oracle:jrockit:r27.8.1 cpe:/a:oracle:jrockit:r28.3.1 cpe:/o:canonical:ubuntu_linux:10.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:12.10 cpe:/o:canonical:ubuntu_linux:13.10 cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:debian:debian_linux:6.0 cpe:/o:debian:debian_linux:7.0

CVE-2014-0453

2014-04-15T21:55:09.713-04:00

2018-01-04T21:29:48.197-05:00

4.0

NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698 HP SSRT101667 HP SSRT101668 REDHAT RHSA-2014:0675 REDHAT RHSA-2014:0685 SECUNIA 59194 SECUNIA 59307 SECUNIA 59324 SECUNIA 59436 SECUNIA 60574 SECUNIA 60580 SECUNIA 61264 GENTOO GLSA-201406-32 GENTOO GLSA-201502-12 DEBIAN DSA-2912 CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21675343 CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21675588 CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21677387 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html BID 66914 UBUNTU USN-2187-1 UBUNTU USN-2191-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21672080 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21673836 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21674539 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21675945 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676190 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676373 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676672 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676703 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677294 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21678113 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21679610 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21679713 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21680387 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21680750 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21681018 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21681047 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21681256 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21683484 CONFIRM http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096132 REDHAT RHSA-2014:0413 REDHAT RHSA-2014:0414 CONFIRM https://www.ibm.com/support/docview.wss?uid=swg21674530 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security.

cpe:/a:oracle:jdk:1.7.0:update_51 cpe:/a:oracle:jdk:1.8.0 cpe:/a:oracle:jre:1.7.0:update_51 cpe:/a:oracle:jre:1.8.0

CVE-2014-0454

2014-04-15T21:55:09.727-04:00

2018-01-04T21:29:48.257-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov HP SSRT101667 REDHAT RHSA-2014:0675 GENTOO GLSA-201502-12 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html BID 66905 UBUNTU USN-2187-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21672080 REDHAT RHSA-2014:0413 CONFIRM https://www.ibm.com/support/docview.wss?uid=swg21675973 Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security.

cpe:/a:oracle:jdk:1.7.0:update_51 cpe:/a:oracle:jdk:1.8.0 cpe:/a:oracle:jre:1.7.0:update_51 cpe:/a:oracle:jre:1.8.0

CVE-2014-0455

2014-04-15T21:55:09.760-04:00

2018-01-04T21:29:48.307-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov HP SSRT101667 REDHAT RHSA-2014:0675 GENTOO GLSA-201502-12 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html BID 66899 UBUNTU USN-2187-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21672080 REDHAT RHSA-2014:0413 CONFIRM https://www.ibm.com/support/docview.wss?uid=swg21675973 Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-0432 and CVE-2014-2402.

cpe:/a:juniper:junos_space:15.1 cpe:/a:oracle:jdk:1.7.0:update_51 cpe:/a:oracle:jdk:1.8.0 cpe:/a:oracle:jre:1.7.0:update_51 cpe:/a:oracle:jre:1.8.0 cpe:/o:canonical:ubuntu_linux:10.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:12.10 cpe:/o:canonical:ubuntu_linux:13.10 cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:debian:debian_linux:6.0 cpe:/o:debian:debian_linux:7.0

CVE-2014-0456

2014-04-15T21:55:09.773-04:00

2018-01-04T21:29:48.383-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698 HP SSRT101667 HP SSRT101668 REDHAT RHSA-2014:0675 REDHAT RHSA-2014:0685 GENTOO GLSA-201406-32 GENTOO GLSA-201502-12 DEBIAN DSA-2912 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html BID 66877 UBUNTU USN-2187-1 UBUNTU USN-2191-1 REDHAT RHSA-2014:0413 REDHAT RHSA-2014:0414 Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

CVE-2014-0457

2014-04-15T21:55:09.820-04:00

2018-01-04T21:29:48.523-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov HP SSRT101668 REDHAT RHSA-2014:0675 REDHAT RHSA-2014:0685 GENTOO GLSA-201406-32 GENTOO GLSA-201502-12 DEBIAN DSA-2912 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html BID 66866 UBUNTU USN-2187-1 UBUNTU USN-2191-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21672080 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676746 REDHAT RHSA-2014:0413 REDHAT RHSA-2014:0414 CONFIRM https://www.ibm.com/support/docview.wss?uid=swg21675973 Unspecified vulnerability in Oracle Java SE 5.0u61, SE 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

cpe:/a:oracle:jdk:1.6.0:update_71 cpe:/a:oracle:jdk:1.7.0:update_51 cpe:/a:oracle:jdk:1.8.0 cpe:/a:oracle:jre:1.6.0:update_71 cpe:/a:oracle:jre:1.7.0:update_51 cpe:/a:oracle:jre:1.8.0

CVE-2014-0458

2014-04-15T21:55:09.867-04:00

2018-01-04T21:29:48.617-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov HP SSRT101667 HP SSRT101668 REDHAT RHSA-2014:0675 REDHAT RHSA-2014:0685 GENTOO GLSA-201406-32 GENTOO GLSA-201502-12 DEBIAN DSA-2912 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html BID 66883 UBUNTU USN-2187-1 UBUNTU USN-2191-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21672080 REDHAT RHSA-2014:0413 REDHAT RHSA-2014:0414 Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0452 and CVE-2014-2423.

cpe:/a:oracle:jdk:1.7.0:update_51 cpe:/a:oracle:jdk:1.8.0 cpe:/a:oracle:jre:1.7.0:update_51 cpe:/a:oracle:jre:1.8.0

CVE-2014-0459

2014-04-15T21:55:09.930-04:00

2018-01-04T21:29:48.680-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov HP SSRT101667 REDHAT RHSA-2014:0675 GENTOO GLSA-201406-32 GENTOO GLSA-201502-12 DEBIAN DSA-2912 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html BID 66910 UBUNTU USN-2187-1 UBUNTU USN-2191-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21672080 REDHAT RHSA-2014:0413 Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect availability via unknown vectors related to 2D.

CVE-2014-0460

2014-04-15T21:55:09.993-04:00

2018-01-04T21:29:48.790-05:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698 HP SSRT101667 HP SSRT101668 REDHAT RHSA-2014:0675 REDHAT RHSA-2014:0685 SECUNIA 59307 SECUNIA 59436 SECUNIA 59516 SECUNIA 59705 SECUNIA 59706 SECUNIA 61264 GENTOO GLSA-201406-32 GENTOO GLSA-201502-12 DEBIAN DSA-2912 CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21675343 CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21675588 CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21677387 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html BID 66916 UBUNTU USN-2187-1 UBUNTU USN-2191-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21672080 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21673836 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21674539 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676315 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676672 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676746 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21677294 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21679713 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21681018 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21681256 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21683484 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21686717 REDHAT RHSA-2014:0413 REDHAT RHSA-2014:0414 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via vectors related to JNDI.

cpe:/a:oracle:jdk:1.6.0:update_71 cpe:/a:oracle:jdk:1.7.0:update_51 cpe:/a:oracle:jdk:1.8.0 cpe:/a:oracle:jre:1.6.0:update_71 cpe:/a:oracle:jre:1.7.0:update_51 cpe:/a:oracle:jre:1.8.0

CVE-2014-0461

2014-04-15T21:55:10.057-04:00

2018-01-04T21:29:48.853-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov HP SSRT101667 HP SSRT101668 REDHAT RHSA-2014:0675 REDHAT RHSA-2014:0685 GENTOO GLSA-201406-32 GENTOO GLSA-201502-12 DEBIAN DSA-2912 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html BID 66902 UBUNTU USN-2187-1 UBUNTU USN-2191-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21672080 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21676746 REDHAT RHSA-2014:0413 REDHAT RHSA-2014:0414 CONFIRM https://www.ibm.com/support/docview.wss?uid=swg21675973 Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

cpe:/a:oracle:openjdk:1.6.0

CVE-2014-0462

2014-05-13T20:55:07.820-04:00

2014-05-14T14:30:38.680-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2014-05-14T14:30:38.477-04:00

DEBIAN DSA-2912 UBUNTU USN-2191-1 Unspecified vulnerability in OpenJDK 6 before 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS has unknown impact and attack vectors, a different vulnerability than CVE-2014-2405.

cpe:/a:oracle:jdk:1.8.0 cpe:/a:oracle:jre:1.8.0

CVE-2014-0463

2014-04-15T21:55:10.103-04:00

2017-01-06T21:59:28.983-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov GENTOO GLSA-201502-12 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html BID 66908 Unspecified vulnerability in Oracle Java SE 8 allows remote attackers to affect confidentiality via unknown vectors related to Scripting, a different vulnerability than CVE-2014-0464.

cpe:/a:oracle:jdk:1.8.0 cpe:/a:oracle:jre:1.8.0

CVE-2014-0464

2014-04-15T21:55:10.167-04:00

2017-01-06T21:59:29.047-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov GENTOO GLSA-201502-12 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html BID 66913 Unspecified vulnerability in Oracle Java SE 8 allows remote attackers to affect confidentiality via unknown vectors related to Scripting, a different vulnerability than CVE-2014-0463.

cpe:/a:oracle:fusion_middleware:8.0:update2_patch5

CVE-2014-0465

2014-04-15T21:55:10.227-04:00

2014-04-16T13:01:15.610-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-04-16T13:01:15.577-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect integrity via unknown vectors related to Admin Console.

cpe:/a:gnu:a2ps:4.14

CVE-2014-0466

2014-04-03T12:15:39.863-04:00

2017-12-15T21:29:03.853-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2014:0499 DEBIAN DSA-2892 BID 66660 CONFIRM https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742902 GENTOO GLSA-201701-67 The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file.

cpe:/a:mutt:mutt:1.5 cpe:/a:mutt:mutt:1.5.1 cpe:/a:mutt:mutt:1.5.2 cpe:/a:mutt:mutt:1.5.3 cpe:/a:mutt:mutt:1.5.4 cpe:/a:mutt:mutt:1.5.5 cpe:/a:mutt:mutt:1.5.6 cpe:/a:mutt:mutt:1.5.7 cpe:/a:mutt:mutt:1.5.8 cpe:/a:mutt:mutt:1.5.9 cpe:/a:mutt:mutt:1.5.10 cpe:/a:mutt:mutt:1.5.11 cpe:/a:mutt:mutt:1.5.12 cpe:/a:mutt:mutt:1.5.13 cpe:/a:mutt:mutt:1.5.14 cpe:/a:mutt:mutt:1.5.15 cpe:/a:mutt:mutt:1.5.16 cpe:/a:mutt:mutt:1.5.17 cpe:/a:mutt:mutt:1.5.18 cpe:/a:mutt:mutt:1.5.19 cpe:/a:mutt:mutt:1.5.20 cpe:/a:mutt:mutt:1.5.21 cpe:/a:mutt:mutt:1.5.22 cpe:/o:opensuse:opensuse:11.4 cpe:/o:opensuse:opensuse:12.3 cpe:/o:opensuse:opensuse:13.1

CVE-2014-0467

2014-03-14T11:55:05.637-04:00

2018-10-30T12:27:34.687-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SUSE SUSE-SU-2014:0471 SUSE openSUSE-SU-2014:0434 SUSE openSUSE-SU-2014:0436 REDHAT RHSA-2014:0304 DEBIAN DSA-2874 CONFIRM http://www.mutt.org/doc/devel/ChangeLog BID 66165 SECTRACK 1029919 UBUNTU USN-2147-1 Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion.

cpe:/a:debian:xbuffy:3.2.1-1 cpe:/a:debian:xbuffy:3.2.1-2 cpe:/a:debian:xbuffy:3.2.1-3 cpe:/a:debian:xbuffy:3.2.1-4 cpe:/a:debian:xbuffy:3.3-1 cpe:/a:debian:xbuffy:3.3.b1.3-4 cpe:/a:debian:xbuffy:3.3.bl.2-1 cpe:/a:debian:xbuffy:3.3.bl.3-1 cpe:/a:debian:xbuffy:3.3.bl.3-2 cpe:/a:debian:xbuffy:3.3.bl.3-3 cpe:/a:debian:xbuffy:3.3.bl.3-5 cpe:/a:debian:xbuffy:3.3.bl.3-6 cpe:/a:debian:xbuffy:3.3.bl.3-7 cpe:/a:debian:xbuffy:3.3.bl.3-8 cpe:/a:debian:xbuffy:3.3.bl.3-9 cpe:/a:debian:xbuffy:3.3.bl.3-10 cpe:/a:debian:xbuffy:3.3.bl.3-11 cpe:/a:debian:xbuffy:3.3.bl.3-12 cpe:/a:debian:xbuffy:3.3.bl.3-13 cpe:/a:debian:xbuffy:3.3.bl.3-14 cpe:/a:debian:xbuffy:3.3.bl.3-15 cpe:/a:debian:xbuffy:3.3.bl.3-16 cpe:/a:debian:xbuffy:3.3.bl.3-17 cpe:/a:debian:xbuffy:3.3.bl.3-18 cpe:/a:debian:xbuffy:3.3.bl.3-19 cpe:/a:debian:xbuffy:3.3.bl.3-20 cpe:/a:debian:xbuffy:3.3.bl.3-21 cpe:/a:debian:xbuffy:3.3.bl.3-22 cpe:/a:debian:xbuffy:3.3.bl.3-23 cpe:/a:debian:xbuffy:3.3.bl.3-24 cpe:/a:debian:xbuffy:3.3.bl.3-25 cpe:/a:debian:xbuffy:3.3.bl.3.dfsg-1 cpe:/a:debian:xbuffy:3.3.bl.3.dfsg-2 cpe:/a:debian:xbuffy:3.3.bl.3.dfsg-3 cpe:/a:debian:xbuffy:3.3.bl.3.dfsg-4 cpe:/a:debian:xbuffy:3.3.bl.3.dfsg-5 cpe:/a:debian:xbuffy:3.3.bl.3.dfsg-6 cpe:/a:debian:xbuffy:3.3.bl.3.dfsg-7 cpe:/a:debian:xbuffy:3.3.bl.3.dfsg-8

CVE-2014-0469

2014-05-05T12:07:05.643-04:00

2014-05-31T00:30:44.457-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://packages.qa.debian.org/x/xbuffy/news/20140427T181904Z.html DEBIAN DSA-2921 MLIST [oss-security] 20140428 CVE-2014-0469: xbuffy stack-based buffer overflow in subject processing BID 67090 Stack-based buffer overflow in a certain Debian patch for xbuffy before 3.3.bl.3.dfsg-9 allows remote attackers to execute arbitrary code via the subject of an email, possibly related to indent subject lines.

cpe:/a:super_project:super:3.30.0

CVE-2014-0470

2014-04-30T10:22:06.110-04:00

2014-07-18T14:40:19.873-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2014-04-30T15:20:24.403-04:00

ALLOWS_ADMIN_ACCESS

DEBIAN DSA-2917 MLIST [oss-security] 20140428 super unchecked setuid (CVE-2014-0470) super.c in Super 3.30.0 does not check the return value of the setuid function when the -F flag is set, which allows local users to gain privileges via unspecified vectors, aka an RLIMIT_NPROC attack.

cpe:/a:debian:dpkg:1.9.1 cpe:/a:debian:dpkg:1.9.2 cpe:/a:debian:dpkg:1.9.3 cpe:/a:debian:dpkg:1.9.7 cpe:/a:debian:dpkg:1.9.8 cpe:/a:debian:dpkg:1.9.9 cpe:/a:debian:dpkg:1.9.10 cpe:/a:debian:dpkg:1.9.11 cpe:/a:debian:dpkg:1.9.12 cpe:/a:debian:dpkg:1.9.13 cpe:/a:debian:dpkg:1.9.14 cpe:/a:debian:dpkg:1.9.15 cpe:/a:debian:dpkg:1.9.16 cpe:/a:debian:dpkg:1.9.17 cpe:/a:debian:dpkg:1.9.18 cpe:/a:debian:dpkg:1.9.19 cpe:/a:debian:dpkg:1.9.20 cpe:/a:debian:dpkg:1.9.21 cpe:/a:debian:dpkg:1.10 cpe:/a:debian:dpkg:1.10.1 cpe:/a:debian:dpkg:1.10.2 cpe:/a:debian:dpkg:1.10.3 cpe:/a:debian:dpkg:1.10.4 cpe:/a:debian:dpkg:1.10.5 cpe:/a:debian:dpkg:1.10.6 cpe:/a:debian:dpkg:1.10.7 cpe:/a:debian:dpkg:1.10.8 cpe:/a:debian:dpkg:1.10.9 cpe:/a:debian:dpkg:1.10.11 cpe:/a:debian:dpkg:1.10.12 cpe:/a:debian:dpkg:1.10.13 cpe:/a:debian:dpkg:1.10.14 cpe:/a:debian:dpkg:1.10.15 cpe:/a:debian:dpkg:1.10.16 cpe:/a:debian:dpkg:1.10.17 cpe:/a:debian:dpkg:1.10.18 cpe:/a:debian:dpkg:1.10.18.1 cpe:/a:debian:dpkg:1.10.19 cpe:/a:debian:dpkg:1.10.20 cpe:/a:debian:dpkg:1.10.21 cpe:/a:debian:dpkg:1.10.22 cpe:/a:debian:dpkg:1.10.23 cpe:/a:debian:dpkg:1.10.24 cpe:/a:debian:dpkg:1.10.25 cpe:/a:debian:dpkg:1.10.26 cpe:/a:debian:dpkg:1.10.27 cpe:/a:debian:dpkg:1.10.28 cpe:/a:debian:dpkg:1.13.0 cpe:/a:debian:dpkg:1.13.1 cpe:/a:debian:dpkg:1.13.2 cpe:/a:debian:dpkg:1.13.3 cpe:/a:debian:dpkg:1.13.4 cpe:/a:debian:dpkg:1.13.5 cpe:/a:debian:dpkg:1.13.6 cpe:/a:debian:dpkg:1.13.7 cpe:/a:debian:dpkg:1.13.8 cpe:/a:debian:dpkg:1.13.9 cpe:/a:debian:dpkg:1.13.10 cpe:/a:debian:dpkg:1.13.11 cpe:/a:debian:dpkg:1.13.11.1 cpe:/a:debian:dpkg:1.13.12 cpe:/a:debian:dpkg:1.13.13 cpe:/a:debian:dpkg:1.13.14 cpe:/a:debian:dpkg:1.13.15 cpe:/a:debian:dpkg:1.13.16 cpe:/a:debian:dpkg:1.13.17 cpe:/a:debian:dpkg:1.13.18 cpe:/a:debian:dpkg:1.13.19 cpe:/a:debian:dpkg:1.13.20 cpe:/a:debian:dpkg:1.13.21 cpe:/a:debian:dpkg:1.13.22 cpe:/a:debian:dpkg:1.13.23 cpe:/a:debian:dpkg:1.13.24 cpe:/a:debian:dpkg:1.13.25 cpe:/a:debian:dpkg:1.14.0 cpe:/a:debian:dpkg:1.14.1 cpe:/a:debian:dpkg:1.14.2 cpe:/a:debian:dpkg:1.14.3 cpe:/a:debian:dpkg:1.14.4 cpe:/a:debian:dpkg:1.14.5 cpe:/a:debian:dpkg:1.14.6 cpe:/a:debian:dpkg:1.14.7 cpe:/a:debian:dpkg:1.14.8 cpe:/a:debian:dpkg:1.14.9 cpe:/a:debian:dpkg:1.14.10 cpe:/a:debian:dpkg:1.14.11 cpe:/a:debian:dpkg:1.14.12 cpe:/a:debian:dpkg:1.14.13 cpe:/a:debian:dpkg:1.14.14 cpe:/a:debian:dpkg:1.14.15 cpe:/a:debian:dpkg:1.14.16 cpe:/a:debian:dpkg:1.14.16.1 cpe:/a:debian:dpkg:1.14.16.2 cpe:/a:debian:dpkg:1.14.16.3 cpe:/a:debian:dpkg:1.14.16.4 cpe:/a:debian:dpkg:1.14.16.5 cpe:/a:debian:dpkg:1.14.16.6 cpe:/a:debian:dpkg:1.14.17 cpe:/a:debian:dpkg:1.14.18 cpe:/a:debian:dpkg:1.14.19 cpe:/a:debian:dpkg:1.14.20 cpe:/a:debian:dpkg:1.14.21 cpe:/a:debian:dpkg:1.14.22 cpe:/a:debian:dpkg:1.14.23 cpe:/a:debian:dpkg:1.14.24 cpe:/a:debian:dpkg:1.14.25 cpe:/a:debian:dpkg:1.14.26 cpe:/a:debian:dpkg:1.14.27 cpe:/a:debian:dpkg:1.14.28 cpe:/a:debian:dpkg:1.14.29 cpe:/a:debian:dpkg:1.14.30 cpe:/a:debian:dpkg:1.15.0 cpe:/a:debian:dpkg:1.15.1 cpe:/a:debian:dpkg:1.15.2 cpe:/a:debian:dpkg:1.15.3 cpe:/a:debian:dpkg:1.15.3.1 cpe:/a:debian:dpkg:1.15.4 cpe:/a:debian:dpkg:1.15.4.1 cpe:/a:debian:dpkg:1.15.5 cpe:/a:debian:dpkg:1.15.5.1 cpe:/a:debian:dpkg:1.15.5.2 cpe:/a:debian:dpkg:1.15.5.3 cpe:/a:debian:dpkg:1.15.5.4 cpe:/a:debian:dpkg:1.15.5.5 cpe:/a:debian:dpkg:1.15.5.6 cpe:/a:debian:dpkg:1.15.6 cpe:/a:debian:dpkg:1.15.6.1 cpe:/a:debian:dpkg:1.15.7 cpe:/a:debian:dpkg:1.15.7.1 cpe:/a:debian:dpkg:1.15.7.2 cpe:/a:debian:dpkg:1.15.8 cpe:/a:debian:dpkg:1.15.8.1 cpe:/a:debian:dpkg:1.15.8.2 cpe:/a:debian:dpkg:1.15.8.3 cpe:/a:debian:dpkg:1.15.8.4 cpe:/a:debian:dpkg:1.15.8.5 cpe:/a:debian:dpkg:1.15.8.6 cpe:/a:debian:dpkg:1.15.8.7 cpe:/a:debian:dpkg:1.15.8.8 cpe:/a:debian:dpkg:1.15.8.9 cpe:/a:debian:dpkg:1.16.0 cpe:/a:debian:dpkg:1.16.0.1 cpe:/a:debian:dpkg:1.16.0.2 cpe:/a:debian:dpkg:1.16.0.3 cpe:/a:debian:dpkg:1.16.1 cpe:/a:debian:dpkg:1.16.1.1 cpe:/a:debian:dpkg:1.16.1.2 cpe:/a:debian:dpkg:1.16.2 cpe:/a:debian:dpkg:1.16.3 cpe:/a:debian:dpkg:1.16.4 cpe:/a:debian:dpkg:1.16.4.1 cpe:/a:debian:dpkg:1.16.4.2 cpe:/a:debian:dpkg:1.16.4.3 cpe:/a:debian:dpkg:1.16.5 cpe:/a:debian:dpkg:1.16.6 cpe:/a:debian:dpkg:1.16.7 cpe:/a:debian:dpkg:1.16.8 cpe:/a:debian:dpkg:1.16.9 cpe:/a:debian:dpkg:1.16.10 cpe:/a:debian:dpkg:1.16.11 cpe:/a:debian:dpkg:1.16.12 cpe:/a:debian:dpkg:1.17.0 cpe:/a:debian:dpkg:1.17.1 cpe:/a:debian:dpkg:1.17.2 cpe:/a:debian:dpkg:1.17.3 cpe:/a:debian:dpkg:1.17.4 cpe:/a:debian:dpkg:1.17.5 cpe:/a:debian:dpkg:1.17.6 cpe:/a:debian:dpkg:1.17.7 cpe:/o:canonical:ubuntu_linux:10.04:-:lts cpe:/o:canonical:ubuntu_linux:12.04:-:lts cpe:/o:canonical:ubuntu_linux:12.10 cpe:/o:canonical:ubuntu_linux:13.10 cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~

CVE-2014-0471

2014-04-30T10:22:06.140-04:00

2015-10-16T10:53:06.400-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2015-10-16T10:43:36.550-04:00

DEBIAN DSA-2915 BID 67106 UBUNTU USN-2183-1 Directory traversal vulnerability in the unpacking functionality in dpkg before 1.15.9, 1.16.x before 1.16.13, and 1.17.x before 1.17.8 allows remote attackers to write arbitrary files via a crafted source package, related to "C-style filename quoting."

cpe:/a:djangoproject:django:1.4 cpe:/a:djangoproject:django:1.4.1 cpe:/a:djangoproject:django:1.4.2 cpe:/a:djangoproject:django:1.4.3 cpe:/a:djangoproject:django:1.4.4 cpe:/a:djangoproject:django:1.4.5 cpe:/a:djangoproject:django:1.4.6 cpe:/a:djangoproject:django:1.4.7 cpe:/a:djangoproject:django:1.4.8 cpe:/a:djangoproject:django:1.4.9 cpe:/a:djangoproject:django:1.4.10 cpe:/a:djangoproject:django:1.5 cpe:/a:djangoproject:django:1.5.1 cpe:/a:djangoproject:django:1.5.2 cpe:/a:djangoproject:django:1.5.3 cpe:/a:djangoproject:django:1.5.4 cpe:/a:djangoproject:django:1.5.5 cpe:/a:djangoproject:django:1.6 cpe:/a:djangoproject:django:1.6.1 cpe:/a:djangoproject:django:1.6.2 cpe:/a:djangoproject:django:1.7:alpha1 cpe:/a:djangoproject:django:1.7:alpha2 cpe:/a:djangoproject:django:1.7:beta1 cpe:/o:canonical:ubuntu_linux:10.04:-:lts cpe:/o:canonical:ubuntu_linux:12.04:-:lts cpe:/o:canonical:ubuntu_linux:12.10 cpe:/o:canonical:ubuntu_linux:13.10 cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~

CVE-2014-0472

2014-04-23T11:55:02.923-04:00

2017-01-06T21:59:29.123-05:00

5.1

NETWORK

HIGH

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2014:1132 REDHAT RHSA-2014:0456 REDHAT RHSA-2014:0457 SECUNIA 61281 DEBIAN DSA-2934 UBUNTU USN-2169-1 CONFIRM https://www.djangoproject.com/weblog/2014/apr/21/security/ The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."

CVE-2014-0473

2014-04-23T11:55:03.127-04:00

2017-01-06T21:59:29.187-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov SUSE openSUSE-SU-2014:1132 REDHAT RHSA-2014:0456 REDHAT RHSA-2014:0457 SECUNIA 61281 DEBIAN DSA-2934 UBUNTU USN-2169-1 CONFIRM https://www.djangoproject.com/weblog/2014/apr/21/security/ The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.

CVE-2014-0474

2014-04-23T11:55:03.237-04:00

2017-01-06T21:59:29.267-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE openSUSE-SU-2014:1132 REDHAT RHSA-2014:0456 REDHAT RHSA-2014:0457 SECUNIA 61281 DEBIAN DSA-2934 UBUNTU USN-2169-1 CONFIRM https://www.djangoproject.com/weblog/2014/apr/21/security/ The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to "MySQL typecasting."

cpe:/a:gnu:glibc:2.0 cpe:/a:gnu:glibc:2.0.1 cpe:/a:gnu:glibc:2.0.2 cpe:/a:gnu:glibc:2.0.3 cpe:/a:gnu:glibc:2.0.4 cpe:/a:gnu:glibc:2.0.5 cpe:/a:gnu:glibc:2.0.6 cpe:/a:gnu:glibc:2.1 cpe:/a:gnu:glibc:2.1.1 cpe:/a:gnu:glibc:2.1.1.6 cpe:/a:gnu:glibc:2.1.2 cpe:/a:gnu:glibc:2.1.3 cpe:/a:gnu:glibc:2.1.9 cpe:/a:gnu:glibc:2.10.1 cpe:/a:gnu:glibc:2.11 cpe:/a:gnu:glibc:2.11.1 cpe:/a:gnu:glibc:2.11.2 cpe:/a:gnu:glibc:2.11.3 cpe:/a:gnu:glibc:2.12 cpe:/a:gnu:glibc:2.12.1 cpe:/a:gnu:glibc:2.12.2 cpe:/a:gnu:glibc:2.13 cpe:/a:gnu:glibc:2.14 cpe:/a:gnu:glibc:2.14.1 cpe:/a:gnu:glibc:2.15 cpe:/a:gnu:glibc:2.16 cpe:/a:gnu:glibc:2.17 cpe:/a:gnu:glibc:2.18 cpe:/a:gnu:glibc:2.19

CVE-2014-0475

2014-07-29T10:55:05.077-04:00

2016-11-28T14:10:39.970-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://linux.oracle.com/errata/ELSA-2015-0092.html DEBIAN DSA-2976 MANDRIVA MDVSA-2014:152 MLIST [oss-security] 20140710 CVE-2014-0475: glibc directory traversal in LC_* locale handling MLIST [oss-security] 20140714 Re: CVE-2014-0475: glibc directory traversal in LC_* locale handling BID 68505 SECTRACK 1030569 REDHAT RHSA-2014:1110 GENTOO GLSA-201602-02 CONFIRM https://sourceware.org/bugzilla/show_bug.cgi?id=17137 Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.

cpe:/a:chkrootkit:chkrootkit:0.49 cpe:/o:canonical:ubuntu_linux:10.04::lts cpe:/o:canonical:ubuntu_linux:12.04::lts cpe:/o:canonical:ubuntu_linux:13.10 cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~

CVE-2014-0476

2014-10-25T18:55:04.070-04:00

2017-09-18T21:36:55.843-04:00

3.7

LOCAL

HIGH

NONE

PARTIAL

http://nvd.nist.gov OSVDB 107710 MISC http://packetstormsecurity.com/files/134484/Chkrootkit-Local-Privilege-Escalation.html CONFIRM http://www.chkrootkit.org/ DEBIAN DSA-2945 MLIST [oss-security] 20140604 CVE-2014-0476 chkrootkit vulnerability UBUNTU USN-2230-1 GENTOO GLSA-201709-05 EXPLOIT-DB 38775 The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.

cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.1::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.2::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.3::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.5::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.6::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.7::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.80::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.85::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.86::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.870::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.871::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.880::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.881::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.882::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.883::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.884::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.885::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.886::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.887::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.888::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.889::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.890::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.891::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.892::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.893::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.894::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.895::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.896::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.897::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.898::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.899::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.900::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.901::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.902::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.903::~~~perl~~ cpe:/a:email%3a%3aaddress_module_project:email%3a%3aaddress:1.904::~~~perl~~ cpe:/o:fedoraproject:fedora

CVE-2014-0477

2014-07-03T13:55:05.937-04:00

2015-11-04T14:00:07.147-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2015-11-04T11:56:21.013-05:00

MLIST [oss-security] 20140618 CVE-2014-0477: Email::Address: Denial-of-Service in Email::Address::parse DEBIAN DSA-2969 MISC https://bugzilla.redhat.com/show_bug.cgi?id=1110723 CONFIRM https://github.com/rjbs/Email-Address/blob/master/Changes CONFIRM https://github.com/rjbs/Email-Address/commit/83f8306117115729ac9346523762c0c396251eb5 CONFIRM https://metacpan.org/release/RJBS/Email-Address-1.905 The parse function in Email::Address module before 1.905 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via an empty quoted string in an RFC 2822 address.

cpe:/a:debian:apt:1.0.3

CVE-2014-0478

2014-06-17T10:55:06.047-04:00

2017-12-21T21:29:12.370-05:00

4.0

NETWORK

HIGH

NONE

PARTIAL

http://nvd.nist.gov DEBIAN DSA-2958 UBUNTU USN-2246-1 CONFIRM https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=749795 APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse packages by removing the Release signature.

cpe:/a:canonical:reportbug:6.5.0 cpe:/a:debian:reportbug:6.4.4

CVE-2014-0479

2014-08-06T15:55:03.227-04:00

2017-08-28T21:34:10.950-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SECUNIA 59896 DEBIAN DSA-2997 OSVDB 109858 BID 69055 CONFIRM https://bugs.launchpad.net/ubuntu/+source/reportbug/+bug/1353046 XF reportbug-cve20140479-code-exec(95149) reportbug before 6.4.4+deb7u1 and 6.5.x before 6.5.0+nmu1 allows remote attackers to execute arbitrary commands via vectors related to compare_versions and reportbug/checkversions.py.

cpe:/a:djangoproject:django:1.4 cpe:/a:djangoproject:django:1.4.1 cpe:/a:djangoproject:django:1.4.2 cpe:/a:djangoproject:django:1.4.4 cpe:/a:djangoproject:django:1.4.5 cpe:/a:djangoproject:django:1.4.6 cpe:/a:djangoproject:django:1.4.7 cpe:/a:djangoproject:django:1.4.8 cpe:/a:djangoproject:django:1.4.9 cpe:/a:djangoproject:django:1.4.10 cpe:/a:djangoproject:django:1.4.11 cpe:/a:djangoproject:django:1.4.12 cpe:/a:djangoproject:django:1.4.13 cpe:/a:djangoproject:django:1.5 cpe:/a:djangoproject:django:1.5:alpha cpe:/a:djangoproject:django:1.5:beta cpe:/a:djangoproject:django:1.5.1 cpe:/a:djangoproject:django:1.5.2 cpe:/a:djangoproject:django:1.5.3 cpe:/a:djangoproject:django:1.5.4 cpe:/a:djangoproject:django:1.5.5 cpe:/a:djangoproject:django:1.5.6 cpe:/a:djangoproject:django:1.5.7 cpe:/a:djangoproject:django:1.5.8 cpe:/a:djangoproject:django:1.6:- cpe:/a:djangoproject:django:1.6:beta1 cpe:/a:djangoproject:django:1.6:beta2 cpe:/a:djangoproject:django:1.6:beta3 cpe:/a:djangoproject:django:1.6:beta4 cpe:/a:djangoproject:django:1.6.1 cpe:/a:djangoproject:django:1.6.2 cpe:/a:djangoproject:django:1.6.3 cpe:/a:djangoproject:django:1.6.4 cpe:/a:djangoproject:django:1.6.5 cpe:/a:djangoproject:django:1.7:beta1 cpe:/a:djangoproject:django:1.7:beta2 cpe:/a:djangoproject:django:1.7:beta3 cpe:/a:djangoproject:django:1.7:beta4 cpe:/a:djangoproject:django:1.7:rc1 cpe:/a:djangoproject:django:1.7:rc2 cpe:/o:opensuse:opensuse:12.3 cpe:/o:opensuse:opensuse:13.1

CVE-2014-0480

2014-08-26T10:55:05.190-04:00

2018-10-30T12:27:34.687-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov SUSE openSUSE-SU-2014:1132 SECUNIA 61276 SECUNIA 61281 DEBIAN DSA-3010 BID 69425 CONFIRM https://www.djangoproject.com/weblog/2014/aug/20/security/ The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated.

cpe:/a:djangoproject:django:1.4 cpe:/a:djangoproject:django:1.4.1 cpe:/a:djangoproject:django:1.4.2 cpe:/a:djangoproject:django:1.4.4 cpe:/a:djangoproject:django:1.4.5 cpe:/a:djangoproject:django:1.4.6 cpe:/a:djangoproject:django:1.4.7 cpe:/a:djangoproject:django:1.4.8 cpe:/a:djangoproject:django:1.4.9 cpe:/a:djangoproject:django:1.4.10 cpe:/a:djangoproject:django:1.4.11 cpe:/a:djangoproject:django:1.4.12 cpe:/a:djangoproject:django:1.4.13 cpe:/a:djangoproject:django:1.5 cpe:/a:djangoproject:django:1.5:alpha cpe:/a:djangoproject:django:1.5:beta cpe:/a:djangoproject:django:1.5.1 cpe:/a:djangoproject:django:1.5.2 cpe:/a:djangoproject:django:1.5.3 cpe:/a:djangoproject:django:1.5.4 cpe:/a:djangoproject:django:1.5.5 cpe:/a:djangoproject:django:1.5.6 cpe:/a:djangoproject:django:1.5.7 cpe:/a:djangoproject:django:1.5.8 cpe:/a:djangoproject:django:1.6:- cpe:/a:djangoproject:django:1.6:beta1 cpe:/a:djangoproject:django:1.6:beta2 cpe:/a:djangoproject:django:1.6:beta3 cpe:/a:djangoproject:django:1.6:beta4 cpe:/a:djangoproject:django:1.6.1 cpe:/a:djangoproject:django:1.6.2 cpe:/a:djangoproject:django:1.6.3 cpe:/a:djangoproject:django:1.6.4 cpe:/a:djangoproject:django:1.6.5 cpe:/a:djangoproject:django:1.7:beta1 cpe:/a:djangoproject:django:1.7:beta2 cpe:/a:djangoproject:django:1.7:beta3 cpe:/a:djangoproject:django:1.7:beta4 cpe:/a:djangoproject:django:1.7:rc1 cpe:/a:djangoproject:django:1.7:rc2 cpe:/o:debian:debian_linux:7.0 cpe:/o:opensuse:opensuse:13.1 cpe:/o:opensuse_project:opensuse:12.3

CVE-2014-0481

2014-08-26T10:55:05.250-04:00

2018-10-30T12:27:37.297-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2014:1132 SECUNIA 61276 SECUNIA 61281 DEBIAN DSA-3010 CONFIRM https://www.djangoproject.com/weblog/2014/aug/20/security/ The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a denial of service (CPU consumption) by unloading a multiple files with the same name.

