CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In September 2014

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
251 CVE-2014-6239 89 Exec Code Sql 2014-09-11 2014-09-11
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Address visualization with Google Maps (st_address_map) extension before 0.3.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
252 CVE-2014-6238 79 XSS 2014-09-11 2017-09-08
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Akronymmanager (aka SB Folderdownload) extension 0.5.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
253 CVE-2014-6237 79 XSS 2014-09-11 2017-09-08
3.5
None Remote Medium ??? None Partial None
Cross-site scripting (XSS) vulnerability in the News Pack extension 0.1.0 and earlier for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
254 CVE-2014-6236 2014-09-11 2017-09-08
7.5
None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the LumoNet PHP Include (lumophpinclude) extension before 1.2.1 for TYPO3 allows remote attackers to execute arbitrary scripts via vectors related to extension links.
255 CVE-2014-6235 Exec Code 2014-09-11 2017-09-08
7.5
None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the ke DomPDF extension before 0.0.5 for TYPO3 allows remote attackers to execute arbitrary code via unknown vectors.
256 CVE-2014-6234 79 XSS 2014-09-11 2017-09-08
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Open Graph protocol (jh_opengraphprotocol) extension before 1.0.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
257 CVE-2014-6233 89 Exec Code Sql 2014-09-11 2017-09-08
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Flat Manager (flatmgr) extension before 2.7.10 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
258 CVE-2014-6232 +Info 2014-09-11 2017-09-08
4.0
None Remote Low ??? Partial None None
Unspecified vulnerability in the LDAP (eu_ldap) extension before 2.8.18 for TYPO3 allows remote authenticated users to obtain sensitive information via unknown vectors.
259 CVE-2014-6231 Exec Code 2014-09-11 2017-09-08
7.5
None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the CWT Frontend Edit (cwt_feedit) extension before 1.2.5 for TYPO3 allows remote authenticated users to execute arbitrary code via unknown vectors.
260 CVE-2014-6091 79 XSS 2014-09-23 2017-09-08
3.5
None Remote Medium ??? None Partial None
Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management (SPM) 6.0.4 before 6.0.4.5 iFix7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
261 CVE-2014-6074 310 2014-09-10 2017-09-08
4.0
None Remote Low ??? Partial None None
IBM UrbanCode Deploy 6.1.0.2 before IF1 allows remote authenticated users to read keystore secret keys via a direct request to a UI page.
262 CVE-2014-6070 79 1 XSS 2014-09-11 2017-09-08
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Adiscon LogAnalyzer before 3.6.6 allow remote attackers to inject arbitrary web script or HTML via the hostname in (1) index.php or (2) detail.php.
263 CVE-2014-6064 200 +Info 2014-09-02 2018-12-18
4.0
None Remote Low ??? Partial None None
The Accounts tab in the administrative user interface in McAfee Web Gateway (MWG) before 7.3.2.9 and 7.4.x before 7.4.2 allows remote authenticated users to obtain the hashed user passwords via unspecified vectors.
264 CVE-2014-6060 399 DoS 2014-09-04 2016-06-23
3.3
None Local Network Low Not required None None Partial
The get_option function in dhcpcd 4.0.0 through 6.x before 6.4.3 allows remote DHCP servers to cause a denial of service by resetting the DHO_OPTIONSOVERLOADED option in the (1) bootfile or (2) servername section, which triggers the option to be processed again.
265 CVE-2014-6055 119 DoS Exec Code Overflow 2014-09-30 2020-10-23
6.5
None Remote Low ??? Partial Partial Partial
Multiple stack-based buffer overflows in the File Transfer feature in rfbserver.c in LibVNCServer 0.9.9 and earlier allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a (1) long file or (2) directory name or the (3) FileTime attribute in a rfbFileTransferOffer message.
266 CVE-2014-6051 189 DoS Exec Code Overflow 2014-09-30 2020-10-23
7.5
None Remote Low Not required Partial Partial Partial
Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.
