2014

IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.35, 8.0 before 8.0.0.10, and 8.5 before 8.5.5.4 does not properl

Cross-site scripting (XSS) vulnerability in HP Operations Agent in HP Operations Manager (formerly OpenView Communicatio

Multiple cross-site request forgery (CSRF) vulnerabilities in the administrative web interface in the proxy server on Fo

Profile Manager in Apple OS X Server before 4.0 allows local users to discover cleartext passwords by reading a file aft

Mail Service in Apple OS X Server before 4.0 does not enforce SACL changes until after a service restart, which allows r

SecurityAgent in Apple OS X before 10.10 does not ensure that a Kerberos ticket is in the cache for the correct user, wh

Apple OS X before 10.10 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted ASN.

The kernel in Apple OS X before 10.10 allows local users to cause a denial of service (panic) via a message to a system

NetFS Client Framework in Apple OS X before 10.10 does not ensure that the disabling of File Sharing is always possible,

The MCX Desktop Config Profiles implementation in Apple OS X before 10.10 retains web-proxy settings from uninstalled mo

Mail in Apple OS X before 10.10 does not properly recognize the removal of a recipient address from a message, which mak

Race condition in LoginWindow in Apple OS X before 10.10 allows physically proximate attackers to obtain access by lever

LaunchServices in Apple OS X before 10.10 allows attackers to bypass intended sandbox restrictions via an application th

IOHIDFamily in Apple OS X before 10.10 allows attackers to cause denial of service (out-of-bounds read operation) via a

The "iCloud Find My Mac" feature in Apple OS X before 10.10 does not properly enforce rate limiting of lost-mode PIN ent

The kernel in Apple OS X before 10.10 allows physically proximate attackers to cause a denial of service (NULL pointer d

Heap-based buffer overflow in the kernel in Apple OS X before 10.10 allows physically proximate attackers to execute arb

fdesetup in Apple OS X before 10.10 does not properly display the encryption status in between a setting-update action a

Dock in Apple OS X before 10.10 does not properly manage the screen-lock state, which allows physically proximate attack

CoreStorage in Apple OS X before 10.10 retains a volume's encryption keys upon an eject action in the unlocked state, wh

Bluetooth in Apple OS X before 10.10 does not require encryption for HID Low Energy devices, which allows remote attacke

App Sandbox in Apple OS X before 10.10 allows attackers to bypass a sandbox protection mechanism via the accessibility A

AFP File Server in Apple OS X before 10.10 allows remote attackers to discover the network addresses of all interfaces v

CFPreferences in Apple OS X before 10.10 does not properly enforce the "require password after sleep or screen saver beg

Safari in Apple OS X before 10.10 allows remote attackers to cause a denial of service (universal Push Notification outa

The Code Signing feature in Apple OS X before 10.10 does not properly handle incomplete resource envelopes in signed bun

Buffer overflow in QuickTime in Apple OS X before 10.10 allows remote attackers to execute arbitrary code or cause a den

The oVirt Engine backend module, as used in Red Hat Enterprise Virtualization Manager before 3.4.2, uses an "insecure Do

SAP Adaptive Server Enterprise (ASE) 15.7 before SP122 or SP63, 15.5 before ESD#5.4, and 15.0.3 before ESD#4.4 does not

Multiple directory traversal vulnerabilities in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allow (1) remote authe

Unrestricted file upload vulnerability in op/op.AddFile2.php in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows

Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allo

Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPre

The NcrCtl4.NcrNet.1 control in Panasonic Network Camera Recorder before 4.04R03 allows remote attackers to execute arbi

Panasonic Network Camera View 3 and 4 allows remote attackers to execute arbitrary code via a crafted page, which trigge

Buffer overflow in the SetLogFile method in Foxit.FoxitPDFSDKProCtrl.5 in Foxit PDF SDK ActiveX 2.3 through 5.0.1820 bef

OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max_meta_count and other m

The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 al

Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sess

Cross-site scripting (XSS) vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to injec

The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS befor

Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vect

Jenkins before 1.551 and LTS before 1.532.2 does not invalidate the API token when a user is deleted, which allows remot

The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers

The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions

BuildTrigger in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to bypass access restricti

Jenkins before 1.502 allows remote authenticated users to configure an otherwise restricted project via vectors related

Cross-site scripting (XSS) vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14

Cross-site scripting (XSS) vulnerability in the easy_social_admin_summary function in the Easy Social module 7.x-2.x bef

Cross-site scripting (XSS) vulnerability in the Webform module 6.x-3.x before 6.x-3.20, 7.x-3.x before 7.x-3.20, and 7.x