Vulnerability Summary for the Week of July 14, 2014Please Note:

• The vulnerabilities are cattegorized by their level of severity which is either High, Medium or Low.

• The CVE indentity number is the publicly known ID given to that particular vulnerability. Therefore you can

search the status of that particular vulnerability using that ID.

• The CVSS (Common Vulnerability Scoring System) score is a standard scoring system used to determine the

severity of the vulnerability.

High Severity Vulnerabilities

The Primary Vendor --- Product

Description Date Published

CVSS Score

The CVE Identity

cisco -- dpc3010 The web server on Cisco DPC3010, DPC3212,

DPC3825, DPC3925, DPQ3925, EPC3010,

EPC3212, EPC3825, and EPC3925 Wireless

Residential Gateway products allows remote

attackers to execute arbitrary code via a crafted

HTTP request, aka Bug ID CSCup40808.

2014-07-17 10.0 CVE-2014-3306

dahuasecurity --

dvr_firmware

Dahua DVR 2.608.0000.0 and 2.608.GV00.0

allows remote attackers to bypass

authentication and obtain sensitive information

including user credentials, change user

passwords, clear log files, and perform other

actions via a request to TCP port 37777.

2014-07-11 7.5 CVE-2013-6117OSVDBEXPLOIT-DBBUGTRAQMISCMISC

datumsystems -- snip Datum Systems SnIP on PSM-500 and PSM-4500

devices does not require authentication for FTP

sessions, which allows remote attackers to

obtain sensitive information via RETR

commands.

2014-07-14 7.8 CVE-2014-2950

datumsystems -- snip Datum Systems SnIP on PSM-500 and PSM-4500

devices has a hardcoded password of admin for

2014-07-14 10.0 CVE-2014-2951

the admin account, which makes it easier for

remote attackers to obtain access via

unspecified vectors.

hp --

storage_management_sof

tware

Unspecified vulnerability in HP StoreVirtual 4000

Storage and StoreVirtual VSA 9.5 through 11.0

allows remote authenticated users to gain

privileges via unknown vectors.

2014-07-16 9.0 CVE-2014-2606

hp --

imc_branch_intelligent_

management_system_sof

tware_module

Unspecified vulnerability in HP Intelligent

Management Center (iMC) before 7.0 E02020P03

and Branch Intelligent Management System

(BIMS) before 7.0 E0201P02 allows remote

attackers to obtain sensitive information via

unknown vectors, aka ZDI-CAN-2080.

2014-07-16 7.8 CVE-2014-2618

hp --

imc_branch_intelligent_

management_system_sof

tware_module

Unspecified vulnerability in HP Intelligent

Management Center (iMC) before 7.0 E02020P03

and Branch Intelligent Management System

(BIMS) before 7.0 E0201P02 allows remote

attackers to obtain sensitive information via

unknown vectors, aka ZDI-CAN-2088.

2014-07-16 7.8 CVE-2014-2619

hp --

imc_branch_intelligent_

management_system_sof

tware_module

Unspecified vulnerability in HP Intelligent

Management Center (iMC) before 7.0 E02020P03

and Branch Intelligent Management System

(BIMS) before 7.0 E0201P02 allows remote

attackers to obtain sensitive information via

unknown vectors, aka ZDI-CAN-2089.

2014-07-16 7.8 CVE-2014-2620

hp --

imc_branch_intelligent_

management_system_sof

tware_module

Unspecified vulnerability in HP Intelligent

Management Center (iMC) before 7.0 E02020P03

and Branch Intelligent Management System

(BIMS) before 7.0 E0201P02 allows remote

attackers to obtain sensitive information via

unknown vectors, aka ZDI-CAN-2090.

2014-07-16 7.8 CVE-2014-2621

hp --

imc_branch_intelligent_

management_system_sof

tware_module

Unspecified vulnerability in HP Intelligent

Management Center (iMC) before 7.0 E02020P03

and Branch Intelligent Management System

(BIMS) before 7.0 E0201P02 allows remote

authenticated users to obtain sensitive

information or modify data via unknown vectors,

aka ZDI-CAN-2312.

2014-07-16 8.5 CVE-2014-2622HPHP

hp --

storage_data_protector

Unspecified vulnerability in HP Storage Data

Protector 8.x allows remote attackers to execute

arbitrary code via unknown vectors.

2014-07-17 10.0 CVE-2014-2623

infoblox -- netmri config/userAdmin/login.tdf in Infoblox NetMRI

before 6.8.5 allows remote attackers to execute

arbitrary commands via shell metacharacters in

the skipjackUsername parameter.

