Vulnerabilities > Medium

DATE CVE VULNERABILITY TITLE RISK
2014-09-19 CVE-2014-4406 Cross-site Scripting vulnerability in Apple OS X Server
Cross-site scripting (XSS) vulnerability in Xcode Server in CoreCollaboration in Apple OS X Server before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
network
low complexity
apple CWE-79
6.1
2014-09-18 CVE-2014-4373 Unspecified vulnerability in Apple Iphone OS
The IntelAccelerator driver in the IOAcceleratorFamily subsystem in Apple iOS before 8 and Apple TV before 7 allows attackers to cause a denial of service (NULL pointer dereference and device restart) via a crafted application.
local
low complexity
apple
5.5
2014-09-18 CVE-2014-4364 Cryptographic Issues vulnerability in Apple Iphone OS
The 802.1X subsystem in Apple iOS before 8 and Apple TV before 7 does not require strong authentication methods, which allows remote attackers to calculate credentials by offering LEAP authentication from a crafted Wi-Fi AP and then performing a cryptographic attack against the MS-CHAPv1 hash.
high complexity
apple CWE-310
5.6
2014-08-29 CVE-2014-4806 Insufficiently Protected Credentials vulnerability in IBM Security Appscan
The installation process in IBM Security AppScan Enterprise 8.x before 8.6.0.2 iFix 003, 8.7.x before 8.7.0.1 iFix 003, 8.8.x before 8.8.0.1 iFix 002, and 9.0.x before 9.0.0.1 iFix 001 on Linux places a cleartext password in a temporary file, which allows local users to obtain sensitive information by reading this file.
local
low complexity
ibm CWE-522
5.5
2014-07-07 CVE-2013-3993 Path Traversal vulnerability in IBM Infosphere Biginsights
IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted data or code, via crafted parameters in unspecified API calls.
network
low complexity
ibm CWE-22
6.5
2014-06-25 CVE-2014-2005 Improper Authentication vulnerability in Sophos Enterprise Console 5.1/5.2/5.2.1
Sophos Disk Encryption (SDE) 5.x in Sophos Enterprise Console (SEC) 5.x before 5.2.2 does not enforce intended authentication requirements for a resume action from sleep mode, which allows physically proximate attackers to obtain desktop access by leveraging the absence of a login screen.
low complexity
sophos CWE-287
6.8
2014-06-23 CVE-2014-0203 Use After Free vulnerability in multiple products
The __do_follow_link function in fs/namei.c in the Linux kernel before 2.6.33 does not properly handle the last pathname component during use of certain filesystems, which allows local users to cause a denial of service (incorrect free operations and system crash) via an open system call.
local
low complexity
linux oracle CWE-416
5.5
2014-04-30 CVE-2014-1530 Cross-site Scripting vulnerability in multiple products
The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to trigger the loading of a URL with a spoofed baseURI property, and conduct cross-site scripting (XSS) attacks, via a crafted web site that performs history navigation.
6.1
2014-04-30 CVE-2014-1523 Out-of-bounds Write vulnerability in multiple products
Heap-based buffer overflow in the read_u32 function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG image.
6.5
2014-03-25 CVE-2014-2526 Cross-site Scripting vulnerability in Barracudadrive
Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7 allow remote attackers to inject arbitrary web script or HTML via the (1) sForumName or (2) sDescription parameter to Forum/manage/ForumManager.lsp; (3) sHint, (4) sWord, or (5) nId parameter to Forum/manage/hangman.lsp; (6) user parameter to rtl/protected/admin/wizard/setuser.lsp; (7) name or (8) email parameter to feedback.lsp; (9) lname or (10) url parameter to private/manage/PageManager.lsp; (11) cmd parameter to fs; (12) newname, (13) description, (14) firstname, (15) lastname, or (16) id parameter to rtl/protected/mail/manage/list.lsp; or (17) PATH_INFO to fs/.
network
low complexity
barracudadrive CWE-79
6.1