Vulnerabilities
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2014-05-06 | CVE-2014-2558 | Code Injection vulnerability in Skyphe File-Gallery The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a \' (backslash quote) in the setting fields to /wp-admin/options-media.php, related to the create_function function. | 6.5 |
| 2014-05-06 | CVE-2013-7354 | Numeric Errors vulnerability in Libpng Multiple integer overflows in libpng before 1.5.14rc03 allow remote attackers to cause a denial of service (crash) via a crafted image to the (1) png_set_sPLT or (2) png_set_text_2 function, which triggers a heap-based buffer overflow. | 5.0 |
| 2014-05-06 | CVE-2013-7353 | Numeric Errors vulnerability in Libpng Integer overflow in the png_set_unknown_chunks function in libpng/pngset.c in libpng before 1.5.14beta08 allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a crafted image, which triggers a heap-based buffer overflow. | 5.0 |
| 2014-05-06 | CVE-2014-2347 | Permissions, Privileges, and Access Controls vulnerability in Amtelco Misecuremessages 6.2 Amtelco miSecureMessages (aka MSM) 6.2 does not properly manage sessions, which allows remote authenticated users to obtain sensitive information via a modified message request. | 3.5 |
| 2014-05-06 | CVE-2014-0198 | NULL Pointer Dereference vulnerability in multiple products The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors that trigger an alert condition. | 4.3 |
| 2014-05-06 | CVE-2014-0185 | Improper Privilege Management vulnerability in PHP sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a crafted FastCGI client. | 7.2 |
| 2014-05-05 | CVE-2014-3220 | Credentials Management vulnerability in F5 Big-Iq 4.1.0.2013.0 F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary users via the name parameter in a request to the user's page in mgmt/shared/authz/users/. | 9.0 |
| 2014-05-05 | CVE-2014-0149 | Cross-Site Scripting vulnerability in Redhat Jboss web Framework KIT 2.5.0 Multiple cross-site scripting (XSS) vulnerabilities in Red Hat JBoss Web Framework Kit 2.5.0 allow remote attackers to inject arbitrary web script or HTML via a (1) parameter or (2) id name. | 4.3 |
| 2014-05-05 | CVE-2013-7375 | SQL Injection vulnerability in PHP-Fusion SQL injection vulnerability in includes/classes/Authenticate.class.php in PHP-Fusion 7.02.01 through 7.02.05 allows remote attackers to execute arbitrary SQL commands via the user ID in a user cookie, a different vulnerability than CVE-2013-1803. | 7.5 |
| 2014-05-05 | CVE-2013-7034 | Code Injection vulnerability in Livezilla The setCookieValue function in _lib/functions.global.inc.php in LiveZilla before 5.1.2.1 allows remote attackers to execute arbitrary PHP code via a serialized PHP object in a cookie. | 7.5 |