원본기사확인하기: [US-CERT: Bulletin(SB14-202)] 2014년 7월 14일까지 발표된 보안 취약점
The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:
-
High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0
-
Medium - Vulnerabilities will be labeled Medium severity if they have a CVSS base score of 4.0 - 6.9
-
Low - Vulnerabilities will be labeled Low severity if they have a CVSS base score of 0.0 - 3.9
Entries may include additional information provided by organizations and efforts sponsored by US-CERT. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletins is compiled from external, open source reports and is not a direct result of US-CERT analysis.
High Vulnerabilities
| Primary Vendor -- Product |
Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| cisco -- dpc3010 | The web server on Cisco DPC3010, DPC3212, DPC3825, DPC3925, DPQ3925, EPC3010, EPC3212, EPC3825, and EPC3925 Wireless Residential Gateway products allows remote attackers to execute arbitrary code via a crafted HTTP request, aka Bug ID CSCup40808. | 2014-07-17 | 10.0 | CVE-2014-3306 |
| dahuasecurity -- dvr_firmware | Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777. | 2014-07-11 | 7.5 | CVE-2013-6117 OSVDB EXPLOIT-DB BUGTRAQ MISC MISC |
| datumsystems -- snip | Datum Systems SnIP on PSM-500 and PSM-4500 devices does not require authentication for FTP sessions, which allows remote attackers to obtain sensitive information via RETR commands. | 2014-07-14 | 7.8 | CVE-2014-2950 |
| datumsystems -- snip | Datum Systems SnIP on PSM-500 and PSM-4500 devices has a hardcoded password of admin for the admin account, which makes it easier for remote attackers to obtain access via unspecified vectors. | 2014-07-14 | 10.0 | CVE-2014-2951 |
| hp -- storage_management_software | Unspecified vulnerability in HP StoreVirtual 4000 Storage and StoreVirtual VSA 9.5 through 11.0 allows remote authenticated users to gain privileges via unknown vectors. | 2014-07-16 | 9.0 | CVE-2014-2606 |
| hp -- imc_branch_intelligent_ |
Unspecified vulnerability in HP Intelligent Management Center (iMC) before 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before 7.0 E0201P02 allows remote attackers to obtain sensitive information via unknown vectors, aka ZDI-CAN-2080. | 2014-07-16 | 7.8 | CVE-2014-2618 |
| hp -- imc_branch_intelligent_ |
Unspecified vulnerability in HP Intelligent Management Center (iMC) before 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before 7.0 E0201P02 allows remote attackers to obtain sensitive information via unknown vectors, aka ZDI-CAN-2088. | 2014-07-16 | 7.8 | CVE-2014-2619 |
| hp -- imc_branch_intelligent_ |
Unspecified vulnerability in HP Intelligent Management Center (iMC) before 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before 7.0 E0201P02 allows remote attackers to obtain sensitive information via unknown vectors, aka ZDI-CAN-2089. | 2014-07-16 | 7.8 | CVE-2014-2620 |
| hp -- imc_branch_intelligent_ |
Unspecified vulnerability in HP Intelligent Management Center (iMC) before 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before 7.0 E0201P02 allows remote attackers to obtain sensitive information via unknown vectors, aka ZDI-CAN-2090. | 2014-07-16 | 7.8 | CVE-2014-2621 |
| hp -- imc_branch_intelligent_ |
Unspecified vulnerability in HP Intelligent Management Center (iMC) before 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before 7.0 E0201P02 allows remote authenticated users to obtain sensitive information or modify data via unknown vectors, aka ZDI-CAN-2312. | 2014-07-16 | 8.5 | CVE-2014-2622 HP HP |
| hp -- storage_data_protector | Unspecified vulnerability in HP Storage Data Protector 8.x allows remote attackers to execute arbitrary code via unknown vectors. | 2014-07-17 | 10.0 | CVE-2014-2623 |
| infoblox -- netmri | config/userAdmin/login.tdf in Infoblox NetMRI before 6.8.5 allows remote attackers to execute arbitrary commands via shell metacharacters in the skipjackUsername parameter. | 2014-07-15 | 10.0 | CVE-2014-3418 MISC XF BID BUGTRAQ EXPLOIT-DB FULLDISC MISC |
| infoblox -- netmri | Infoblox NetMRI before 6.8.5 has a default password of admin for the "root" MySQL database account, which makes it easier for local users to obtain access via unspecified vectors. | 2014-07-15 | 7.2 | CVE-2014-3419 MISC XF SECTRACK BID BUGTRAQ MISC MISC |
| juniper -- srx100 | Juniper Junos 12.1X46 before 12.1X46-D20 and 12.1X47 before 12.1X47-D10 on SRX Series devices allows remote attackers to cause a denial of service (flowd crash) via a crafted SIP packet. | 2014-07-11 | 7.8 | CVE-2014-3815 SECTRACK |