267 CVE-2014-6043 264 1 2014-09-11 2020-03-26
6.5
None Remote Low ??? Partial Partial Partial
ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 does not properly restrict access to the database browser, which allows remote authenticated users to obtain access to the database via a direct request to event/runQuery.do. Fixed in Build 10000.
268 CVE-2014-6041 264 Bypass 2014-09-02 2017-09-08
5.8
None Remote Medium Not required Partial Partial None
The Android WebView in Android before 4.4 allows remote attackers to bypass the Same Origin Policy via a crafted attribute containing a \u0000 character, as demonstrated by an onclick="window.open('\u0000javascript: sequence to the Android Browser application 4.2.1 or a third-party web browser.
269 CVE-2014-6029 20 2014-09-05 2020-01-30
4.9
None Remote Medium ??? None Partial Partial
TorrentFlux 2.4 allows remote authenticated users to delete or modify other users' cookies via the cid parameter in an editCookies action to profile.php.
270 CVE-2014-6028 20 2014-09-05 2020-01-30
4.0
None Remote Low ??? None Partial None
TorrentFlux 2.4 allows remote authenticated users to obtain other users' cookies via the cid parameter in an editCookies action to profile.php.
271 CVE-2014-6025 310 +Info 2014-09-09 2014-09-21
5.4
None Local Network Medium Not required Partial Partial Partial
The Chartboost library before 2.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
272 CVE-2014-6024 310 +Info 2014-09-09 2014-09-12
5.4
None Local Network Medium Not required Partial Partial Partial
The Flurry library before 3.4.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
273 CVE-2014-6023 310 +Info 2014-09-22 2014-09-25
5.4
None Local Network Medium Not required Partial Partial Partial
The s-peek credit rating report (aka com.rhomobile.speek) application 2.1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
274 CVE-2014-6022 310 +Info 2014-09-22 2014-09-25
5.4
None Local Network Medium Not required Partial Partial Partial
The Versent Books (aka com.versentbooks) application 1.1.99 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
275 CVE-2014-6021 310 +Info 2014-09-22 2014-09-25
5.4
None Local Network Medium Not required Partial Partial Partial
The Harley-Davidson Visa (aka com.usbank.icsmobile.harleydavidson) application 1.18 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
276 CVE-2014-6020 310 +Info 2014-09-22 2014-09-24
5.4
None Local Network Medium Not required Partial Partial Partial
The Fuel Rewards Network (aka com.excentus.frn) application 1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
277 CVE-2014-6019 310 +Info 2014-09-22 2014-09-24
5.4
None Local Network Medium Not required Partial Partial Partial
The psychology (aka com.alek.psychology) application 1.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
278 CVE-2014-6018 310 +Info 2014-09-22 2014-09-24
5.4
None Local Network Medium Not required Partial Partial Partial
The global beauty research (aka com.appems.topgirl) application 1.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
279 CVE-2014-6017 310 +Info 2014-09-22 2014-09-24
5.4
None Local Network Medium Not required Partial Partial Partial
The Doodle Drop (aka net.lazyer.DoodleDrop) application 1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
280 CVE-2014-6016 310 +Info 2014-09-22 2014-09-24
5.4
None Local Network Medium Not required Partial Partial Partial
The Celluloid (aka com.eurisko.celluloid) application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
281 CVE-2014-6015 310 +Info 2014-09-22 2014-09-24
5.4
None Local Network Medium Not required Partial Partial Partial
The TuCarro (aka com.tucarro) application 2.0.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
282 CVE-2014-6014 310 +Info 2014-09-22 2014-09-24
5.4
None Local Network Medium Not required Partial Partial Partial
The Conquest Of Fantasia (aka air.com.ingen.studios.cof.sg) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
283 CVE-2014-6013 310 +Info 2014-09-22 2014-09-24
5.4
None Local Network Medium Not required Partial Partial Partial
The nuSquare (aka tw.com.nuphoto.nusquare) application 1.0.78 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
