Vulnerabilities > Medium

DATE CVE VULNERABILITY TITLE RISK
2014-03-19 CVE-2014-1496 Improper Privilege Management vulnerability in multiple products
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 might allow local users to gain privileges by modifying the extracted Mar contents during an update.
local
low complexity
mozilla suse CWE-269
5.5
2014-03-19 CVE-2014-2120 Cross-site Scripting vulnerability in Cisco Adaptive Security Appliance Software
Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025.
network
low complexity
cisco CWE-79
6.1
2014-03-18 CVE-2014-2532 Permissions, Privileges, and Access Controls vulnerability in multiple products
sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character.
network
high complexity
oracle openbsd CWE-264
4.9
2014-02-18 CVE-2014-2019 Permissions, Privileges, and Access Controls vulnerability in Apple Iphone OS
The iCloud subsystem in Apple iOS before 7.1 allows physically proximate attackers to bypass an intended password requirement, and turn off the Find My iPhone service or complete a Delete Account action and then associate this service with a different Apple ID account, by entering an arbitrary iCloud Account Password value and a blank iCloud Account Description value.
low complexity
apple CWE-264
4.6
2013-12-31 CVE-2013-3572 Cross-site Scripting vulnerability in UI Unifi Controller
Cross-site scripting (XSS) vulnerability in the administer interface in the UniFi Controller in Ubiquiti Networks UniFi 2.3.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted client hostname.
network
low complexity
ui CWE-79
6.1
2013-12-11 CVE-2013-6673 Cryptographic Issues vulnerability in multiple products
Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 do not recognize a user's removal of trust from an EV X.509 certificate, which makes it easier for man-in-the-middle attackers to spoof SSL servers in opportunistic circumstances via a valid certificate that is unacceptable to the user.
5.9
2013-11-19 CVE-2013-5223 Cross-site Scripting vulnerability in Dlink Dsl-2760U Firmware
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev.
network
low complexity
dlink CWE-79
5.4
2013-10-09 CVE-2013-3896 Unspecified vulnerability in Microsoft Silverlight
Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application, aka "Silverlight Vulnerability."
local
low complexity
microsoft
5.5
2013-06-07 CVE-2013-2128 Resource Exhaustion vulnerability in Linux Kernel
The tcp_read_sock function in net/ipv4/tcp.c in the Linux kernel before 2.6.34 does not properly manage skb consumption, which allows local users to cause a denial of service (system crash) via a crafted splice system call for a TCP socket.
local
low complexity
linux CWE-400
5.5
2013-05-16 CVE-2013-1675 Improper Initialization vulnerability in multiple products
Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
network
low complexity
mozilla canonical debian redhat opensuse CWE-665
6.5