| juniper -- junos | Juniper Junos 11.4 before 11.4R12, 12.1 before 12.1R11, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D30, 12.1X46 before 12.1X46-D20, 12.1X47 before 12.1X47-D10, 12.2 before 12.2R8-S2, 12.3 before 12.3R7, 13.1 before 13.1R4-S2, 13.2 before 13.2R5, 13.3 before 13.3R2-S2, and 14.1 before 14.1R1 allows remote authenticated users to gain privileges via unspecified combinations of CLI commands and arguments. | 2014-07-11 | 9.0 | CVE-2014-3816 SECTRACK |
| juniper -- srx100 | Juniper Junos 11.4 before 11.4R12, 12.1X44 before 12.1X44-D32, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, and 12.1X47 before 12.1X47-D10 on SRX Series devices, when NAT protocol translation from IPv4 to IPv6 is enabled, allows remote attackers to cause a denial of service (flowd hang or crash) via a crafted packet. | 2014-07-11 | 7.8 | CVE-2014-3817 SECTRACK |
| juniper -- junos | Juniper Junos 11.4 before 11.4R12, 12.1 before 12.1R10, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, 12.1X47 before 12.1X47-D10, 12.2 before 12.2R8, 12.3 before 12.3R7, 13.1 before 13.1R4, 13.2 before 13.2R4, 13.3 before 13.3R2, and 14.1 before 14.1R1, when Auto-RP is enabled, allows remote attackers to cause a denial of service (RDP routing process crash and restart) via a malformed PIM packet. | 2014-07-11 | 7.8 | CVE-2014-3819 SECTRACK BID |
| oracle -- jdk | Unspecified vulnerability in the Java SE component in Oracle Java SE Java SE 7u60 and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-4223. NOTE: the previous information is from the July 2014 CPU. Oracle has not commented on another vendor's claim that the issue is related to improper restriction of the "use of privileged annotations." | 2014-07-17 | 9.3 | CVE-2014-2483 CONFIRM |
| oracle -- jdk | Unspecified vulnerability in the Java SE component in Oracle Java SE 7u60 and SE 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. | 2014-07-17 | 9.3 | CVE-2014-2490 |
| oracle -- jdk | Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. | 2014-07-17 | 9.3 | CVE-2014-4216 |
| oracle -- jdk | Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. | 2014-07-17 | 9.3 | CVE-2014-4219 |
| oracle -- jdk | Unspecified vulnerability in Oracle Java SE 7u60 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-2483. | 2014-07-17 | 9.3 | CVE-2014-4223 |
| oracle -- jdk | Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. | 2014-07-17 | 10.0 | CVE-2014-4227 |
| oracle -- jdk | Unspecified vulnerability in Oracle Java SE 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX. | 2014-07-17 | 9.3 | CVE-2014-4247 |
| oracle -- fusion_middleware | Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.8.0 allows remote attackers to affect confidentiality via unknown vectors related to Portlet Services. | 2014-07-17 | 7.1 | CVE-2014-4257 |
| oracle -- jdk | Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. | 2014-07-17 | 9.3 | CVE-2014-4262 |
| raritan -- dpxr20a-16 | Raritan PX before 1.5.11 on DPXR20A-16 devices allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password. | 2014-07-14 | 10.0 | CVE-2014-2955 FULLDISC |
| wp_rss_poster_plugin_project -- wp-rss-poster | SQL injection vulnerability in the WP Rss Poster (wp-rss-poster) plugin 1.0.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in the wrp-add-new page to wp-admin/admin.php. | 2014-07-11 | 7.5 | CVE-2014-4938 MISC |
| yealink -- sip-t38g | config/.htpasswd in Yealink IP Phone SIP-T38G have a hardcoded password of (1) user (s7C9Cx.rLsWFA) for the user account, (2) admin (uoCbM.VEiKQto) for the admin account, and (3) var (jhl3iZAe./qXM) for the var account, which makes it easier for remote attackers to obtain access via unspecified vectors. | 2014-07-16 | 7.8 | CVE-2013-5755 EXPLOIT-DB |
| zte -- zxv10_w300 | The ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK has a default password of admin for the admin account, which makes it easier for remote attackers to obtain access via unspecified vectors. | 2014-07-16 | 7.8 | CVE-2014-4018 MISC EXPLOIT-DB MISC |
Medium Vulnerabilities
| Primary Vendor -- Product |
Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| arubanetworks -- clearpass | SQL injection vulnerability in the Policy Manager in Aruba Networks ClearPass 5.x, 6.0.x, 6.1.x through 6.1.4.61696, 6.2.x through 6.2.6.62196, and 6.3.x before 6.3.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. | 2014-07-14 | 4.9 | CVE-2014-4013 SECUNIA |
| arubanetworks -- clearpass | The Policy Manager in Aruba Networks ClearPass 5.x, 6.0.x, 6.1.x through 6.1.4.61696, 6.2.x through 6.2.6.62196, and 6.3.x before 6.3.4 allows remote authenticated users to obtain database credentials via unspecified vectors. | 2014-07-15 | 4.0 | CVE-2014-4031 SECUNIA |