CVE-2014-0482

2014-08-26T10:55:05.297-04:00

2018-10-30T12:27:34.687-04:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2014:1132 SECUNIA 61276 SECUNIA 61281 DEBIAN DSA-3010 CONFIRM https://www.djangoproject.com/weblog/2014/aug/20/security/ The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors related to the REMOTE_USER header.

CVE-2014-0483

2014-08-26T10:55:05.347-04:00

2018-10-30T12:27:34.687-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov SUSE openSUSE-SU-2014:1132 SECUNIA 61276 SECUNIA 61281 DEBIAN DSA-3010 CONFIRM https://github.com/django/django/commit/2b31342cdf14fc20e07c43d258f1e7334ad664a6 CONFIRM https://www.djangoproject.com/weblog/2014/aug/20/security/ The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1&t=password URI.

cpe:/a:canonical:acpi-support:0.140

CVE-2014-0484

2014-09-22T11:55:07.373-04:00

2014-09-24T14:50:33.017-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2014-09-24T14:50:32.780-04:00

DEBIAN DSA-3020 The Debian acpi-support package before 0.140-5+deb7u3 allows local users to gain privileges via vectors related to the "user's environment."

cpe:/a:s3ql_project:s3ql:1.17 cpe:/a:s3ql_project:s3ql:1.18 cpe:/a:s3ql_project:s3ql:1.18.1

CVE-2014-0485

2014-09-02T10:55:03.323-04:00

2014-09-03T09:33:57.990-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-09-03T09:33:57.740-04:00

DEBIAN DSA-3013 MLIST [oss-security] 20140828 CVE-2014-0485: unsafe Python pickle in s3ql CONFIRM https://bitbucket.org/nikratio/s3ql/commits/091ac263809b4e8 S3QL 1.18.1 and earlier uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object in (1) common.py or (2) local.py in backends/.

CVE-2014-0486

2018-03-27T12:29:00.217-04:00

2018-04-19T13:28:40.037-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2018-04-19T09:40:17.390-04:00

BID 70097 XF knotdns-cve20140486-dos(96185) CONFIRM https://gitlab.labs.nic.cz/knot/knot-dns/issues/294 Knot DNS before 1.5.2 allows remote attackers to cause a denial of service (application crash) via a crafted DNS message.

cpe:/a:debian:apt:1.0.3 cpe:/a:debian:apt:1.0.4 cpe:/a:debian:apt:1.0.5 cpe:/a:debian:apt:1.0.6 cpe:/a:debian:apt:1.0.7 cpe:/a:debian:apt:1.0.8

CVE-2014-0487

2014-11-03T17:55:07.303-05:00

2014-11-04T17:13:31.790-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-11-04T07:50:38.000-05:00

UBUNTU USN-2348-1 DEBIAN DSA-3025 APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unspecified impact and attack vectors.

cpe:/a:debian:apt:1.0.3 cpe:/a:debian:apt:1.0.4 cpe:/a:debian:apt:1.0.5 cpe:/a:debian:apt:1.0.6 cpe:/a:debian:apt:1.0.7 cpe:/a:debian:apt:1.0.8

CVE-2014-0488

2014-11-03T17:55:07.350-05:00

2014-11-04T17:12:14.357-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2014-11-04T07:52:07.000-05:00

UBUNTU USN-2348-1 DEBIAN DSA-3025 APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data.

cpe:/a:debian:apt:1.0.3 cpe:/a:debian:apt:1.0.4 cpe:/a:debian:apt:1.0.5 cpe:/a:debian:apt:1.0.6 cpe:/a:debian:apt:1.0.7 cpe:/a:debian:apt:1.0.8

CVE-2014-0489

2014-11-03T17:55:07.397-05:00

2014-11-04T17:10:47.550-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-11-04T12:54:14.413-05:00

UBUNTU USN-2348-1 DEBIAN DSA-3025 APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package.

cpe:/a:debian:apt:1.0.3 cpe:/a:debian:apt:1.0.4 cpe:/a:debian:apt:1.0.5 cpe:/a:debian:apt:1.0.6 cpe:/a:debian:apt:1.0.7 cpe:/a:debian:apt:1.0.8

CVE-2014-0490

2014-11-03T17:55:07.447-05:00

2014-11-04T16:32:49.993-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-11-04T14:33:13.887-05:00

UBUNTU USN-2348-1 DEBIAN DSA-3025 The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remote attackers to execute arbitrary code via a crafted package.

cpe:/a:adobe:adobe_air:- cpe:/a:adobe:adobe_air:1.0 cpe:/a:adobe:adobe_air:1.0.1 cpe:/a:adobe:adobe_air:1.0.8.4990 cpe:/a:adobe:adobe_air:1.0.4990 cpe:/a:adobe:adobe_air:1.1 cpe:/a:adobe:adobe_air:1.1.0.5790 cpe:/a:adobe:adobe_air:1.5 cpe:/a:adobe:adobe_air:1.5.0.7220 cpe:/a:adobe:adobe_air:1.5.1 cpe:/a:adobe:adobe_air:1.5.1.8210 cpe:/a:adobe:adobe_air:1.5.2 cpe:/a:adobe:adobe_air:1.5.3 cpe:/a:adobe:adobe_air:1.5.3.9120 cpe:/a:adobe:adobe_air:1.5.3.9130 cpe:/a:adobe:adobe_air:2.0.2 cpe:/a:adobe:adobe_air:2.0.2.12610 cpe:/a:adobe:adobe_air:2.0.3 cpe:/a:adobe:adobe_air:2.0.3.13070 cpe:/a:adobe:adobe_air:2.0.4 cpe:/a:adobe:adobe_air:2.5.0.16600 cpe:/a:adobe:adobe_air:2.5.1.17730 cpe:/a:adobe:adobe_air:2.6 cpe:/a:adobe:adobe_air:2.6.0.19120 cpe:/a:adobe:adobe_air:2.6.0.19140 cpe:/a:adobe:adobe_air:2.7 cpe:/a:adobe:adobe_air:2.7.0.1948 cpe:/a:adobe:adobe_air:2.7.0.1953 cpe:/a:adobe:adobe_air:2.7.0.19480 cpe:/a:adobe:adobe_air:2.7.0.19530 cpe:/a:adobe:adobe_air:2.7.1 cpe:/a:adobe:adobe_air:2.7.1.19610 cpe:/a:adobe:adobe_air:3.0.0.408 cpe:/a:adobe:adobe_air:3.0.0.4080 cpe:/a:adobe:adobe_air:3.1.0.485 cpe:/a:adobe:adobe_air:3.1.0.488 cpe:/a:adobe:adobe_air:3.1.0.4880 cpe:/a:adobe:adobe_air:3.2.0.207 cpe:/a:adobe:adobe_air:3.2.0.2070 cpe:/a:adobe:adobe_air:3.3.0.3670 cpe:/a:adobe:adobe_air:3.4.0.2540 cpe:/a:adobe:adobe_air:3.4.0.2710 cpe:/a:adobe:adobe_air:3.5.0.600 cpe:/a:adobe:adobe_air:3.5.0.880 cpe:/a:adobe:adobe_air:3.5.0.890 cpe:/a:adobe:adobe_air:3.5.0.1060 cpe:/a:adobe:adobe_air:3.6.0.597 cpe:/a:adobe:adobe_air:3.6.0.6090 cpe:/a:adobe:adobe_air:3.7.0.1530 cpe:/a:adobe:adobe_air:3.7.0.1860 cpe:/a:adobe:adobe_air:3.7.0.2090 cpe:/a:adobe:adobe_air:3.8.0.870 cpe:/a:adobe:adobe_air:3.8.0.910 cpe:/a:adobe:adobe_air:3.9.0.1030 cpe:/a:adobe:adobe_air:3.9.0.1060 cpe:/a:adobe:adobe_air:3.9.0.1210 cpe:/a:adobe:adobe_air:3.9.0.1380 cpe:/a:adobe:adobe_air_sdk:3.0.0.4080 cpe:/a:adobe:adobe_air_sdk:3.1.0.488 cpe:/a:adobe:adobe_air_sdk:3.2.0.2070 cpe:/a:adobe:adobe_air_sdk:3.3.0.3650 cpe:/a:adobe:adobe_air_sdk:3.3.0.3690 cpe:/a:adobe:adobe_air_sdk:3.4.0.2540 cpe:/a:adobe:adobe_air_sdk:3.4.0.2710 cpe:/a:adobe:adobe_air_sdk:3.5.0.600 cpe:/a:adobe:adobe_air_sdk:3.5.0.880 cpe:/a:adobe:adobe_air_sdk:3.5.0.890 cpe:/a:adobe:adobe_air_sdk:3.5.0.1060 cpe:/a:adobe:adobe_air_sdk:3.6.0.599 cpe:/a:adobe:adobe_air_sdk:3.6.0.6090 cpe:/a:adobe:adobe_air_sdk:3.7.0.1530 cpe:/a:adobe:adobe_air_sdk:3.7.0.1860 cpe:/a:adobe:adobe_air_sdk:3.7.0.2090 cpe:/a:adobe:adobe_air_sdk:3.8.0.870 cpe:/a:adobe:adobe_air_sdk:3.8.0.910 cpe:/a:adobe:adobe_air_sdk:3.8.0.1430 cpe:/a:adobe:adobe_air_sdk:3.9.0.1030 cpe:/a:adobe:adobe_air_sdk:3.9.0.1210 cpe:/a:adobe:adobe_air_sdk:3.9.0.1380 cpe:/a:adobe:flash_player:11.0 cpe:/a:adobe:flash_player:11.0.1.152 cpe:/a:adobe:flash_player:11.0.1.152::~~~~x64~ cpe:/a:adobe:flash_player:11.0.1.153 cpe:/a:adobe:flash_player:11.1 cpe:/a:adobe:flash_player:11.1.102.55 cpe:/a:adobe:flash_player:11.1.102.55::~~~~x64~ cpe:/a:adobe:flash_player:11.1.102.59 cpe:/a:adobe:flash_player:11.1.102.62 cpe:/a:adobe:flash_player:11.1.102.63 cpe:/a:adobe:flash_player:11.1.111.8 cpe:/a:adobe:flash_player:11.1.111.13 cpe:/a:adobe:flash_player:11.1.111.44 cpe:/a:adobe:flash_player:11.1.111.50 cpe:/a:adobe:flash_player:11.1.111.54 cpe:/a:adobe:flash_player:11.1.111.64 cpe:/a:adobe:flash_player:11.1.111.73 cpe:/a:adobe:flash_player:11.1.115.7 cpe:/a:adobe:flash_player:11.1.115.34 cpe:/a:adobe:flash_player:11.1.115.48 cpe:/a:adobe:flash_player:11.1.115.54 cpe:/a:adobe:flash_player:11.1.115.58 cpe:/a:adobe:flash_player:11.1.115.59 cpe:/a:adobe:flash_player:11.1.115.63 cpe:/a:adobe:flash_player:11.1.115.69 cpe:/a:adobe:flash_player:11.1.115.81 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.327 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:11.2.202.400 cpe:/a:adobe:flash_player:11.2.202.406 cpe:/a:adobe:flash_player:11.2.202.411 cpe:/a:adobe:flash_player:11.2.202.418 cpe:/a:adobe:flash_player:11.2.202.424 cpe:/a:adobe:flash_player:11.2.202.425 cpe:/a:adobe:flash_player:11.2.202.429 cpe:/a:adobe:flash_player:11.2.202.438 cpe:/a:adobe:flash_player:11.2.202.440 cpe:/a:adobe:flash_player:11.2.202.442 cpe:/a:adobe:flash_player:11.2.202.451 cpe:/a:adobe:flash_player:11.2.202.457 cpe:/a:adobe:flash_player:11.2.202.460 cpe:/a:adobe:flash_player:11.2.202.466 cpe:/a:adobe:flash_player:11.2.202.468 cpe:/a:adobe:flash_player:11.2.202.475 cpe:/a:adobe:flash_player:11.2.202.481 cpe:/a:adobe:flash_player:11.2.202.491 cpe:/a:adobe:flash_player:11.2.202.508 cpe:/a:adobe:flash_player:11.2.202.521 cpe:/a:adobe:flash_player:11.2.202.535 cpe:/a:adobe:flash_player:11.2.202.540 cpe:/a:adobe:flash_player:11.2.202.548 cpe:/a:adobe:flash_player:11.2.202.554 cpe:/a:adobe:flash_player:11.2.202.559 cpe:/a:adobe:flash_player:11.2.202.569 cpe:/a:adobe:flash_player:11.2.202.577 cpe:/a:adobe:flash_player:11.2.202.616 cpe:/a:adobe:flash_player:11.2.202.621 cpe:/a:adobe:flash_player:11.2.202.626 cpe:/a:adobe:flash_player:11.2.202.632 cpe:/a:adobe:flash_player:11.2.202.635 cpe:/a:adobe:flash_player:11.2.202.635::~~~linux~~ cpe:/a:adobe:flash_player:11.2.202.637 cpe:/a:adobe:flash_player:11.2.202.637::~~~linux~~ cpe:/a:adobe:flash_player:11.2.202.643 cpe:/a:adobe:flash_player:11.2.202.644 cpe:/a:adobe:flash_player:11.3.300.257 cpe:/a:adobe:flash_player:11.3.300.262 cpe:/a:adobe:flash_player:11.3.300.265 cpe:/a:adobe:flash_player:11.3.300.268 cpe:/a:adobe:flash_player:11.3.300.270 cpe:/a:adobe:flash_player:11.3.300.271 cpe:/a:adobe:flash_player:11.3.300.273 cpe:/a:adobe:flash_player:11.4.402.265 cpe:/a:adobe:flash_player:11.4.402.278 cpe:/a:adobe:flash_player:11.4.402.287 cpe:/a:adobe:flash_player:11.5.502.110 cpe:/a:adobe:flash_player:11.5.502.135 cpe:/a:adobe:flash_player:11.5.502.136 cpe:/a:adobe:flash_player:11.5.502.146 cpe:/a:adobe:flash_player:11.5.502.149 cpe:/a:adobe:flash_player:11.6.602.167 cpe:/a:adobe:flash_player:11.6.602.168 cpe:/a:adobe:flash_player:11.6.602.171 cpe:/a:adobe:flash_player:11.6.602.180 cpe:/a:adobe:flash_player:11.7.700.169 cpe:/a:adobe:flash_player:11.7.700.202 cpe:/a:adobe:flash_player:11.7.700.203 cpe:/a:adobe:flash_player:11.7.700.224 cpe:/a:adobe:flash_player:11.7.700.225 cpe:/a:adobe:flash_player:11.7.700.232 cpe:/a:adobe:flash_player:11.7.700.242 cpe:/a:adobe:flash_player:11.7.700.252 cpe:/a:adobe:flash_player:11.7.700.257 cpe:/a:adobe:flash_player:11.8.800.94 cpe:/a:adobe:flash_player:11.8.800.97 cpe:/a:adobe:flash_player:11.8.800.168 cpe:/a:adobe:flash_player:11.8.800.174 cpe:/a:adobe:flash_player:11.9.900.117 cpe:/a:adobe:flash_player:11.9.900.152 cpe:/a:adobe:flash_player:11.9.900.170 cpe:/a:adobe:flash_player:11.9.900.700

CVE-2014-0491

2014-01-15T11:13:03.993-05:00

2018-12-13T10:43:57.547-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-11T09:07:55.453-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-02.html SUSE openSUSE-SU-2014:0128 REDHAT RHSA-2014:0028 SECTRACK 1029602 Adobe Flash Player before 11.7.700.260 and 11.8.x and 11.9.x before 12.0.0.38 on Windows and Mac OS X and before 11.2.202.335 on Linux, Adobe AIR before 4.0.0.1390, Adobe AIR SDK before 4.0.0.1390, and Adobe AIR SDK & Compiler before 4.0.0.1390 allow attackers to bypass unspecified protection mechanisms via unknown vectors.

CVE-2014-0492

2014-01-15T11:13:04.023-05:00

2018-12-13T10:44:16.843-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-11T09:05:17.950-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-02.html SUSE openSUSE-SU-2014:0128 REDHAT RHSA-2014:0028 SECTRACK 1029602 Adobe Flash Player before 11.7.700.260 and 11.8.x and 11.9.x before 12.0.0.38 on Windows and Mac OS X and before 11.2.202.335 on Linux, Adobe AIR before 4.0.0.1390, Adobe AIR SDK before 4.0.0.1390, and Adobe AIR SDK & Compiler before 4.0.0.1390 allow attackers to defeat the ASLR protection mechanism by leveraging an "address leak."

CVE-2014-0493

2014-01-15T11:13:04.057-05:00

2018-12-13T10:50:24.087-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-11T09:16:49.773-05:00

CONFIRM http://helpx.adobe.com/security/products/acrobat/apsb14-01.html SECTRACK 1029604 Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0495.

cpe:/a:adobe:digital_editions:2.0.1

CVE-2014-0494

2014-01-23T14:55:03.970-05:00

2017-08-28T21:34:11.030-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/Digital-Editions/apsb14-03.html BID 65091 SECTRACK 1029680 XF adobe-digital-cve20140494-code-exec(90648) Adobe Digital Editions 2.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.

CVE-2014-0495

2014-01-15T11:13:04.070-05:00

2018-12-13T10:50:35.977-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-11T09:17:05.167-05:00

CVE-2014-0496

2014-01-15T11:13:04.100-05:00

2018-12-13T10:50:55.103-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-11T09:17:00.117-05:00

CONFIRM http://helpx.adobe.com/security/products/acrobat/apsb14-01.html SECTRACK 1029604 Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors.

cpe:/a:adobe:flash_player:11.0 cpe:/a:adobe:flash_player:11.0.1.152 cpe:/a:adobe:flash_player:11.0.1.152::~~~~x64~ cpe:/a:adobe:flash_player:11.0.1.153 cpe:/a:adobe:flash_player:11.1 cpe:/a:adobe:flash_player:11.1.102.55 cpe:/a:adobe:flash_player:11.1.102.55::~~~~x64~ cpe:/a:adobe:flash_player:11.1.102.59 cpe:/a:adobe:flash_player:11.1.102.62 cpe:/a:adobe:flash_player:11.1.102.63 cpe:/a:adobe:flash_player:11.1.111.8 cpe:/a:adobe:flash_player:11.1.111.13 cpe:/a:adobe:flash_player:11.1.111.44 cpe:/a:adobe:flash_player:11.1.111.50 cpe:/a:adobe:flash_player:11.1.111.54 cpe:/a:adobe:flash_player:11.1.111.64 cpe:/a:adobe:flash_player:11.1.111.73 cpe:/a:adobe:flash_player:11.1.115.7 cpe:/a:adobe:flash_player:11.1.115.34 cpe:/a:adobe:flash_player:11.1.115.48 cpe:/a:adobe:flash_player:11.1.115.54 cpe:/a:adobe:flash_player:11.1.115.58 cpe:/a:adobe:flash_player:11.1.115.59 cpe:/a:adobe:flash_player:11.1.115.63 cpe:/a:adobe:flash_player:11.1.115.69 cpe:/a:adobe:flash_player:11.1.115.81 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.327 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:11.2.202.400 cpe:/a:adobe:flash_player:11.2.202.406 cpe:/a:adobe:flash_player:11.2.202.411 cpe:/a:adobe:flash_player:11.2.202.418 cpe:/a:adobe:flash_player:11.2.202.424 cpe:/a:adobe:flash_player:11.2.202.425 cpe:/a:adobe:flash_player:11.2.202.429 cpe:/a:adobe:flash_player:11.2.202.438 cpe:/a:adobe:flash_player:11.2.202.440 cpe:/a:adobe:flash_player:11.2.202.442 cpe:/a:adobe:flash_player:11.2.202.451 cpe:/a:adobe:flash_player:11.2.202.457 cpe:/a:adobe:flash_player:11.2.202.460 cpe:/a:adobe:flash_player:11.2.202.466 cpe:/a:adobe:flash_player:11.2.202.468 cpe:/a:adobe:flash_player:11.2.202.475 cpe:/a:adobe:flash_player:11.2.202.481 cpe:/a:adobe:flash_player:11.2.202.491 cpe:/a:adobe:flash_player:11.2.202.508 cpe:/a:adobe:flash_player:11.2.202.521 cpe:/a:adobe:flash_player:11.2.202.535 cpe:/a:adobe:flash_player:11.2.202.540 cpe:/a:adobe:flash_player:11.2.202.548 cpe:/a:adobe:flash_player:11.2.202.554 cpe:/a:adobe:flash_player:11.2.202.559 cpe:/a:adobe:flash_player:11.2.202.569 cpe:/a:adobe:flash_player:11.2.202.577 cpe:/a:adobe:flash_player:11.2.202.616 cpe:/a:adobe:flash_player:11.2.202.621 cpe:/a:adobe:flash_player:11.2.202.626 cpe:/a:adobe:flash_player:11.2.202.632 cpe:/a:adobe:flash_player:11.2.202.635 cpe:/a:adobe:flash_player:11.2.202.635::~~~linux~~ cpe:/a:adobe:flash_player:11.2.202.637 cpe:/a:adobe:flash_player:11.2.202.637::~~~linux~~ cpe:/a:adobe:flash_player:11.2.202.643 cpe:/a:adobe:flash_player:11.2.202.644 cpe:/a:adobe:flash_player:11.3.300.257 cpe:/a:adobe:flash_player:11.3.300.262 cpe:/a:adobe:flash_player:11.3.300.265 cpe:/a:adobe:flash_player:11.3.300.268 cpe:/a:adobe:flash_player:11.3.300.270 cpe:/a:adobe:flash_player:11.3.300.271 cpe:/a:adobe:flash_player:11.3.300.273 cpe:/a:adobe:flash_player:11.4.402.265 cpe:/a:adobe:flash_player:11.4.402.278 cpe:/a:adobe:flash_player:11.4.402.287 cpe:/a:adobe:flash_player:11.5.502.110 cpe:/a:adobe:flash_player:11.5.502.135 cpe:/a:adobe:flash_player:11.5.502.136 cpe:/a:adobe:flash_player:11.5.502.146 cpe:/a:adobe:flash_player:11.5.502.149 cpe:/a:adobe:flash_player:11.6.602.167 cpe:/a:adobe:flash_player:11.6.602.168 cpe:/a:adobe:flash_player:11.6.602.171 cpe:/a:adobe:flash_player:11.6.602.180 cpe:/a:adobe:flash_player:11.7.700.169 cpe:/a:adobe:flash_player:11.7.700.202 cpe:/a:adobe:flash_player:11.7.700.203 cpe:/a:adobe:flash_player:11.7.700.224 cpe:/a:adobe:flash_player:11.7.700.225 cpe:/a:adobe:flash_player:11.7.700.232 cpe:/a:adobe:flash_player:11.7.700.242 cpe:/a:adobe:flash_player:11.7.700.252 cpe:/a:adobe:flash_player:11.7.700.257 cpe:/a:adobe:flash_player:11.7.700.260 cpe:/a:adobe:flash_player:11.8.800.94 cpe:/a:adobe:flash_player:11.8.800.97 cpe:/a:adobe:flash_player:11.8.800.168 cpe:/a:adobe:flash_player:11.8.800.174 cpe:/a:adobe:flash_player:11.8.800.175 cpe:/a:adobe:flash_player:11.9.900.117 cpe:/a:adobe:flash_player:11.9.900.152 cpe:/a:adobe:flash_player:11.9.900.170 cpe:/a:adobe:flash_player:11.9.900.700 cpe:/a:adobe:flash_player:12.0.0.38 cpe:/a:adobe:flash_player:12.0.0.41 cpe:/a:adobe:flash_player:12.0.0.43

CVE-2014-0497

2014-02-05T00:15:29.897-05:00

2018-12-13T10:52:24.743-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-11T09:51:35.937-05:00

CONFIRM http://googlechromereleases.blogspot.com/2014/02/stable-channel-update.html CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-04.html SUSE openSUSE-SU-2014:0197 SUSE openSUSE-SU-2014:0203 SUSE SUSE-SU-2014:0221 REDHAT RHSA-2014:0137 SECUNIA 56437 SECUNIA 56737 SECUNIA 56780 SECUNIA 56799 SECUNIA 56839 EXPLOIT-DB 33212 OSVDB 102849 BID 65327 SECTRACK 1029715 XF adobe-flash-cve20140497-code-exec(90884) Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.

