Exploits

    Dashboard / Exploits

    7.5
    High

    CVE-2014-2013

    Last Modified: 21 Jan 2014

    Stack-based buffer overflow in the xps_parse_color function in xps/xps-common.c in MuPDF 1.3 and earlier allows remote attackers to execute arbitrary code via a large number of entries in the ContextColor value of the Fill attribute in a Path element.

    Source:Jean-Jamil Khalife
    Published:3 Mar 2014
    5
    Medium

    CVE-2014-2009

    Last Modified: 4 Mar 2019

    The mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to obtain credentials, the installation path, and other sensitive information via a direct request to api/curllog.log.

    Source:Wireghoul
    Published:12 Sept 2014
    7.5
    High

    CVE-2014-2008

    Last Modified: 4 Mar 2019

    SQL injection vulnerability in confirm.php in the mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to execute arbitrary SQL commands via the TID parameter.

    Source:Wireghoul
    Published:12 Sept 2014
    6.8
    Medium

    CVE-2014-1990

    Last Modified: 13 Nov 2013

    Cross-site request forgery (CSRF) vulnerability in TopAccess (aka the web-based management utility) on TOSHIBA TEC e-Studio 232, 233, 282, and 283 devices allows remote attackers to hijack the authentication of administrators for requests that change passwords.

    Source:Hubert Gradek
    Published:19 Apr 2014
    10
    Critical

    CVE-2014-1982

    Last Modified: 26 Mar 2014

    The administrative interface in Allied Telesis AT-RG634A ADSL Broadband router 3.3+, iMG624A firmware 3.5, iMG616LH firmware 2.4, and iMG646BD firmware 3.5 allows remote attackers to gain privileges and execute arbitrary commands via a direct request to cli.html.

    Source:Groundworks Technologies
    Published:28 Mar 2014
    7.8
    High

    CVE-2014-1947

    Last Modified: 16 Feb 2014

    Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick 6.5.4 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of layers in a PSD image, involving the L%02ld string, a different vulnerability than CVE-2014-2030.

    Source:Mike Czumak
    Published:14 Nov 2013
    7.5
    High

    CVE-2014-1945

    Last Modified: 5 Mar 2014

    SQL injection vulnerability in ajax_udf.php in OpenDocMan before 1.2.7.2 allows remote attackers to execute arbitrary SQL commands via the add_value parameter.

    Source:High-Tech Bridge SA
    Published:7 Mar 2014
    4.3
    Medium

    CVE-2014-1944

    Last Modified: 5 Mar 2014

    Cross-site scripting (XSS) vulnerability in Ilch CMS 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the text parameter to index.php/guestbook/index/newentry.

    Source:High-Tech Bridge SA
    Published:7 Mar 2014
    6.8
    Medium

    CVE-2014-1915

    Last Modified: 12 Dec 2015

    Multiple cross-site request forgery (CSRF) vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to hijack the authentication of (1) administrators for requests that change the administrator password via an update action to sw/admin_change_password.php or (2) unspecified victims for requests that add a topic or blog entry to sw/add_topic.php. NOTE: vector 2 can be leveraged to bypass the authentication requirements for exploiting vector 1 in CVE-2014-1914.

    Source:AtT4CKxT3rR0r1ST
    Published:7 Feb 2014
    7.5
    High

    CVE-2014-1912

    Last Modified: 25 Feb 2014

    Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remote attackers to execute arbitrary code via a crafted string.

    Source:Sha0
    Published:14 Jan 2014
    5
    Medium

    CVE-2014-1908

    Last Modified: 28 Feb 2014

    The error-handling feature in (1) bp.php, (2) videowhisper_streaming.php, and (3) ls/rtmp.inc.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.

    Source:High-Tech Bridge SA
    Published:29 Dec 2014
    6.4
    Medium

    CVE-2014-1907

    Last Modified: 28 Feb 2014

    Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_login.php or (2) delete arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_logout.php.

    Source:High-Tech Bridge SA
    Published:6 Mar 2014
    4.3
    Medium

    CVE-2014-1906

    Last Modified: 28 Feb 2014

    Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) m parameter to lb_status.php; (2) msg parameter to vc_chatlog.php; n parameter to (3) channel.php, (4) htmlchat.php, (5) video.php, or (6) videotext.php; (7) message parameter to lb_logout.php; or ct parameter to (8) lb_status.php or (9) v_status.php in ls/.

    Source:High-Tech Bridge SA
    Published:6 Mar 2014
    10
    Critical

    CVE-2014-1905

    Last Modified: 28 Feb 2014

    Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension, and then accessing the file via a direct request to a wp-content/plugins/videowhisper-live-streaming-integration/ls/snapshots/ pathname, as demonstrated by a .php.jpg filename.

    Source:High-Tech Bridge SA
    Published:29 Dec 2014
    7.5
    High

    CVE-2014-1903

    Last Modified: 12 Apr 2018

    admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the function and args parameters to admin/config.php.

    Source:@0x00string
    Published:18 Feb 2014
    6.5
    Medium

    CVE-2014-1889

    Last Modified: 16 Feb 2014

    The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveraging a missing permissions check.