| bannersky -- bsk_pdf_manager | Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) categoryid or (2) pdfid parameter to wp-admin/admin.php. | 2014-07-14 | 6.5 | CVE-2014-4944 BID MISC |
| bestpractical -- rt | Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remote attackers to cause a denial of service (CPU consumption) via a string without an address. | 2014-07-15 | 5.0 | CVE-2014-1474 |
| binarymoon -- timthumb | TimThumb 2.8.13 and WordThumb 1.07, when Webshot (aka Webshots) is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the src parameter. | 2014-07-15 | 6.8 | CVE-2014-4663 CONFIRM CONFIRM EXPLOIT-DB SECUNIA MLIST FULLDISC FULLDISC MISC |
| bookx_plugin_project -- bookx | Directory traversal vulnerability in includes/bookx_export.php BookX plugin 1.7 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. | 2014-07-11 | 5.0 | CVE-2014-4937 MISC |
| cisco -- adaptive_security_appliance_ |
Cisco Adaptive Security Appliance (ASA) Software 8.4(.6) and earlier, when using an unsupported configuration with overlapping criteria for filtering and inspection, allows remote attackers to cause a denial of service (traffic loop and device crash) via a packet that triggers multiple matches, aka Bug ID CSCui45606. | 2014-07-14 | 5.4 | CVE-2013-5567 XF SECTRACK BID |
| cisco -- adaptive_security_appliance_ |
The WebVPN CIFS implementation in Cisco Adaptive Security Appliance (ASA) Software 9.0(.4.1) and earlier allows remote CIFS servers to cause a denial of service (device reload) via a long share list, aka Bug ID CSCuj83344. | 2014-07-14 | 6.8 | CVE-2013-6691 XF SECTRACK BID |
| cisco -- unified_communications_manager | Directory traversal vulnerability in the Multiple Analyzer in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager 10.0(1) allows remote authenticated users to delete arbitrary files via a crafted URL, aka Bug ID CSCup76314. | 2014-07-14 | 5.5 | CVE-2014-3317 XF SECTRACK BID SECUNIA |
| cisco -- unified_communications_manager | Directory traversal vulnerability in the Real-Time Monitoring Tool (RTMT) in Cisco Unified Communications Manager (CM) 10.0(1) allows remote authenticated users to read arbitrary files via a crafted URL, aka Bug ID CSCup57676. | 2014-07-14 | 6.8 | CVE-2014-3319 XF SECTRACK SECUNIA |
| cisco -- unified_communications_domain_ |
Multiple open redirect vulnerabilities in the admin web interface in the web framework in Cisco Unified Communications Domain Manager (CDM) 8.1(.4) and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted URLs for unspecified scripts, aka Bug ID CSCuo48835. | 2014-07-17 | 5.8 | CVE-2014-3320 |
| cisco -- asr_9000_rsp440_router | Cisco IOS XR 4.3.4 and earlier on ASR 9000 devices, when bridge-group virtual interface (BVI) routing is enabled, allows remote attackers to cause a denial of service (chip and card hangs) via a series of crafted MPLS packets, aka Bug ID CSCuo91149. | 2014-07-17 | 5.7 | CVE-2014-3321 |
| cisco -- unified_contact_center_ |
Directory traversal vulnerability in Cisco Unified Contact Center Enterprise allows remote authenticated users to read arbitrary web-root files via a crafted URL, aka Bug ID CSCun25262. | 2014-07-17 | 4.0 | CVE-2014-3323 |
| citrix -- netscaler_access_gateway | Cross-site scripting (XSS) vulnerability in administration user interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (formerly Access Gateway Enterprise Edition) 10.1 before 10.1-126.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 2014-07-16 | 4.3 | CVE-2014-4346 SECTRACK SECTRACK |
| citrix -- netscaler_access_gateway | Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (formerly Access Gateway Enterprise Edition) before 9.3-62.4 and 10.x before 10.1-126.12 allows attackers to obtain sensitive information via vectors related to a cookie. | 2014-07-16 | 5.0 | CVE-2014-4347 SECTRACK SECTRACK |
| citrix -- xendesktop | Citrix XenDesktop 7.x, 5.x, and 4.x, when pooled random desktop groups is enabled and ShutdownDesktopsAfterUse is disabled, allows local guest users to gain access to another user's desktop via unspecified vectors. | 2014-07-11 | 4.9 | CVE-2014-4700 XF SECTRACK BID SECUNIA |
| cross-rss_plugin_project -- wp-cross-rss | Absolute path traversal vulnerability in Cross-RSS (wp-cross-rss) plugin 1.7 for WordPress allows remote attackers to read arbitrary files via a full pathname in the rss parameter to proxy.php. | 2014-07-11 | 5.0 | CVE-2014-4941 MISC |
| dell -- sonicwall_scrutinizer | Dell SonicWall Scrutinizer 11.0.1 allows remote authenticated users to change the change user passwords via the user ID in the savePrefs parameter in a change password request to cgi-bin/admin.cgi. | 2014-07-16 | 5.5 | CVE-2014-4976 MISC MISC XF BID FULLDISC MISC |