cpe:/a:adobe:adobe_air:- cpe:/a:adobe:adobe_air:1.0 cpe:/a:adobe:adobe_air:1.0.1 cpe:/a:adobe:adobe_air:1.0.8.4990 cpe:/a:adobe:adobe_air:1.0.4990 cpe:/a:adobe:adobe_air:1.1 cpe:/a:adobe:adobe_air:1.1.0.5790 cpe:/a:adobe:adobe_air:1.5 cpe:/a:adobe:adobe_air:1.5.0.7220 cpe:/a:adobe:adobe_air:1.5.1 cpe:/a:adobe:adobe_air:1.5.1.8210 cpe:/a:adobe:adobe_air:1.5.2 cpe:/a:adobe:adobe_air:1.5.3 cpe:/a:adobe:adobe_air:1.5.3.9120 cpe:/a:adobe:adobe_air:1.5.3.9130 cpe:/a:adobe:adobe_air:2.0.2 cpe:/a:adobe:adobe_air:2.0.2.12610 cpe:/a:adobe:adobe_air:2.0.3 cpe:/a:adobe:adobe_air:2.0.3.13070 cpe:/a:adobe:adobe_air:2.0.4 cpe:/a:adobe:adobe_air:2.5.0.16600 cpe:/a:adobe:adobe_air:2.5.1.17730 cpe:/a:adobe:adobe_air:2.6 cpe:/a:adobe:adobe_air:2.6.0.19120 cpe:/a:adobe:adobe_air:2.6.0.19140 cpe:/a:adobe:adobe_air:2.7 cpe:/a:adobe:adobe_air:2.7.0.1948 cpe:/a:adobe:adobe_air:2.7.0.1953 cpe:/a:adobe:adobe_air:2.7.0.19480 cpe:/a:adobe:adobe_air:2.7.0.19530 cpe:/a:adobe:adobe_air:2.7.1 cpe:/a:adobe:adobe_air:2.7.1.19610 cpe:/a:adobe:adobe_air:3.0.0.408 cpe:/a:adobe:adobe_air:3.0.0.4080 cpe:/a:adobe:adobe_air:3.1.0.485 cpe:/a:adobe:adobe_air:3.1.0.488 cpe:/a:adobe:adobe_air:3.1.0.4880 cpe:/a:adobe:adobe_air:3.2.0.207 cpe:/a:adobe:adobe_air:3.2.0.2070 cpe:/a:adobe:adobe_air:3.3.0.3670 cpe:/a:adobe:adobe_air:3.4.0.2540 cpe:/a:adobe:adobe_air:3.4.0.2710 cpe:/a:adobe:adobe_air:3.5.0.600 cpe:/a:adobe:adobe_air:3.5.0.880 cpe:/a:adobe:adobe_air:3.5.0.890 cpe:/a:adobe:adobe_air:3.5.0.1060 cpe:/a:adobe:adobe_air:3.6.0.597 cpe:/a:adobe:adobe_air:3.6.0.6090 cpe:/a:adobe:adobe_air:3.7.0.1530 cpe:/a:adobe:adobe_air:3.7.0.1860 cpe:/a:adobe:adobe_air:3.7.0.2090 cpe:/a:adobe:adobe_air:3.8.0.870 cpe:/a:adobe:adobe_air:3.8.0.910 cpe:/a:adobe:adobe_air:3.9.0.1030 cpe:/a:adobe:adobe_air:3.9.0.1060 cpe:/a:adobe:adobe_air:3.9.0.1210 cpe:/a:adobe:adobe_air:3.9.0.1380 cpe:/a:adobe:adobe_air:4.0.0.1390 cpe:/a:adobe:adobe_air_sdk:3.0.0.4080 cpe:/a:adobe:adobe_air_sdk:3.1.0.488 cpe:/a:adobe:adobe_air_sdk:3.2.0.2070 cpe:/a:adobe:adobe_air_sdk:3.3.0.3650 cpe:/a:adobe:adobe_air_sdk:3.3.0.3690 cpe:/a:adobe:adobe_air_sdk:3.4.0.2540 cpe:/a:adobe:adobe_air_sdk:3.4.0.2710 cpe:/a:adobe:adobe_air_sdk:3.5.0.600 cpe:/a:adobe:adobe_air_sdk:3.5.0.880 cpe:/a:adobe:adobe_air_sdk:3.5.0.890 cpe:/a:adobe:adobe_air_sdk:3.5.0.1060 cpe:/a:adobe:adobe_air_sdk:3.6.0.599 cpe:/a:adobe:adobe_air_sdk:3.6.0.6090 cpe:/a:adobe:adobe_air_sdk:3.7.0.1530 cpe:/a:adobe:adobe_air_sdk:3.7.0.1860 cpe:/a:adobe:adobe_air_sdk:3.7.0.2090 cpe:/a:adobe:adobe_air_sdk:3.8.0.870 cpe:/a:adobe:adobe_air_sdk:3.8.0.910 cpe:/a:adobe:adobe_air_sdk:3.8.0.1430 cpe:/a:adobe:adobe_air_sdk:3.9.0.1030 cpe:/a:adobe:adobe_air_sdk:3.9.0.1210 cpe:/a:adobe:adobe_air_sdk:3.9.0.1380 cpe:/a:adobe:adobe_air_sdk:4.0.0.1390 cpe:/a:adobe:flash_player:11.0 cpe:/a:adobe:flash_player:11.0.1.152 cpe:/a:adobe:flash_player:11.0.1.152::~~~~x64~ cpe:/a:adobe:flash_player:11.0.1.153 cpe:/a:adobe:flash_player:11.1 cpe:/a:adobe:flash_player:11.1.102.55 cpe:/a:adobe:flash_player:11.1.102.55::~~~~x64~ cpe:/a:adobe:flash_player:11.1.102.59 cpe:/a:adobe:flash_player:11.1.102.62 cpe:/a:adobe:flash_player:11.1.102.63 cpe:/a:adobe:flash_player:11.1.111.8 cpe:/a:adobe:flash_player:11.1.111.13 cpe:/a:adobe:flash_player:11.1.111.44 cpe:/a:adobe:flash_player:11.1.111.50 cpe:/a:adobe:flash_player:11.1.111.54 cpe:/a:adobe:flash_player:11.1.111.64 cpe:/a:adobe:flash_player:11.1.111.73 cpe:/a:adobe:flash_player:11.1.115.7 cpe:/a:adobe:flash_player:11.1.115.34 cpe:/a:adobe:flash_player:11.1.115.48 cpe:/a:adobe:flash_player:11.1.115.54 cpe:/a:adobe:flash_player:11.1.115.58 cpe:/a:adobe:flash_player:11.1.115.59 cpe:/a:adobe:flash_player:11.1.115.63 cpe:/a:adobe:flash_player:11.1.115.69 cpe:/a:adobe:flash_player:11.1.115.81 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.327 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:11.2.202.400 cpe:/a:adobe:flash_player:11.2.202.406 cpe:/a:adobe:flash_player:11.2.202.411 cpe:/a:adobe:flash_player:11.2.202.418 cpe:/a:adobe:flash_player:11.2.202.424 cpe:/a:adobe:flash_player:11.2.202.425 cpe:/a:adobe:flash_player:11.2.202.429 cpe:/a:adobe:flash_player:11.2.202.438 cpe:/a:adobe:flash_player:11.2.202.440 cpe:/a:adobe:flash_player:11.2.202.442 cpe:/a:adobe:flash_player:11.2.202.451 cpe:/a:adobe:flash_player:11.2.202.457 cpe:/a:adobe:flash_player:11.2.202.460 cpe:/a:adobe:flash_player:11.2.202.466 cpe:/a:adobe:flash_player:11.2.202.468 cpe:/a:adobe:flash_player:11.2.202.475 cpe:/a:adobe:flash_player:11.2.202.481 cpe:/a:adobe:flash_player:11.2.202.491 cpe:/a:adobe:flash_player:11.2.202.508 cpe:/a:adobe:flash_player:11.2.202.521 cpe:/a:adobe:flash_player:11.2.202.535 cpe:/a:adobe:flash_player:11.2.202.540 cpe:/a:adobe:flash_player:11.2.202.548 cpe:/a:adobe:flash_player:11.2.202.554 cpe:/a:adobe:flash_player:11.2.202.559 cpe:/a:adobe:flash_player:11.2.202.569 cpe:/a:adobe:flash_player:11.2.202.577 cpe:/a:adobe:flash_player:11.2.202.616 cpe:/a:adobe:flash_player:11.2.202.621 cpe:/a:adobe:flash_player:11.2.202.626 cpe:/a:adobe:flash_player:11.2.202.632 cpe:/a:adobe:flash_player:11.2.202.635 cpe:/a:adobe:flash_player:11.2.202.635::~~~linux~~ cpe:/a:adobe:flash_player:11.2.202.637 cpe:/a:adobe:flash_player:11.2.202.637::~~~linux~~ cpe:/a:adobe:flash_player:11.2.202.643 cpe:/a:adobe:flash_player:11.2.202.644 cpe:/a:adobe:flash_player:11.3.300.257 cpe:/a:adobe:flash_player:11.3.300.262 cpe:/a:adobe:flash_player:11.3.300.265 cpe:/a:adobe:flash_player:11.3.300.268 cpe:/a:adobe:flash_player:11.3.300.270 cpe:/a:adobe:flash_player:11.3.300.271 cpe:/a:adobe:flash_player:11.3.300.273 cpe:/a:adobe:flash_player:11.4.402.265 cpe:/a:adobe:flash_player:11.4.402.278 cpe:/a:adobe:flash_player:11.4.402.287 cpe:/a:adobe:flash_player:11.5.502.110 cpe:/a:adobe:flash_player:11.5.502.135 cpe:/a:adobe:flash_player:11.5.502.136 cpe:/a:adobe:flash_player:11.5.502.146 cpe:/a:adobe:flash_player:11.5.502.149 cpe:/a:adobe:flash_player:11.6.602.167 cpe:/a:adobe:flash_player:11.6.602.168 cpe:/a:adobe:flash_player:11.6.602.171 cpe:/a:adobe:flash_player:11.6.602.180 cpe:/a:adobe:flash_player:11.7.700.169 cpe:/a:adobe:flash_player:11.7.700.202 cpe:/a:adobe:flash_player:11.7.700.203 cpe:/a:adobe:flash_player:11.7.700.224 cpe:/a:adobe:flash_player:11.7.700.225 cpe:/a:adobe:flash_player:11.7.700.232 cpe:/a:adobe:flash_player:11.7.700.242 cpe:/a:adobe:flash_player:11.7.700.252 cpe:/a:adobe:flash_player:11.7.700.257 cpe:/a:adobe:flash_player:11.7.700.260 cpe:/a:adobe:flash_player:11.7.700.261 cpe:/a:adobe:flash_player:11.8.800.94 cpe:/a:adobe:flash_player:11.8.800.97 cpe:/a:adobe:flash_player:11.8.800.168 cpe:/a:adobe:flash_player:11.8.800.174 cpe:/a:adobe:flash_player:11.9.900.117 cpe:/a:adobe:flash_player:11.9.900.152 cpe:/a:adobe:flash_player:11.9.900.170 cpe:/a:adobe:flash_player:11.9.900.700 cpe:/a:adobe:flash_player:12.0.0.38 cpe:/a:adobe:flash_player:12.0.0.41 cpe:/a:adobe:flash_player:12.0.0.43 cpe:/a:adobe:flash_player:12.0.0.44

CVE-2014-0498

2014-02-21T00:06:54.517-05:00

2018-12-13T10:54:15.917-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-11T09:34:29.220-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-07.html SUSE openSUSE-SU-2014:0277 SUSE openSUSE-SU-2014:0278 SUSE SUSE-SU-2014:0290 REDHAT RHSA-2014:0196 GENTOO GLSA-201405-04 Stack-based buffer overflow in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows attackers to execute arbitrary code via unspecified vectors.

cpe:/a:adobe:adobe_air:- cpe:/a:adobe:adobe_air:1.0 cpe:/a:adobe:adobe_air:1.0.1 cpe:/a:adobe:adobe_air:1.0.8.4990 cpe:/a:adobe:adobe_air:1.0.4990 cpe:/a:adobe:adobe_air:1.1 cpe:/a:adobe:adobe_air:1.1.0.5790 cpe:/a:adobe:adobe_air:1.5 cpe:/a:adobe:adobe_air:1.5.0.7220 cpe:/a:adobe:adobe_air:1.5.1 cpe:/a:adobe:adobe_air:1.5.1.8210 cpe:/a:adobe:adobe_air:1.5.2 cpe:/a:adobe:adobe_air:1.5.3 cpe:/a:adobe:adobe_air:1.5.3.9120 cpe:/a:adobe:adobe_air:1.5.3.9130 cpe:/a:adobe:adobe_air:2.0.2 cpe:/a:adobe:adobe_air:2.0.2.12610 cpe:/a:adobe:adobe_air:2.0.3 cpe:/a:adobe:adobe_air:2.0.3.13070 cpe:/a:adobe:adobe_air:2.0.4 cpe:/a:adobe:adobe_air:2.5.0.16600 cpe:/a:adobe:adobe_air:2.5.1.17730 cpe:/a:adobe:adobe_air:2.6 cpe:/a:adobe:adobe_air:2.6.0.19120 cpe:/a:adobe:adobe_air:2.6.0.19140 cpe:/a:adobe:adobe_air:2.7 cpe:/a:adobe:adobe_air:2.7.0.1948 cpe:/a:adobe:adobe_air:2.7.0.1953 cpe:/a:adobe:adobe_air:2.7.0.19480 cpe:/a:adobe:adobe_air:2.7.0.19530 cpe:/a:adobe:adobe_air:2.7.1 cpe:/a:adobe:adobe_air:2.7.1.19610 cpe:/a:adobe:adobe_air:3.0.0.408 cpe:/a:adobe:adobe_air:3.0.0.4080 cpe:/a:adobe:adobe_air:3.1.0.485 cpe:/a:adobe:adobe_air:3.1.0.488 cpe:/a:adobe:adobe_air:3.1.0.4880 cpe:/a:adobe:adobe_air:3.2.0.207 cpe:/a:adobe:adobe_air:3.2.0.2070 cpe:/a:adobe:adobe_air:3.3.0.3670 cpe:/a:adobe:adobe_air:3.4.0.2540 cpe:/a:adobe:adobe_air:3.4.0.2710 cpe:/a:adobe:adobe_air:3.5.0.600 cpe:/a:adobe:adobe_air:3.5.0.880 cpe:/a:adobe:adobe_air:3.5.0.890 cpe:/a:adobe:adobe_air:3.5.0.1060 cpe:/a:adobe:adobe_air:3.6.0.597 cpe:/a:adobe:adobe_air:3.6.0.6090 cpe:/a:adobe:adobe_air:3.7.0.1530 cpe:/a:adobe:adobe_air:3.7.0.1860 cpe:/a:adobe:adobe_air:3.7.0.2090 cpe:/a:adobe:adobe_air:3.8.0.870 cpe:/a:adobe:adobe_air:3.8.0.910 cpe:/a:adobe:adobe_air:3.9.0.1030 cpe:/a:adobe:adobe_air:3.9.0.1060 cpe:/a:adobe:adobe_air:3.9.0.1210 cpe:/a:adobe:adobe_air:3.9.0.1380 cpe:/a:adobe:adobe_air:4.0.0.1390 cpe:/a:adobe:adobe_air_sdk:3.0.0.4080 cpe:/a:adobe:adobe_air_sdk:3.1.0.488 cpe:/a:adobe:adobe_air_sdk:3.2.0.2070 cpe:/a:adobe:adobe_air_sdk:3.3.0.3650 cpe:/a:adobe:adobe_air_sdk:3.3.0.3690 cpe:/a:adobe:adobe_air_sdk:3.4.0.2540 cpe:/a:adobe:adobe_air_sdk:3.4.0.2710 cpe:/a:adobe:adobe_air_sdk:3.5.0.600 cpe:/a:adobe:adobe_air_sdk:3.5.0.880 cpe:/a:adobe:adobe_air_sdk:3.5.0.890 cpe:/a:adobe:adobe_air_sdk:3.5.0.1060 cpe:/a:adobe:adobe_air_sdk:3.6.0.599 cpe:/a:adobe:adobe_air_sdk:3.6.0.6090 cpe:/a:adobe:adobe_air_sdk:3.7.0.1530 cpe:/a:adobe:adobe_air_sdk:3.7.0.1860 cpe:/a:adobe:adobe_air_sdk:3.7.0.2090 cpe:/a:adobe:adobe_air_sdk:3.8.0.870 cpe:/a:adobe:adobe_air_sdk:3.8.0.910 cpe:/a:adobe:adobe_air_sdk:3.8.0.1430 cpe:/a:adobe:adobe_air_sdk:3.9.0.1030 cpe:/a:adobe:adobe_air_sdk:3.9.0.1210 cpe:/a:adobe:adobe_air_sdk:3.9.0.1380 cpe:/a:adobe:adobe_air_sdk:4.0.0.1390 cpe:/a:adobe:flash_player:11.0 cpe:/a:adobe:flash_player:11.0.1.152 cpe:/a:adobe:flash_player:11.0.1.152::~~~~x64~ cpe:/a:adobe:flash_player:11.0.1.153 cpe:/a:adobe:flash_player:11.1 cpe:/a:adobe:flash_player:11.1.102.55 cpe:/a:adobe:flash_player:11.1.102.55::~~~~x64~ cpe:/a:adobe:flash_player:11.1.102.59 cpe:/a:adobe:flash_player:11.1.102.62 cpe:/a:adobe:flash_player:11.1.102.63 cpe:/a:adobe:flash_player:11.1.111.8 cpe:/a:adobe:flash_player:11.1.111.13 cpe:/a:adobe:flash_player:11.1.111.44 cpe:/a:adobe:flash_player:11.1.111.50 cpe:/a:adobe:flash_player:11.1.111.54 cpe:/a:adobe:flash_player:11.1.111.64 cpe:/a:adobe:flash_player:11.1.111.73 cpe:/a:adobe:flash_player:11.1.115.7 cpe:/a:adobe:flash_player:11.1.115.34 cpe:/a:adobe:flash_player:11.1.115.48 cpe:/a:adobe:flash_player:11.1.115.54 cpe:/a:adobe:flash_player:11.1.115.58 cpe:/a:adobe:flash_player:11.1.115.59 cpe:/a:adobe:flash_player:11.1.115.63 cpe:/a:adobe:flash_player:11.1.115.69 cpe:/a:adobe:flash_player:11.1.115.81 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.327 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:11.2.202.400 cpe:/a:adobe:flash_player:11.2.202.406 cpe:/a:adobe:flash_player:11.2.202.411 cpe:/a:adobe:flash_player:11.2.202.418 cpe:/a:adobe:flash_player:11.2.202.424 cpe:/a:adobe:flash_player:11.2.202.425 cpe:/a:adobe:flash_player:11.2.202.429 cpe:/a:adobe:flash_player:11.2.202.438 cpe:/a:adobe:flash_player:11.2.202.440 cpe:/a:adobe:flash_player:11.2.202.442 cpe:/a:adobe:flash_player:11.2.202.451 cpe:/a:adobe:flash_player:11.2.202.457 cpe:/a:adobe:flash_player:11.2.202.460 cpe:/a:adobe:flash_player:11.2.202.466 cpe:/a:adobe:flash_player:11.2.202.468 cpe:/a:adobe:flash_player:11.2.202.475 cpe:/a:adobe:flash_player:11.2.202.481 cpe:/a:adobe:flash_player:11.2.202.491 cpe:/a:adobe:flash_player:11.2.202.508 cpe:/a:adobe:flash_player:11.2.202.521 cpe:/a:adobe:flash_player:11.2.202.535 cpe:/a:adobe:flash_player:11.2.202.540 cpe:/a:adobe:flash_player:11.2.202.548 cpe:/a:adobe:flash_player:11.2.202.554 cpe:/a:adobe:flash_player:11.2.202.559 cpe:/a:adobe:flash_player:11.2.202.569 cpe:/a:adobe:flash_player:11.2.202.577 cpe:/a:adobe:flash_player:11.2.202.616 cpe:/a:adobe:flash_player:11.2.202.621 cpe:/a:adobe:flash_player:11.2.202.626 cpe:/a:adobe:flash_player:11.2.202.632 cpe:/a:adobe:flash_player:11.2.202.635 cpe:/a:adobe:flash_player:11.2.202.635::~~~linux~~ cpe:/a:adobe:flash_player:11.2.202.637 cpe:/a:adobe:flash_player:11.2.202.637::~~~linux~~ cpe:/a:adobe:flash_player:11.2.202.643 cpe:/a:adobe:flash_player:11.2.202.644 cpe:/a:adobe:flash_player:11.3.300.257 cpe:/a:adobe:flash_player:11.3.300.262 cpe:/a:adobe:flash_player:11.3.300.265 cpe:/a:adobe:flash_player:11.3.300.268 cpe:/a:adobe:flash_player:11.3.300.270 cpe:/a:adobe:flash_player:11.3.300.271 cpe:/a:adobe:flash_player:11.3.300.273 cpe:/a:adobe:flash_player:11.4.402.265 cpe:/a:adobe:flash_player:11.4.402.278 cpe:/a:adobe:flash_player:11.4.402.287 cpe:/a:adobe:flash_player:11.5.502.110 cpe:/a:adobe:flash_player:11.5.502.135 cpe:/a:adobe:flash_player:11.5.502.136 cpe:/a:adobe:flash_player:11.5.502.146 cpe:/a:adobe:flash_player:11.5.502.149 cpe:/a:adobe:flash_player:11.6.602.167 cpe:/a:adobe:flash_player:11.6.602.168 cpe:/a:adobe:flash_player:11.6.602.171 cpe:/a:adobe:flash_player:11.6.602.180 cpe:/a:adobe:flash_player:11.7.700.169 cpe:/a:adobe:flash_player:11.7.700.202 cpe:/a:adobe:flash_player:11.7.700.203 cpe:/a:adobe:flash_player:11.7.700.224 cpe:/a:adobe:flash_player:11.7.700.225 cpe:/a:adobe:flash_player:11.7.700.232 cpe:/a:adobe:flash_player:11.7.700.242 cpe:/a:adobe:flash_player:11.7.700.252 cpe:/a:adobe:flash_player:11.7.700.257 cpe:/a:adobe:flash_player:11.7.700.260 cpe:/a:adobe:flash_player:11.7.700.261 cpe:/a:adobe:flash_player:11.8.800.94 cpe:/a:adobe:flash_player:11.8.800.97 cpe:/a:adobe:flash_player:11.8.800.168 cpe:/a:adobe:flash_player:11.8.800.174 cpe:/a:adobe:flash_player:11.9.900.117 cpe:/a:adobe:flash_player:11.9.900.152 cpe:/a:adobe:flash_player:11.9.900.170 cpe:/a:adobe:flash_player:11.9.900.700 cpe:/a:adobe:flash_player:12.0.0.38 cpe:/a:adobe:flash_player:12.0.0.41 cpe:/a:adobe:flash_player:12.0.0.43 cpe:/a:adobe:flash_player:12.0.0.44

CVE-2014-0499

2014-02-21T00:07:00.000-05:00

2018-12-13T10:54:47.153-05:00

7.8

NETWORK

LOW

NONE

COMPLETE

NONE

http://nvd.nist.gov

2018-12-11T09:34:23.157-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-07.html SUSE openSUSE-SU-2014:0277 SUSE openSUSE-SU-2014:0278 SUSE SUSE-SU-2014:0290 REDHAT RHSA-2014:0196 GENTOO GLSA-201405-04 Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 do not prevent access to address information, which makes it easier for attackers to bypass the ASLR protection mechanism via unspecified vectors.

cpe:/a:adobe:shockwave_player:11.0.0.456 cpe:/a:adobe:shockwave_player:11.0.3.471 cpe:/a:adobe:shockwave_player:11.5.0.595 cpe:/a:adobe:shockwave_player:11.5.0.596 cpe:/a:adobe:shockwave_player:11.5.1.601 cpe:/a:adobe:shockwave_player:11.5.2.602 cpe:/a:adobe:shockwave_player:11.5.6.606 cpe:/a:adobe:shockwave_player:11.5.7.609 cpe:/a:adobe:shockwave_player:11.5.8.612 cpe:/a:adobe:shockwave_player:11.5.9.615 cpe:/a:adobe:shockwave_player:11.5.9.620 cpe:/a:adobe:shockwave_player:11.5.10.620 cpe:/a:adobe:shockwave_player:11.6.0.626 cpe:/a:adobe:shockwave_player:11.6.1.629 cpe:/a:adobe:shockwave_player:11.6.3.633 cpe:/a:adobe:shockwave_player:11.6.4.634 cpe:/a:adobe:shockwave_player:11.6.5.635 cpe:/a:adobe:shockwave_player:11.6.6.636 cpe:/a:adobe:shockwave_player:11.6.7.637 cpe:/a:adobe:shockwave_player:11.6.8.638 cpe:/a:adobe:shockwave_player:12.0.0.112 cpe:/a:adobe:shockwave_player:12.0.2.122 cpe:/a:adobe:shockwave_player:12.0.3.133 cpe:/a:adobe:shockwave_player:12.0.4.144 cpe:/a:adobe:shockwave_player:12.0.6.147 cpe:/a:adobe:shockwave_player:12.0.7.148

CVE-2014-0500

2014-02-11T23:50:41.313-05:00

2018-01-02T21:29:03.130-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/shockwave/apsb14-06.html OSVDB 103157 SECUNIA 56740 BID 65490 SECTRACK 1029740 XF adobe-cve20140500-code-exec(91007) Adobe Shockwave Player before 12.0.9.149 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0501.

CVE-2014-0501

2014-02-11T23:50:41.343-05:00

2018-01-02T21:29:03.210-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/shockwave/apsb14-06.html OSVDB 103158 SECUNIA 56740 BID 65493 SECTRACK 1029740 XF adobe-cve20140501-code-exec(91008) Adobe Shockwave Player before 12.0.9.149 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0500.

cpe:/a:adobe:adobe_air:- cpe:/a:adobe:adobe_air:1.0 cpe:/a:adobe:adobe_air:1.0.1 cpe:/a:adobe:adobe_air:1.0.8.4990 cpe:/a:adobe:adobe_air:1.0.4990 cpe:/a:adobe:adobe_air:1.1 cpe:/a:adobe:adobe_air:1.1.0.5790 cpe:/a:adobe:adobe_air:1.5 cpe:/a:adobe:adobe_air:1.5.0.7220 cpe:/a:adobe:adobe_air:1.5.1 cpe:/a:adobe:adobe_air:1.5.1.8210 cpe:/a:adobe:adobe_air:1.5.2 cpe:/a:adobe:adobe_air:1.5.3 cpe:/a:adobe:adobe_air:1.5.3.9120 cpe:/a:adobe:adobe_air:1.5.3.9130 cpe:/a:adobe:adobe_air:2.0.2 cpe:/a:adobe:adobe_air:2.0.2.12610 cpe:/a:adobe:adobe_air:2.0.3 cpe:/a:adobe:adobe_air:2.0.3.13070 cpe:/a:adobe:adobe_air:2.0.4 cpe:/a:adobe:adobe_air:2.5.0.16600 cpe:/a:adobe:adobe_air:2.5.1.17730 cpe:/a:adobe:adobe_air:2.6 cpe:/a:adobe:adobe_air:2.6.0.19120 cpe:/a:adobe:adobe_air:2.6.0.19140 cpe:/a:adobe:adobe_air:2.7 cpe:/a:adobe:adobe_air:2.7.0.1948 cpe:/a:adobe:adobe_air:2.7.0.1953 cpe:/a:adobe:adobe_air:2.7.0.19480 cpe:/a:adobe:adobe_air:2.7.0.19530 cpe:/a:adobe:adobe_air:2.7.1 cpe:/a:adobe:adobe_air:2.7.1.19610 cpe:/a:adobe:adobe_air:3.0.0.408 cpe:/a:adobe:adobe_air:3.0.0.4080 cpe:/a:adobe:adobe_air:3.1.0.485 cpe:/a:adobe:adobe_air:3.1.0.488 cpe:/a:adobe:adobe_air:3.1.0.4880 cpe:/a:adobe:adobe_air:3.2.0.207 cpe:/a:adobe:adobe_air:3.2.0.2070 cpe:/a:adobe:adobe_air:3.3.0.3670 cpe:/a:adobe:adobe_air:3.4.0.2540 cpe:/a:adobe:adobe_air:3.4.0.2710 cpe:/a:adobe:adobe_air:3.5.0.600 cpe:/a:adobe:adobe_air:3.5.0.880 cpe:/a:adobe:adobe_air:3.5.0.890 cpe:/a:adobe:adobe_air:3.5.0.1060 cpe:/a:adobe:adobe_air:3.6.0.597 cpe:/a:adobe:adobe_air:3.6.0.6090 cpe:/a:adobe:adobe_air:3.7.0.1530 cpe:/a:adobe:adobe_air:3.7.0.1860 cpe:/a:adobe:adobe_air:3.7.0.2090 cpe:/a:adobe:adobe_air:3.8.0.870 cpe:/a:adobe:adobe_air:3.8.0.910 cpe:/a:adobe:adobe_air:3.9.0.1030 cpe:/a:adobe:adobe_air:3.9.0.1060 cpe:/a:adobe:adobe_air:3.9.0.1210 cpe:/a:adobe:adobe_air:3.9.0.1380 cpe:/a:adobe:adobe_air:4.0.0.1390 cpe:/a:adobe:adobe_air_sdk:3.0.0.4080 cpe:/a:adobe:adobe_air_sdk:3.1.0.488 cpe:/a:adobe:adobe_air_sdk:3.2.0.2070 cpe:/a:adobe:adobe_air_sdk:3.3.0.3650 cpe:/a:adobe:adobe_air_sdk:3.3.0.3690 cpe:/a:adobe:adobe_air_sdk:3.4.0.2540 cpe:/a:adobe:adobe_air_sdk:3.4.0.2710 cpe:/a:adobe:adobe_air_sdk:3.5.0.600 cpe:/a:adobe:adobe_air_sdk:3.5.0.880 cpe:/a:adobe:adobe_air_sdk:3.5.0.890 cpe:/a:adobe:adobe_air_sdk:3.5.0.1060 cpe:/a:adobe:adobe_air_sdk:3.6.0.599 cpe:/a:adobe:adobe_air_sdk:3.6.0.6090 cpe:/a:adobe:adobe_air_sdk:3.7.0.1530 cpe:/a:adobe:adobe_air_sdk:3.7.0.1860 cpe:/a:adobe:adobe_air_sdk:3.7.0.2090 cpe:/a:adobe:adobe_air_sdk:3.8.0.870 cpe:/a:adobe:adobe_air_sdk:3.8.0.910 cpe:/a:adobe:adobe_air_sdk:3.8.0.1430 cpe:/a:adobe:adobe_air_sdk:3.9.0.1030 cpe:/a:adobe:adobe_air_sdk:3.9.0.1210 cpe:/a:adobe:adobe_air_sdk:3.9.0.1380 cpe:/a:adobe:adobe_air_sdk:4.0.0.1390 cpe:/a:adobe:flash_player:11.0 cpe:/a:adobe:flash_player:11.0.1.152 cpe:/a:adobe:flash_player:11.0.1.152::~~~~x64~ cpe:/a:adobe:flash_player:11.0.1.153 cpe:/a:adobe:flash_player:11.1 cpe:/a:adobe:flash_player:11.1.102.55 cpe:/a:adobe:flash_player:11.1.102.55::~~~~x64~ cpe:/a:adobe:flash_player:11.1.102.59 cpe:/a:adobe:flash_player:11.1.102.62 cpe:/a:adobe:flash_player:11.1.102.63 cpe:/a:adobe:flash_player:11.1.111.8 cpe:/a:adobe:flash_player:11.1.111.13 cpe:/a:adobe:flash_player:11.1.111.44 cpe:/a:adobe:flash_player:11.1.111.50 cpe:/a:adobe:flash_player:11.1.111.54 cpe:/a:adobe:flash_player:11.1.111.64 cpe:/a:adobe:flash_player:11.1.111.73 cpe:/a:adobe:flash_player:11.1.115.7 cpe:/a:adobe:flash_player:11.1.115.34 cpe:/a:adobe:flash_player:11.1.115.48 cpe:/a:adobe:flash_player:11.1.115.54 cpe:/a:adobe:flash_player:11.1.115.58 cpe:/a:adobe:flash_player:11.1.115.59 cpe:/a:adobe:flash_player:11.1.115.63 cpe:/a:adobe:flash_player:11.1.115.69 cpe:/a:adobe:flash_player:11.1.115.81 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.327 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:11.2.202.400 cpe:/a:adobe:flash_player:11.2.202.406 cpe:/a:adobe:flash_player:11.2.202.411 cpe:/a:adobe:flash_player:11.2.202.418 cpe:/a:adobe:flash_player:11.2.202.424 cpe:/a:adobe:flash_player:11.2.202.425 cpe:/a:adobe:flash_player:11.2.202.429 cpe:/a:adobe:flash_player:11.2.202.438 cpe:/a:adobe:flash_player:11.2.202.440 cpe:/a:adobe:flash_player:11.2.202.442 cpe:/a:adobe:flash_player:11.2.202.451 cpe:/a:adobe:flash_player:11.2.202.457 cpe:/a:adobe:flash_player:11.2.202.460 cpe:/a:adobe:flash_player:11.2.202.466 cpe:/a:adobe:flash_player:11.2.202.468 cpe:/a:adobe:flash_player:11.2.202.475 cpe:/a:adobe:flash_player:11.2.202.481 cpe:/a:adobe:flash_player:11.2.202.491 cpe:/a:adobe:flash_player:11.2.202.508 cpe:/a:adobe:flash_player:11.2.202.521 cpe:/a:adobe:flash_player:11.2.202.535 cpe:/a:adobe:flash_player:11.2.202.540 cpe:/a:adobe:flash_player:11.2.202.548 cpe:/a:adobe:flash_player:11.2.202.554 cpe:/a:adobe:flash_player:11.2.202.559 cpe:/a:adobe:flash_player:11.2.202.569 cpe:/a:adobe:flash_player:11.2.202.577 cpe:/a:adobe:flash_player:11.2.202.616 cpe:/a:adobe:flash_player:11.2.202.621 cpe:/a:adobe:flash_player:11.2.202.626 cpe:/a:adobe:flash_player:11.2.202.632 cpe:/a:adobe:flash_player:11.2.202.635 cpe:/a:adobe:flash_player:11.2.202.635::~~~linux~~ cpe:/a:adobe:flash_player:11.2.202.637 cpe:/a:adobe:flash_player:11.2.202.637::~~~linux~~ cpe:/a:adobe:flash_player:11.2.202.643 cpe:/a:adobe:flash_player:11.2.202.644 cpe:/a:adobe:flash_player:11.3.300.257 cpe:/a:adobe:flash_player:11.3.300.262 cpe:/a:adobe:flash_player:11.3.300.265 cpe:/a:adobe:flash_player:11.3.300.268 cpe:/a:adobe:flash_player:11.3.300.270 cpe:/a:adobe:flash_player:11.3.300.271 cpe:/a:adobe:flash_player:11.3.300.273 cpe:/a:adobe:flash_player:11.4.402.265 cpe:/a:adobe:flash_player:11.4.402.278 cpe:/a:adobe:flash_player:11.4.402.287 cpe:/a:adobe:flash_player:11.5.502.110 cpe:/a:adobe:flash_player:11.5.502.135 cpe:/a:adobe:flash_player:11.5.502.136 cpe:/a:adobe:flash_player:11.5.502.146 cpe:/a:adobe:flash_player:11.5.502.149 cpe:/a:adobe:flash_player:11.6.602.167 cpe:/a:adobe:flash_player:11.6.602.168 cpe:/a:adobe:flash_player:11.6.602.171 cpe:/a:adobe:flash_player:11.6.602.180 cpe:/a:adobe:flash_player:11.7.700.169 cpe:/a:adobe:flash_player:11.7.700.202 cpe:/a:adobe:flash_player:11.7.700.203 cpe:/a:adobe:flash_player:11.7.700.224 cpe:/a:adobe:flash_player:11.7.700.225 cpe:/a:adobe:flash_player:11.7.700.232 cpe:/a:adobe:flash_player:11.7.700.242 cpe:/a:adobe:flash_player:11.7.700.252 cpe:/a:adobe:flash_player:11.7.700.257 cpe:/a:adobe:flash_player:11.7.700.260 cpe:/a:adobe:flash_player:11.7.700.261 cpe:/a:adobe:flash_player:11.8.800.94 cpe:/a:adobe:flash_player:11.8.800.97 cpe:/a:adobe:flash_player:11.8.800.168 cpe:/a:adobe:flash_player:11.8.800.174 cpe:/a:adobe:flash_player:11.9.900.117 cpe:/a:adobe:flash_player:11.9.900.152 cpe:/a:adobe:flash_player:11.9.900.170 cpe:/a:adobe:flash_player:11.9.900.700 cpe:/a:adobe:flash_player:12.0.0.38 cpe:/a:adobe:flash_player:12.0.0.41 cpe:/a:adobe:flash_player:12.0.0.43 cpe:/a:adobe:flash_player:12.0.0.44

CVE-2014-0502

2014-02-21T00:07:00.017-05:00

2018-12-13T10:55:17.857-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-11T09:34:13.813-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-07.html SUSE openSUSE-SU-2014:0277 SUSE openSUSE-SU-2014:0278 SUSE SUSE-SU-2014:0290 REDHAT RHSA-2014:0196 GENTOO GLSA-201405-04 MISC http://www.alienvault.com/open-threat-exchange/blog/analysis-of-an-attack-exploiting-the-adobe-zero-day-cve-2014-0502/ MISC https://volatility-labs.blogspot.com/2014/04/building-decoder-for-cve-2014-0502.html Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.