    Source:Pietro Oliva
    Published:10 Apr 2018
    7.5
    High

    CVE-2014-1854

    Last Modified: 23 Feb 2014

    SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter.

    Source:High-Tech Bridge SA
    Published:27 Feb 2014
    10
    Critical

    CVE-2014-1849

    Last Modified: 8 Jan 2016

    Foscam IP camera 11.37.2.49 and other versions, when using the Foscam DynDNS option, generates credentials based on predictable camera subdomain names, which allows remote attackers to spoof or hijack arbitrary cameras and conduct other attacks by modifying arbitrary camera records in the Foscam DNS server.

    Source:Sergey Shekyan
    Published:14 May 2014
    5
    Medium

    CVE-2014-1843

    Last Modified: 11 Feb 2014

    Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to obtain the property information of an arbitrary home folder via a Properties action with a .. (dot dot) in the src parameter.

    Source:Fara Rustein
    Published:29 Apr 2014
    5
    Medium

    CVE-2014-1842

    Last Modified: 11 Feb 2014

    Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to list all usernames via a Go action with a .. (dot dot) in the search-bar value.

    Source:Fara Rustein
    Published:29 Apr 2014
    5
    Medium

    CVE-2014-1841

    Last Modified: 11 Feb 2014

    Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to copy an arbitrary user's home folder via a Move action with a .. (dot dot) in the src parameter.

    Source:Fara Rustein
    Published:29 Apr 2014
    6.4
    Medium

    CVE-2014-1836

    Last Modified: 25 Jan 2018

    Absolute path traversal vulnerability in htdocs/libraries/image-editor/image-edit.php in ImpressCMS before 1.3.6 allows remote attackers to delete arbitrary files via a full pathname in the image_path parameter in a cancel action.

    Source:Pedro Ribeiro
    Published:1 Jul 2015
    9.3
    Critical

    CVE-2014-1815

    Last Modified: 28 Aug 2014

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, as exploited in the wild in May 2014, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0310.

    Source:PhysicalDrive0
    Published:14 May 2014
    8.8
    High

    CVE-2014-1812

    Last Modified: 22 Apr 2026

    The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly handle distribution of passwords, which allows remote authenticated users to obtain sensitive credential information and consequently gain privileges by leveraging access to the SYSVOL share, as exploited in the wild in May 2014, aka "Group Policy Preferences Password Elevation of Privilege Vulnerability."

    Published:14 May 2014
    10
    Critical

    CVE-2014-1806

    Last Modified: 17 Nov 2014

    The .NET Remoting implementation in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly restrict memory access, which allows remote attackers to execute arbitrary code via vectors involving malformed objects, aka "TypeFilterLevel Vulnerability."

    Source:James Forshaw
    Published:14 May 2014
    9.3
    Critical

    CVE-2014-1805

    Last Modified: 22 Jul 2014

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773, CVE-2014-1783, CVE-2014-1784, CVE-2014-1786, CVE-2014-1795, CVE-2014-2758, CVE-2014-2759, CVE-2014-2765, CVE-2014-2766, and CVE-2014-2775.

    Source:Drozdova Liudmila
    Published:11 Jun 2014
    9.3
    Critical

    CVE-2014-1804

    Last Modified: 22 Jul 2014

    Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1781, CVE-2014-1792, and CVE-2014-2770.

    Source:Drozdova Liudmila
    Published:11 Jun 2014
    9.3
    Critical

    CVE-2014-1803

    Last Modified: 22 Jul 2014

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0282, CVE-2014-1775, CVE-2014-1779, CVE-2014-1799, and CVE-2014-2757.

    Source:Drozdova Liudmila
    Published:11 Jun 2014
    9.3
    Critical

    CVE-2014-1802

    Last Modified: 22 Jul 2014

    Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1772, CVE-2014-1780, CVE-2014-1794, CVE-2014-1797, CVE-2014-2756, CVE-2014-2763, CVE-2014-2764, CVE-2014-2769, and CVE-2014-2771.

    Source:Drozdova Liudmila
    Published:11 Jun 2014
    9.3
    Critical

    CVE-2014-1800

    Last Modified: 22 Jul 2014

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

    Source:Drozdova Liudmila
    Published:11 Jun 2014
    9.3
    Critical

    CVE-2014-1799

    Last Modified: 22 Jul 2014

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0282, CVE-2014-1775, CVE-2014-1779, CVE-2014-1803, and CVE-2014-2757.

    Source:Drozdova Liudmila
    Published:11 Jun 2014
    9.3
    Critical

    CVE-2014-1797

    Last Modified: 22 Jul 2014

    Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1772, CVE-2014-1780, CVE-2014-1794, CVE-2014-1802, CVE-2014-2756, CVE-2014-2763, CVE-2014-2764, CVE-2014-2769, and CVE-2014-2771.