| dell -- sonicwall_scrutinizer | Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) selectedUserGroup parameter in a create new user request to cgi-bin/admin.cgi or the (2) user_id parameter in the changeUnit function, (3) methodDetail parameter in the methodDetail function, or (4) xcNetworkDetail parameter in the xcNetworkDetail function in d4d/exporters.php. | 2014-07-16 | 6.5 | CVE-2014-4977 MISC MISC XF BID FULLDISC MISC |
| enl_newsletter_plugin_project -- enl-newsletter | SQL injection vulnerability in the ENL Newsletter (enl-newsletter) plugin 1.0.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the enl-add-new page to wp-admin/admin.php. | 2014-07-11 | 6.5 | CVE-2014-4939 MISC |
| fortinet -- fortiweb | Multiple cross-site scripting (XSS) vulnerabilities in FortiGuard FortiWeb 5.0.x, 5.1.x, and 5.2.x before 5.2.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) user/ldap_user/check_dlg or (2) user/radius_user/check_dlg. | 2014-07-11 | 4.3 | CVE-2014-4738 SECTRACK BID SECUNIA |
| freebsd -- freebsd | FreeBSD 8.4 before p14, 9.1 before p17, 9.2 before p10, and 10.0 before p7 does not properly initialize the buffer between the header and data of a control message, which allows local users to obtain sensitive information from kernel memory via unspecified vectors. | 2014-07-15 | 4.9 | CVE-2014-3952 XF SECTRACK BID |
| freebsd -- freebsd | FreeBSD 8.4 before p14, 9.1 before p17, 9.2 before p10, and 10.0 before p7 does not properly initialize certain data structures, which allows local users to obtain sensitive information from kernel memory via a (1) SCTP_SNDRCV, (2) SCTP_EXTRCV, or (3) SCTP_RCVINFO SCTP cmsg or a (4) SCTP_PEER_ADDR_CHANGE, (5) SCTP_REMOTE_ERROR, or (6) SCTP_AUTHENTICATION_EVENT notification. | 2014-07-15 | 4.9 | CVE-2014-3953 SECTRACK |
| horde -- groupware | Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via an unspecified flag in the basic (1) mailbox or (2) message view. | 2014-07-14 | 4.3 | CVE-2014-4945 CONFIRM CONFIRM SECUNIA SECUNIA |
| horde -- groupware | Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via (1) unspecified flags or (2) a mailbox name in the dynamic mailbox view. | 2014-07-14 | 4.3 | CVE-2014-4946 CONFIRM CONFIRM SECUNIA SECUNIA MLIST |
| hp -- storage_management_software | Unspecified vulnerability in HP StoreVirtual 4000 Storage and StoreVirtual VSA 9.5 through 11.0 allows remote attackers to obtain sensitive information via unknown vectors. | 2014-07-16 | 5.0 | CVE-2014-2605 |
| ibm -- business_process_manager | Cross-site scripting (XSS) vulnerability in IBM Business Process Manager 7.5 through 8.5.5, and WebSphere Lombardi Edition 7.2, allows remote attackers to inject arbitrary web script or HTML via a crafted URL that triggers a service failure. | 2014-07-17 | 4.3 | CVE-2014-0957 XF |
| juniper -- junos | Cross-site scripting (XSS) vulnerability in SRX Web Authentication (webauth) in Juniper Junos 11.4 before 11.4R11, 12.1X44 before 12.1X44-D34, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, and 12.1X47 before 12.1X47-D10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 2014-07-11 | 4.3 | CVE-2014-3821 SECTRACK BID |
| juniper -- srx100 | Juniper Junos 11.4 before 11.4R8, 12.1 before 12.1R5, 12.1X44 before 12.1X44-D20, 12.1X45 before 12.1X45-D15, 12.1X46 before 12.1X46-D10, and 12.1X47 before 12.1X47-D10 on SRX Series devices, allows remote attackers to cause a denial of service (flowd crash) via a malformed packet, related to translating IPv6 to IPv4. | 2014-07-11 | 5.4 | CVE-2014-3822 SECTRACK |
| levelfourdevelopment -- wp-easycart | The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo function. | 2014-07-11 | 5.0 | CVE-2014-4942 MISC |
| mysql -- mysql | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier and 5.6.17 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SRINFOSC. | 2014-07-17 | 6.5 | CVE-2014-4258 |
| mysql -- mysql | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier, and 5.6.17 and earlier, allows remote authenticated users to affect integrity and availability via vectors related to SRCHAR. | 2014-07-17 | 5.5 | CVE-2014-4260 |
| op5 -- monitor | Cross-site scripting (XSS) vulnerability in share/pnp/application/views/ |
2014-07-11 | 4.3 | CVE-2014-4907 CONFIRM BID SECUNIA SECUNIA MLIST |
| oracle -- mojarra | Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors. | 2014-07-17 | 4.3 | CVE-2013-5855 CONFIRM CONFIRM MISC |
| oracle -- hyperion | Unspecified vulnerability in the Hyperion BI+ component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote attackers to affect integrity via unknown vectors related to Web Analysis. | 2014-07-17 | 4.3 | CVE-2014-0436 |