cpe:/a:adobe:flash_player:11.0 cpe:/a:adobe:flash_player:11.0.1.152 cpe:/a:adobe:flash_player:11.0.1.152::~~~~x64~ cpe:/a:adobe:flash_player:11.0.1.153 cpe:/a:adobe:flash_player:11.1 cpe:/a:adobe:flash_player:11.1.102.55 cpe:/a:adobe:flash_player:11.1.102.55::~~~~x64~ cpe:/a:adobe:flash_player:11.1.102.59 cpe:/a:adobe:flash_player:11.1.102.62 cpe:/a:adobe:flash_player:11.1.102.63 cpe:/a:adobe:flash_player:11.1.111.8 cpe:/a:adobe:flash_player:11.1.111.13 cpe:/a:adobe:flash_player:11.1.111.44 cpe:/a:adobe:flash_player:11.1.111.50 cpe:/a:adobe:flash_player:11.1.111.54 cpe:/a:adobe:flash_player:11.1.111.64 cpe:/a:adobe:flash_player:11.1.111.73 cpe:/a:adobe:flash_player:11.1.115.7 cpe:/a:adobe:flash_player:11.1.115.34 cpe:/a:adobe:flash_player:11.1.115.48 cpe:/a:adobe:flash_player:11.1.115.54 cpe:/a:adobe:flash_player:11.1.115.58 cpe:/a:adobe:flash_player:11.1.115.59 cpe:/a:adobe:flash_player:11.1.115.63 cpe:/a:adobe:flash_player:11.1.115.69 cpe:/a:adobe:flash_player:11.1.115.81 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.327 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:11.2.202.400 cpe:/a:adobe:flash_player:11.2.202.406 cpe:/a:adobe:flash_player:11.2.202.411 cpe:/a:adobe:flash_player:11.2.202.418 cpe:/a:adobe:flash_player:11.2.202.424 cpe:/a:adobe:flash_player:11.2.202.425 cpe:/a:adobe:flash_player:11.2.202.429 cpe:/a:adobe:flash_player:11.2.202.438 cpe:/a:adobe:flash_player:11.2.202.440 cpe:/a:adobe:flash_player:11.2.202.442 cpe:/a:adobe:flash_player:11.2.202.451 cpe:/a:adobe:flash_player:11.2.202.457 cpe:/a:adobe:flash_player:11.2.202.460 cpe:/a:adobe:flash_player:11.2.202.466 cpe:/a:adobe:flash_player:11.2.202.468 cpe:/a:adobe:flash_player:11.2.202.475 cpe:/a:adobe:flash_player:11.2.202.481 cpe:/a:adobe:flash_player:11.2.202.491 cpe:/a:adobe:flash_player:11.2.202.508 cpe:/a:adobe:flash_player:11.2.202.521 cpe:/a:adobe:flash_player:11.2.202.535 cpe:/a:adobe:flash_player:11.2.202.540 cpe:/a:adobe:flash_player:11.2.202.548 cpe:/a:adobe:flash_player:11.2.202.554 cpe:/a:adobe:flash_player:11.2.202.559 cpe:/a:adobe:flash_player:11.2.202.569 cpe:/a:adobe:flash_player:11.2.202.577 cpe:/a:adobe:flash_player:11.2.202.616 cpe:/a:adobe:flash_player:11.2.202.621 cpe:/a:adobe:flash_player:11.2.202.626 cpe:/a:adobe:flash_player:11.2.202.632 cpe:/a:adobe:flash_player:11.2.202.635 cpe:/a:adobe:flash_player:11.2.202.635::~~~linux~~ cpe:/a:adobe:flash_player:11.2.202.637 cpe:/a:adobe:flash_player:11.2.202.637::~~~linux~~ cpe:/a:adobe:flash_player:11.2.202.643 cpe:/a:adobe:flash_player:11.2.202.644 cpe:/a:adobe:flash_player:11.3.300.257 cpe:/a:adobe:flash_player:11.3.300.262 cpe:/a:adobe:flash_player:11.3.300.265 cpe:/a:adobe:flash_player:11.3.300.268 cpe:/a:adobe:flash_player:11.3.300.270 cpe:/a:adobe:flash_player:11.3.300.271 cpe:/a:adobe:flash_player:11.3.300.273 cpe:/a:adobe:flash_player:11.4.402.265 cpe:/a:adobe:flash_player:11.4.402.278 cpe:/a:adobe:flash_player:11.4.402.287 cpe:/a:adobe:flash_player:11.5.502.110 cpe:/a:adobe:flash_player:11.5.502.135 cpe:/a:adobe:flash_player:11.5.502.136 cpe:/a:adobe:flash_player:11.5.502.146 cpe:/a:adobe:flash_player:11.5.502.149 cpe:/a:adobe:flash_player:11.6.602.167 cpe:/a:adobe:flash_player:11.6.602.168 cpe:/a:adobe:flash_player:11.6.602.171 cpe:/a:adobe:flash_player:11.6.602.180 cpe:/a:adobe:flash_player:11.7.700.169 cpe:/a:adobe:flash_player:11.7.700.202 cpe:/a:adobe:flash_player:11.7.700.203 cpe:/a:adobe:flash_player:11.7.700.224 cpe:/a:adobe:flash_player:11.7.700.225 cpe:/a:adobe:flash_player:11.7.700.232 cpe:/a:adobe:flash_player:11.7.700.242 cpe:/a:adobe:flash_player:11.7.700.252 cpe:/a:adobe:flash_player:11.7.700.257 cpe:/a:adobe:flash_player:11.7.700.260 cpe:/a:adobe:flash_player:11.7.700.261 cpe:/a:adobe:flash_player:11.7.700.269 cpe:/a:adobe:flash_player:11.8.800.94 cpe:/a:adobe:flash_player:11.8.800.97 cpe:/a:adobe:flash_player:11.8.800.168 cpe:/a:adobe:flash_player:11.8.800.174 cpe:/a:adobe:flash_player:11.8.800.175 cpe:/a:adobe:flash_player:11.9.900.117 cpe:/a:adobe:flash_player:11.9.900.152 cpe:/a:adobe:flash_player:11.9.900.170 cpe:/a:adobe:flash_player:11.9.900.700 cpe:/a:adobe:flash_player:12.0.0.38 cpe:/a:adobe:flash_player:12.0.0.41 cpe:/a:adobe:flash_player:12.0.0.43 cpe:/a:adobe:flash_player:12.0.0.44 cpe:/a:adobe:flash_player:12.0.0.70

CVE-2014-0503

2014-03-12T01:15:20.163-04:00

2018-12-13T11:00:37.443-05:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-12-11T09:54:25.757-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-08.html SUSE openSUSE-SU-2014:0379 SUSE SUSE-SU-2014:0387 REDHAT RHSA-2014:0289 GENTOO GLSA-201405-04 Adobe Flash Player before 11.7.700.272 and 11.8.x through 12.0.x before 12.0.0.77 on Windows and OS X, and before 11.2.202.346 on Linux, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.

cpe:/a:adobe:flash_player:11.0 cpe:/a:adobe:flash_player:11.0.1.152 cpe:/a:adobe:flash_player:11.0.1.152::~~~~x64~ cpe:/a:adobe:flash_player:11.0.1.153 cpe:/a:adobe:flash_player:11.1 cpe:/a:adobe:flash_player:11.1.102.55 cpe:/a:adobe:flash_player:11.1.102.55::~~~~x64~ cpe:/a:adobe:flash_player:11.1.102.59 cpe:/a:adobe:flash_player:11.1.102.62 cpe:/a:adobe:flash_player:11.1.102.63 cpe:/a:adobe:flash_player:11.1.111.8 cpe:/a:adobe:flash_player:11.1.111.13 cpe:/a:adobe:flash_player:11.1.111.44 cpe:/a:adobe:flash_player:11.1.111.50 cpe:/a:adobe:flash_player:11.1.111.54 cpe:/a:adobe:flash_player:11.1.111.64 cpe:/a:adobe:flash_player:11.1.111.73 cpe:/a:adobe:flash_player:11.1.115.7 cpe:/a:adobe:flash_player:11.1.115.34 cpe:/a:adobe:flash_player:11.1.115.48 cpe:/a:adobe:flash_player:11.1.115.54 cpe:/a:adobe:flash_player:11.1.115.58 cpe:/a:adobe:flash_player:11.1.115.59 cpe:/a:adobe:flash_player:11.1.115.63 cpe:/a:adobe:flash_player:11.1.115.69 cpe:/a:adobe:flash_player:11.1.115.81 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.327 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:11.2.202.400 cpe:/a:adobe:flash_player:11.2.202.406 cpe:/a:adobe:flash_player:11.2.202.411 cpe:/a:adobe:flash_player:11.2.202.418 cpe:/a:adobe:flash_player:11.2.202.424 cpe:/a:adobe:flash_player:11.2.202.425 cpe:/a:adobe:flash_player:11.2.202.429 cpe:/a:adobe:flash_player:11.2.202.438 cpe:/a:adobe:flash_player:11.2.202.440 cpe:/a:adobe:flash_player:11.2.202.442 cpe:/a:adobe:flash_player:11.2.202.451 cpe:/a:adobe:flash_player:11.2.202.457 cpe:/a:adobe:flash_player:11.2.202.460 cpe:/a:adobe:flash_player:11.2.202.466 cpe:/a:adobe:flash_player:11.2.202.468 cpe:/a:adobe:flash_player:11.2.202.475 cpe:/a:adobe:flash_player:11.2.202.481 cpe:/a:adobe:flash_player:11.2.202.491 cpe:/a:adobe:flash_player:11.2.202.508 cpe:/a:adobe:flash_player:11.2.202.521 cpe:/a:adobe:flash_player:11.2.202.535 cpe:/a:adobe:flash_player:11.2.202.540 cpe:/a:adobe:flash_player:11.2.202.548 cpe:/a:adobe:flash_player:11.2.202.554 cpe:/a:adobe:flash_player:11.2.202.559 cpe:/a:adobe:flash_player:11.2.202.569 cpe:/a:adobe:flash_player:11.2.202.577 cpe:/a:adobe:flash_player:11.2.202.616 cpe:/a:adobe:flash_player:11.2.202.621 cpe:/a:adobe:flash_player:11.2.202.626 cpe:/a:adobe:flash_player:11.2.202.632 cpe:/a:adobe:flash_player:11.2.202.635 cpe:/a:adobe:flash_player:11.2.202.635::~~~linux~~ cpe:/a:adobe:flash_player:11.2.202.637 cpe:/a:adobe:flash_player:11.2.202.637::~~~linux~~ cpe:/a:adobe:flash_player:11.2.202.643 cpe:/a:adobe:flash_player:11.2.202.644 cpe:/a:adobe:flash_player:11.3.300.257 cpe:/a:adobe:flash_player:11.3.300.262 cpe:/a:adobe:flash_player:11.3.300.265 cpe:/a:adobe:flash_player:11.3.300.268 cpe:/a:adobe:flash_player:11.3.300.270 cpe:/a:adobe:flash_player:11.3.300.271 cpe:/a:adobe:flash_player:11.3.300.273 cpe:/a:adobe:flash_player:11.4.402.265 cpe:/a:adobe:flash_player:11.4.402.278 cpe:/a:adobe:flash_player:11.4.402.287 cpe:/a:adobe:flash_player:11.5.502.110 cpe:/a:adobe:flash_player:11.5.502.135 cpe:/a:adobe:flash_player:11.5.502.136 cpe:/a:adobe:flash_player:11.5.502.146 cpe:/a:adobe:flash_player:11.5.502.149 cpe:/a:adobe:flash_player:11.6.602.167 cpe:/a:adobe:flash_player:11.6.602.168 cpe:/a:adobe:flash_player:11.6.602.171 cpe:/a:adobe:flash_player:11.6.602.180 cpe:/a:adobe:flash_player:11.7.700.169 cpe:/a:adobe:flash_player:11.7.700.202 cpe:/a:adobe:flash_player:11.7.700.203 cpe:/a:adobe:flash_player:11.7.700.224 cpe:/a:adobe:flash_player:11.7.700.225 cpe:/a:adobe:flash_player:11.7.700.232 cpe:/a:adobe:flash_player:11.7.700.242 cpe:/a:adobe:flash_player:11.7.700.252 cpe:/a:adobe:flash_player:11.7.700.257 cpe:/a:adobe:flash_player:11.7.700.260 cpe:/a:adobe:flash_player:11.7.700.261 cpe:/a:adobe:flash_player:11.7.700.269 cpe:/a:adobe:flash_player:11.8.800.94 cpe:/a:adobe:flash_player:11.8.800.97 cpe:/a:adobe:flash_player:11.8.800.168 cpe:/a:adobe:flash_player:11.8.800.174 cpe:/a:adobe:flash_player:11.8.800.175 cpe:/a:adobe:flash_player:11.9.900.117 cpe:/a:adobe:flash_player:11.9.900.152 cpe:/a:adobe:flash_player:11.9.900.170 cpe:/a:adobe:flash_player:11.9.900.700 cpe:/a:adobe:flash_player:12.0.0.38 cpe:/a:adobe:flash_player:12.0.0.41 cpe:/a:adobe:flash_player:12.0.0.43 cpe:/a:adobe:flash_player:12.0.0.44 cpe:/a:adobe:flash_player:12.0.0.70

CVE-2014-0504

2014-03-12T01:15:20.177-04:00

2018-12-13T11:00:23.630-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-12-11T09:55:27.273-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-08.html SUSE openSUSE-SU-2014:0379 SUSE SUSE-SU-2014:0387 REDHAT RHSA-2014:0289 GENTOO GLSA-201405-04 Adobe Flash Player before 11.7.700.272 and 11.8.x through 12.0.x before 12.0.0.77 on Windows and OS X, and before 11.2.202.346 on Linux, allows attackers to read the clipboard via unspecified vectors.

cpe:/a:adobe:shockwave_player:12.0.0.112 cpe:/a:adobe:shockwave_player:12.0.2.122 cpe:/a:adobe:shockwave_player:12.0.3.133 cpe:/a:adobe:shockwave_player:12.0.4.144 cpe:/a:adobe:shockwave_player:12.0.6.147 cpe:/a:adobe:shockwave_player:12.0.7.148 cpe:/a:adobe:shockwave_player:12.0.9.149

CVE-2014-0505

2014-03-14T06:55:05.600-04:00

2014-03-14T13:07:42.850-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2014-03-14T13:07:42.807-04:00

CONFIRM http://helpx.adobe.com/security/products/shockwave/apsb14-10.html Adobe Shockwave Player before 12.1.0.150 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

cpe:/a:adobe:flash_player:12.0.0.77

CVE-2014-0506

2014-03-27T06:55:04.357-04:00

2017-12-15T21:29:03.917-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-09.html SUSE SUSE-SU-2014:0535 SUSE openSUSE-SU-2014:0520 SUSE openSUSE-SU-2014:0549 REDHAT RHSA-2014:0380 GENTOO GLSA-201405-04 MISC http://twitter.com/thezdi/statuses/443886338077495296 MISC http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/ Use-after-free vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows remote attackers to execute arbitrary code, and possibly bypass an Internet Explorer sandbox protection mechanism, via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.

cpe:/a:adobe:adobe_air:1.0 cpe:/a:adobe:adobe_air:1.0.1 cpe:/a:adobe:adobe_air:1.0.8.4990 cpe:/a:adobe:adobe_air:1.0.4990 cpe:/a:adobe:adobe_air:1.1 cpe:/a:adobe:adobe_air:1.1.0.5790 cpe:/a:adobe:adobe_air:1.5 cpe:/a:adobe:adobe_air:1.5.0.7220 cpe:/a:adobe:adobe_air:1.5.1 cpe:/a:adobe:adobe_air:1.5.1.8210 cpe:/a:adobe:adobe_air:1.5.2 cpe:/a:adobe:adobe_air:1.5.3 cpe:/a:adobe:adobe_air:1.5.3.9120 cpe:/a:adobe:adobe_air:1.5.3.9130 cpe:/a:adobe:adobe_air:2.0.2 cpe:/a:adobe:adobe_air:2.0.2.12610 cpe:/a:adobe:adobe_air:2.0.3 cpe:/a:adobe:adobe_air:2.0.3.13070 cpe:/a:adobe:adobe_air:2.0.4 cpe:/a:adobe:adobe_air:2.5.0.16600 cpe:/a:adobe:adobe_air:2.5.1.17730 cpe:/a:adobe:adobe_air:2.6 cpe:/a:adobe:adobe_air:2.6.0.19120 cpe:/a:adobe:adobe_air:2.6.0.19140 cpe:/a:adobe:adobe_air:2.7 cpe:/a:adobe:adobe_air:2.7.0.1948 cpe:/a:adobe:adobe_air:2.7.0.1953 cpe:/a:adobe:adobe_air:2.7.0.19480 cpe:/a:adobe:adobe_air:2.7.0.19530 cpe:/a:adobe:adobe_air:2.7.1 cpe:/a:adobe:adobe_air:2.7.1.19610 cpe:/a:adobe:adobe_air:3.0.0.408 cpe:/a:adobe:adobe_air:3.0.0.4080 cpe:/a:adobe:adobe_air:3.1.0.485 cpe:/a:adobe:adobe_air:3.1.0.488 cpe:/a:adobe:adobe_air:3.1.0.4880 cpe:/a:adobe:adobe_air:3.2.0.207 cpe:/a:adobe:adobe_air:3.2.0.2070 cpe:/a:adobe:adobe_air:3.3.0.3670 cpe:/a:adobe:adobe_air:3.4.0.2540 cpe:/a:adobe:adobe_air:3.4.0.2710 cpe:/a:adobe:adobe_air:3.5.0.600 cpe:/a:adobe:adobe_air:3.5.0.880 cpe:/a:adobe:adobe_air:3.5.0.890 cpe:/a:adobe:adobe_air:3.5.0.1060 cpe:/a:adobe:adobe_air:3.6.0.597 cpe:/a:adobe:adobe_air:3.6.0.6090 cpe:/a:adobe:adobe_air:3.7.0.1530 cpe:/a:adobe:adobe_air:3.7.0.1860 cpe:/a:adobe:adobe_air:3.7.0.2090 cpe:/a:adobe:adobe_air:3.8.0.870 cpe:/a:adobe:adobe_air:3.8.0.910 cpe:/a:adobe:adobe_air:3.9.0.1030 cpe:/a:adobe:adobe_air:3.9.0.1060 cpe:/a:adobe:adobe_air:3.9.0.1210 cpe:/a:adobe:adobe_air:3.9.0.1380 cpe:/a:adobe:adobe_air:4.0.0.1390 cpe:/a:adobe:adobe_air_sdk:3.0.0.4080 cpe:/a:adobe:adobe_air_sdk:3.1.0.488 cpe:/a:adobe:adobe_air_sdk:3.2.0.2070 cpe:/a:adobe:adobe_air_sdk:3.3.0.3650 cpe:/a:adobe:adobe_air_sdk:3.3.0.3690 cpe:/a:adobe:adobe_air_sdk:3.4.0.2540 cpe:/a:adobe:adobe_air_sdk:3.4.0.2710 cpe:/a:adobe:adobe_air_sdk:3.5.0.600 cpe:/a:adobe:adobe_air_sdk:3.5.0.880 cpe:/a:adobe:adobe_air_sdk:3.5.0.890 cpe:/a:adobe:adobe_air_sdk:3.5.0.1060 cpe:/a:adobe:adobe_air_sdk:3.6.0.599 cpe:/a:adobe:adobe_air_sdk:3.6.0.6090 cpe:/a:adobe:adobe_air_sdk:3.7.0.1530 cpe:/a:adobe:adobe_air_sdk:3.7.0.1860 cpe:/a:adobe:adobe_air_sdk:3.7.0.2090 cpe:/a:adobe:adobe_air_sdk:3.8.0.870 cpe:/a:adobe:adobe_air_sdk:3.8.0.910 cpe:/a:adobe:adobe_air_sdk:3.8.0.1430 cpe:/a:adobe:adobe_air_sdk:3.9.0.1030 cpe:/a:adobe:adobe_air_sdk:3.9.0.1210 cpe:/a:adobe:adobe_air_sdk:3.9.0.1380 cpe:/a:adobe:adobe_air_sdk:4.0.0.1390 cpe:/a:adobe:adobe_air_sdk:4.0.0.1628 cpe:/a:adobe:flash_player:11.0 cpe:/a:adobe:flash_player:11.0.1.152 cpe:/a:adobe:flash_player:11.0.1.153 cpe:/a:adobe:flash_player:11.1 cpe:/a:adobe:flash_player:11.1.102.55 cpe:/a:adobe:flash_player:11.1.102.59 cpe:/a:adobe:flash_player:11.1.102.62 cpe:/a:adobe:flash_player:11.1.102.63 cpe:/a:adobe:flash_player:11.1.111.8 cpe:/a:adobe:flash_player:11.1.111.44 cpe:/a:adobe:flash_player:11.1.111.50 cpe:/a:adobe:flash_player:11.1.111.54 cpe:/a:adobe:flash_player:11.1.115.7 cpe:/a:adobe:flash_player:11.1.115.34 cpe:/a:adobe:flash_player:11.1.115.48 cpe:/a:adobe:flash_player:11.1.115.54 cpe:/a:adobe:flash_player:11.1.115.58 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.327 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.3.300.257 cpe:/a:adobe:flash_player:11.3.300.262 cpe:/a:adobe:flash_player:11.3.300.265 cpe:/a:adobe:flash_player:11.3.300.268 cpe:/a:adobe:flash_player:11.3.300.270 cpe:/a:adobe:flash_player:11.3.300.271 cpe:/a:adobe:flash_player:11.3.300.273 cpe:/a:adobe:flash_player:11.4.402.265 cpe:/a:adobe:flash_player:11.4.402.278 cpe:/a:adobe:flash_player:11.4.402.287 cpe:/a:adobe:flash_player:11.5.502.110 cpe:/a:adobe:flash_player:11.5.502.135 cpe:/a:adobe:flash_player:11.5.502.136 cpe:/a:adobe:flash_player:11.5.502.146 cpe:/a:adobe:flash_player:11.5.502.149 cpe:/a:adobe:flash_player:11.6.602.167 cpe:/a:adobe:flash_player:11.6.602.168 cpe:/a:adobe:flash_player:11.6.602.171 cpe:/a:adobe:flash_player:11.6.602.180 cpe:/a:adobe:flash_player:11.7.700.169 cpe:/a:adobe:flash_player:11.7.700.202 cpe:/a:adobe:flash_player:11.7.700.224 cpe:/a:adobe:flash_player:11.7.700.232 cpe:/a:adobe:flash_player:11.7.700.242 cpe:/a:adobe:flash_player:11.7.700.252 cpe:/a:adobe:flash_player:11.7.700.257 cpe:/a:adobe:flash_player:11.7.700.260 cpe:/a:adobe:flash_player:11.8.800.94 cpe:/a:adobe:flash_player:11.8.800.97 cpe:/a:adobe:flash_player:11.8.800.168 cpe:/a:adobe:flash_player:11.9.900.117 cpe:/a:adobe:flash_player:11.9.900.152 cpe:/a:adobe:flash_player:11.9.900.170 cpe:/a:adobe:flash_player:12.0.0.38 cpe:/a:adobe:flash_player:12.0.0.41 cpe:/a:adobe:flash_player:12.0.0.43

CVE-2014-0507

2014-04-08T19:55:06.353-04:00

2017-12-15T21:29:04.027-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-09.html SUSE SUSE-SU-2014:0535 SUSE openSUSE-SU-2014:0520 SUSE openSUSE-SU-2014:0549 REDHAT RHSA-2014:0380 GENTOO GLSA-201405-04 BID 66701 SECTRACK 1030035 Buffer overflow in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows attackers to execute arbitrary code via unspecified vectors.

CVE-2014-0508

2014-04-08T19:55:06.370-04:00

2017-12-15T21:29:04.167-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-09.html SUSE SUSE-SU-2014:0535 SUSE openSUSE-SU-2014:0520 SUSE openSUSE-SU-2014:0549 REDHAT RHSA-2014:0380 GENTOO GLSA-201405-04 SECTRACK 1030035 Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors.

CVE-2014-0509

2014-04-08T19:55:06.400-04:00

2017-12-15T21:29:04.293-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-09.html SUSE SUSE-SU-2014:0535 SUSE openSUSE-SU-2014:0520 SUSE openSUSE-SU-2014:0549 REDHAT RHSA-2014:0380 GENTOO GLSA-201405-04 BID 66703 SECTRACK 1030035 Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:adobe:flash_player:12.0.0.77

CVE-2014-0510

2014-03-27T06:55:04.387-04:00

2014-06-21T00:38:39.377-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-14.html SUSE SUSE-SU-2014:0671 REDHAT RHSA-2014:0496 GENTOO GLSA-201406-08 MISC http://twitter.com/thezdi/statuses/444262022444621824 MISC http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/ BID 66241 Heap-based buffer overflow in Adobe Flash Player 12.0.0.77 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by Zeguang Zhao and Liang Chen during a Pwn2Own competition at CanSecWest 2014.

cpe:/a:adobe:acrobat_reader:11.0.6

CVE-2014-0511

2014-03-27T06:55:04.417-04:00

2014-05-16T00:24:14.717-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/reader/apsb14-15.html MISC http://twitter.com/thezdi/statuses/443827076580122624 MISC http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/ Heap-based buffer overflow in Adobe Reader 11.0.06 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.

cpe:/a:adobe:acrobat_reader:11.0.6

CVE-2014-0512

2014-03-27T06:55:04.450-04:00

2014-05-16T00:24:14.857-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/reader/apsb14-15.html MISC http://twitter.com/thezdi/statuses/443827076580122624 MISC http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/ Adobe Reader 11.0.06 allows attackers to bypass a PDF sandbox protection mechanism via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.

cpe:/a:adobe:illustrator:16.0.1 cpe:/a:adobe:illustrator:16.0.2 cpe:/a:adobe:illustrator:16.0.3 cpe:/a:adobe:illustrator:16.0.4 cpe:/a:adobe:illustrator:16.2.0 cpe:/a:adobe:illustrator:16.2.1

CVE-2014-0513

2014-05-14T07:13:04.693-04:00

2014-05-14T11:15:25.657-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2014-05-14T11:15:25.457-04:00

CONFIRM http://helpx.adobe.com/security/products/illustrator/apsb14-11.html Stack-based buffer overflow in Adobe Illustrator CS6 before 16.0.5 and 16.2.x before 16.2.2 allows remote attackers to execute arbitrary code via unspecified vectors.

cpe:/a:adobe:adobe_reader:11.1.0::~~~android~~ cpe:/a:adobe:adobe_reader:11.1.3::~~~android~~

CVE-2014-0514

2014-04-15T19:13:14.743-04:00

2018-10-09T15:42:03.327-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/reader-mobile/apsb14-12.html MISC http://packetstormsecurity.com/files/127113/Adobe-Reader-for-Android-addJavascriptInterface-Exploit.html FULLDISC 20140413 Adobe Reader for Android exposes insecure Javascript interfaces EXPLOIT-DB 32884 EXPLOIT-DB 33791 OSVDB 105781 MISC http://www.securify.nl/advisory/SFY20140401/adobe_reader_for_android_exposes_insecure_javascript_interfaces.html BUGTRAQ 20140413 Adobe Reader for Android exposes insecure Javascript interfaces BID 66798 The Adobe Reader Mobile application before 11.2 for Android does not properly restrict use of JavaScript, which allows remote attackers to execute arbitrary code via a crafted PDF document, a related issue to CVE-2012-6636.

cpe:/a:adobe:flash_player:11.0 cpe:/a:adobe:flash_player:11.0.1.152 cpe:/a:adobe:flash_player:11.0.1.152::~~~~x64~ cpe:/a:adobe:flash_player:11.0.1.153 cpe:/a:adobe:flash_player:11.1 cpe:/a:adobe:flash_player:11.1.102.55 cpe:/a:adobe:flash_player:11.1.102.55::~~~~x64~ cpe:/a:adobe:flash_player:11.1.102.59 cpe:/a:adobe:flash_player:11.1.102.62 cpe:/a:adobe:flash_player:11.1.102.63 cpe:/a:adobe:flash_player:11.1.111.8 cpe:/a:adobe:flash_player:11.1.111.13 cpe:/a:adobe:flash_player:11.1.111.44 cpe:/a:adobe:flash_player:11.1.111.50 cpe:/a:adobe:flash_player:11.1.111.54 cpe:/a:adobe:flash_player:11.1.111.64 cpe:/a:adobe:flash_player:11.1.111.73 cpe:/a:adobe:flash_player:11.1.115.7 cpe:/a:adobe:flash_player:11.1.115.34 cpe:/a:adobe:flash_player:11.1.115.48 cpe:/a:adobe:flash_player:11.1.115.54 cpe:/a:adobe:flash_player:11.1.115.58 cpe:/a:adobe:flash_player:11.1.115.59 cpe:/a:adobe:flash_player:11.1.115.63 cpe:/a:adobe:flash_player:11.1.115.69 cpe:/a:adobe:flash_player:11.1.115.81 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.327 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:11.2.202.400 cpe:/a:adobe:flash_player:11.2.202.406 cpe:/a:adobe:flash_player:11.2.202.411 cpe:/a:adobe:flash_player:11.2.202.418 cpe:/a:adobe:flash_player:11.2.202.424 cpe:/a:adobe:flash_player:11.2.202.425 cpe:/a:adobe:flash_player:11.2.202.429 cpe:/a:adobe:flash_player:11.2.202.438 cpe:/a:adobe:flash_player:11.2.202.440 cpe:/a:adobe:flash_player:11.2.202.442 cpe:/a:adobe:flash_player:11.2.202.451 cpe:/a:adobe:flash_player:11.2.202.457 cpe:/a:adobe:flash_player:11.2.202.460 cpe:/a:adobe:flash_player:11.2.202.466 cpe:/a:adobe:flash_player:11.2.202.468 cpe:/a:adobe:flash_player:11.2.202.475 cpe:/a:adobe:flash_player:11.2.202.481 cpe:/a:adobe:flash_player:11.2.202.491 cpe:/a:adobe:flash_player:11.2.202.508 cpe:/a:adobe:flash_player:11.2.202.521 cpe:/a:adobe:flash_player:11.2.202.535 cpe:/a:adobe:flash_player:11.2.202.540 cpe:/a:adobe:flash_player:11.2.202.548 cpe:/a:adobe:flash_player:11.2.202.554 cpe:/a:adobe:flash_player:11.2.202.559 cpe:/a:adobe:flash_player:11.2.202.569 cpe:/a:adobe:flash_player:11.2.202.577 cpe:/a:adobe:flash_player:11.2.202.616 cpe:/a:adobe:flash_player:11.2.202.621 cpe:/a:adobe:flash_player:11.2.202.626 cpe:/a:adobe:flash_player:11.2.202.632 cpe:/a:adobe:flash_player:11.2.202.635 cpe:/a:adobe:flash_player:11.2.202.635::~~~linux~~ cpe:/a:adobe:flash_player:11.2.202.637 cpe:/a:adobe:flash_player:11.2.202.637::~~~linux~~ cpe:/a:adobe:flash_player:11.2.202.643 cpe:/a:adobe:flash_player:11.2.202.644 cpe:/a:adobe:flash_player:11.3.300.257 cpe:/a:adobe:flash_player:11.3.300.262 cpe:/a:adobe:flash_player:11.3.300.265 cpe:/a:adobe:flash_player:11.3.300.268 cpe:/a:adobe:flash_player:11.3.300.270 cpe:/a:adobe:flash_player:11.3.300.271 cpe:/a:adobe:flash_player:11.3.300.273 cpe:/a:adobe:flash_player:11.4.402.265 cpe:/a:adobe:flash_player:11.4.402.278 cpe:/a:adobe:flash_player:11.4.402.287 cpe:/a:adobe:flash_player:11.5.502.110 cpe:/a:adobe:flash_player:11.5.502.135 cpe:/a:adobe:flash_player:11.5.502.136 cpe:/a:adobe:flash_player:11.5.502.146 cpe:/a:adobe:flash_player:11.5.502.149 cpe:/a:adobe:flash_player:11.6.602.167 cpe:/a:adobe:flash_player:11.6.602.168 cpe:/a:adobe:flash_player:11.6.602.171 cpe:/a:adobe:flash_player:11.6.602.180 cpe:/a:adobe:flash_player:11.7.700.169 cpe:/a:adobe:flash_player:11.7.700.202 cpe:/a:adobe:flash_player:11.7.700.203 cpe:/a:adobe:flash_player:11.7.700.224 cpe:/a:adobe:flash_player:11.7.700.225 cpe:/a:adobe:flash_player:11.7.700.232 cpe:/a:adobe:flash_player:11.7.700.242 cpe:/a:adobe:flash_player:11.7.700.252 cpe:/a:adobe:flash_player:11.7.700.257 cpe:/a:adobe:flash_player:11.7.700.260 cpe:/a:adobe:flash_player:11.7.700.261 cpe:/a:adobe:flash_player:11.7.700.269 cpe:/a:adobe:flash_player:11.7.700.272 cpe:/a:adobe:flash_player:11.7.700.275 cpe:/a:adobe:flash_player:11.8.800.94 cpe:/a:adobe:flash_player:11.8.800.97 cpe:/a:adobe:flash_player:11.8.800.168 cpe:/a:adobe:flash_player:11.8.800.174 cpe:/a:adobe:flash_player:11.8.800.175 cpe:/a:adobe:flash_player:11.9.900.117 cpe:/a:adobe:flash_player:11.9.900.152 cpe:/a:adobe:flash_player:11.9.900.170 cpe:/a:adobe:flash_player:11.9.900.700 cpe:/a:adobe:flash_player:12.0.0.38 cpe:/a:adobe:flash_player:12.0.0.41 cpe:/a:adobe:flash_player:12.0.0.43 cpe:/a:adobe:flash_player:12.0.0.44 cpe:/a:adobe:flash_player:12.0.0.70 cpe:/a:adobe:flash_player:12.0.0.77 cpe:/a:adobe:flash_player:13.0::~~esr~~~ cpe:/a:adobe:flash_player:13.0.0.182 cpe:/a:adobe:flash_player:13.0.0.201

CVE-2014-0515

2014-04-29T06:37:03.733-04:00

2018-12-13T11:02:51.133-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-11T09:58:00.373-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-13.html SUSE openSUSE-SU-2014:0585 SUSE openSUSE-SU-2014:0589 SUSE SUSE-SU-2014:0605 REDHAT RHSA-2014:0447 GENTOO GLSA-201405-04 BID 67092 SECTRACK 1030155 Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and before 11.2.202.356 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in April 2014.

CVE-2014-0516

2014-05-14T07:13:04.757-04:00

2018-12-13T11:03:58.070-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2018-12-11T10:05:45.670-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-14.html SUSE SUSE-SU-2014:0671 SUSE openSUSE-SU-2014:0673 REDHAT RHSA-2014:0496 GENTOO GLSA-201406-08 Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SDK & Compiler before 13.0.0.111 allow remote attackers to bypass the Same Origin Policy via unspecified vectors.