2014-07-15 10.0 CVE-2014-3418MISCXFBIDBUGTRAQEXPLOIT-DBFULLDISCMISC

infoblox -- netmri Infoblox NetMRI before 6.8.5 has a default

password of admin for the "root" MySQL

database account, which makes it easier for local

users to obtain access via unspecified vectors.

2014-07-15 7.2 CVE-2014-3419MISCXFSECTRACKBIDBUGTRAQMISCMISC

juniper -- srx100 Juniper Junos 12.1X46 before 12.1X46-D20 and

12.1X47 before 12.1X47-D10 on SRX Series

devices allows remote attackers to cause a denial

of service (flowd crash) via a crafted SIP packet.

2014-07-11 7.8 CVE-2014-3815SECTRACK

juniper -- junos Juniper Junos 11.4 before 11.4R12, 12.1 before

12.1R11, 12.1X44 before 12.1X44-D35, 12.1X45

before 12.1X45-D30, 12.1X46 before 12.1X46-

D20, 12.1X47 before 12.1X47-D10, 12.2 before

12.2R8-S2, 12.3 before 12.3R7, 13.1 before

13.1R4-S2, 13.2 before 13.2R5, 13.3 before

13.3R2-S2, and 14.1 before 14.1R1 allows remote

authenticated users to gain privileges via

unspecified combinations of CLI commands and

arguments.

2014-07-11 9.0 CVE-2014-3816SECTRACK

juniper -- srx100 Juniper Junos 11.4 before 11.4R12, 12.1X44

before 12.1X44-D32, 12.1X45 before 12.1X45-

D25, 12.1X46 before 12.1X46-D20, and 12.1X47

before 12.1X47-D10 on SRX Series devices, when

NAT protocol translation from IPv4 to IPv6 is

enabled, allows remote attackers to cause a

denial of service (flowd hang or crash) via a

crafted packet.

2014-07-11 7.8 CVE-2014-3817SECTRACK

juniper -- junos Juniper Junos 11.4 before 11.4R12, 12.1 before 2014-07-11 7.8 CVE-2014-3819

12.1R10, 12.1X44 before 12.1X44-D35, 12.1X45

before 12.1X45-D25, 12.1X46 before 12.1X46-

D20, 12.1X47 before 12.1X47-D10, 12.2 before

12.2R8, 12.3 before 12.3R7, 13.1 before 13.1R4,

13.2 before 13.2R4, 13.3 before 13.3R2, and 14.1

before 14.1R1, when Auto-RP is enabled, allows

remote attackers to cause a denial of service

(RDP routing process crash and restart) via a

malformed PIM packet.

SECTRACKBID

oracle -- jdk Unspecified vulnerability in the Java SE

component in Oracle Java SE Java SE 7u60 and

OpenJDK 7 allows remote attackers to affect

confidentiality, integrity, and availability via

unknown vectors related to Libraries, a different

vulnerability than CVE-2014-4223. NOTE: the

previous information is from the July 2014 CPU.

Oracle has not commented on another vendor's

claim that the issue is related to improper

restriction of the "use of privileged annotations."

2014-07-17 9.3 CVE-2014-2483CONFIRM

oracle -- jdk Unspecified vulnerability in the Java SE

component in Oracle Java SE 7u60 and SE 8u5

allows remote attackers to affect confidentiality,

integrity, and availability via unknown vectors

related to Hotspot.

2014-07-17 9.3 CVE-2014-2490

oracle -- jdk Unspecified vulnerability in Oracle Java SE

5.0u65, 6u75, 7u60, and 8u5 allows remote

attackers to affect confidentiality, integrity, and

availability via unknown vectors related to

Hotspot.

2014-07-17 9.3 CVE-2014-4216

oracle -- jdk Unspecified vulnerability in Oracle Java SE 6u75,

7u60, and 8u5 allows remote attackers to affect

confidentiality, integrity, and availability via

unknown vectors related to Hotspot.

2014-07-17 9.3 CVE-2014-4219

oracle -- jdk Unspecified vulnerability in Oracle Java SE 7u60

allows remote attackers to affect confidentiality,

integrity, and availability via unknown vectors

related to Libraries, a different vulnerability than

CVE-2014-2483.

2014-07-17 9.3 CVE-2014-4223

oracle -- jdk Unspecified vulnerability in Oracle Java SE 6u75,

7u60, and 8u5 allows remote attackers to affect

confidentiality, integrity, and availability via

unknown vectors related to Deployment.