| oracle -- peoplesoft_products | Unspecified vulnerability in the PeopleSoft Enterprise ELS Enterprise Learning Management component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors. | 2014-07-17 | 5.5 | CVE-2014-2456 |
| oracle -- fusion_middleware | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS - Web Services. | 2014-07-17 | 6.8 | CVE-2014-2479 |
| oracle -- fusion_middleware | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2014-2481. | 2014-07-17 | 6.8 | CVE-2014-2480 |
| oracle -- fusion_middleware | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2014-2480. | 2014-07-17 | 6.8 | CVE-2014-2481 |
| oracle -- e-business_suite | Unspecified vulnerability in the Oracle Concurrent Processing component in Oracle E-Business Suite 12.1.3, 12.2.2, and 12.2.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors. | 2014-07-17 | 5.5 | CVE-2014-2482 |
| oracle -- mysql | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.17 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SRFTS. | 2014-07-17 | 6.5 | CVE-2014-2484 |
| oracle -- vm_virtualbox | Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, and 4.3.14, when running on Windows, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-4261. | 2014-07-17 | 6.9 | CVE-2014-2487 |
| oracle -- vm_virtualbox | Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, and 4.3.12 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core. | 2014-07-17 | 4.1 | CVE-2014-2489 |
| oracle -- siebel_crm | Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to Portal Framework, a different vulnerability than CVE-2014-4205. | 2014-07-17 | 4.3 | CVE-2014-2491 |
| oracle -- supply_chain_products_suite | Unspecified vulnerability in the Oracle Agile Product Collaboration component in Oracle Supply Chain Products Suite 9.3.3 allows remote attackers to affect integrity via unknown vectors related to Web client (PC). | 2014-07-17 | 4.3 | CVE-2014-2492 |
| oracle -- fusion_middleware | Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.2.4.0, and 12.1.2.0.0 allows remote attackers to affect confidentiality and availability via vectors related to ADF Faces. | 2014-07-17 | 6.4 | CVE-2014-2493 |
| oracle -- mysql | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier allows remote authenticated users to affect availability via vectors related to ENARC. | 2014-07-17 | 4.0 | CVE-2014-2494 |
| oracle -- peoplesoft_products | Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Test Framework. | 2014-07-17 | 5.5 | CVE-2014-2496 |
| oracle -- fusion_middleware | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect availability via vectors related to WLS - Web Services. | 2014-07-17 | 5.0 | CVE-2014-4201 |
| oracle -- fusion_middleware | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect availability via vectors related to WLS - Web Services. | 2014-07-17 | 5.0 | CVE-2014-4202 |
| oracle -- hyperion | Unspecified vulnerability in the Hyperion Enterprise Performance Management Architect component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Property Editing. | 2014-07-17 | 4.1 | CVE-2014-4203 |
| oracle -- siebel_crm | Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to Portal Framework, a different vulnerability than CVE-2014-2491. | 2014-07-17 | 4.3 | CVE-2014-4205 |
| oracle -- mysql | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier allows remote authenticated users to affect availability via vectors related to SROPTZR. | 2014-07-17 | 4.0 | CVE-2014-4207 |
| oracle -- jdk | Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality and integrity via vectors related to JMX. | 2014-07-17 | 6.4 | CVE-2014-4209 |
| oracle -- fusion_middleware | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allows remote attackers to affect confidentiality via vectors related to WLS - Web Services. | 2014-07-17 | 5.0 | CVE-2014-4210 |
| oracle -- fusion_middleware | Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.7 and 11.1.1.8 allows remote attackers to affect integrity via unknown vectors related to Portlet Services. | 2014-07-17 | 5.0 | CVE-2014-4211 |
| oracle -- fusion_middleware | Unspecified vulnerability in the Oracle Fusion Middleware component in Oracle Fusion Middleware 11.1.1.7 allows remote attackers to affect confidentiality via unknown vectors related to Process Mgmt and Notification. | 2014-07-17 | 4.3 | CVE-2014-4212 |
| oracle -- e-business_suite | Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 12.0.6, 12.1.3, 12.2.2, and 12.2.3 allows remote attackers to affect integrity via unknown vectors. | 2014-07-17 | 4.3 | CVE-2014-4213 |