CVE-2014-0517

2014-05-14T07:13:04.820-04:00

2018-12-13T11:05:59.260-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2018-12-11T10:05:48.967-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-14.html SUSE SUSE-SU-2014:0671 SUSE openSUSE-SU-2014:0673 REDHAT RHSA-2014:0496 GENTOO GLSA-201406-08 Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SDK & Compiler before 13.0.0.111 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0518, CVE-2014-0519, and CVE-2014-0520.

CVE-2014-0518

2014-05-14T07:13:04.897-04:00

2018-12-13T11:08:52.953-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2018-12-11T10:05:51.513-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-14.html SUSE SUSE-SU-2014:0671 SUSE openSUSE-SU-2014:0673 REDHAT RHSA-2014:0496 GENTOO GLSA-201406-08 Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SDK & Compiler before 13.0.0.111 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0517, CVE-2014-0519, and CVE-2014-0520.

CVE-2014-0519

2014-05-14T07:13:04.960-04:00

2018-12-13T11:29:46.607-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2018-12-11T10:05:54.593-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-14.html SUSE SUSE-SU-2014:0671 SUSE openSUSE-SU-2014:0673 REDHAT RHSA-2014:0496 GENTOO GLSA-201406-08 Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SDK & Compiler before 13.0.0.111 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0517, CVE-2014-0518, and CVE-2014-0520.

CVE-2014-0520

2014-05-14T07:13:05.023-04:00

2018-12-13T13:24:16.077-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2018-12-11T10:05:58.483-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-14.html SUSE SUSE-SU-2014:0671 SUSE openSUSE-SU-2014:0673 REDHAT RHSA-2014:0496 GENTOO GLSA-201406-08 Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SDK & Compiler before 13.0.0.111 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0517, CVE-2014-0518, and CVE-2014-0519.

cpe:/a:adobe:acrobat:10.0 cpe:/a:adobe:acrobat:10.0.1 cpe:/a:adobe:acrobat:10.0.2 cpe:/a:adobe:acrobat:10.0.3 cpe:/a:adobe:acrobat:10.1 cpe:/a:adobe:acrobat:10.1.1 cpe:/a:adobe:acrobat:10.1.2 cpe:/a:adobe:acrobat:10.1.3 cpe:/a:adobe:acrobat:10.1.4 cpe:/a:adobe:acrobat:10.1.5 cpe:/a:adobe:acrobat:10.1.6 cpe:/a:adobe:acrobat:10.1.7 cpe:/a:adobe:acrobat:10.1.8 cpe:/a:adobe:acrobat:10.1.9 cpe:/a:adobe:acrobat:11.0 cpe:/a:adobe:acrobat:11.0.1 cpe:/a:adobe:acrobat:11.0.2 cpe:/a:adobe:acrobat:11.0.3 cpe:/a:adobe:acrobat:11.0.4 cpe:/a:adobe:acrobat:11.0.5:-:~~~windows~~ cpe:/a:adobe:acrobat:11.0.6 cpe:/a:adobe:acrobat_reader:10.0 cpe:/a:adobe:acrobat_reader:10.0.1 cpe:/a:adobe:acrobat_reader:10.0.2 cpe:/a:adobe:acrobat_reader:10.0.3 cpe:/a:adobe:acrobat_reader:10.1 cpe:/a:adobe:acrobat_reader:10.1.1 cpe:/a:adobe:acrobat_reader:10.1.2 cpe:/a:adobe:acrobat_reader:10.1.3 cpe:/a:adobe:acrobat_reader:10.1.4 cpe:/a:adobe:acrobat_reader:10.1.5 cpe:/a:adobe:acrobat_reader:10.1.6 cpe:/a:adobe:acrobat_reader:10.1.7 cpe:/a:adobe:acrobat_reader:10.1.8 cpe:/a:adobe:acrobat_reader:10.1.9 cpe:/a:adobe:acrobat_reader:11.0 cpe:/a:adobe:acrobat_reader:11.0.1 cpe:/a:adobe:acrobat_reader:11.0.2 cpe:/a:adobe:acrobat_reader:11.0.3 cpe:/a:adobe:acrobat_reader:11.0.4 cpe:/a:adobe:acrobat_reader:11.0.5:-:~~~windows~~ cpe:/a:adobe:acrobat_reader:11.0.6

CVE-2014-0521

2014-05-14T07:13:05.070-04:00

2014-05-14T09:23:15.133-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-05-14T09:23:14.913-04:00

CONFIRM http://helpx.adobe.com/security/products/reader/apsb14-15.html Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X do not properly implement JavaScript APIs, which allows remote attackers to obtain sensitive information via a crafted PDF document.

CVE-2014-0522

2014-05-14T07:13:05.130-04:00

2014-05-14T09:29:43.443-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2014-05-14T09:29:43.207-04:00

CONFIRM http://helpx.adobe.com/security/products/reader/apsb14-15.html Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0523, CVE-2014-0524, and CVE-2014-0526.

CVE-2014-0523

2014-05-14T07:13:05.193-04:00

2016-12-07T22:04:23.140-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/reader/apsb14-15.html IDEFENSE 20141210 Adobe Reader U3D Processinng Memory Corruption Vulnerability Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0522, CVE-2014-0524, and CVE-2014-0526.

CVE-2014-0524

2014-05-14T07:13:05.257-04:00

2014-05-14T10:40:44.913-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2014-05-14T10:40:44.710-04:00

CVE-2014-0525

2014-05-14T07:13:05.333-04:00

2014-05-14T10:45:03.820-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2014-05-14T10:45:03.587-04:00

CONFIRM http://helpx.adobe.com/security/products/reader/apsb14-15.html The API in Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X does not prevent access to unmapped memory, which allows attackers to execute arbitrary code via unspecified API calls.

CVE-2014-0526

2014-05-14T07:13:05.413-04:00

2014-05-14T10:49:17.993-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2014-05-14T10:49:17.777-04:00

CVE-2014-0527

2014-05-14T07:13:05.477-04:00

2014-05-14T10:52:00.923-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2014-05-14T10:52:00.720-04:00

CONFIRM http://helpx.adobe.com/security/products/reader/apsb14-15.html Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.

CVE-2014-0528

2014-05-14T07:13:05.537-04:00

2014-05-14T10:54:15.003-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2014-05-14T10:54:14.767-04:00

CONFIRM http://helpx.adobe.com/security/products/reader/apsb14-15.html Double free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.

CVE-2014-0529

2014-05-14T07:13:05.600-04:00

2015-10-23T11:39:34.787-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2015-10-23T10:59:00.760-04:00

CONFIRM http://helpx.adobe.com/security/products/reader/apsb14-15.html BID 67362 Buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.

CVE-2014-0530

2017-05-11T10:29:33.107-04:00

2017-05-11T10:29:33.123-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.

cpe:/a:adobe:adobe_air:13.0.0.83 cpe:/a:adobe:adobe_air:13.0.0.111 cpe:/a:adobe:adobe_air_sdk:13.0.0.83 cpe:/a:adobe:adobe_air_sdk:13.0.0.111 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:13.0.0.182 cpe:/a:adobe:flash_player:13.0.0.201 cpe:/a:adobe:flash_player:13.0.0.206 cpe:/a:adobe:flash_player:13.0.0.214

CVE-2014-0531

2014-06-11T06:57:17.313-04:00

2017-12-21T21:29:12.480-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-16.html SUSE SUSE-SU-2014:0806 SUSE openSUSE-SU-2014:0798 SUSE openSUSE-SU-2014:0799 REDHAT RHSA-2014:0745 GENTOO GLSA-201406-17 BID 67962 SECTRACK 1030368 Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-0532 and CVE-2014-0533.

CVE-2014-0532

2014-06-11T06:57:17.347-04:00

2017-12-21T21:29:12.607-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-16.html SUSE SUSE-SU-2014:0806 SUSE openSUSE-SU-2014:0798 SUSE openSUSE-SU-2014:0799 REDHAT RHSA-2014:0745 GENTOO GLSA-201406-17 BID 67973 SECTRACK 1030368 Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-0531 and CVE-2014-0533.

CVE-2014-0533

2014-06-11T06:57:17.393-04:00

2017-12-21T21:29:12.713-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-16.html SUSE SUSE-SU-2014:0806 SUSE openSUSE-SU-2014:0798 SUSE openSUSE-SU-2014:0799 REDHAT RHSA-2014:0745 GENTOO GLSA-201406-17 BID 67974 SECTRACK 1030368 Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-0531 and CVE-2014-0532.

CVE-2014-0534

2014-06-11T06:57:17.423-04:00

2017-12-21T21:29:12.823-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-16.html SUSE SUSE-SU-2014:0806 SUSE openSUSE-SU-2014:0798 SUSE openSUSE-SU-2014:0799 REDHAT RHSA-2014:0745 GENTOO GLSA-201406-17 BID 67963 SECTRACK 1030368 Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0535.

CVE-2014-0535

2014-06-11T06:57:17.470-04:00

2017-12-21T21:29:12.917-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-16.html SUSE SUSE-SU-2014:0806 SUSE openSUSE-SU-2014:0798 SUSE openSUSE-SU-2014:0799 REDHAT RHSA-2014:0745 GENTOO GLSA-201406-17 BID 67970 SECTRACK 1030368 Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0534.

CVE-2014-0536

2014-06-11T06:57:17.500-04:00

2017-12-21T21:29:13.010-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-16.html SUSE SUSE-SU-2014:0806 SUSE openSUSE-SU-2014:0798 SUSE openSUSE-SU-2014:0799 REDHAT RHSA-2014:0745 GENTOO GLSA-201406-17 BID 67961 SECTRACK 1030368 Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

cpe:/a:adobe:adobe_air:13.0.0.83 cpe:/a:adobe:adobe_air:13.0.0.111 cpe:/a:adobe:adobe_air:14.0.0.110 cpe:/a:adobe:adobe_air_sdk:13.0.0.83 cpe:/a:adobe:adobe_air_sdk:13.0.0.111 cpe:/a:adobe:adobe_air_sdk:14.0.0.110 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:13.0.0.182 cpe:/a:adobe:flash_player:13.0.0.201 cpe:/a:adobe:flash_player:13.0.0.206 cpe:/a:adobe:flash_player:13.0.0.214 cpe:/a:adobe:flash_player:13.0.0.223 cpe:/a:adobe:flash_player:14.0.0.125

CVE-2014-0537

2014-07-09T01:04:24.630-04:00

2014-08-05T10:16:40.647-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-08-05T10:16:40.397-04:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-17.html REDHAT RHSA-2014:0860 GENTOO GLSA-201407-02 BID 68455 SECTRACK 1030533 Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0539.

cpe:/a:adobe:adobe_air:13.0.0.83 cpe:/a:adobe:adobe_air:13.0.0.111 cpe:/a:adobe:adobe_air:14.0.0.110 cpe:/a:adobe:adobe_air:14.0.0.137 cpe:/a:adobe:adobe_air_sdk:13.0.0.83 cpe:/a:adobe:adobe_air_sdk:13.0.0.111 cpe:/a:adobe:adobe_air_sdk:14.0.0.110 cpe:/a:adobe:adobe_air_sdk:14.0.0.137 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:13.0.0.182 cpe:/a:adobe:flash_player:13.0.0.201 cpe:/a:adobe:flash_player:13.0.0.206 cpe:/a:adobe:flash_player:13.0.0.214 cpe:/a:adobe:flash_player:13.0.0.223 cpe:/a:adobe:flash_player:13.0.0.231 cpe:/a:adobe:flash_player:14.0.0.125 cpe:/a:adobe:flash_player:14.0.0.145

CVE-2014-0538

2014-08-12T18:55:02.373-04:00

2017-01-06T21:59:30.030-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-18.html SECUNIA 58593 SECUNIA 59904 SECUNIA 60710 SECUNIA 60732 GENTOO GLSA-201408-05 GENTOO GLSA-201408-16 SECTRACK 1030712 Use-after-free vulnerability in Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 allows attackers to execute arbitrary code via unspecified vectors.

CVE-2014-0539

2014-07-09T01:04:24.677-04:00

2014-08-05T10:17:17.620-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-08-05T10:17:17.353-04:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-17.html REDHAT RHSA-2014:0860 GENTOO GLSA-201407-02 BID 68454 SECTRACK 1030533 Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0537.

CVE-2014-0540

2014-08-12T18:55:02.420-04:00

2017-01-06T21:59:30.140-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-18.html SECUNIA 60710 SECUNIA 60732 GENTOO GLSA-201408-05 SECTRACK 1030712 Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2014-0542, CVE-2014-0543, CVE-2014-0544, and CVE-2014-0545.

CVE-2014-0541

2014-08-12T18:55:02.467-04:00

2017-01-06T21:59:30.233-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-18.html SECUNIA 58593 SECUNIA 59904 SECUNIA 60710 SECUNIA 60732 GENTOO GLSA-201408-05 SECTRACK 1030712 Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 allow attackers to bypass intended access restrictions via unspecified vectors.

CVE-2014-0542

2014-08-12T18:55:02.513-04:00

2017-01-06T21:59:30.547-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-18.html SECUNIA 60710 SECUNIA 60732 GENTOO GLSA-201408-05 SECTRACK 1030712 Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2014-0540, CVE-2014-0543, CVE-2014-0544, and CVE-2014-0545.

CVE-2014-0543

2014-08-12T18:55:02.560-04:00

2017-01-06T21:59:30.717-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-18.html SECUNIA 60710 SECUNIA 60732 GENTOO GLSA-201408-05 SECTRACK 1030712 Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2014-0540, CVE-2014-0542, CVE-2014-0544, and CVE-2014-0545.

CVE-2014-0544

2014-08-12T18:55:02.593-04:00

2017-01-06T21:59:30.813-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-18.html SECUNIA 60710 SECUNIA 60732 GENTOO GLSA-201408-05 SECTRACK 1030712 Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2014-0540, CVE-2014-0542, CVE-2014-0543, and CVE-2014-0545.

CVE-2014-0545

2014-08-12T18:55:02.637-04:00

2017-01-06T21:59:30.907-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-18.html SECUNIA 60710 SECUNIA 60732 GENTOO GLSA-201408-05 SECTRACK 1030712 Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2014-0540, CVE-2014-0542, CVE-2014-0543, and CVE-2014-0544.

cpe:/a:adobe:acrobat:10.0 cpe:/a:adobe:acrobat:10.0.1 cpe:/a:adobe:acrobat:10.0.2 cpe:/a:adobe:acrobat:10.0.3 cpe:/a:adobe:acrobat:10.1 cpe:/a:adobe:acrobat:10.1.1 cpe:/a:adobe:acrobat:10.1.2 cpe:/a:adobe:acrobat:10.1.3 cpe:/a:adobe:acrobat:10.1.4 cpe:/a:adobe:acrobat:10.1.5 cpe:/a:adobe:acrobat:10.1.6 cpe:/a:adobe:acrobat:10.1.7 cpe:/a:adobe:acrobat:10.1.8 cpe:/a:adobe:acrobat:10.1.9 cpe:/a:adobe:acrobat:10.1.10 cpe:/a:adobe:acrobat:11.0 cpe:/a:adobe:acrobat:11.0.1 cpe:/a:adobe:acrobat:11.0.2 cpe:/a:adobe:acrobat:11.0.3 cpe:/a:adobe:acrobat:11.0.4 cpe:/a:adobe:acrobat:11.0.5:-:~~~windows~~ cpe:/a:adobe:acrobat:11.0.6 cpe:/a:adobe:acrobat:11.0.7 cpe:/a:adobe:acrobat_reader:10.0 cpe:/a:adobe:acrobat_reader:10.0.1 cpe:/a:adobe:acrobat_reader:10.0.2 cpe:/a:adobe:acrobat_reader:10.0.3 cpe:/a:adobe:acrobat_reader:10.1 cpe:/a:adobe:acrobat_reader:10.1.1 cpe:/a:adobe:acrobat_reader:10.1.2 cpe:/a:adobe:acrobat_reader:10.1.3 cpe:/a:adobe:acrobat_reader:10.1.4 cpe:/a:adobe:acrobat_reader:10.1.5 cpe:/a:adobe:acrobat_reader:10.1.6 cpe:/a:adobe:acrobat_reader:10.1.7 cpe:/a:adobe:acrobat_reader:10.1.8 cpe:/a:adobe:acrobat_reader:10.1.9 cpe:/a:adobe:acrobat_reader:10.1.10 cpe:/a:adobe:acrobat_reader:11.0 cpe:/a:adobe:acrobat_reader:11.0.1 cpe:/a:adobe:acrobat_reader:11.0.2 cpe:/a:adobe:acrobat_reader:11.0.3 cpe:/a:adobe:acrobat_reader:11.0.4 cpe:/a:adobe:acrobat_reader:11.0.5:-:~~~windows~~ cpe:/a:adobe:acrobat_reader:11.0.6 cpe:/a:adobe:acrobat_reader:11.0.7

CVE-2014-0546

2014-08-12T17:55:06.460-04:00

2017-01-06T21:59:30.983-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/reader/apsb14-19.html SECTRACK 1030711 Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context, via unspecified vectors.

cpe:/a:adobe:adobe_air:13.0.0.83 cpe:/a:adobe:adobe_air:13.0.0.111 cpe:/a:adobe:adobe_air:14.0.0.110 cpe:/a:adobe:adobe_air:14.0.0.137 cpe:/a:adobe:adobe_air:14.0.0.178 cpe:/a:adobe:adobe_air:14.0.0.179 cpe:/a:adobe:adobe_air_sdk:13.0.0.83 cpe:/a:adobe:adobe_air_sdk:13.0.0.111 cpe:/a:adobe:adobe_air_sdk:14.0.0.110 cpe:/a:adobe:adobe_air_sdk:14.0.0.137 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:11.2.202.400 cpe:/a:adobe:flash_player:13.0.0.182 cpe:/a:adobe:flash_player:13.0.0.201 cpe:/a:adobe:flash_player:13.0.0.206 cpe:/a:adobe:flash_player:13.0.0.214 cpe:/a:adobe:flash_player:13.0.0.223 cpe:/a:adobe:flash_player:13.0.0.231 cpe:/a:adobe:flash_player:13.0.0.241 cpe:/a:adobe:flash_player:14.0.0.125 cpe:/a:adobe:flash_player:14.0.0.145 cpe:/a:adobe:flash_player:14.0.0.176 cpe:/a:adobe:flash_player:14.0.0.179 cpe:/a:adobe:flash_player:15.0.0.144

CVE-2014-0547

2014-09-09T21:55:06.730-04:00

2017-08-28T21:34:11.137-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-21.html SUSE openSUSE-SU-2014:1110 SUSE SUSE-SU-2014:1124 SUSE openSUSE-SU-2014:1130 SECUNIA 61089 GENTOO GLSA-201409-05 BID 69695 SECTRACK 1030822 XF adobe-flash-cve20140547-code-exec(95817) Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0549, CVE-2014-0550, CVE-2014-0551, CVE-2014-0552, and CVE-2014-0555.

cpe:/a:adobe:adobe_air:13.0.0.83 cpe:/a:adobe:adobe_air:13.0.0.111 cpe:/a:adobe:adobe_air:14.0.0.110 cpe:/a:adobe:adobe_air:14.0.0.137 cpe:/a:adobe:adobe_air:14.0.0.178 cpe:/a:adobe:adobe_air:14.0.0.179 cpe:/a:adobe:adobe_air_sdk:13.0.0.83 cpe:/a:adobe:adobe_air_sdk:13.0.0.111 cpe:/a:adobe:adobe_air_sdk:14.0.0.110 cpe:/a:adobe:adobe_air_sdk:14.0.0.137 cpe:/a:adobe:adobe_air_sdk:14.0.0.178 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:11.2.202.400 cpe:/a:adobe:flash_player:13.0.0.182 cpe:/a:adobe:flash_player:13.0.0.201 cpe:/a:adobe:flash_player:13.0.0.206 cpe:/a:adobe:flash_player:13.0.0.214 cpe:/a:adobe:flash_player:13.0.0.223 cpe:/a:adobe:flash_player:13.0.0.231 cpe:/a:adobe:flash_player:13.0.0.241 cpe:/a:adobe:flash_player:14.0.0.125 cpe:/a:adobe:flash_player:14.0.0.145 cpe:/a:adobe:flash_player:14.0.0.176 cpe:/a:adobe:flash_player:14.0.0.179 cpe:/a:adobe:flash_player:15.0.0.144

CVE-2014-0548

2014-09-09T21:55:06.967-04:00

2017-08-28T21:34:11.217-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-21.html SUSE openSUSE-SU-2014:1110 SUSE SUSE-SU-2014:1124 SUSE openSUSE-SU-2014:1130 SECUNIA 61089 GENTOO GLSA-201409-05 BID 69705 SECTRACK 1030822 XF adobe-flash-cve20140548-sec-bypass(95818) Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allow remote attackers to bypass the Same Origin Policy via unspecified vectors.

cpe:/a:adobe:adobe_air:13.0.0.83 cpe:/a:adobe:adobe_air:13.0.0.111 cpe:/a:adobe:adobe_air:14.0.0.110 cpe:/a:adobe:adobe_air:14.0.0.137 cpe:/a:adobe:adobe_air:14.0.0.178 cpe:/a:adobe:adobe_air:14.0.0.179 cpe:/a:adobe:adobe_air_sdk:13.0.0.83 cpe:/a:adobe:adobe_air_sdk:13.0.0.111 cpe:/a:adobe:adobe_air_sdk:14.0.0.110 cpe:/a:adobe:adobe_air_sdk:14.0.0.137 cpe:/a:adobe:adobe_air_sdk:14.0.0.178 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:11.2.202.400 cpe:/a:adobe:flash_player:13.0.0.182 cpe:/a:adobe:flash_player:13.0.0.201 cpe:/a:adobe:flash_player:13.0.0.206 cpe:/a:adobe:flash_player:13.0.0.214 cpe:/a:adobe:flash_player:13.0.0.223 cpe:/a:adobe:flash_player:13.0.0.231 cpe:/a:adobe:flash_player:13.0.0.241 cpe:/a:adobe:flash_player:14.0.0.125 cpe:/a:adobe:flash_player:14.0.0.145 cpe:/a:adobe:flash_player:14.0.0.176 cpe:/a:adobe:flash_player:14.0.0.179 cpe:/a:adobe:flash_player:15.0.0.144

CVE-2014-0549

2014-09-09T21:55:07.013-04:00

2017-08-28T21:34:11.310-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-21.html SUSE openSUSE-SU-2014:1110 SUSE SUSE-SU-2014:1124 SUSE openSUSE-SU-2014:1130 SECUNIA 61089 GENTOO GLSA-201409-05 BID 69699 SECTRACK 1030822 XF adobe-flash-cve20140549-code-exec(95819) Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0547, CVE-2014-0550, CVE-2014-0551, CVE-2014-0552, and CVE-2014-0555.

cpe:/a:adobe:adobe_air:13.0.0.83 cpe:/a:adobe:adobe_air:13.0.0.111 cpe:/a:adobe:adobe_air:14.0.0.110 cpe:/a:adobe:adobe_air:14.0.0.137 cpe:/a:adobe:adobe_air:14.0.0.178 cpe:/a:adobe:adobe_air:14.0.0.179 cpe:/a:adobe:adobe_air_sdk:13.0.0.83 cpe:/a:adobe:adobe_air_sdk:13.0.0.111 cpe:/a:adobe:adobe_air_sdk:14.0.0.110 cpe:/a:adobe:adobe_air_sdk:14.0.0.137 cpe:/a:adobe:adobe_air_sdk:14.0.0.178 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:11.2.202.400 cpe:/a:adobe:flash_player:13.0.0.182 cpe:/a:adobe:flash_player:13.0.0.201 cpe:/a:adobe:flash_player:13.0.0.206 cpe:/a:adobe:flash_player:13.0.0.214 cpe:/a:adobe:flash_player:13.0.0.223 cpe:/a:adobe:flash_player:13.0.0.231 cpe:/a:adobe:flash_player:13.0.0.241 cpe:/a:adobe:flash_player:14.0.0.125 cpe:/a:adobe:flash_player:14.0.0.145 cpe:/a:adobe:flash_player:14.0.0.176 cpe:/a:adobe:flash_player:14.0.0.179 cpe:/a:adobe:flash_player:15.0.0.144

CVE-2014-0550

2014-09-09T21:55:07.310-04:00

2017-08-28T21:34:11.387-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-21.html SUSE openSUSE-SU-2014:1110 SUSE SUSE-SU-2014:1124 SUSE openSUSE-SU-2014:1130 SECUNIA 61089 GENTOO GLSA-201409-05 BID 69700 SECTRACK 1030822 XF adobe-flash-cve20140550-code-exec(95820) Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0547, CVE-2014-0549, CVE-2014-0551, CVE-2014-0552, and CVE-2014-0555.

cpe:/a:adobe:adobe_air:13.0.0.83 cpe:/a:adobe:adobe_air:13.0.0.111 cpe:/a:adobe:adobe_air:14.0.0.110 cpe:/a:adobe:adobe_air:14.0.0.137 cpe:/a:adobe:adobe_air:14.0.0.178 cpe:/a:adobe:adobe_air:14.0.0.179 cpe:/a:adobe:adobe_air_sdk:13.0.0.83 cpe:/a:adobe:adobe_air_sdk:13.0.0.111 cpe:/a:adobe:adobe_air_sdk:14.0.0.110 cpe:/a:adobe:adobe_air_sdk:14.0.0.137 cpe:/a:adobe:adobe_air_sdk:14.0.0.178 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:11.2.202.400 cpe:/a:adobe:flash_player:13.0.0.182 cpe:/a:adobe:flash_player:13.0.0.201 cpe:/a:adobe:flash_player:13.0.0.206 cpe:/a:adobe:flash_player:13.0.0.214 cpe:/a:adobe:flash_player:13.0.0.223 cpe:/a:adobe:flash_player:13.0.0.231 cpe:/a:adobe:flash_player:13.0.0.241 cpe:/a:adobe:flash_player:14.0.0.125 cpe:/a:adobe:flash_player:14.0.0.145 cpe:/a:adobe:flash_player:14.0.0.176 cpe:/a:adobe:flash_player:14.0.0.179 cpe:/a:adobe:flash_player:15.0.0.144

CVE-2014-0551

2014-09-09T21:55:07.370-04:00

2017-08-28T21:34:11.483-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-21.html SUSE openSUSE-SU-2014:1110 SUSE SUSE-SU-2014:1124 SUSE openSUSE-SU-2014:1130 SECUNIA 61089 GENTOO GLSA-201409-05 BID 69702 SECTRACK 1030822 XF adobe-flash-cve20140551-code-exec(95821) Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0547, CVE-2014-0549, CVE-2014-0550, CVE-2014-0552, and CVE-2014-0555.

cpe:/a:adobe:adobe_air:13.0.0.83 cpe:/a:adobe:adobe_air:13.0.0.111 cpe:/a:adobe:adobe_air:14.0.0.110 cpe:/a:adobe:adobe_air:14.0.0.137 cpe:/a:adobe:adobe_air:14.0.0.178 cpe:/a:adobe:adobe_air:14.0.0.179 cpe:/a:adobe:adobe_air_sdk:13.0.0.83 cpe:/a:adobe:adobe_air_sdk:13.0.0.111 cpe:/a:adobe:adobe_air_sdk:14.0.0.110 cpe:/a:adobe:adobe_air_sdk:14.0.0.137 cpe:/a:adobe:adobe_air_sdk:14.0.0.178 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:11.2.202.400 cpe:/a:adobe:flash_player:13.0.0.182 cpe:/a:adobe:flash_player:13.0.0.201 cpe:/a:adobe:flash_player:13.0.0.206 cpe:/a:adobe:flash_player:13.0.0.214 cpe:/a:adobe:flash_player:13.0.0.223 cpe:/a:adobe:flash_player:13.0.0.231 cpe:/a:adobe:flash_player:13.0.0.241 cpe:/a:adobe:flash_player:14.0.0.125 cpe:/a:adobe:flash_player:14.0.0.145 cpe:/a:adobe:flash_player:14.0.0.176 cpe:/a:adobe:flash_player:14.0.0.179 cpe:/a:adobe:flash_player:15.0.0.144

CVE-2014-0552

2014-09-09T21:55:08.433-04:00

2017-08-28T21:34:11.637-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-21.html SUSE openSUSE-SU-2014:1110 SUSE SUSE-SU-2014:1124 SUSE openSUSE-SU-2014:1130 SECUNIA 61089 GENTOO GLSA-201409-05 BID 69703 SECTRACK 1030822 XF adobe-flash-cve20140552-code-exec(95822) Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0547, CVE-2014-0549, CVE-2014-0550, CVE-2014-0551, and CVE-2014-0555.

cpe:/a:adobe:adobe_air:13.0.0.83 cpe:/a:adobe:adobe_air:13.0.0.111 cpe:/a:adobe:adobe_air:14.0.0.110 cpe:/a:adobe:adobe_air:14.0.0.137 cpe:/a:adobe:adobe_air:14.0.0.178 cpe:/a:adobe:adobe_air:14.0.0.179 cpe:/a:adobe:adobe_air_sdk:13.0.0.83 cpe:/a:adobe:adobe_air_sdk:13.0.0.111 cpe:/a:adobe:adobe_air_sdk:14.0.0.110 cpe:/a:adobe:adobe_air_sdk:14.0.0.137 cpe:/a:adobe:adobe_air_sdk:14.0.0.178 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:11.2.202.400 cpe:/a:adobe:flash_player:13.0.0.182 cpe:/a:adobe:flash_player:13.0.0.201 cpe:/a:adobe:flash_player:13.0.0.206 cpe:/a:adobe:flash_player:13.0.0.214 cpe:/a:adobe:flash_player:13.0.0.223 cpe:/a:adobe:flash_player:13.0.0.231 cpe:/a:adobe:flash_player:13.0.0.241 cpe:/a:adobe:flash_player:14.0.0.125 cpe:/a:adobe:flash_player:14.0.0.145 cpe:/a:adobe:flash_player:14.0.0.176 cpe:/a:adobe:flash_player:14.0.0.179 cpe:/a:adobe:flash_player:15.0.0.144 cpe:/o:opensuse:opensuse:11.4 cpe:/o:opensuse:opensuse:12.3 cpe:/o:opensuse:opensuse:13.1 cpe:/o:suse:suse_linux_enterprise_desktop:11.0:sp3

CVE-2014-0553

2014-09-09T21:55:08.497-04:00

2018-10-30T12:27:34.687-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-21.html SUSE openSUSE-SU-2014:1110 SUSE SUSE-SU-2014:1124 SUSE openSUSE-SU-2014:1130 SECUNIA 61089 GENTOO GLSA-201409-05 BID 69707 SECTRACK 1030822 XF adobe-flash-cve20140553-code-exec(95823) Use-after-free vulnerability in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allows attackers to execute arbitrary code via unspecified vectors.

cpe:/a:adobe:adobe_air:13.0.0.83 cpe:/a:adobe:adobe_air:13.0.0.111 cpe:/a:adobe:adobe_air:14.0.0.110 cpe:/a:adobe:adobe_air:14.0.0.137 cpe:/a:adobe:adobe_air:14.0.0.178 cpe:/a:adobe:adobe_air:14.0.0.179 cpe:/a:adobe:adobe_air_sdk:13.0.0.83 cpe:/a:adobe:adobe_air_sdk:13.0.0.111 cpe:/a:adobe:adobe_air_sdk:14.0.0.110 cpe:/a:adobe:adobe_air_sdk:14.0.0.137 cpe:/a:adobe:adobe_air_sdk:14.0.0.178 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:11.2.202.400 cpe:/a:adobe:flash_player:13.0.0.182 cpe:/a:adobe:flash_player:13.0.0.201 cpe:/a:adobe:flash_player:13.0.0.206 cpe:/a:adobe:flash_player:13.0.0.214 cpe:/a:adobe:flash_player:13.0.0.223 cpe:/a:adobe:flash_player:13.0.0.231 cpe:/a:adobe:flash_player:13.0.0.241 cpe:/a:adobe:flash_player:14.0.0.125 cpe:/a:adobe:flash_player:14.0.0.145 cpe:/a:adobe:flash_player:14.0.0.176 cpe:/a:adobe:flash_player:14.0.0.179 cpe:/a:adobe:flash_player:15.0.0.144

CVE-2014-0554

2014-09-10T06:55:06.723-04:00

2017-08-28T21:34:11.857-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-21.html SUSE openSUSE-SU-2014:1110 SUSE SUSE-SU-2014:1124 SUSE openSUSE-SU-2014:1130 SECUNIA 61089 GENTOO GLSA-201409-05 BID 69697 SECTRACK 1030822 XF adobe-flash-cve20140554-sec-bypass(95824) Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allow attackers to bypass intended access restrictions via unspecified vectors.

cpe:/a:adobe:adobe_air:13.0.0.83 cpe:/a:adobe:adobe_air:13.0.0.111 cpe:/a:adobe:adobe_air:14.0.0.110 cpe:/a:adobe:adobe_air:14.0.0.137 cpe:/a:adobe:adobe_air:14.0.0.178 cpe:/a:adobe:adobe_air:14.0.0.179 cpe:/a:adobe:adobe_air_sdk:13.0.0.83 cpe:/a:adobe:adobe_air_sdk:13.0.0.111 cpe:/a:adobe:adobe_air_sdk:14.0.0.110 cpe:/a:adobe:adobe_air_sdk:14.0.0.137 cpe:/a:adobe:adobe_air_sdk:14.0.0.178 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:11.2.202.400 cpe:/a:adobe:flash_player:13.0.0.182 cpe:/a:adobe:flash_player:13.0.0.201 cpe:/a:adobe:flash_player:13.0.0.206 cpe:/a:adobe:flash_player:13.0.0.214 cpe:/a:adobe:flash_player:13.0.0.223 cpe:/a:adobe:flash_player:13.0.0.231 cpe:/a:adobe:flash_player:13.0.0.241 cpe:/a:adobe:flash_player:14.0.0.125 cpe:/a:adobe:flash_player:14.0.0.145 cpe:/a:adobe:flash_player:14.0.0.176 cpe:/a:adobe:flash_player:14.0.0.179 cpe:/a:adobe:flash_player:15.0.0.144