    Source:Drozdova Liudmila
    Published:11 Jun 2014
    9.3
    Critical

    CVE-2014-1796

    Last Modified: 22 Jul 2014

    Microsoft Internet Explorer 6 and 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

    Source:Drozdova Liudmila
    Published:11 Jun 2014
    9.3
    Critical

    CVE-2014-1795

    Last Modified: 22 Jul 2014

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773, CVE-2014-1783, CVE-2014-1784, CVE-2014-1786, CVE-2014-1805, CVE-2014-2758, CVE-2014-2759, CVE-2014-2765, CVE-2014-2766, and CVE-2014-2775.

    Source:Drozdova Liudmila
    Published:11 Jun 2014
    9.3
    Critical

    CVE-2014-1794

    Last Modified: 22 Jul 2014

    Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1772, CVE-2014-1780, CVE-2014-1797, CVE-2014-1802, CVE-2014-2756, CVE-2014-2763, CVE-2014-2764, CVE-2014-2769, and CVE-2014-2771.

    Source:Drozdova Liudmila
    Published:11 Jun 2014
    9.3
    Critical

    CVE-2014-1792

    Last Modified: 22 Jul 2014

    Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1781, CVE-2014-1804, and CVE-2014-2770.

    Source:Drozdova Liudmila
    Published:11 Jun 2014
    9.3
    Critical

    CVE-2014-1791

    Last Modified: 22 Jul 2014

    Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

    Source:Drozdova Liudmila
    Published:11 Jun 2014
    9.3
    Critical

    CVE-2014-1790

    Last Modified: 22 Jul 2014

    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1789.

    Source:Drozdova Liudmila
    Published:11 Jun 2014
    9.3
    Critical

    CVE-2014-1789

    Last Modified: 22 Jul 2014

    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1790.

    Source:Drozdova Liudmila
    Published:11 Jun 2014
    9.3
    Critical

    CVE-2014-1788

    Last Modified: 22 Jul 2014

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1774 and CVE-2014-2754.

    Source:Drozdova Liudmila
    Published:11 Jun 2014
    9.3
    Critical

    CVE-2014-1786

    Last Modified: 22 Jul 2014

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773, CVE-2014-1783, CVE-2014-1784, CVE-2014-1795, CVE-2014-1805, CVE-2014-2758, CVE-2014-2759, CVE-2014-2765, CVE-2014-2766, and CVE-2014-2775.

    Source:Drozdova Liudmila
    Published:11 Jun 2014
    9.3
    Critical

    CVE-2014-1785

    Last Modified: 22 Dec 2016

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1769, CVE-2014-1782, CVE-2014-2753, CVE-2014-2755, CVE-2014-2760, CVE-2014-2761, CVE-2014-2772, and CVE-2014-2776.

    Source:Skylined
    Published:11 Jun 2014
    9.3
    Critical

    CVE-2014-1784

    Last Modified: 22 Jul 2014

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773, CVE-2014-1783, CVE-2014-1786, CVE-2014-1795, CVE-2014-1805, CVE-2014-2758, CVE-2014-2759, CVE-2014-2765, CVE-2014-2766, and CVE-2014-2775.

    Source:Drozdova Liudmila
    Published:11 Jun 2014
    9.3
    Critical

    CVE-2014-1783

    Last Modified: 22 Jul 2014

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773, CVE-2014-1784, CVE-2014-1786, CVE-2014-1795, CVE-2014-1805, CVE-2014-2758, CVE-2014-2759, CVE-2014-2765, CVE-2014-2766, and CVE-2014-2775.

    Source:Drozdova Liudmila
    Published:11 Jun 2014
    9.3
    Critical

    CVE-2014-1782

    Last Modified: 22 Jul 2014

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1769, CVE-2014-1785, CVE-2014-2753, CVE-2014-2755, CVE-2014-2760, CVE-2014-2761, CVE-2014-2772, and CVE-2014-2776.

    Source:Drozdova Liudmila
    Published:11 Jun 2014
    9.3
    Critical

    CVE-2014-1781

    Last Modified: 22 Jul 2014

    Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1792, CVE-2014-1804, and CVE-2014-2770.

    Source:Drozdova Liudmila
    Published:11 Jun 2014
    9.3
    Critical

    CVE-2014-1780

    Last Modified: 22 Jul 2014

    Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1772, CVE-2014-1794, CVE-2014-1797, CVE-2014-1802, CVE-2014-2756, CVE-2014-2763, CVE-2014-2764, CVE-2014-2769, and CVE-2014-2771.

    Source:Drozdova Liudmila
    Published:11 Jun 2014
    9.3
    Critical

    CVE-2014-1779

    Last Modified: 22 Jul 2014

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0282, CVE-2014-1775, CVE-2014-1799, CVE-2014-1803, and CVE-2014-2757.

    Source:Drozdova Liudmila
    Published:11 Jun 2014
    6.8
    Medium

    CVE-2014-1778

    Last Modified: 22 Jul 2014

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary web script with increased privileges via unspecified vectors, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2014-2777.

    Source:Drozdova Liudmila
    Published:11 Jun 2014
    4.3
    Medium

    CVE-2014-1777

    Last Modified: 22 Jul 2014

    Microsoft Internet Explorer 10 and 11 allows remote attackers to read local files on the client via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."

    Source:Drozdova Liudmila
    Published:11 Jun 2014
    Items Per Page