| oracle -- sunos | Unspecified vulnerability in Oracle Solaris 10 and 11.1 allows local users to affect availability via vectors related to CPU performance counters (CPC) drivers. | 2014-07-17 | 4.9 | CVE-2014-4215 |
| oracle -- fusion_middleware | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, and 12.1.1.0 allows remote attackers to affect integrity via vectors related to WLS - Web Services. | 2014-07-17 | 4.3 | CVE-2014-4217 |
| oracle -- jdk | Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect integrity via unknown vectors related to Libraries. | 2014-07-17 | 5.0 | CVE-2014-4218 |
| oracle -- jdk | Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4208. | 2014-07-17 | 5.0 | CVE-2014-4220 |
| oracle -- jdk | Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Libraries. | 2014-07-17 | 4.3 | CVE-2014-4221 |
| oracle -- sunos | Unspecified vulnerability in Oracle Sun Solaris 8, 9, 10, and 11.1 allows local users to affect availability via unknown vectors related to sockfs. | 2014-07-17 | 4.9 | CVE-2014-4224 |
| oracle -- peoplesoft_products | Unspecified vulnerability in the PeopleSoft Enterprise FIN Install component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. | 2014-07-17 | 5.1 | CVE-2014-4226 |
| oracle -- vm_virtualbox | Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.1.34, 4.2.26, and 4.3.12 allows local users to affect confidentiality, integrity, and availability via vectors related to Graphics driver (WDDM) for Windows guests. | 2014-07-17 | 4.4 | CVE-2014-4228 |
| oracle -- supply_chain_products_suite | Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.2, 6.3, 6.3.1, 6.3.2, 6.3.3, and 6.3.4 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Data, Domain, and Function Security. | 2014-07-17 | 5.5 | CVE-2014-4229 |
| oracle -- siebel_crm | Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via vectors related to Open_UI. | 2014-07-17 | 4.3 | CVE-2014-4230 |
| oracle -- siebel_crm | Unspecified vulnerability in the Siebel Travel & Transportation component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to Diary. | 2014-07-17 | 4.3 | CVE-2014-4231 |
| oracle -- virtualization | Unspecified vulnerability in the Oracle Secure Global Desktop (SGD) component in Oracle Virtualization 4.63, 4.71, 5.0, and 5.1 allows remote attackers to affect integrity via unknown vectors related to Workspace Web Application. | 2014-07-17 | 4.3 | CVE-2014-4232 |
| oracle -- mysql | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.17 and earlier allows remote authenticated users to affect availability via vectors related to SRREP. | 2014-07-17 | 4.0 | CVE-2014-4233 |
| oracle -- supply_chain_products_suite | Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3, 6.3.1, 6.3.2, 6.3.3, and 6.3.4 allows remote attackers to affect confidentiality via unknown vectors related to Data, Domain & Function Security. | 2014-07-17 | 5.0 | CVE-2014-4234 |
| oracle -- database_server | Unspecified vulnerability in the RDBMS Core component in Oracle Database Server 11.2.0.4 and 12.1.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors. | 2014-07-17 | 6.5 | CVE-2014-4236 |
| oracle -- database_server | Unspecified vulnerability in the RDBMS Core component in Oracle Database Server 11.2.0.4 and 12.1.0.1 allows remote authenticated users to affect confidentiality via unknown vectors. | 2014-07-17 | 4.0 | CVE-2014-4237 |
| oracle -- mysql | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.17 and earlier allows remote authenticated users to affect availability via vectors related to SROPTZR. | 2014-07-17 | 4.0 | CVE-2014-4238 |
| oracle -- sunos | Unspecified vulnerability in Oracle Sun Solaris 8, 9, 10, and 11.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Common Agent Container (Cacao). | 2014-07-17 | 4.0 | CVE-2014-4239 |
| oracle -- fusion_middleware | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allows remote attackers to affect integrity via vectors related to WLS - Web Services. | 2014-07-17 | 4.3 | CVE-2014-4241 |
| oracle -- fusion_middleware | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect integrity via unknown vectors related to Console. | 2014-07-17 | 4.3 | CVE-2014-4242 |
| oracle -- jdk | Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and JRockit R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security. | 2014-07-17 | 4.0 | CVE-2014-4244 |
| oracle -- fusion_middleware | Unspecified vulnerability in the BI Publisher component in Oracle Fusion Middleware 11.1.1.7 allows remote attackers to affect confidentiality via unknown vectors related to Mobile Service. | 2014-07-17 | 5.0 | CVE-2014-4249 |
| oracle -- jdk | Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Security. | 2014-07-17 | 5.0 | CVE-2014-4252 |