CVE-2014-0555

2014-09-09T21:55:08.573-04:00

2017-08-28T21:34:11.950-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-21.html SUSE openSUSE-SU-2014:1110 SUSE SUSE-SU-2014:1124 SUSE openSUSE-SU-2014:1130 SECUNIA 61089 GENTOO GLSA-201409-05 BID 69706 SECTRACK 1030822 XF adobe-flash-cve20140555-code-exec(95825) Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0547, CVE-2014-0549, CVE-2014-0550, CVE-2014-0551, and CVE-2014-0552.

cpe:/a:adobe:adobe_air:13.0.0.83 cpe:/a:adobe:adobe_air:13.0.0.111 cpe:/a:adobe:adobe_air:14.0.0.110 cpe:/a:adobe:adobe_air:14.0.0.137 cpe:/a:adobe:adobe_air:14.0.0.178 cpe:/a:adobe:adobe_air:14.0.0.179 cpe:/a:adobe:adobe_air_sdk:13.0.0.83 cpe:/a:adobe:adobe_air_sdk:13.0.0.111 cpe:/a:adobe:adobe_air_sdk:14.0.0.110 cpe:/a:adobe:adobe_air_sdk:14.0.0.137 cpe:/a:adobe:adobe_air_sdk:14.0.0.178 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:11.2.202.400 cpe:/a:adobe:flash_player:13.0.0.182 cpe:/a:adobe:flash_player:13.0.0.201 cpe:/a:adobe:flash_player:13.0.0.206 cpe:/a:adobe:flash_player:13.0.0.214 cpe:/a:adobe:flash_player:13.0.0.223 cpe:/a:adobe:flash_player:13.0.0.231 cpe:/a:adobe:flash_player:13.0.0.241 cpe:/a:adobe:flash_player:14.0.0.125 cpe:/a:adobe:flash_player:14.0.0.145 cpe:/a:adobe:flash_player:14.0.0.176 cpe:/a:adobe:flash_player:14.0.0.179 cpe:/a:adobe:flash_player:15.0.0.144

CVE-2014-0556

2014-09-09T21:55:08.870-04:00

2017-08-28T21:34:12.060-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov MISC http://googleprojectzero.blogspot.com/2014/09/exploiting-cve-2014-0556-in-flash.html CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-21.html SUSE openSUSE-SU-2014:1110 SUSE SUSE-SU-2014:1124 SUSE openSUSE-SU-2014:1130 MISC http://packetstormsecurity.com/files/131516/Adobe-Flash-Player-copyPixelsToByteArray-Integer-Overflow.html SECUNIA 61089 GENTOO GLSA-201409-05 BID 69696 SECTRACK 1030822 MISC https://code.google.com/p/google-security-research/issues/detail?id=46 XF adobe-flash-cve20140556-bo(95826) EXPLOIT-DB 36808 Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0559.

cpe:/a:adobe:adobe_air:13.0.0.83 cpe:/a:adobe:adobe_air:13.0.0.111 cpe:/a:adobe:adobe_air:14.0.0.110 cpe:/a:adobe:adobe_air:14.0.0.137 cpe:/a:adobe:adobe_air:14.0.0.178 cpe:/a:adobe:adobe_air:14.0.0.179 cpe:/a:adobe:adobe_air_sdk:13.0.0.83 cpe:/a:adobe:adobe_air_sdk:13.0.0.111 cpe:/a:adobe:adobe_air_sdk:14.0.0.110 cpe:/a:adobe:adobe_air_sdk:14.0.0.137 cpe:/a:adobe:adobe_air_sdk:14.0.0.178 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:11.2.202.400 cpe:/a:adobe:flash_player:13.0.0.182 cpe:/a:adobe:flash_player:13.0.0.201 cpe:/a:adobe:flash_player:13.0.0.206 cpe:/a:adobe:flash_player:13.0.0.214 cpe:/a:adobe:flash_player:13.0.0.223 cpe:/a:adobe:flash_player:13.0.0.231 cpe:/a:adobe:flash_player:13.0.0.241 cpe:/a:adobe:flash_player:14.0.0.125 cpe:/a:adobe:flash_player:14.0.0.145 cpe:/a:adobe:flash_player:14.0.0.176 cpe:/a:adobe:flash_player:14.0.0.179 cpe:/a:adobe:flash_player:15.0.0.144

CVE-2014-0557

2014-09-09T21:55:08.933-04:00

2017-08-28T21:34:12.153-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-21.html SUSE openSUSE-SU-2014:1110 SUSE SUSE-SU-2014:1124 SUSE openSUSE-SU-2014:1130 SECUNIA 61089 GENTOO GLSA-201409-05 BID 69701 SECTRACK 1030822 XF adobe-flash-cve20140557-sec-bypass(95827) Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors.

cpe:/a:adobe:adobe_air:13.0.0.83 cpe:/a:adobe:adobe_air:13.0.0.111 cpe:/a:adobe:adobe_air:14.0.0.110 cpe:/a:adobe:adobe_air:14.0.0.137 cpe:/a:adobe:adobe_air:14.0.0.178 cpe:/a:adobe:adobe_air:14.0.0.179 cpe:/a:adobe:adobe_air:15.0.0.249 cpe:/a:adobe:adobe_air:15.0.0.252 cpe:/a:adobe:adobe_air_sdk:13.0.0.83 cpe:/a:adobe:adobe_air_sdk:13.0.0.111 cpe:/a:adobe:adobe_air_sdk:14.0.0.110 cpe:/a:adobe:adobe_air_sdk:14.0.0.137 cpe:/a:adobe:adobe_air_sdk:14.0.0.178 cpe:/a:adobe:adobe_air_sdk:15.0.0.249 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:11.2.202.400 cpe:/a:adobe:flash_player:11.2.202.406 cpe:/a:adobe:flash_player:13.0.0.182 cpe:/a:adobe:flash_player:13.0.0.201 cpe:/a:adobe:flash_player:13.0.0.206 cpe:/a:adobe:flash_player:13.0.0.214 cpe:/a:adobe:flash_player:13.0.0.223 cpe:/a:adobe:flash_player:13.0.0.231 cpe:/a:adobe:flash_player:13.0.0.241 cpe:/a:adobe:flash_player:13.0.0.244 cpe:/a:adobe:flash_player:14.0.0.125 cpe:/a:adobe:flash_player:14.0.0.145 cpe:/a:adobe:flash_player:14.0.0.176 cpe:/a:adobe:flash_player:14.0.0.179 cpe:/a:adobe:flash_player:15.0.0.144 cpe:/a:adobe:flash_player:15.0.0.152

CVE-2014-0558

2014-10-15T06:55:06.083-04:00

2017-01-02T21:59:02.343-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-22.html SUSE SUSE-SU-2014:1360 SUSE openSUSE-SU-2015:0725 SUSE openSUSE-SU-2014:1329 REDHAT RHSA-2014:1648 SECTRACK 1031019 Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0564.

cpe:/a:adobe:adobe_air:13.0.0.83 cpe:/a:adobe:adobe_air:13.0.0.111 cpe:/a:adobe:adobe_air:14.0.0.110 cpe:/a:adobe:adobe_air:14.0.0.137 cpe:/a:adobe:adobe_air:14.0.0.178 cpe:/a:adobe:adobe_air:14.0.0.179 cpe:/a:adobe:adobe_air_sdk:13.0.0.83 cpe:/a:adobe:adobe_air_sdk:13.0.0.111 cpe:/a:adobe:adobe_air_sdk:14.0.0.110 cpe:/a:adobe:adobe_air_sdk:14.0.0.137 cpe:/a:adobe:adobe_air_sdk:14.0.0.178 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:11.2.202.400 cpe:/a:adobe:flash_player:13.0.0.182 cpe:/a:adobe:flash_player:13.0.0.201 cpe:/a:adobe:flash_player:13.0.0.206 cpe:/a:adobe:flash_player:13.0.0.214 cpe:/a:adobe:flash_player:13.0.0.223 cpe:/a:adobe:flash_player:13.0.0.231 cpe:/a:adobe:flash_player:13.0.0.241 cpe:/a:adobe:flash_player:14.0.0.125 cpe:/a:adobe:flash_player:14.0.0.145 cpe:/a:adobe:flash_player:14.0.0.176 cpe:/a:adobe:flash_player:14.0.0.179 cpe:/a:adobe:flash_player:15.0.0.144

CVE-2014-0559

2014-09-09T21:55:09.013-04:00

2017-08-28T21:34:12.310-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-21.html SUSE openSUSE-SU-2014:1110 SUSE SUSE-SU-2014:1124 SUSE openSUSE-SU-2014:1130 SECUNIA 61089 GENTOO GLSA-201409-05 BID 69704 SECTRACK 1030822 XF adobe-flash-cve20140559-bo(95828) Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0556.

cpe:/a:adobe:acrobat:10.0 cpe:/a:adobe:acrobat:10.0:-:pro cpe:/a:adobe:acrobat:10.0.1 cpe:/a:adobe:acrobat:10.0.1:-:pro cpe:/a:adobe:acrobat:10.0.2 cpe:/a:adobe:acrobat:10.0.3 cpe:/a:adobe:acrobat:10.1 cpe:/a:adobe:acrobat:10.1.1 cpe:/a:adobe:acrobat:10.1.2 cpe:/a:adobe:acrobat:10.1.3 cpe:/a:adobe:acrobat:10.1.4 cpe:/a:adobe:acrobat:10.1.5 cpe:/a:adobe:acrobat:10.1.6 cpe:/a:adobe:acrobat:10.1.7 cpe:/a:adobe:acrobat:10.1.8 cpe:/a:adobe:acrobat:10.1.9 cpe:/a:adobe:acrobat:10.1.10 cpe:/a:adobe:acrobat:10.1.11 cpe:/a:adobe:acrobat:11.0 cpe:/a:adobe:acrobat:11.0.1 cpe:/a:adobe:acrobat:11.0.2 cpe:/a:adobe:acrobat:11.0.3 cpe:/a:adobe:acrobat:11.0.4 cpe:/a:adobe:acrobat:11.0.5:-:~~~windows~~ cpe:/a:adobe:acrobat:11.0.6 cpe:/a:adobe:acrobat:11.0.7 cpe:/a:adobe:acrobat:11.0.8 cpe:/a:adobe:acrobat_reader:10.0 cpe:/a:adobe:acrobat_reader:10.0.1 cpe:/a:adobe:acrobat_reader:10.0.2 cpe:/a:adobe:acrobat_reader:10.0.3 cpe:/a:adobe:acrobat_reader:10.1 cpe:/a:adobe:acrobat_reader:10.1.1 cpe:/a:adobe:acrobat_reader:10.1.2 cpe:/a:adobe:acrobat_reader:10.1.3 cpe:/a:adobe:acrobat_reader:10.1.4 cpe:/a:adobe:acrobat_reader:10.1.5 cpe:/a:adobe:acrobat_reader:10.1.6 cpe:/a:adobe:acrobat_reader:10.1.7 cpe:/a:adobe:acrobat_reader:10.1.8 cpe:/a:adobe:acrobat_reader:10.1.9 cpe:/a:adobe:acrobat_reader:10.1.10 cpe:/a:adobe:acrobat_reader:10.1.11 cpe:/a:adobe:acrobat_reader:11.0 cpe:/a:adobe:acrobat_reader:11.0.1 cpe:/a:adobe:acrobat_reader:11.0.2 cpe:/a:adobe:acrobat_reader:11.0.3 cpe:/a:adobe:acrobat_reader:11.0.4 cpe:/a:adobe:acrobat_reader:11.0.5:-:~~~windows~~ cpe:/a:adobe:acrobat_reader:11.0.6 cpe:/a:adobe:acrobat_reader:11.0.7 cpe:/a:adobe:acrobat_reader:11.0.8

CVE-2014-0560

2014-09-17T06:55:06.573-04:00

2017-08-28T21:34:12.387-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/reader/apsb14-20.html BID 69823 SECTRACK 1030853 XF adobe-reader-cve20140560-code-exec(96001) Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.

CVE-2014-0561

2014-09-17T06:55:06.653-04:00

2017-08-28T21:34:12.467-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/reader/apsb14-20.html BID 69821 SECTRACK 1030853 XF adobe-reader-cve20140561-bo(95996) Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0567.

CVE-2014-0562

2014-09-17T06:55:06.683-04:00

2017-08-28T21:34:12.530-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/reader/apsb14-20.html BID 69822 SECTRACK 1030853 XF adobe-reader-cve20140562-xss(95997) Cross-site scripting (XSS) vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on OS X allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)."

CVE-2014-0563

2014-09-17T06:55:06.730-04:00

2017-08-28T21:34:12.590-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/reader/apsb14-20.html BID 69826 SECTRACK 1030853 XF adobe-reader-cve20140563-code-exec(95998) Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allow attackers to cause a denial of service (memory corruption) via unspecified vectors.

cpe:/a:adobe:adobe_air:13.0.0.83 cpe:/a:adobe:adobe_air:13.0.0.111 cpe:/a:adobe:adobe_air:14.0.0.110 cpe:/a:adobe:adobe_air:14.0.0.137 cpe:/a:adobe:adobe_air:14.0.0.178 cpe:/a:adobe:adobe_air:14.0.0.179 cpe:/a:adobe:adobe_air:15.0.0.249 cpe:/a:adobe:adobe_air:15.0.0.252 cpe:/a:adobe:adobe_air_sdk:13.0.0.83 cpe:/a:adobe:adobe_air_sdk:13.0.0.111 cpe:/a:adobe:adobe_air_sdk:14.0.0.110 cpe:/a:adobe:adobe_air_sdk:14.0.0.137 cpe:/a:adobe:adobe_air_sdk:14.0.0.178 cpe:/a:adobe:adobe_air_sdk:15.0.0.249 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:11.2.202.400 cpe:/a:adobe:flash_player:11.2.202.406 cpe:/a:adobe:flash_player:13.0.0.182 cpe:/a:adobe:flash_player:13.0.0.201 cpe:/a:adobe:flash_player:13.0.0.206 cpe:/a:adobe:flash_player:13.0.0.214 cpe:/a:adobe:flash_player:13.0.0.223 cpe:/a:adobe:flash_player:13.0.0.231 cpe:/a:adobe:flash_player:13.0.0.241 cpe:/a:adobe:flash_player:13.0.0.244 cpe:/a:adobe:flash_player:14.0.0.125 cpe:/a:adobe:flash_player:14.0.0.145 cpe:/a:adobe:flash_player:14.0.0.176 cpe:/a:adobe:flash_player:14.0.0.179 cpe:/a:adobe:flash_player:15.0.0.144 cpe:/a:adobe:flash_player:15.0.0.152

CVE-2014-0564

2014-10-15T06:55:06.130-04:00

2017-01-02T21:59:02.437-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

CVE-2014-0565

2014-09-17T06:55:06.777-04:00

2017-08-28T21:34:12.670-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/reader/apsb14-20.html BID 69824 SECTRACK 1030853 XF adobe-reader-cve20140565-code-exec(96002) Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0566.

cpe:/a:adobe:acrobat:10.0 cpe:/a:adobe:acrobat:10.0:-:pro cpe:/a:adobe:acrobat:10.0.1 cpe:/a:adobe:acrobat:10.0.1:-:pro cpe:/a:adobe:acrobat:10.0.2 cpe:/a:adobe:acrobat:10.0.3 cpe:/a:adobe:acrobat:10.1 cpe:/a:adobe:acrobat:10.1.1 cpe:/a:adobe:acrobat:10.1.2 cpe:/a:adobe:acrobat:10.1.3 cpe:/a:adobe:acrobat:10.1.4 cpe:/a:adobe:acrobat:10.1.5 cpe:/a:adobe:acrobat:10.1.6 cpe:/a:adobe:acrobat:10.1.7 cpe:/a:adobe:acrobat:10.1.8 cpe:/a:adobe:acrobat:10.1.9 cpe:/a:adobe:acrobat:10.1.10 cpe:/a:adobe:acrobat:10.1.11 cpe:/a:adobe:acrobat:11.0 cpe:/a:adobe:acrobat:11.0.1 cpe:/a:adobe:acrobat:11.0.2 cpe:/a:adobe:acrobat:11.0.3 cpe:/a:adobe:acrobat:11.0.4 cpe:/a:adobe:acrobat:11.0.5:-:~~~windows~~ cpe:/a:adobe:acrobat:11.0.6 cpe:/a:adobe:acrobat:11.0.7 cpe:/a:adobe:acrobat:11.0.8 cpe:/a:adobe:acrobat_dc:2015.006.30033::~~classic~~~ cpe:/a:adobe:acrobat_dc:2015.007.20033::~~continuous~~~ cpe:/a:adobe:acrobat_reader:10.0 cpe:/a:adobe:acrobat_reader:10.0.1 cpe:/a:adobe:acrobat_reader:10.0.2 cpe:/a:adobe:acrobat_reader:10.0.3 cpe:/a:adobe:acrobat_reader:10.1 cpe:/a:adobe:acrobat_reader:10.1.1 cpe:/a:adobe:acrobat_reader:10.1.2 cpe:/a:adobe:acrobat_reader:10.1.3 cpe:/a:adobe:acrobat_reader:10.1.4 cpe:/a:adobe:acrobat_reader:10.1.5 cpe:/a:adobe:acrobat_reader:10.1.6 cpe:/a:adobe:acrobat_reader:10.1.7 cpe:/a:adobe:acrobat_reader:10.1.8 cpe:/a:adobe:acrobat_reader:10.1.9 cpe:/a:adobe:acrobat_reader:10.1.10 cpe:/a:adobe:acrobat_reader:10.1.11 cpe:/a:adobe:acrobat_reader:11.0 cpe:/a:adobe:acrobat_reader:11.0.1 cpe:/a:adobe:acrobat_reader:11.0.2 cpe:/a:adobe:acrobat_reader:11.0.3 cpe:/a:adobe:acrobat_reader:11.0.4 cpe:/a:adobe:acrobat_reader:11.0.5:-:~~~windows~~ cpe:/a:adobe:acrobat_reader:11.0.6 cpe:/a:adobe:acrobat_reader:11.0.7 cpe:/a:adobe:acrobat_reader:11.0.8 cpe:/a:adobe:acrobat_reader_dc:2015.006.30033::~~classic~~~ cpe:/a:adobe:acrobat_reader_dc:2015.007.20033::~~continuous~~~

CVE-2014-0566

2014-09-17T06:55:06.823-04:00

2017-09-21T21:29:00.657-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/reader/apsb14-20.html BID 69825 SECTRACK 1030853 SECTRACK 1032892 XF adobe-reader-cve20140566-code-exec(96003) CONFIRM https://helpx.adobe.com/security/products/reader/apsb15-15.html Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0565.

CVE-2014-0567

2014-09-17T06:55:06.870-04:00

2017-08-28T21:34:12.840-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/reader/apsb14-20.html BID 69827 SECTRACK 1030853 XF adobe-reader-cve20140567-bo(95999) Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0561.

CVE-2014-0568

2014-09-17T06:55:06.917-04:00

2017-08-28T21:34:12.937-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/reader/apsb14-20.html BID 69828 SECTRACK 1030853 MISC https://code.google.com/p/google-security-research/issues/detail?id=94 XF adobe-reader-cve20140568-sec-bypass(96000) The NtSetInformationFile system call hook feature in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows allows attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context, via an NTFS junction attack.

cpe:/a:adobe:adobe_air:13.0.0.83 cpe:/a:adobe:adobe_air:13.0.0.111 cpe:/a:adobe:adobe_air:14.0.0.110 cpe:/a:adobe:adobe_air:14.0.0.137 cpe:/a:adobe:adobe_air:14.0.0.178 cpe:/a:adobe:adobe_air:14.0.0.179 cpe:/a:adobe:adobe_air:15.0.0.249 cpe:/a:adobe:adobe_air:15.0.0.252 cpe:/a:adobe:adobe_air_sdk:13.0.0.83 cpe:/a:adobe:adobe_air_sdk:13.0.0.111 cpe:/a:adobe:adobe_air_sdk:14.0.0.110 cpe:/a:adobe:adobe_air_sdk:14.0.0.137 cpe:/a:adobe:adobe_air_sdk:14.0.0.178 cpe:/a:adobe:adobe_air_sdk:15.0.0.249 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:11.2.202.400 cpe:/a:adobe:flash_player:11.2.202.406 cpe:/a:adobe:flash_player:13.0.0.182 cpe:/a:adobe:flash_player:13.0.0.201 cpe:/a:adobe:flash_player:13.0.0.206 cpe:/a:adobe:flash_player:13.0.0.214 cpe:/a:adobe:flash_player:13.0.0.223 cpe:/a:adobe:flash_player:13.0.0.231 cpe:/a:adobe:flash_player:13.0.0.241 cpe:/a:adobe:flash_player:13.0.0.244 cpe:/a:adobe:flash_player:14.0.0.125 cpe:/a:adobe:flash_player:14.0.0.145 cpe:/a:adobe:flash_player:14.0.0.176 cpe:/a:adobe:flash_player:14.0.0.179 cpe:/a:adobe:flash_player:15.0.0.144 cpe:/a:adobe:flash_player:15.0.0.152

CVE-2014-0569

2014-10-15T06:55:06.193-04:00

2017-10-06T21:29:00.257-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-22.html SUSE SUSE-SU-2014:1360 SUSE openSUSE-SU-2015:0725 SUSE openSUSE-SU-2014:1329 REDHAT RHSA-2014:1648 BID 70441 SECTRACK 1031019 MISC http://www.zerodayinitiative.com/advisories/ZDI-14-365/ Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allows attackers to execute arbitrary code via unspecified vectors.

cpe:/a:adobe:coldfusion:9.0 cpe:/a:adobe:coldfusion:9.0:update_10 cpe:/a:adobe:coldfusion:9.0:update_12 cpe:/a:adobe:coldfusion:9.0.1 cpe:/a:adobe:coldfusion:9.0.1:update_11 cpe:/a:adobe:coldfusion:9.0.1:update_9 cpe:/a:adobe:coldfusion:9.0.2 cpe:/a:adobe:coldfusion:9.0.2:update_4 cpe:/a:adobe:coldfusion:9.0.2:update_6 cpe:/a:adobe:coldfusion:10.0 cpe:/a:adobe:coldfusion:10.0:update_1 cpe:/a:adobe:coldfusion:10.0:update_11 cpe:/a:adobe:coldfusion:10.0:update_12 cpe:/a:adobe:coldfusion:10.0:update_2 cpe:/a:adobe:coldfusion:10.0:update_3 cpe:/a:adobe:coldfusion:10.0:update_4 cpe:/a:adobe:coldfusion:10.0:update_8 cpe:/a:adobe:coldfusion:11.0

CVE-2014-0570

2014-10-15T06:55:06.240-04:00

2014-11-18T21:59:48.027-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/coldfusion/apsb14-23.html SECTRACK 1031020 Cross-site request forgery (CSRF) vulnerability in Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2014-0571

2014-10-15T06:55:06.287-04:00

2014-11-18T21:59:49.387-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/coldfusion/apsb14-23.html SECTRACK 1031020 Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2014-0572

2014-10-15T06:55:06.347-04:00

2014-11-18T21:59:50.620-05:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://helpx.adobe.com/security/products/coldfusion/apsb14-23.html SECTRACK 1031020 Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2 allows local users to bypass intended IP-based access restrictions via unspecified vectors.

cpe:/a:adobe:air:15.0.0.356 cpe:/a:adobe:air_sdk:15.0.0.356 cpe:/a:adobe:air_sdk_%26_compiler:3.6.0.6090 cpe:/a:adobe:air_sdk_%26_compiler:3.7.0.2090 cpe:/a:adobe:air_sdk_%26_compiler:3.7.0.2100 cpe:/a:adobe:air_sdk_%26_compiler:3.8.0.1430 cpe:/a:adobe:air_sdk_%26_compiler:3.9.0.1380 cpe:/a:adobe:air_sdk_%26_compiler:4.0.0.1628 cpe:/a:adobe:air_sdk_%26_compiler:13.0.0.111 cpe:/a:adobe:air_sdk_%26_compiler:14.0.0.178 cpe:/a:adobe:air_sdk_%26_compiler:15.0.0.302 cpe:/a:adobe:flash_player:11.0 cpe:/a:adobe:flash_player:11.0.1.152 cpe:/a:adobe:flash_player:11.0.1.152::~~~~x64~ cpe:/a:adobe:flash_player:11.0.1.153 cpe:/a:adobe:flash_player:11.1 cpe:/a:adobe:flash_player:11.1.102.55 cpe:/a:adobe:flash_player:11.1.102.55::~~~~x64~ cpe:/a:adobe:flash_player:11.1.102.59 cpe:/a:adobe:flash_player:11.1.102.62 cpe:/a:adobe:flash_player:11.1.102.63 cpe:/a:adobe:flash_player:11.1.111.8 cpe:/a:adobe:flash_player:11.1.111.13 cpe:/a:adobe:flash_player:11.1.111.44 cpe:/a:adobe:flash_player:11.1.111.50 cpe:/a:adobe:flash_player:11.1.111.54 cpe:/a:adobe:flash_player:11.1.111.64 cpe:/a:adobe:flash_player:11.1.111.73 cpe:/a:adobe:flash_player:11.1.115.7 cpe:/a:adobe:flash_player:11.1.115.34 cpe:/a:adobe:flash_player:11.1.115.48 cpe:/a:adobe:flash_player:11.1.115.54 cpe:/a:adobe:flash_player:11.1.115.58 cpe:/a:adobe:flash_player:11.1.115.59 cpe:/a:adobe:flash_player:11.1.115.63 cpe:/a:adobe:flash_player:11.1.115.69 cpe:/a:adobe:flash_player:11.1.115.81 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.327 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:11.2.202.400 cpe:/a:adobe:flash_player:11.2.202.406 cpe:/a:adobe:flash_player:11.2.202.411 cpe:/a:adobe:flash_player:13.0::~~esr~~~ cpe:/a:adobe:flash_player:13.0.0.182 cpe:/a:adobe:flash_player:13.0.0.201 cpe:/a:adobe:flash_player:13.0.0.206 cpe:/a:adobe:flash_player:13.0.0.214 cpe:/a:adobe:flash_player:13.0.0.223 cpe:/a:adobe:flash_player:13.0.0.231 cpe:/a:adobe:flash_player:13.0.0.241 cpe:/a:adobe:flash_player:13.0.0.244 cpe:/a:adobe:flash_player:13.0.0.250 cpe:/a:adobe:flash_player:14.0.0.125 cpe:/a:adobe:flash_player:14.0.0.145 cpe:/a:adobe:flash_player:14.0.0.176 cpe:/a:adobe:flash_player:14.0.0.179 cpe:/a:adobe:flash_player:15.0.0.152 cpe:/a:adobe:flash_player:15.0.0.167 cpe:/a:adobe:flash_player:15.0.0.189

CVE-2014-0573

2014-11-11T18:55:01.767-05:00

2018-12-13T11:59:08.073-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-12T09:56:19.043-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-24.html SUSE openSUSE-SU-2015:0725 Use-after-free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0588 and CVE-2014-8438.

CVE-2014-0574

2014-11-11T18:55:01.893-05:00

2018-12-13T12:09:57.413-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-12T09:56:27.467-05:00

CONFIRM http://googlechromereleases.blogspot.com/2014/11/stable-channel-update_18.html CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-24.html SUSE openSUSE-SU-2015:0725 CONFIRM https://code.google.com/p/chromium/issues/detail?id=423703 Double free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors.

CVE-2014-0575

2017-05-11T10:29:33.137-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.

CVE-2014-0576

2014-11-11T18:55:01.987-05:00

2018-12-13T12:10:07.723-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-12T09:56:44.403-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-24.html SUSE openSUSE-SU-2015:0725 Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0581, CVE-2014-8440, and CVE-2014-8441.

CVE-2014-0577

2014-11-11T18:55:02.110-05:00

2018-12-13T12:10:15.787-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-12T10:25:02.533-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-24.html SUSE openSUSE-SU-2015:0725 Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2014-0584, CVE-2014-0585, CVE-2014-0586, and CVE-2014-0590.

cpe:/a:adobe:air:18.0.0.144 cpe:/a:adobe:air_sdk:18.0.0.144 cpe:/a:adobe:air_sdk_%26_compiler:18.0.0.144 cpe:/a:adobe:flash_player:11.2.202.468 cpe:/a:adobe:flash_player:13.0.0.289 cpe:/a:adobe:flash_player:14.0.0.125 cpe:/a:adobe:flash_player:14.0.0.145 cpe:/a:adobe:flash_player:14.0.0.176 cpe:/a:adobe:flash_player:14.0.0.179 cpe:/a:adobe:flash_player:15.0.0.152 cpe:/a:adobe:flash_player:15.0.0.167 cpe:/a:adobe:flash_player:15.0.0.189 cpe:/a:adobe:flash_player:15.0.0.223 cpe:/a:adobe:flash_player:15.0.0.239 cpe:/a:adobe:flash_player:15.0.0.246 cpe:/a:adobe:flash_player:16.0.0.235 cpe:/a:adobe:flash_player:16.0.0.257 cpe:/a:adobe:flash_player:16.0.0.287 cpe:/a:adobe:flash_player:16.0.0.296 cpe:/a:adobe:flash_player:17.0.0.134 cpe:/a:adobe:flash_player:17.0.0.169 cpe:/a:adobe:flash_player:17.0.0.188 cpe:/a:adobe:flash_player:17.0.0.190 cpe:/a:adobe:flash_player:18.0.0.160 cpe:/a:adobe:flash_player:18.0.0.194

CVE-2014-0578

2015-07-09T12:59:00.087-04:00

2017-09-21T21:29:00.733-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov SUSE SUSE-SU-2015:1211 SUSE SUSE-SU-2015:1214 REDHAT RHSA-2015:1214 BID 75594 SECTRACK 1032810 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb15-16.html GENTOO GLSA-201507-13 Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-3115, CVE-2015-3116, CVE-2015-3125, and CVE-2015-5116.

CVE-2014-0579

2017-05-11T10:29:33.170-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.

cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.2.202.275 cpe:/a:adobe:flash_player:11.2.202.280 cpe:/a:adobe:flash_player:11.2.202.285 cpe:/a:adobe:flash_player:11.2.202.291 cpe:/a:adobe:flash_player:11.2.202.297 cpe:/a:adobe:flash_player:11.2.202.310 cpe:/a:adobe:flash_player:11.2.202.327 cpe:/a:adobe:flash_player:11.2.202.332 cpe:/a:adobe:flash_player:11.2.202.335 cpe:/a:adobe:flash_player:11.2.202.336 cpe:/a:adobe:flash_player:11.2.202.341 cpe:/a:adobe:flash_player:11.2.202.346 cpe:/a:adobe:flash_player:11.2.202.350 cpe:/a:adobe:flash_player:11.2.202.356 cpe:/a:adobe:flash_player:11.2.202.359 cpe:/a:adobe:flash_player:11.2.202.378 cpe:/a:adobe:flash_player:11.2.202.394 cpe:/a:adobe:flash_player:11.2.202.400 cpe:/a:adobe:flash_player:11.2.202.406 cpe:/a:adobe:flash_player:11.2.202.411 cpe:/a:adobe:flash_player:11.2.202.418 cpe:/a:adobe:flash_player:11.2.202.424 cpe:/a:adobe:flash_player:13.0::~~esr~~~ cpe:/a:adobe:flash_player:13.0.0.182 cpe:/a:adobe:flash_player:13.0.0.201 cpe:/a:adobe:flash_player:13.0.0.206 cpe:/a:adobe:flash_player:13.0.0.214 cpe:/a:adobe:flash_player:13.0.0.223 cpe:/a:adobe:flash_player:13.0.0.231 cpe:/a:adobe:flash_player:13.0.0.241 cpe:/a:adobe:flash_player:13.0.0.244 cpe:/a:adobe:flash_player:13.0.0.250 cpe:/a:adobe:flash_player:13.0.0.252 cpe:/a:adobe:flash_player:13.0.0.258 cpe:/a:adobe:flash_player:14.0.0.125 cpe:/a:adobe:flash_player:14.0.0.145 cpe:/a:adobe:flash_player:14.0.0.176 cpe:/a:adobe:flash_player:14.0.0.179 cpe:/a:adobe:flash_player:16.0.0.234

CVE-2014-0580

2014-12-10T16:59:00.070-05:00

2018-12-13T12:15:21.933-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-12T10:39:25.687-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-27.html Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows remote attackers to bypass the Same Origin Policy via unspecified vectors.

CVE-2014-0581

2014-11-11T18:55:02.173-05:00

2018-12-13T12:10:22.773-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-12T10:25:31.613-05:00

CVE-2014-0582

2014-11-11T18:55:02.220-05:00

2018-12-13T12:10:52.023-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-12T10:26:13.020-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-24.html SUSE openSUSE-SU-2015:0725 BID 71039 Heap-based buffer overflow in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0589.