284 CVE-2014-6012 310 +Info 2014-09-22 2014-09-24
5.4
None Local Network Medium Not required Partial Partial Partial
The Gravity Bounce (aka net.toddm.gb) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
285 CVE-2014-6011 310 +Info 2014-09-22 2014-09-24
5.4
None Local Network Medium Not required Partial Partial Partial
The cutprice (aka kr.co.wedoit.cutprice) application 1.0.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
286 CVE-2014-6010 310 +Info 2014-09-22 2014-09-23
5.4
None Local Network Medium Not required Partial Partial Partial
The Rasta Weed Widgets HD (aka aw.awesomewidgets.rastaweed) application 4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
287 CVE-2014-6009 310 +Info 2014-09-22 2014-09-23
5.4
None Local Network Medium Not required Partial Partial Partial
The Zombie Detector (aka com.jimmybolstad.zombiedetector) application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
288 CVE-2014-6008 310 +Info 2014-09-22 2014-09-23
5.4
None Local Network Medium Not required Partial Partial Partial
The Blitz Bingo (aka com.appMobi.sbbingo.app) application 2.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
289 CVE-2014-6007 310 +Info 2014-09-22 2014-09-23
5.4
None Local Network Medium Not required Partial Partial Partial
The LikeHero Get Instagram Likes (aka com.fraoula.likehero) application 1.0.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
290 CVE-2014-6006 310 +Info 2014-09-22 2017-11-30
5.4
None Local Network Medium Not required Partial Partial Partial
The Gratta & Vinci? (aka com.dreamstep.wGrattaevinci) application 0.21.13167.93474 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
291 CVE-2014-6005 310 +Info 2014-09-22 2014-09-23
5.4
None Local Network Medium Not required Partial Partial Partial
The Survey.com Mobile (aka com.survey.android) application 3.2.16 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
292 CVE-2014-6004 310 +Info 2014-09-22 2014-09-23
5.4
None Local Network Medium Not required Partial Partial Partial
The Pocket Cam Photo Editor (aka mobi.pocketcam.editor) application 3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
293 CVE-2014-6003 310 +Info 2014-09-22 2014-09-23
5.4
None Local Network Medium Not required Partial Partial Partial
The Belas Frases de Amor (aka com.goodbarber.frasesdeamor) application 1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
294 CVE-2014-6002 310 +Info 2014-09-22 2014-09-23
5.4
None Local Network Medium Not required Partial Partial Partial
The DTE Energy (aka com.dteenergy.mydte) application 3.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
295 CVE-2014-6001 310 +Info 2014-09-22 2014-09-23
5.4
None Local Network Medium Not required Partial Partial Partial
The gewara (aka com.gewara) application 5.2.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
296 CVE-2014-6000 310 +Info 2014-09-22 2014-09-23
5.4
None Local Network Medium Not required Partial Partial Partial
The FreshDirect (aka com.freshdirect.android) application 2.7.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
297 CVE-2014-5999 310 +Info 2014-09-22 2014-09-23
5.4
None Local Network Medium Not required Partial Partial Partial
The autonavi (aka com.telenav.doudouyou.android.autonavi) application 4.6.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
298 CVE-2014-5998 310 +Info 2014-09-22 2014-09-23
5.4
None Local Network Medium Not required Partial Partial Partial
The SkyDrive Assistant (aka com.dhh.sky) application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
299 CVE-2014-5997 310 +Info 2014-09-22 2014-09-23
5.4
None Local Network Medium Not required Partial Partial Partial
The Auto Trader (aka za.co.autotrader.android.app) application 2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
300 CVE-2014-5996 310 +Info 2014-09-22 2014-09-23
5.4
None Local Network Medium Not required Partial Partial Partial
The DEKRA Used Car Report (aka com.dekra.maengelreport) application 3.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Total number of vulnerabilities : 1150   Page : 1 2 3 4 5 6 (This Page)7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.