| oracle -- fusion_middleware | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect availability via vectors related to WebLogic Server JVM. | 2014-07-17 | 5.0 | CVE-2014-4253 |
| oracle -- fusion_middleware | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS - Web Services. | 2014-07-17 | 6.8 | CVE-2014-4254 |
| oracle -- fusion_middleware | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS - Security and Policy. | 2014-07-17 | 6.8 | CVE-2014-4255 |
| oracle -- fusion_middleware | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect confidentiality and integrity via vectors related to WLS - Deployment. | 2014-07-17 | 5.8 | CVE-2014-4256 |
| oracle -- vm_virtualbox | Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, and 4.3.14 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-2487. | 2014-07-17 | 6.9 | CVE-2014-4261 |
| oracle -- jdk | Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to "Diffie-Hellman key agreement." | 2014-07-17 | 4.0 | CVE-2014-4263 |
| oracle -- jdk | Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect availability via unknown vectors related to Security. | 2014-07-17 | 5.0 | CVE-2014-4264 |
| oracle -- jdk | Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect integrity via unknown vectors related to Deployment. | 2014-07-17 | 5.0 | CVE-2014-4265 |
| oracle -- jdk | Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect integrity via unknown vectors related to Serviceability. | 2014-07-17 | 5.0 | CVE-2014-4266 |
| oracle -- fusion_middleware | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components. | 2014-07-17 | 6.8 | CVE-2014-4267 |
| oracle -- jdk | Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Swing. | 2014-07-17 | 5.0 | CVE-2014-4268 |
| oracle -- hyperion | Unspecified vulnerability in the Hyperion Common Admin component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote authenticated users to affect confidentiality via unknown vectors related to User Interface, a different vulnerability than CVE-2014-4270. | 2014-07-17 | 4.0 | CVE-2014-4269 |
| oracle -- hyperion | Unspecified vulnerability in the Hyperion Common Admin component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote authenticated users to affect confidentiality via unknown vectors related to User Interface, a different vulnerability than CVE-2014-4269. | 2014-07-17 | 4.0 | CVE-2014-4270 |
| oracle -- hyperion | Unspecified vulnerability in the Hyperion Essbase component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote attackers to affect availability via unknown vectors related to Agent. | 2014-07-17 | 5.0 | CVE-2014-4271 |
| reportico -- php_report_designer | Directory traversal vulnerability in Reportico PHP Report Designer before 4.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the xmlin parameter. | 2014-07-16 | 5.0 | CVE-2014-3777 MISC OSVDB FULLDISC MISC |
| shopizer -- shopizer | Shopizer 1.1.5 and earlier allows remote attackers to reduce the total cost of their shopping cart via a negative number in the productQuantity parameter, which causes the price of the item to be subtracted from the total cost. | 2014-07-15 | 6.4 | CVE-2014-4962 BUGTRAQ FULLDISC |
| shopizer -- shopizer | Shopizer 1.1.5 and earlier allows remote attackers to modify the account settings of arbitrary users via the customer.customerId parameter to shop/profile/register.action. | 2014-07-15 | 6.8 | CVE-2014-4963 BUGTRAQ FULLDISC |
| shopizer -- shopizer | Multiple cross-site request forgery (CSRF) vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to hijack the authentication of users for requests that (1) modify customer settings or hijack the authentication of administrators for requests that change (2) customer passwords, (3) shop configuration, or (4) product details, as demonstrated by (5) modify a product's price via a crafted request to central/catalog/saveproduct. |
2014-07-15 | 6.8 | CVE-2014-4964 BUGTRAQ FULLDISC |
| shopizer -- shopizer | Multiple cross-site scripting (XSS) vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) customername parameter to central/orders/searchcriteria. |
2014-07-15 | 4.3 | CVE-2014-4965 BUGTRAQ FULLDISC |
| sun -- sunos | Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Patch installation scripts. | 2014-07-17 | 6.9 | CVE-2014-4225 |
| tera_charts_plugin_project -- tera-charts | Multiple directory traversal vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the fn parameter to (1) charts/treemap.php or (2) charts/zoomabletreemap.php. | 2014-07-11 | 5.0 | CVE-2014-4940 MISC |
| yealink -- voip_phone_firmware | CRLF injection vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the model parameter to servlet. | 2014-07-16 | 5.0 | CVE-2014-3427 BUGTRAQ FULLDISC |