CVE-2014-0583

2014-11-11T18:55:02.267-05:00

2018-12-13T12:11:09.647-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2018-12-12T10:26:35.960-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-24.html SUSE openSUSE-SU-2015:0725 BID 71035 Heap-based buffer overflow in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to complete a transition from Low Integrity to Medium Integrity via unspecified vectors.

CVE-2014-0584

2014-11-11T18:55:02.313-05:00

2018-12-13T12:11:24.647-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-12T10:26:45.007-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-24.html SUSE openSUSE-SU-2015:0725 Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2014-0577, CVE-2014-0585, CVE-2014-0586, and CVE-2014-0590.

CVE-2014-0585

2014-11-11T18:55:02.360-05:00

2018-12-13T12:11:34.820-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-12T10:26:57.087-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-24.html SUSE openSUSE-SU-2015:0725 Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2014-0577, CVE-2014-0584, CVE-2014-0586, and CVE-2014-0590.

CVE-2014-0586

2014-11-11T18:55:02.407-05:00

2018-12-13T12:11:43.587-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-12T10:33:36.160-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-24.html SUSE openSUSE-SU-2015:0725 Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2014-0577, CVE-2014-0584, CVE-2014-0585, and CVE-2014-0590.

CVE-2014-0587

2014-12-10T16:59:01.257-05:00

2018-12-13T12:16:35.730-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-12T10:39:32.343-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-27.html Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-9164.

CVE-2014-0588

2014-11-11T18:55:02.457-05:00

2018-12-13T12:11:51.180-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-12T10:31:17.033-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-24.html SUSE openSUSE-SU-2015:0725 IDEFENSE 20141112 Adobe Flash Player Byte Array Uncompress Use-after-Free Vulnerability Use-after-free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0573 and CVE-2014-8438.

CVE-2014-0589

2014-11-11T18:55:02.503-05:00

2018-12-13T12:12:00.803-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-12T10:31:40.270-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-24.html SUSE openSUSE-SU-2015:0725 BID 71051 Heap-based buffer overflow in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0582.

CVE-2014-0590

2014-11-11T18:55:02.550-05:00

2018-12-13T12:13:25.243-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-12T10:31:55.820-05:00

CONFIRM http://helpx.adobe.com/security/products/flash-player/apsb14-24.html SUSE openSUSE-SU-2015:0725 Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2014-0577, CVE-2014-0584, CVE-2014-0585, and CVE-2014-0586.

cpe:/a:isc:bind:9.6 cpe:/a:isc:bind:9.6:r5_p1 cpe:/a:isc:bind:9.6:r6_b1 cpe:/a:isc:bind:9.6:r6_rc1 cpe:/a:isc:bind:9.6:r6_rc2 cpe:/a:isc:bind:9.6:r7_p1 cpe:/a:isc:bind:9.6:r7_p2 cpe:/a:isc:bind:9.6:r9_p1 cpe:/a:isc:bind:9.6.0 cpe:/a:isc:bind:9.6.0:p1 cpe:/a:isc:bind:9.6.0:rc1 cpe:/a:isc:bind:9.6.0:rc2 cpe:/a:isc:bind:9.6.1 cpe:/a:isc:bind:9.6.1:p1 cpe:/a:isc:bind:9.6.1:p2 cpe:/a:isc:bind:9.6.1:p3 cpe:/a:isc:bind:9.6.1:rc1 cpe:/a:isc:bind:9.6.2 cpe:/a:isc:bind:9.6.2:rc1 cpe:/a:isc:bind:9.6.3 cpe:/a:isc:bind:9.6.3:rc1 cpe:/a:isc:bind:9.7.0 cpe:/a:isc:bind:9.7.0:b1 cpe:/a:isc:bind:9.7.0:p1 cpe:/a:isc:bind:9.7.0:p2 cpe:/a:isc:bind:9.7.0:rc1 cpe:/a:isc:bind:9.7.0:rc2 cpe:/a:isc:bind:9.7.1 cpe:/a:isc:bind:9.7.1:p1 cpe:/a:isc:bind:9.7.1:p2 cpe:/a:isc:bind:9.7.1:rc1 cpe:/a:isc:bind:9.7.2 cpe:/a:isc:bind:9.7.2:p1 cpe:/a:isc:bind:9.7.2:p2 cpe:/a:isc:bind:9.7.2:p3 cpe:/a:isc:bind:9.7.2:rc1 cpe:/a:isc:bind:9.7.3 cpe:/a:isc:bind:9.7.3:b1 cpe:/a:isc:bind:9.7.3:p1 cpe:/a:isc:bind:9.7.3:rc1 cpe:/a:isc:bind:9.7.4 cpe:/a:isc:bind:9.7.4:b1 cpe:/a:isc:bind:9.7.4:p1 cpe:/a:isc:bind:9.7.4:rc1 cpe:/a:isc:bind:9.7.5 cpe:/a:isc:bind:9.7.5:b1 cpe:/a:isc:bind:9.7.5:rc1 cpe:/a:isc:bind:9.7.5:rc2 cpe:/a:isc:bind:9.7.6 cpe:/a:isc:bind:9.7.6:p1 cpe:/a:isc:bind:9.7.6:p2 cpe:/a:isc:bind:9.7.7 cpe:/a:isc:bind:9.8.0 cpe:/a:isc:bind:9.8.0:a1 cpe:/a:isc:bind:9.8.0:b1 cpe:/a:isc:bind:9.8.0:p1 cpe:/a:isc:bind:9.8.0:p2 cpe:/a:isc:bind:9.8.0:p4 cpe:/a:isc:bind:9.8.0:rc1 cpe:/a:isc:bind:9.8.1 cpe:/a:isc:bind:9.8.1:b1 cpe:/a:isc:bind:9.8.1:b2 cpe:/a:isc:bind:9.8.1:b3 cpe:/a:isc:bind:9.8.1:p1 cpe:/a:isc:bind:9.8.1:rc1 cpe:/a:isc:bind:9.8.2:b1 cpe:/a:isc:bind:9.8.2:rc1 cpe:/a:isc:bind:9.8.2:rc2 cpe:/a:isc:bind:9.8.3 cpe:/a:isc:bind:9.8.3:p1 cpe:/a:isc:bind:9.8.3:p2 cpe:/a:isc:bind:9.8.4 cpe:/a:isc:bind:9.8.5 cpe:/a:isc:bind:9.8.5:b1 cpe:/a:isc:bind:9.8.5:b2 cpe:/a:isc:bind:9.8.5:p1 cpe:/a:isc:bind:9.8.5:p2 cpe:/a:isc:bind:9.8.5:rc1 cpe:/a:isc:bind:9.8.5:rc2 cpe:/a:isc:bind:9.8.6 cpe:/a:isc:bind:9.8.6:b1 cpe:/a:isc:bind:9.8.6:p1 cpe:/a:isc:bind:9.8.6:rc1 cpe:/a:isc:bind:9.8.6:rc2 cpe:/a:isc:bind:9.9.4 cpe:/a:isc:bind:9.9.4:p1 cpe:/a:isc:bind:9.9.4:rc1 cpe:/a:isc:bind:9.9.4:rc2

CVE-2014-0591

2014-01-13T23:29:56.953-05:00

2018-10-30T12:27:02.577-04:00

2.6

NETWORK

HIGH

NONE

PARTIAL

http://nvd.nist.gov APPLE APPLE-SA-2014-10-16-3 CONFIRM http://linux.oracle.com/errata/ELSA-2014-1244 FEDORA FEDORA-2014-0858 FEDORA FEDORA-2014-0811 SUSE SUSE-SU-2015:0480 SUSE openSUSE-SU-2014:0199 SUSE openSUSE-SU-2014:0202 HP HPSBUX02961 REDHAT RHSA-2014:0043 SECUNIA 56871 SECUNIA 61117 SECUNIA 61199 SECUNIA 61343 DEBIAN DSA-3023 FREEBSD FreeBSD-SA-14:04 MANDRIVA MDVSA-2014:002 BID 64801 SECTRACK 1029589 SLACKWARE SSA:2014-175-01 SLACKWARE SSA:2014-028-01 UBUNTU USN-2081-1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1051717 CONFIRM https://kb.isc.org/article/AA-01078 CONFIRM https://kb.isc.org/article/AA-01085 CONFIRM https://support.apple.com/kb/HT6536 The query_findclosestnsec3 function in query.c in named in ISC BIND 9.6, 9.7, and 9.8 before 9.8.6-P2 and 9.9 before 9.9.4-P2, and 9.6-ESV before 9.6-ESV-R10-P2, allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a crafted DNS query to an authoritative nameserver that uses the NSEC3 signing feature.

cpe:/a:crowbar:barclamp:1.7 cpe:/a:novell:suse_cloud:3.0

CVE-2014-0592

2014-04-04T10:55:19.717-04:00

2014-04-04T12:20:45.747-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-04-04T12:20:39.887-04:00

SUSE SUSE-SU-2014:0452 BID 66519 CONFIRM https://bugzilla.novell.com/show_bug.cgi?id=864183 CONFIRM https://github.com/crowbar/barclamp-network/pull/269 Barclamp (aka barclamp-network) 1.7 for the Crowbar Framework, as used in SUSE Cloud 3, does not enable netfilter on bridges when creating new instances, which allows remote attackers to bypass security group restrictions via unspecified vectors, related to floating IPs.

CVE-2014-0593

2018-06-08T13:29:00.380-04:00

2019-10-09T19:09:34.397-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM https://bugzilla.suse.com/show_bug.cgi?id=866966 CONFIRM https://github.com/openSUSE/obs-service-set_version/commit/10d5bddcea29f74a175f7f550924bf6407e52e93 MLIST [opensuse-buildservice] 20140303 EXE package format CONFIRM https://www.suse.com/de-de/security/cve/CVE-2014-0593/ The set_version script as shipped with obs-service-set_version is a source validator for the Open Build Service (OBS). In versions prior to 0.5.3-1.1 this script did not properly sanitize the input provided by the user, allowing for code execution on the executing server.

cpe:/a:opensuse:open_build_service:0.2.3 cpe:/a:opensuse:open_build_service:0.4.0 cpe:/a:opensuse:open_build_service:0.4.2 cpe:/a:opensuse:open_build_service:0.5.0 cpe:/a:opensuse:open_build_service:0.5.1 cpe:/a:opensuse:open_build_service:0.5.2 cpe:/a:opensuse:open_build_service:0.5.3 cpe:/a:opensuse:open_build_service:0.6.0 cpe:/a:opensuse:open_build_service:0.7.0 cpe:/a:opensuse:open_build_service:0.8.0 cpe:/a:opensuse:open_build_service:0.9.0 cpe:/a:opensuse:open_build_service:0.9.1 cpe:/a:opensuse:open_build_service:0.9.2 cpe:/a:opensuse:open_build_service:0.9.3 cpe:/a:opensuse:open_build_service:0.9.4 cpe:/a:opensuse:open_build_service:0.9.5 cpe:/a:opensuse:open_build_service:1.7.0 cpe:/a:opensuse:open_build_service:1.7.2 cpe:/a:opensuse:open_build_service:1.7.3 cpe:/a:opensuse:open_build_service:1.7.4 cpe:/a:opensuse:open_build_service:1.7.5 cpe:/a:opensuse:open_build_service:1.7.6 cpe:/a:opensuse:open_build_service:1.7.7 cpe:/a:opensuse:open_build_service:1.9.90 cpe:/a:opensuse:open_build_service:1.9.91 cpe:/a:opensuse:open_build_service:1.9.92 cpe:/a:opensuse:open_build_service:2.0.0 cpe:/a:opensuse:open_build_service:2.0.1 cpe:/a:opensuse:open_build_service:2.0.2 cpe:/a:opensuse:open_build_service:2.0.3 cpe:/a:opensuse:open_build_service:2.0.4 cpe:/a:opensuse:open_build_service:2.0.5 cpe:/a:opensuse:open_build_service:2.0.6 cpe:/a:opensuse:open_build_service:2.0.7 cpe:/a:opensuse:open_build_service:2.0.8 cpe:/a:opensuse:open_build_service:2.0.16 cpe:/a:opensuse:open_build_service:2.0.103 cpe:/a:opensuse:open_build_service:2.0.104 cpe:/a:opensuse:open_build_service:2.0.106 cpe:/a:opensuse:open_build_service:2.1.0 cpe:/a:opensuse:open_build_service:2.1.1 cpe:/a:opensuse:open_build_service:2.1.2 cpe:/a:opensuse:open_build_service:2.1.3 cpe:/a:opensuse:open_build_service:2.1.4 cpe:/a:opensuse:open_build_service:2.1.5 cpe:/a:opensuse:open_build_service:2.1.5.1 cpe:/a:opensuse:open_build_service:2.1.6 cpe:/a:opensuse:open_build_service:2.1.7 cpe:/a:opensuse:open_build_service:2.1.8 cpe:/a:opensuse:open_build_service:2.1.8.1 cpe:/a:opensuse:open_build_service:2.1.9 cpe:/a:opensuse:open_build_service:2.1.10 cpe:/a:opensuse:open_build_service:2.1.11 cpe:/a:opensuse:open_build_service:2.1.12 cpe:/a:opensuse:open_build_service:2.1.13 cpe:/a:opensuse:open_build_service:2.1.14 cpe:/a:opensuse:open_build_service:2.1.15 cpe:/a:opensuse:open_build_service:2.1.16 cpe:/a:opensuse:open_build_service:2.1.17 cpe:/a:opensuse:open_build_service:2.3.0 cpe:/a:opensuse:open_build_service:2.3.1 cpe:/a:opensuse:open_build_service:2.3.1-7 cpe:/a:opensuse:open_build_service:2.3.2 cpe:/a:opensuse:open_build_service:2.3.3 cpe:/a:opensuse:open_build_service:2.3.4 cpe:/a:opensuse:open_build_service:2.3.4.1 cpe:/a:opensuse:open_build_service:2.3.5 cpe:/a:opensuse:open_build_service:2.3.6 cpe:/a:opensuse:open_build_service:2.3.7 cpe:/a:opensuse:open_build_service:2.3.8 cpe:/a:opensuse:open_build_service:2.3.60 cpe:/a:opensuse:open_build_service:2.3.90 cpe:/a:opensuse:open_build_service:2.3.91 cpe:/a:opensuse:open_build_service:2.3.95 cpe:/a:opensuse:open_build_service:2.3.96 cpe:/a:opensuse:open_build_service:2.3.97 cpe:/a:opensuse:open_build_service:2.4.0 cpe:/a:opensuse:open_build_service:2.4.1 cpe:/a:opensuse:open_build_service:2.4.2 cpe:/a:opensuse:open_build_service:2.4.3 cpe:/a:opensuse:open_build_service:2.4.4 cpe:/a:opensuse:open_build_service:2.4.5

CVE-2014-0594

2018-06-08T13:29:00.443-04:00

2019-10-09T19:09:34.523-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://bugzilla.suse.com/show_bug.cgi?id=870606 CONFIRM https://github.com/openSUSE/open-build-service/commit/2188c059b67b82171d0e28ef59f77e62d22a09d8 In the Open Build Service (OBS) before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent.

cpe:/a:novell:open_enterprise_server:11.0:sp2:~~~linux_kernel~~

CVE-2014-0595

2014-05-08T06:55:03.183-04:00

2017-12-21T21:29:13.073-05:00

2.6

LOCAL

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov SUSE SUSE-SU-2014:0847 CONFIRM http://www.novell.com/support/kb/doc.php?id=7014932 BID 67144 /opt/novell/ncl/bin/nwrights in Novell Client for Linux in Novell Open Enterprise Server (OES) 11 Linux SP2 does not properly manage a certain array, which allows local users to obtain the S permission in opportunistic circumstances by leveraging the granting of the F permission by an administrator.

cpe:/a:novell:open_enterprise_server:11.0:sp1:~~~linux_kernel~~

CVE-2014-0598

2014-06-18T13:55:06.443-04:00

2017-01-06T21:59:33.267-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 68066 CONFIRM https://bugzilla.novell.com/show_bug.cgi?id=869970 CONFIRM https://www.novell.com/support/kb/doc.php?id=7010867 Directory traversal vulnerability in iPrint in Novell Open Enterprise Server (OES) 11 SP1 before Maintenance Update 9151 on Linux has unspecified impact and remote attack vectors.

cpe:/a:novell:open_enterprise_server:11.0:sp1:~~~linux_kernel~~

CVE-2014-0599

2014-06-18T13:55:06.507-04:00

2014-06-21T00:38:43.877-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://bugzilla.novell.com/show_bug.cgi?id=869975 CONFIRM https://www.novell.com/support/kb/doc.php?id=7010867 Cross-site scripting (XSS) vulnerability in iPrint in Novell Open Enterprise Server (OES) 11 SP1 before Maintenance Update 9151 on Linux allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:novell:groupwise:2014

CVE-2014-0600

2014-08-29T05:55:07.337-04:00

2017-01-06T21:59:33.313-05:00

7.8

NETWORK

LOW

NONE

COMPLETE

NONE

http://nvd.nist.gov CONFIRM http://www.novell.com/support/kb/doc.php?id=7015566 SECTRACK 1030801 MISC http://www.zerodayinitiative.com/advisories/ZDI-14-296/ CONFIRM https://bugzilla.novell.com/show_bug.cgi?id=879192 FileUploadServlet in the Administration service in Novell GroupWise 2014 before SP1 allows remote attackers to read or write to arbitrary files via the poLibMaintenanceFileSave parameter, aka ZDI-CAN-2287.

cpe:/a:netiq:security_manager:6.5.4

CVE-2014-0602

2014-07-07T07:01:28.633-04:00

2014-07-08T21:18:17.897-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-07-07T12:07:43.467-04:00

CONFIRM https://www.netiq.com/support/kb/doc.php?id=7015309 Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in NetIQ Security Manager through 6.5.4 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-3460.

cpe:/a:attachmate:reflection_ftp_client:14.1.420

CVE-2014-0603

2015-02-06T06:59:00.060-05:00

2015-02-09T09:05:26.240-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2015-02-06T11:17:11.673-05:00

CONFIRM http://support.attachmate.com/techdocs/2501.html MISC http://www.zerodayinitiative.com/advisories/ZDI-14-288/ MISC http://www.zerodayinitiative.com/advisories/ZDI-14-291/ The rftpcom.dll ActiveX control in Attachmate Reflection FTP Client before 14.1.429 allows remote attackers to cause a denial of service (memory corruption) and execute arbitrary code via vectors related to the (1) GetGlobalSettings or (2) GetSiteProperties3 methods, which triggers a dereference of an arbitrary memory address. NOTE: this issue was MERGED with CVE-2014-0606 because it is the same type of vulnerability, affecting the same set of versions, and discovered by the same researcher.

cpe:/a:attachmate:reflection_ftp_client:14.1.420

CVE-2014-0604

2015-02-06T06:59:01.310-05:00

2015-02-09T09:05:52.383-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2015-02-06T11:13:34.393-05:00

CONFIRM http://support.attachmate.com/techdocs/2501.html MISC http://www.zerodayinitiative.com/advisories/ZDI-14-289/ Directory traversal vulnerability in the rftpcom.dll ActiveX control in Attachmate Reflection FTP Client before 14.1.429 allows remote attackers to execute arbitrary code via unspecified vectors to the StartLog method.

cpe:/a:attachmate:reflection_ftp_client:14.1.420

CVE-2014-0605

2015-02-06T06:59:02.340-05:00

2015-02-09T09:08:47.117-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2015-02-06T11:08:36.507-05:00

CONFIRM http://support.attachmate.com/techdocs/2501.html MISC http://www.zerodayinitiative.com/advisories/ZDI-14-290/ Directory traversal vulnerability in the rftpcom.dll ActiveX control in Attachmate Reflection FTP Client before 14.1.429 allows remote attackers to execute arbitrary code via unspecified vectors to the SaveSettings method.

CVE-2014-0606

2015-02-06T06:59:03.420-05:00

2015-02-06T06:59:03.450-05:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-0603. Reason: This issue was MERGED into CVE-2014-0603 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions. Notes: All CVE users should reference CVE-2014-0603 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:attachmate:verastream_process_designer:6.0 cpe:/a:attachmate:verastream_process_designer:6.0:sp1

CVE-2014-0607

2014-07-24T10:55:06.410-04:00

2014-07-24T13:33:00.557-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2014-07-24T13:33:00.323-04:00

CONFIRM http://support.attachmate.com/techdocs/2700.html Unrestricted file upload vulnerability in Attachmate Verastream Process Designer (VPD) before R6 SP1 Hotfix 1 allows remote attackers to execute arbitrary code by uploading and launching an executable file.

cpe:/a:novell:open_enterprise_server:11.0:sp1:~~~linux_kernel~~ cpe:/a:novell:open_enterprise_server:11.0:sp2:~~~linux_kernel~~

CVE-2014-0609

2014-08-17T14:55:01.543-04:00

2017-01-06T21:59:33.360-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SECUNIA 59982 CONFIRM http://www.novell.com/support/kb/doc.php?id=7010867 CONFIRM http://www.novell.com/support/kb/doc.php?id=7014420 Unspecified vulnerability in Novell Open Enterprise Server (OES) 11 SP1 before Scheduled Maintenance Update 9415 and 11 SP2 before Scheduled Maintenance Update 9413 for Linux has unknown impact and attack vectors.

cpe:/a:novell:groupwise:8.0 cpe:/a:novell:groupwise:8.00:hp1 cpe:/a:novell:groupwise:8.00:hp2 cpe:/a:novell:groupwise:8.00:hp3 cpe:/a:novell:groupwise:8.01 cpe:/a:novell:groupwise:8.01:hp cpe:/a:novell:groupwise:8.02 cpe:/a:novell:groupwise:8.02:hp1 cpe:/a:novell:groupwise:8.02:hp2 cpe:/a:novell:groupwise:8.02:hp3 cpe:/a:novell:groupwise:8.03 cpe:/a:novell:groupwise:8.03:hp1 cpe:/a:novell:groupwise:8.03:hp2 cpe:/a:novell:groupwise:8.03:hp3 cpe:/a:novell:groupwise:2012 cpe:/a:novell:groupwise:2012:sp1 cpe:/a:novell:groupwise:2012:sp2 cpe:/a:novell:groupwise:2014

CVE-2014-0610

2014-09-04T21:55:10.813-04:00

2017-08-28T21:34:13.013-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://www.novell.com/support/kb/doc.php?id=7015565 SECTRACK 1030802 CONFIRM https://bugzilla.novell.com/show_bug.cgi?id=874533 XF novell-groupwise-cve20140610-code-exec(95738) The client in Novell GroupWise before 8.0.3 HP4, 2012 before SP3, and 2014 before SP1 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference) via unspecified vectors.

cpe:/a:novell:groupwise:2012:sp3 cpe:/a:novell:groupwise:2014:sp1

CVE-2014-0611

2015-07-22T10:59:00.063-04:00

2017-09-21T21:29:00.810-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.novell.com/support/kb/doc.php?id=7016653 SECTRACK 1032978 CONFIRM https://bugzilla.novell.com/show_bug.cgi?id=909584 CONFIRM https://bugzilla.novell.com/show_bug.cgi?id=909586 CONFIRM https://bugzilla.novell.com/show_bug.cgi?id=909587 CONFIRM https://bugzilla.novell.com/show_bug.cgi?id=909588 CONFIRM https://bugzilla.novell.com/show_bug.cgi?id=909590 CONFIRM https://bugzilla.novell.com/show_bug.cgi?id=930467 Multiple cross-site scripting (XSS) vulnerabilities in WebAccess in Novell GroupWise 2012 before Support Pack 4 and 2014 before Support Pack 2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/h:juniper:srx100:- cpe:/h:juniper:srx110:- cpe:/h:juniper:srx210:- cpe:/h:juniper:srx220:- cpe:/h:juniper:srx240:- cpe:/h:juniper:srx550:- cpe:/h:juniper:srx650:- cpe:/o:juniper:junos:11.4 cpe:/o:juniper:junos:12.1 cpe:/o:juniper:junos:12.1x44 cpe:/o:juniper:junos:12.1x45 cpe:/o:juniper:junos:12.1x46

CVE-2014-0612

2014-04-14T11:09:06.273-04:00

2014-04-19T00:46:35.330-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10620 SECTRACK 1030057 BID 66759 Unspecified vulnerability in Juniper Junos before 11.4R10-S1, before 11.4R11, 12.1X44 before 12.1X44-D26, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, and 12.1X46 before 12.1X46-D10, when Dynamic IPsec VPN is configured, allows remote attackers to cause a denial of service (new Dynamic VPN connection failures and CPU and disk consumption) via unknown vectors.

cpe:/o:juniper:junos:10.4 cpe:/o:juniper:junos:11.4 cpe:/o:juniper:junos:12.1r cpe:/o:juniper:junos:12.1x44 cpe:/o:juniper:junos:12.1x45 cpe:/o:juniper:junos:12.1x46 cpe:/o:juniper:junos:12.2 cpe:/o:juniper:junos:12.3 cpe:/o:juniper:junos:13.1 cpe:/o:juniper:junos:13.2 cpe:/o:juniper:junos:13.3

CVE-2014-0613

2014-01-15T11:08:04.157-05:00

2014-01-15T13:11:02.323-05:00

7.1

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2014-01-15T13:10:59.573-05:00

CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10607 SECTRACK 1029586 The XNM command processor in Juniper Junos 10.4 before 10.4R16, 11.4 before 11.4R10, 12.1R before 12.1R8-S2, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, 12.2 before 12.2R7, 12.3 before 12.3R5, 13.1 before 13.1R3-S1, 13.2 before 13.2R2-S2, and 13.3 before 13.3R1, when xnm-ssl or xnm-clear-text is enabled, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.

cpe:/o:juniper:junos:13.2 cpe:/o:juniper:junos:13.3

CVE-2014-0614

2014-04-14T11:09:06.303-04:00

2014-04-15T09:30:14.717-04:00

7.1

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2014-04-15T09:30:14.687-04:00

CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10618 SECTRACK 1030062 BID 66762 Juniper Junos 13.2 before 13.2R3 and 13.3 before 13.3R1, when PIM is enabled, allows remote attackers to cause a denial of service (kernel panic and crash) via a large number of crafted IGMP packets.

CVE-2014-0615

2014-01-15T11:08:04.313-05:00

2014-01-24T14:22:37.923-05:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2014-01-15T08:17:06.000-05:00

CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10608 BID 64762 SECTRACK 1029585 Juniper Junos 10.4 before 10.4R16, 11.4 before 11.4R10, 12.1R before 12.1R8-S2, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, 12.2 before 12.2R7, 12.3 before 12.3R5, 13.1 before 13.1R3-S1, 13.2 before 13.2R2, and 13.3 before 13.3R1 allows local users to gain privileges via vectors related to "certain combinations of Junos OS CLI commands and arguments."

CVE-2014-0616

2014-01-15T11:08:04.343-05:00

2014-01-24T14:21:16.560-05:00

7.1

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2014-01-24T14:21:13.873-05:00

CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10609 BID 64766 SECTRACK 1029582 Juniper Junos 10.4 before 10.4R16, 11.4 before 11.4R10, 12.1R before 12.1R8-S2, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, 12.2 before 12.2R7, 12.3 before 12.3R4-S2, 13.1 before 13.1R3-S1, 13.2 before 13.2R2, and 13.3 before 13.3R1 allows remote attackers to cause a denial of service (rdp crash) via a large BGP UPDATE message which immediately triggers a withdraw message to be sent, as demonstrated by a long AS_PATH and a large number of BGP Communities.

cpe:/h:juniper:srx100:- cpe:/h:juniper:srx110:- cpe:/h:juniper:srx1400:- cpe:/h:juniper:srx210:- cpe:/h:juniper:srx220:- cpe:/h:juniper:srx240:- cpe:/h:juniper:srx3400:- cpe:/h:juniper:srx3600:- cpe:/h:juniper:srx550:- cpe:/h:juniper:srx5600:- cpe:/h:juniper:srx5800:- cpe:/h:juniper:srx650:- cpe:/o:juniper:junos:10.4r cpe:/o:juniper:junos:10.4s cpe:/o:juniper:junos:11.4 cpe:/o:juniper:junos:12.1r

CVE-2014-0617

2014-01-15T11:08:04.377-05:00

2014-01-15T13:27:15.923-05:00

7.1

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2014-01-15T13:27:13.423-05:00

CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10610 BID 64764 SECTRACK 1029583 Juniper Junos 10.4S before 10.4S15, 10.4R before 10.4R16, 11.4 before 11.4R9, and 12.1R before 12.1R7 on SRX Series service gateways allows remote attackers to cause a denial of service (flowd crash) via a crafted IP packet.

cpe:/h:juniper:srx100:- cpe:/h:juniper:srx110:- cpe:/h:juniper:srx1400:- cpe:/h:juniper:srx210:- cpe:/h:juniper:srx220:- cpe:/h:juniper:srx240:- cpe:/h:juniper:srx3400:- cpe:/h:juniper:srx3600:- cpe:/h:juniper:srx550:- cpe:/h:juniper:srx5600:- cpe:/h:juniper:srx5800:- cpe:/h:juniper:srx650:- cpe:/o:juniper:junos:10.4 cpe:/o:juniper:junos:11.4 cpe:/o:juniper:junos:12.1r cpe:/o:juniper:junos:12.1x44 cpe:/o:juniper:junos:12.1x45

CVE-2014-0618

2014-01-10T23:44:42.617-05:00

2017-08-28T21:34:13.090-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 64769 SECTRACK 1029584 XF juniper-junos-srx-cve20140618-dos(90238) CONFIRM https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10611 Juniper Junos before 10.4 before 10.4R16, 11.4 before 11.4R8, 12.1R before 12.1R7, 12.1X44 before 12.1X44-D20, and 12.1X45 before 12.1X45-D10 on SRX Series service gateways, when used as a UAC enforcer and captive portal is enabled, allows remote attackers to cause a denial of service (flowd crash) via a crafted HTTP message.

cpe:/a:hamstersoft:hamster_free_zip_archiver:2.0.1.7

CVE-2014-0619

2014-10-23T10:55:01.947-04:00

2017-08-28T21:34:13.137-04:00

6.9

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/128739/Hamster-Free-ZIP-Archiver-2.0.1.7-DLL-Hijacking.html XF hamster-dll-code-execution(97658) Untrusted search path vulnerability in Hamster Free ZIP Archiver 2.0.1.7 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the current working directory.

cpe:/h:technicolor:tc7200:- cpe:/o:technicolor:tc7200_firmware:std6.01.12

CVE-2014-0620

2014-01-08T10:30:02.683-05:00

2015-07-24T14:38:39.217-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2015-07-24T14:20:39.550-04:00

EXPLOIT-DB 30668 BID 64672 Multiple cross-site scripting (XSS) vulnerabilities in Technicolor (formerly Thomson) TC7200 STD6.01.12 allow remote attackers to inject arbitrary web script or HTML via the (1) ADDNewDomain parameter to parental/website-filters.asp or (2) VmTracerouteHost parameter to goform/status/diagnostics-route.

cpe:/h:technicolor:tc7200:- cpe:/o:technicolor:tc7200_firmware:std6.01.12

CVE-2014-0621

2014-01-08T10:30:02.730-05:00

2014-05-05T11:23:52.383-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2014-01-08T23:18:22.000-05:00

EXPLOIT-DB 30667 Multiple cross-site request forgery (CSRF) vulnerabilities in Technicolor (formerly Thomson) TC7200 STD6.01.12 allow remote attackers to hijack the authentication of administrators for requests that (1) perform a factory reset via a request to goform/system/factory, (2) disable advanced options via a request to goform/advanced/options, (3) remove ip-filters via the IpFilterAddressDelete1 parameter to goform/advanced/ip-filters, or (4) remove firewall settings via the cbFirewall parameter to goform/advanced/firewall.

cpe:/a:emc:documentum_foundation_services:6.5 cpe:/a:emc:documentum_foundation_services:6.6 cpe:/a:emc:documentum_foundation_services:6.7 cpe:/a:emc:documentum_foundation_services:7.0 cpe:/a:emc:documentum_foundation_services:7.1

CVE-2014-0622

2014-02-06T17:55:03.357-05:00

2018-01-02T21:29:03.427-05:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov BUGTRAQ 20140205 ESA-2014-005: EMC Documentum Foundation Services (DFS) Content Access Vulnerability OSVDB 102949 SECUNIA 56845 BID 65398 XF emc-documentum-cve20140622-sec-bypass(90982) The web service in EMC Documentum Foundation Services (DFS) 6.5 through 6.7 before 6.7 SP1 P22, 6.7 SP2 before P08, 7.0 before P12, and 7.1 before P01 does not properly implement content uploading, which allows remote authenticated users to bypass intended content access restrictions via unspecified vectors.

cpe:/a:rsa:authentication_manager:7.1:- cpe:/a:rsa:authentication_manager:7.1:sp4

CVE-2014-0623

2014-03-27T06:55:04.480-04:00

2014-03-27T11:37:47.770-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-03-27T11:37:43.443-04:00

BUGTRAQ 20140326 ESA-2014-015: RSA Authentication Manager Cross Frame Scripting Vulnerability Cross-site scripting (XSS) vulnerability in the Self-Service Console in EMC RSA Authentication Manager 7.1 before SP4 P32 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "cross frame scripting" issue.

cpe:/a:emc:rsa_data_loss_prevention:9.0 cpe:/a:emc:rsa_data_loss_prevention:9.5 cpe:/a:emc:rsa_data_loss_prevention:9.6

CVE-2014-0624

2014-03-06T06:55:05.177-05:00

2014-03-07T14:17:23.473-05:00

2.7

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2014-03-06T12:41:47.500-05:00

BUGTRAQ 20140228 ESA-2014-003: RSA Data Loss Prevention Improper Session Management Vulnerability EMC RSA Data Loss Prevention (DLP) 9.x before 9.6-SP2 does not properly manage sessions, which allows remote authenticated users to gain privileges and bypass intended content-reading restrictions via unspecified vectors.

cpe:/a:emc:rsa_bsafe_ssl-j:5.0 cpe:/a:emc:rsa_bsafe_ssl-j:5.1.0 cpe:/a:emc:rsa_bsafe_ssl-j:5.1.1 cpe:/a:emc:rsa_bsafe_ssl-j:5.1.2 cpe:/a:emc:rsa_bsafe_ssl-j:6.0 cpe:/a:emc:rsa_bsafe_ssl-j:6.0.1

CVE-2014-0625

2014-02-17T19:55:05.143-05:00

2014-02-18T14:43:45.623-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-02-18T14:43:45.577-05:00

BUGTRAQ 20140214 ESA-2014-009: RSA BSAFE SSL-J Multiple Vulnerabilities The SSLSocket implementation in the (1) JSAFE and (2) JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to cause a denial of service (memory consumption) by triggering application-data processing during the TLS handshake, a time at which the data is internally buffered.

cpe:/a:emc:rsa_bsafe_ssl-j:5.0 cpe:/a:emc:rsa_bsafe_ssl-j:5.1.0 cpe:/a:emc:rsa_bsafe_ssl-j:5.1.1 cpe:/a:emc:rsa_bsafe_ssl-j:5.1.2 cpe:/a:emc:rsa_bsafe_ssl-j:6.0 cpe:/a:emc:rsa_bsafe_ssl-j:6.0.1

CVE-2014-0626

2014-02-17T19:55:05.173-05:00

2014-02-18T14:45:23.737-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-02-18T14:45:23.657-05:00

BUGTRAQ 20140214 ESA-2014-009: RSA BSAFE SSL-J Multiple Vulnerabilities The (1) JSAFE and (2) JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 make it easier for remote attackers to bypass intended cryptographic protection mechanisms by triggering application-data processing during the TLS handshake, a time at which the data is both unencrypted and unauthenticated.

cpe:/a:emc:rsa_bsafe_ssl-j:5.0 cpe:/a:emc:rsa_bsafe_ssl-j:5.1.0 cpe:/a:emc:rsa_bsafe_ssl-j:5.1.1 cpe:/a:emc:rsa_bsafe_ssl-j:5.1.2 cpe:/a:emc:rsa_bsafe_ssl-j:6.0 cpe:/a:emc:rsa_bsafe_ssl-j:6.0.1

CVE-2014-0627

2014-02-17T19:55:05.207-05:00

2014-02-18T14:46:21.660-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-02-18T14:46:21.597-05:00

BUGTRAQ 20140214 ESA-2014-009: RSA BSAFE SSL-J Multiple Vulnerabilities The SSLEngine API implementation in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to trigger the selection of a weak cipher suite by using the wrap method during a certain incomplete-handshake state.

cpe:/a:emc:rsa_bsafe:4.0.0::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.0.1::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.0.2::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.0.3::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.0.4::~~micro_edition_suite~~~

CVE-2014-0628

2014-03-25T09:25:38.210-04:00

2014-03-25T11:13:51.850-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-03-25T11:13:48.447-04:00

BUGTRAQ 20140324 ESA-2014-011: RSA BSAFE Micro Edition Suite Server Crash Vulnerability The server in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.5 does not properly process certificate chains, which allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.

cpe:/a:emc:documentum_taskspace:6.7:sp1 cpe:/a:emc:documentum_taskspace:6.7:sp2

CVE-2014-0629

2014-03-06T06:55:05.193-05:00

2014-03-07T14:16:34.033-05:00

8.5

NETWORK

MEDIUM

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2014-03-06T07:45:19.000-05:00

BUGTRAQ 20140305 ESA-2014-012: EMC Documentum TaskSpace Multiple Vulnerabilities EMC Documentum TaskSpace (TSP) 6.7SP1 before P25 and 6.7SP2 before P11 does not properly handle the interaction between the dm_world group and the dm_superusers_dynamic group, which allows remote authenticated users to obtain sensitive information and gain privileges in opportunistic circumstances by leveraging an incorrect group-addition implementation.

cpe:/a:emc:documentum_taskspace:6.7:sp1 cpe:/a:emc:documentum_taskspace:6.7:sp2

CVE-2014-0630

2014-03-06T06:55:05.223-05:00

2014-03-07T14:14:46.673-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2014-03-06T12:46:37.337-05:00

BUGTRAQ 20140305 ESA-2014-012: EMC Documentum TaskSpace Multiple Vulnerabilities EMC Documentum TaskSpace (TSP) 6.7SP1 before P25 and 6.7SP2 before P11 allows remote authenticated users to read arbitrary files via a modified imaging-service URL.

CVE-2014-0631

2015-01-07T10:59:00.057-05:00

2015-01-07T10:59:00.070-05:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2014. Notes: none.

cpe:/a:emc:vplex_geosynchrony:4.0 cpe:/a:emc:vplex_geosynchrony:5.0 cpe:/a:emc:vplex_geosynchrony:5.1 cpe:/a:emc:vplex_geosynchrony:5.2 cpe:/a:emc:vplex_geosynchrony:5.2.1

CVE-2014-0632

2014-04-01T02:28:17.997-04:00

2015-10-13T12:35:21.860-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2015-10-13T12:01:05.590-04:00

BUGTRAQ 20140326 ESA-2014-016: EMC VPLEX Multiple Vulnerabilities BID 66513 Directory traversal vulnerability in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 allows remote authenticated users to execute arbitrary code via unspecified vectors.

cpe:/a:emc:vplex_geosynchrony:4.0 cpe:/a:emc:vplex_geosynchrony:5.0 cpe:/a:emc:vplex_geosynchrony:5.1 cpe:/a:emc:vplex_geosynchrony:5.2 cpe:/a:emc:vplex_geosynchrony:5.2.1

CVE-2014-0633

2014-04-01T02:28:18.030-04:00

2014-04-01T10:13:09.453-04:00

7.7

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2014-04-01T10:13:05.737-04:00

BUGTRAQ 20140326 ESA-2014-016: EMC VPLEX Multiple Vulnerabilities The GUI in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 does not properly validate session-timeout values, which might make it easier for remote attackers to execute arbitrary code by leveraging an unattended workstation.

cpe:/a:emc:vplex_geosynchrony:4.0 cpe:/a:emc:vplex_geosynchrony:5.0 cpe:/a:emc:vplex_geosynchrony:5.1 cpe:/a:emc:vplex_geosynchrony:5.2 cpe:/a:emc:vplex_geosynchrony:5.2.1

CVE-2014-0634

2014-04-01T02:28:18.060-04:00

2014-04-01T10:14:43.753-04:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2014-04-01T10:14:43.707-04:00

BUGTRAQ 20140326 ESA-2014-016: EMC VPLEX Multiple Vulnerabilities EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

cpe:/a:emc:vplex_geosynchrony:4.0 cpe:/a:emc:vplex_geosynchrony:5.0 cpe:/a:emc:vplex_geosynchrony:5.1 cpe:/a:emc:vplex_geosynchrony:5.2 cpe:/a:emc:vplex_geosynchrony:5.2.1

CVE-2014-0635

2014-04-01T02:28:18.077-04:00

2014-04-01T10:16:06.773-04:00

7.5

NETWORK

MEDIUM

SINGLE_INSTANCE

COMPLETE

PARTIAL

http://nvd.nist.gov

2014-04-01T10:15:53.477-04:00

BUGTRAQ 20140326 ESA-2014-016: EMC VPLEX Multiple Vulnerabilities Session fixation vulnerability in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 allows remote attackers to hijack web sessions via unspecified vectors.

cpe:/a:emc:rsa_bsafe:3.2.0::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:3.2.1::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:3.2.2::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:3.2.3::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:3.2.4::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:3.2.5::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.0.0::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.0.1::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.0.2::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.0.3::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.0.4::~~micro_edition_suite~~~

CVE-2014-0636

2014-04-11T15:55:04.307-04:00

2016-09-06T13:04:21.137-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-09-06T12:36:46.467-04:00

BUGTRAQ 20140411 ESA-2014-019: RSA BSAFE Micro Edition Suite Certificate Chain Processing Vulnerability BID 66791 EMC RSA BSAFE Micro Edition Suite (MES) 3.2.x before 3.2.6 and 4.0.x before 4.0.5 does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate chain.

cpe:/a:emc:rsa_adaptive_authentication_on-premise:6.0 cpe:/a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1 cpe:/a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1:sp1_patch2 cpe:/a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1:sp1_patch3 cpe:/a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1:sp2 cpe:/a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1:sp2_patch1 cpe:/a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1:sp3 cpe:/a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1:sp3_p3 cpe:/a:emc:rsa_adaptive_authentication_on-premise:7.0 cpe:/a:emc:rsa_adaptive_authentication_on-premise:7.1

CVE-2014-0637

2014-04-04T11:09:05.337-04:00

2014-04-04T12:34:39.997-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-04-04T12:34:39.917-04:00

BUGTRAQ 20140401 ESA-2014-020: RSA Adaptive Authentication (On-Premise) Multiple Vulnerabilities Cross-site scripting (XSS) vulnerability in the back-office case-management application in RSA Adaptive Authentication (On-Premise) 6.x and 7.x before 7.1 SP0 P2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

CVE-2014-0638

2014-04-04T11:09:38.057-04:00

2014-04-04T12:37:35.080-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-04-04T12:37:34.423-04:00

BUGTRAQ 20140401 ESA-2014-020: RSA Adaptive Authentication (On-Premise) Multiple Vulnerabilities Cross-site scripting (XSS) vulnerability in RSA Adaptive Authentication (On-Premise) 6.x and 7.x before 7.1 SP0 P2 allows remote attackers to inject arbitrary web script or HTML via vectors involving FRAME elements, related to a "cross-frame scripting" issue.

cpe:/a:emc:rsa_archer_egrc:5.0 cpe:/a:emc:rsa_archer_egrc:5.1 cpe:/a:emc:rsa_archer_egrc:5.2 cpe:/a:emc:rsa_archer_egrc:5.3 cpe:/a:emc:rsa_archer_egrc:5.4 cpe:/a:emc:rsa_archer_egrc:5.4:sp1

CVE-2014-0639

2014-05-25T18:55:01.893-04:00

2015-08-13T13:44:44.883-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2015-08-13T08:18:06.350-04:00

BUGTRAQ 20140523 ESA-2014-021: RSA Archer GRC Multiple Cross-Site Scripting Vulnerabilities MISC http://packetstormsecurity.com/files/126788/RSA-Archer-GRC-Cross-Site-Scripting.html BID 67602 SECTRACK 1030281 Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Archer 5.x before GRC 5.4 SP1 P3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:emc:rsa_archer_egrc:5.3 cpe:/a:emc:rsa_archer_egrc:5.4 cpe:/a:emc:rsa_archer_egrc:5.4:sp1 cpe:/a:emc:rsa_archer_egrc:5.5

CVE-2014-0640

2014-08-20T07:17:13.610-04:00

2017-08-28T21:34:13.217-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BUGTRAQ 20140819 ESA-2014-071: RSA Archer GRC Platform Multiple Vulnerabilities BID 69288 SECTRACK 1030738 XF rsaarcher-cve20140640-info-disc(95362) EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote authenticated users to bypass intended restrictions on resource access via unspecified vectors.

cpe:/a:emc:rsa_archer_egrc:5.3 cpe:/a:emc:rsa_archer_egrc:5.4 cpe:/a:emc:rsa_archer_egrc:5.4:sp1 cpe:/a:emc:rsa_archer_egrc:5.5

CVE-2014-0641

2014-08-20T07:17:13.673-04:00

2017-08-28T21:34:13.263-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BUGTRAQ 20140819 ESA-2014-071: RSA Archer GRC Platform Multiple Vulnerabilities BID 69289 SECTRACK 1030738 XF rsaarcher-cve20140641-csrf (95361) Cross-site request forgery (CSRF) vulnerability in EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to hijack the authentication of arbitrary users.

cpe:/a:emc:documentum_content_server:6.0 cpe:/a:emc:documentum_content_server:6.5 cpe:/a:emc:documentum_content_server:6.5:sp1 cpe:/a:emc:documentum_content_server:6.5:sp2 cpe:/a:emc:documentum_content_server:6.5:sp3 cpe:/a:emc:documentum_content_server:6.6 cpe:/a:emc:documentum_content_server:6.7:- cpe:/a:emc:documentum_content_server:6.7:sp1 cpe:/a:emc:documentum_content_server:6.7:sp2 cpe:/a:emc:documentum_content_server:7.0 cpe:/a:emc:documentum_content_server:7.1

CVE-2014-0642

2014-04-15T19:13:16.790-04:00

2014-04-16T10:03:42.857-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2014-04-16T10:03:42.797-04:00

BUGTRAQ 20140411 ESA-2014-026: EMC Documentum Content Server Information Disclosure Vulnerability MISC http://twitter.com/artika4biz/statuses/455358950116823040 EMC Documentum Content Server before 6.7 SP1 P26, 6.7 SP2 before P13, 7.0 before P13, and 7.1 before P02 allows remote authenticated users to bypass intended access restrictions and read metadata from certain folders via unspecified vectors.

cpe:/a:emc:rsa_netwitness:9.8.5.17 cpe:/a:emc:rsa_security_analytics:10.2 cpe:/a:emc:rsa_security_analytics:10.2.3 cpe:/a:emc:rsa_security_analytics:10.3 cpe:/a:emc:rsa_security_analytics:10.3.1

CVE-2014-0643

2014-05-16T07:11:59.383-04:00

2018-12-12T11:27:27.150-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2014-05-16T10:25:32.547-04:00

BUGTRAQ 20140512 ESA-2014-027: RSA NetWitness and RSA Security Analytics Authentication Bypass Vulnerability EMC RSA NetWitness before 9.8.5.19 and RSA Security Analytics before 10.2.4 and 10.3.x before 10.3.2, when Kerberos PAM is enabled, do not require a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid account name.

cpe:/a:emc:cloud_tiering_appliance_software:10.0:- cpe:/a:emc:cloud_tiering_appliance_software:10.0:sp1 cpe:/h:emc:cloud_tiering_appliance:-

CVE-2014-0644

2014-04-16T21:55:05.657-04:00

2014-04-17T11:06:50.127-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

NONE

http://nvd.nist.gov

2014-04-17T11:06:50.063-04:00

BUGTRAQ 20140416 ESA-2014-028: EMC Cloud Tiering Appliance XML External Entity (XXE) and Information Disclosure Vulnerabilities FULLDISC 20140331 EMC CTA v10.0 unauthenticated XXE with root perms MISC https://gist.github.com/brandonprry/9895721 EMC Cloud Tiering Appliance (CTA) 10 through SP1 allows remote attackers to read arbitrary files via an api/login request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, as demonstrated by reading the /etc/shadow file.

cpe:/a:emc:cloud_tiering_appliance_software:9.0 cpe:/a:emc:cloud_tiering_appliance_software:10.0:- cpe:/a:emc:cloud_tiering_appliance_software:10.0:sp1 cpe:/a:emc:file_management_appliance_software:7.0 cpe:/h:emc:cloud_tiering_appliance:- cpe:/h:emc:file_management_appliance:-

CVE-2014-0645

2014-04-16T21:55:05.690-04:00

2014-04-17T11:10:45.367-04:00

4.7

LOCAL

MEDIUM

NONE

COMPLETE

NONE

http://nvd.nist.gov

2014-04-17T11:10:45.273-04:00

BUGTRAQ 20140416 ESA-2014-028: EMC Cloud Tiering Appliance XML External Entity (XXE) and Information Disclosure Vulnerabilities FULLDISC 20140331 EMC CTA v10.0 unauthenticated XXE with root perms MISC https://gist.github.com/brandonprry/9895721 EMC Cloud Tiering Appliance (CTA) 9.x through 10 SP1 and File Management Appliance (FMA) 7.x store DES password hashes for the root, super, and admin accounts, which makes it easier for context-dependent attackers to obtain sensitive information via a brute-force attack.

cpe:/a:emc:rsa_access_manager:6.1:sp3 cpe:/a:emc:rsa_access_manager:6.1:sp4 cpe:/a:emc:rsa_access_manager:6.2:- cpe:/a:emc:rsa_access_manager:6.2:sp1

CVE-2014-0646

2014-05-01T13:29:56.697-04:00

2014-05-02T09:49:06.440-04:00

6.9

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2014-05-02T09:49:06.363-04:00

BUGTRAQ 20140430 ESA-2014-029: RSA Access Manager Sensitive Information Disclosure Vulnerability The runtime WS component in the server in EMC RSA Access Manager 6.1.3 before 6.1.3.39, 6.1.4 before 6.1.4.22, 6.2.0 before 6.2.0.11, and 6.2.1 before 6.2.1.03, when INFO logging is enabled, allows local users to discover cleartext passwords by reading log files.

cpe:/a:starbucks:starbucks:2.6.1

CVE-2014-0647

2014-01-27T19:55:03.957-05:00

2018-10-09T15:42:04.093-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov FULLDISC 20140117 Re: [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application FULLDISC 20140113 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application BUGTRAQ 20140114 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application BID 64942 MISC http://www.zdnet.com/starbucks-fixes-ios-app-bugs-7000025323/ MISC http://www.zdnet.com/the-starbucks-bug-not-as-awful-as-reported-7000025269/ XF starbucks-cve20140647-info-disclosure(90412) MISC https://itunes.apple.com/us/app/starbucks/id331177714?mt=8 The Starbucks 2.6.1 application for iOS stores sensitive information in plaintext in the Crashlytics log file (/Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog), which allows attackers to discover usernames, passwords, and e-mail addresses via an application that reads session.clslog.

cpe:/a:cisco:secure_access_control_system:5.1 cpe:/a:cisco:secure_access_control_system:5.1.0.44 cpe:/a:cisco:secure_access_control_system:5.1.0.44.1 cpe:/a:cisco:secure_access_control_system:5.1.0.44.2 cpe:/a:cisco:secure_access_control_system:5.1.0.44.3 cpe:/a:cisco:secure_access_control_system:5.1.0.44.4 cpe:/a:cisco:secure_access_control_system:5.1.0.44.5 cpe:/a:cisco:secure_access_control_system:5.2 cpe:/a:cisco:secure_access_control_system:5.2.0.26 cpe:/a:cisco:secure_access_control_system:5.2.0.26.1 cpe:/a:cisco:secure_access_control_system:5.2.0.26.2 cpe:/a:cisco:secure_access_control_system:5.3.0.40.1 cpe:/a:cisco:secure_access_control_system:5.3.0.40.2 cpe:/a:cisco:secure_access_control_system:5.3.0.40.3 cpe:/a:cisco:secure_access_control_system:5.3.0.40.4 cpe:/a:cisco:secure_access_control_system:5.3.0.40.5 cpe:/a:cisco:secure_access_control_system:5.3.0.40.6 cpe:/a:cisco:secure_access_control_system:5.3.0.40.7 cpe:/a:cisco:secure_access_control_system:5.3.0.40.8 cpe:/a:cisco:secure_access_control_system:5.3.0.40.9 cpe:/a:cisco:secure_access_control_system:5.4.0.46.1 cpe:/a:cisco:secure_access_control_system:5.4.0.46.2 cpe:/a:cisco:secure_access_control_system:5.4.0.46.3 cpe:/a:cisco:secure_access_control_system:5.4.0.46.4 cpe:/a:cisco:secure_access_control_system:5.4.0.46.5 cpe:/a:cisco:secure_access_control_system:5.4.0.46.6

CVE-2014-0648

2014-01-16T14:55:04.637-05:00

2017-08-28T21:34:13.437-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CISCO 20140115 Multiple Vulnerabilities in Cisco Secure Access Control System CONFIRM http://tools.cisco.com/security/center/viewAlert.x?alertId=32379 BID 64962 SECTRACK 1029634 XF cisco-acs-cve20140648-unauth-access(90431) The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers to obtain administrative access via a request to this interface, aka Bug ID CSCud75187.

CVE-2014-0649

2014-01-16T14:55:04.670-05:00

2017-08-28T21:34:13.497-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov CISCO 20140115 Multiple Vulnerabilities in Cisco Secure Access Control System CONFIRM http://tools.cisco.com/security/center/viewAlert.x?alertId=32378 BID 64958 SECTRACK 1029634 XF cisco-acs-cve20140649-priv-esc(90430) The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authorization requirements, which allows remote authenticated users to obtain superadmin access via a request to this interface, aka Bug ID CSCud75180.

CVE-2014-0650

2014-01-16T14:55:04.700-05:00

2017-08-28T21:34:13.560-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CISCO 20140115 Multiple Vulnerabilities in Cisco Secure Access Control System CONFIRM http://tools.cisco.com/security/center/viewAlert.x?alertId=32380 BID 64964 SECTRACK 1029634 XF cisco-acs-cve20140650-command-exec(90432) The web interface in Cisco Secure Access Control System (ACS) 5.x before 5.4 Patch 3 allows remote attackers to execute arbitrary operating-system commands via a request to this interface, aka Bug ID CSCue65962.

cpe:/a:cisco:context_directory_agent:-

CVE-2014-0651

2014-01-08T16:55:06.223-05:00

2017-08-28T21:34:13.637-04:00

4.9

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CISCO 20140107 Cisco Context Directory Agent Privilege Escalation Vulnerability CONFIRM http://tools.cisco.com/security/center/viewAlert.x?alertId=32364 BID 64706 SECTRACK 1029573 XF cisco-cda-cve20140651-priv-esc(90166) The administrative interface in Cisco Context Directory Agent (CDA) does not properly enforce authorization requirements, which allows remote authenticated users to obtain administrative access by hijacking a session, aka Bug ID CSCuj45347.

cpe:/a:cisco:context_directory_agent:-

CVE-2014-0652

2014-01-08T16:55:06.240-05:00

2017-08-28T21:34:13.687-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CISCO 20140107 Cisco Context Directory Agent Mappings Page Cross-Site Scripting Vulnerability CONFIRM http://tools.cisco.com/security/center/viewAlert.x?alertId=32365 BID 64703 SECTRACK 1029572 XF cisco-cda-cve20140652-xss(90167) Cross-site scripting (XSS) vulnerability in the Mappings page in Cisco Context Directory Agent (CDA) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuj45358.

cpe:/h:cisco:adaptive_security_appliance

CVE-2014-0653

2014-01-08T16:55:06.270-05:00

2017-08-28T21:34:13.747-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CISCO 20140107 Cisco Adaptive Security Appliance Identity Firewall NetBIOS Logout Probe Auth State Change Vulnerability CONFIRM http://tools.cisco.com/security/center/viewAlert.x?alertId=32363 BID 64708 SECTRACK 1029570 XF cisco-asa-cve20140653-sec-bypass(90165) The Identity Firewall (IDFW) functionality in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to trigger authentication-state modifications via a crafted NetBIOS logout probe response, aka Bug ID CSCuj45340.

cpe:/a:cisco:context_directory_agent:-

CVE-2014-0654

2014-01-08T16:55:06.303-05:00

2017-08-28T21:34:13.810-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CISCO 20140107 Cisco Context Directory Agent Replayed RADIUS Accounting Message Vulnerability CONFIRM http://tools.cisco.com/security/center/viewAlert.x?alertId=32366 BID 64709 SECTRACK 1029574 XF cisco-cda-cve20140654-sec-bypass(90168) Cisco Context Directory Agent (CDA) allows remote attackers to modify the cache via a replay attack involving crafted RADIUS accounting messages, aka Bug ID CSCuj45383.

cpe:/h:cisco:adaptive_security_appliance

CVE-2014-0655

2014-01-08T16:55:06.333-05:00

2017-08-28T21:34:13.873-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CISCO 20140107 Cisco Adaptive Security Appliance RADIUS Change of Authorization Message Replay Vulnerability CONFIRM http://tools.cisco.com/security/center/viewAlert.x?alertId=32362 BID 64700 SECTRACK 1029575 XF cisco-asa-cve20140655-sec-bypass(90164) The Identity Firewall (IDFW) functionality in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to change the user-cache contents via a replay attack involving crafted RADIUS Change of Authorization (CoA) messages, aka Bug ID CSCuj45332.

cpe:/a:cisco:context_directory_agent:-

CVE-2014-0656

2014-01-08T16:55:06.380-05:00

2017-08-28T21:34:13.920-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CISCO 20140107 Cisco Context Directory Agent Hidden Input Vulnerability BID 64701 SECTRACK 1029569 XF cisco-cda-cve20140656-sec-bypass(90169) Cisco Context Directory Agent (CDA) allows remote authenticated users to trigger the omission of certain user-interface data via crafted field values, aka Bug ID CSCuj45353.

cpe:/a:cisco:unified_communications_manager:3.3%285%29 cpe:/a:cisco:unified_communications_manager:3.3%285%29sr1 cpe:/a:cisco:unified_communications_manager:3.3%285%29sr2a cpe:/a:cisco:unified_communications_manager:4.1%283%29 cpe:/a:cisco:unified_communications_manager:4.1%283%29sr1 cpe:/a:cisco:unified_communications_manager:4.1%283%29sr2 cpe:/a:cisco:unified_communications_manager:4.1%283%29sr3 cpe:/a:cisco:unified_communications_manager:4.1%283%29sr4 cpe:/a:cisco:unified_communications_manager:4.2 cpe:/a:cisco:unified_communications_manager:4.2.1 cpe:/a:cisco:unified_communications_manager:4.2.2 cpe:/a:cisco:unified_communications_manager:4.2.3 cpe:/a:cisco:unified_communications_manager:4.2.3sr1 cpe:/a:cisco:unified_communications_manager:4.2.3sr2 cpe:/a:cisco:unified_communications_manager:4.2.3sr2b cpe:/a:cisco:unified_communications_manager:4.3 cpe:/a:cisco:unified_communications_manager:4.3%281%29 cpe:/a:cisco:unified_communications_manager:5.0 cpe:/a:cisco:unified_communications_manager:5.1 cpe:/a:cisco:unified_communications_manager:5.1%281%29 cpe:/a:cisco:unified_communications_manager:5.1%281b%29 cpe:/a:cisco:unified_communications_manager:5.1%281c%29 cpe:/a:cisco:unified_communications_manager:5.1%282%29 cpe:/a:cisco:unified_communications_manager:5.1%282a%29 cpe:/a:cisco:unified_communications_manager:5.1%282b%29 cpe:/a:cisco:unified_communications_manager:5.1%283%29 cpe:/a:cisco:unified_communications_manager:5.1%283a%29 cpe:/a:cisco:unified_communications_manager:5.1%283c%29 cpe:/a:cisco:unified_communications_manager:5.1%283d%29 cpe:/a:cisco:unified_communications_manager:5.1%283e%29 cpe:/a:cisco:unified_communications_manager:5.1.2 cpe:/a:cisco:unified_communications_manager:6.0 cpe:/a:cisco:unified_communications_manager:6.0%281%29 cpe:/a:cisco:unified_communications_manager:6.0%281a%29 cpe:/a:cisco:unified_communications_manager:6.0%281b%29 cpe:/a:cisco:unified_communications_manager:6.1%281%29 cpe:/a:cisco:unified_communications_manager:6.1%281a%29 cpe:/a:cisco:unified_communications_manager:6.1%281b%29 cpe:/a:cisco:unified_communications_manager:6.1%282%29 cpe:/a:cisco:unified_communications_manager:6.1%282%29su1 cpe:/a:cisco:unified_communications_manager:6.1%282%29su1a cpe:/a:cisco:unified_communications_manager:6.1%283%29 cpe:/a:cisco:unified_communications_manager:6.1%283a%29 cpe:/a:cisco:unified_communications_manager:6.1%283b%29 cpe:/a:cisco:unified_communications_manager:6.1%283b%29su1 cpe:/a:cisco:unified_communications_manager:6.1%284%29 cpe:/a:cisco:unified_communications_manager:6.1%284%29su1 cpe:/a:cisco:unified_communications_manager:6.1%284a%29 cpe:/a:cisco:unified_communications_manager:6.1%284a%29su2 cpe:/a:cisco:unified_communications_manager:6.1%285%29 cpe:/a:cisco:unified_communications_manager:6.1%285%29su1 cpe:/a:cisco:unified_communications_manager:6.1%285%29su2 cpe:/a:cisco:unified_communications_manager:6.1%285%29su3 cpe:/a:cisco:unified_communications_manager:7.0%281%29su1 cpe:/a:cisco:unified_communications_manager:7.0%281%29su1a cpe:/a:cisco:unified_communications_manager:7.0%282%29 cpe:/a:cisco:unified_communications_manager:7.0%282a%29 cpe:/a:cisco:unified_communications_manager:7.0%282a%29su1 cpe:/a:cisco:unified_communications_manager:7.0%282a%29su2 cpe:/a:cisco:unified_communications_manager:7.1%282a%29 cpe:/a:cisco:unified_communications_manager:7.1%282a%29su1 cpe:/a:cisco:unified_communications_manager:7.1%282b%29 cpe:/a:cisco:unified_communications_manager:7.1%282b%29su1 cpe:/a:cisco:unified_communications_manager:7.1%283%29 cpe:/a:cisco:unified_communications_manager:7.1%283a%29 cpe:/a:cisco:unified_communications_manager:7.1%283a%29su1 cpe:/a:cisco:unified_communications_manager:7.1%283a%29su1a cpe:/a:cisco:unified_communications_manager:7.1%283b%29 cpe:/a:cisco:unified_communications_manager:7.1%283b%29su1 cpe:/a:cisco:unified_communications_manager:7.1%283b%29su2 cpe:/a:cisco:unified_communications_manager:7.1%285%29 cpe:/a:cisco:unified_communications_manager:7.1%285%29su1 cpe:/a:cisco:unified_communications_manager:7.1%285%29su1a cpe:/a:cisco:unified_communications_manager:7.1%285a%29 cpe:/a:cisco:unified_communications_manager:7.1%285b%29 cpe:/a:cisco:unified_communications_manager:7.1%285b%29su1 cpe:/a:cisco:unified_communications_manager:7.1%285b%29su1a cpe:/a:cisco:unified_communications_manager:7.1%285b%29su2 cpe:/a:cisco:unified_communications_manager:7.1%285b%29su3 cpe:/a:cisco:unified_communications_manager:7.1%285b%29su4 cpe:/a:cisco:unified_communications_manager:7.1%285b%29su5 cpe:/a:cisco:unified_communications_manager:7.1%285b%29su6 cpe:/a:cisco:unified_communications_manager:8.0 cpe:/a:cisco:unified_communications_manager:8.0%281%29 cpe:/a:cisco:unified_communications_manager:8.0%282%29 cpe:/a:cisco:unified_communications_manager:8.0%282a%29 cpe:/a:cisco:unified_communications_manager:8.0%282b%29 cpe:/a:cisco:unified_communications_manager:8.0%282c%29 cpe:/a:cisco:unified_communications_manager:8.0%282c%29su1 cpe:/a:cisco:unified_communications_manager:8.0%283%29 cpe:/a:cisco:unified_communications_manager:8.0%283a%29 cpe:/a:cisco:unified_communications_manager:8.0%283a%29su1 cpe:/a:cisco:unified_communications_manager:8.0%283a%29su2 cpe:/a:cisco:unified_communications_manager:8.0%283a%29su3 cpe:/a:cisco:unified_communications_manager:8.5 cpe:/a:cisco:unified_communications_manager:8.5%281%29 cpe:/a:cisco:unified_communications_manager:8.5%281%29su1 cpe:/a:cisco:unified_communications_manager:8.5%281%29su2 cpe:/a:cisco:unified_communications_manager:8.5%281%29su3 cpe:/a:cisco:unified_communications_manager:8.5%281%29su4 cpe:/a:cisco:unified_communications_manager:8.5%281%29su5 cpe:/a:cisco:unified_communications_manager:8.6 cpe:/a:cisco:unified_communications_manager:8.6%281%29 cpe:/a:cisco:unified_communications_manager:8.6%281a%29 cpe:/a:cisco:unified_communications_manager:8.6%282%29 cpe:/a:cisco:unified_communications_manager:8.6%282a%29 cpe:/a:cisco:unified_communications_manager:8.6%282a%29su1 cpe:/a:cisco:unified_communications_manager:8.6%282a%29su2 cpe:/a:cisco:unified_communications_manager:8.6%282a%29su3 cpe:/a:cisco:unified_communications_manager:8.6%283%29 cpe:/a:cisco:unified_communications_manager:8.6%284%29 cpe:/a:cisco:unified_communications_manager:9.0%281%29 cpe:/a:cisco:unified_communications_manager:9.1%281%29

CVE-2014-0657

2014-01-08T16:55:06.410-05:00

2017-08-28T21:34:13.997-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CISCO 20140107 Cisco Unified Communications Manager Role Bypass Vulnerability CONFIRM http://tools.cisco.com/security/center/viewAlert.x?alertId=32341 BID 64690 SECTRACK 1029571 XF cisco-ucm-cve20140657-sec-bypass(90120) The administration portal in Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier does not properly handle role restrictions, which allows remote authenticated users to bypass role-based access control via multiple visits to a forbidden portal URL, aka Bug ID CSCuj83540.

cpe:/h:cisco:unified_ip_phone_9951 cpe:/h:cisco:unified_ip_phone_9971 cpe:/o:cisco:unified_ip_phones_9900_series_firmware:-

CVE-2014-0658

2014-01-10T11:47:06.037-05:00

2017-08-28T21:34:14.060-04:00

5.4

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov CISCO 20140110 Cisco 9900 Series IP Phone Crafted Header Unregister Vulnerability CONFIRM http://tools.cisco.com/security/center/viewAlert.x?alertId=32402 BID 64770 SECTRACK <