| zte -- zxv10_w300 | ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the PPPoE/PPPoA password via a direct request for basic/tc2wanfun.js. | 2014-07-16 | 5.0 | CVE-2014-4154 MISC EXPLOIT-DB MISC |
Low Vulnerabilities
| Primary Vendor -- Product |
Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| kaseya -- virtual_system_administrator | kapfa.sys in Kaseya Virtual System Administrator (VSA) 6.5 before 6.5.0.17 and 7.0 before 7.0.0.16 allows local users to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors. | 2014-07-14 | 1.7 | CVE-2014-2926 |
| mysql -- mysql | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via vectors related to ENFED. | 2014-07-17 | 2.8 | CVE-2014-4243 |
| oracle -- vm_virtualbox | Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, and 4.3.12 allows local users to affect integrity and availability via unknown vectors related to Core. | 2014-07-17 | 3.6 | CVE-2014-2477 |
| oracle -- siebel_crm | Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows local users to affect confidentiality via unknown vectors related to Integration Business Services. | 2014-07-17 | 1.4 | CVE-2014-2485 |
| oracle -- vm_virtualbox | Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, and 4.3.12 allows local users to affect integrity and availability via unknown vectors related to Core. | 2014-07-17 | 3.0 | CVE-2014-2486 |
| oracle -- vm_virtualbox | Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, and 4.3.12 allows local users to affect confidentiality via unknown vectors related to Core. | 2014-07-17 | 1.0 | CVE-2014-2488 |
| oracle -- peoplesoft_products | Unspecified vulnerability in the PeopleSoft Enterprise SCM Purchasing component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Purchasing. | 2014-07-17 | 2.3 | CVE-2014-2495 |
| oracle -- peoplesoft_products | Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.53 allows remote authenticated users to affect integrity via vectors related to PIA Core Technology. | 2014-07-17 | 3.5 | CVE-2014-4204 |
| oracle -- hyperion | Unspecified vulnerability in the Hyperion Enterprise Performance Management Architect component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows local users to affect integrity and availability via unknown vectors related to Data Synchronizer. | 2014-07-17 | 3.3 | CVE-2014-4206 |
| oracle -- jdk | Unspecified vulnerability in the Java SE component in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4220. | 2014-07-17 | 2.6 | CVE-2014-4208 |
| oracle -- mysql | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.17 and earlier allows remote authenticated users to affect availability via vectors related to SRSP. | 2014-07-17 | 3.3 | CVE-2014-4214 |
| oracle -- fusion_middleware | Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 11.1.1.7.0 and 12.1.2.0 allows remote authenticated users to affect confidentiality via vectors related to plugin 1.1. | 2014-07-17 | 2.1 | CVE-2014-4222 |
| oracle -- e-business_suite | Unspecified vulnerability in the Oracle iStore component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.2, and 12.2.3 allows remote authenticated users to affect integrity via unknown vectors. | 2014-07-17 | 3.5 | CVE-2014-4235 |
| oracle -- mysql | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.17 and earlier allows local users to affect confidentiality and integrity via vectors related to SRREP. | 2014-07-17 | 3.6 | CVE-2014-4240 |
| oracle -- database_server | Unspecified vulnerability in the RDBMS Core component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote authenticated users to affect confidentiality via unknown vectors. | 2014-07-17 | 3.5 | CVE-2014-4245 |
| oracle -- hyperion | Unspecified vulnerability in the Hyperion Analytic Provider Services component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote authenticated users to affect confidentiality via vectors related to SVP. | 2014-07-17 | 3.5 | CVE-2014-4246 |
| oracle -- e-business_suite | Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.2, and 12.2.3 allows local users to affect confidentiality via unknown vectors related to Logging. | 2014-07-17 | 1.0 | CVE-2014-4248 |
| oracle -- siebel_crm | Unspecified vulnerability in the Siebel Core - Server OM Frwks component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Object Manager. | 2014-07-17 | 3.5 | CVE-2014-4250 |
| oracle -- fusion_middleware | Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 11.1.1.7.0 and 12.1.2.0 allows remote authenticated users to affect integrity via vectors related to plugin 1.1. | 2014-07-17 | 3.5 | CVE-2014-4251 |
원본기사확인하기: [US-CERT: Bulletin(SB14-202)] 2014년 7월 14일까지 발표된 보안 취약점