2014-07-17 10.0 CVE-2014-4227

oracle -- jdk Unspecified vulnerability in Oracle Java SE 8u5

allows remote attackers to affect confidentiality,

integrity, and availability via unknown vectors

related to JavaFX.

2014-07-17 9.3 CVE-2014-4247

oracle --

fusion_middleware

Unspecified vulnerability in the Oracle

WebCenter Portal component in Oracle Fusion

Middleware 11.1.1.7.0 and 11.1.1.8.0 allows

remote attackers to affect confidentiality via

unknown vectors related to Portlet Services.

2014-07-17 7.1 CVE-2014-4257

oracle -- jdk Unspecified vulnerability in Oracle Java SE

5.0u65, 6u75, 7u60, and 8u5 allows remote

attackers to affect confidentiality, integrity, and

availability via unknown vectors related to

Libraries.

2014-07-17 9.3 CVE-2014-4262

raritan -- dpxr20a-16 Raritan PX before 1.5.11 on DPXR20A-16 devices

allows remote attackers to bypass

authentication and execute arbitrary IPMI

commands by using cipher suite 0 (aka cipher

zero) and an arbitrary password.

2014-07-14 10.0 CVE-2014-2955FULLDISC

wp_rss_poster_plugin_pr

oject -- wp-rss-poster

SQL injection vulnerability in the WP Rss Poster

(wp-rss-poster) plugin 1.0.0 for WordPress allows

remote attackers to execute arbitrary SQL

commands via the id parameter in the wrp-add-

new page to wp-admin/admin.php.

2014-07-11 7.5 CVE-2014-4938MISC

yealink -- sip-t38g config/.htpasswd in Yealink IP Phone SIP-T38G

have a hardcoded password of (1) user

(s7C9Cx.rLsWFA) for the user account, (2) admin

(uoCbM.VEiKQto) for the admin account, and (3)

var (jhl3iZAe./qXM) for the var account, which

makes it easier for remote attackers to obtain

access via unspecified vectors.

2014-07-16 7.8 CVE-2013-5755EXPLOIT-DB

zte -- zxv10_w300 The ZTE ZXV10 W300 router with firmware

W300V1.0.0a_ZRD_LK has a default password of

admin for the admin account, which makes it

2014-07-16 7.8 CVE-2014-4018MISCEXPLOIT-DBMISC

easier for remote attackers to obtain access via

unspecified vectors.

Medium Severity Vulnerabilities

The Primary Vendor --- Product

Description Date Published CVSSScore

The CVE Identity

arubanetworks --

clearpass

SQL injection vulnerability in the Policy Manager in

Aruba Networks ClearPass 5.x, 6.0.x, 6.1.x through

6.1.4.61696, 6.2.x through 6.2.6.62196, and 6.3.x

before 6.3.4 allows remote authenticated users to

execute arbitrary SQL commands via unspecified

vectors.

2014-07-14 4.9 CVE-2014-4013SECUNIA

arubanetworks --

clearpass

The Policy Manager in Aruba Networks ClearPass

5.x, 6.0.x, 6.1.x through 6.1.4.61696, 6.2.x through

6.2.6.62196, and 6.3.x before 6.3.4 allows remote

authenticated users to obtain database credentials

via unspecified vectors.

2014-07-15 4.0 CVE-2014-4031SECUNIA

bannersky --

bsk_pdf_manager

Multiple SQL injection vulnerabilities in inc/bsk-pdf-

dashboard.php in the BSK PDF Manager plugin

1.3.2 for WordPress allow remote authenticated

users to execute arbitrary SQL commands via the (1)

categoryid or (2) pdfid parameter to wp-

admin/admin.php.

2014-07-14 6.5 CVE-2014-4944BIDMISC

bestpractical -- rt Algorithmic complexity vulnerability in

Email::Address::List before 0.02, as used in RT 4.2.0

through 4.2.2, allows remote attackers to cause a

denial of service (CPU consumption) via a string

without an address.

2014-07-15 5.0 CVE-2014-1474

binarymoon --

timthumb

TimThumb 2.8.13 and WordThumb 1.07, when

Webshot (aka Webshots) is enabled, allows remote

attackers to execute arbitrary commands via shell

metacharacters in the src parameter.

2014-07-15 6.8 CVE-2014-4663CONFIRMCONFIRMEXPLOIT-DBSECUNIAMLISTFULLDISCFULLDISCMISC

bookx_plugin_proje

ct -- bookx

Directory traversal vulnerability in

includes/bookx_export.php BookX plugin 1.7 for

WordPress allows remote attackers to read arbitrary

files via a .. (dot dot) in the file parameter.

2014-07-11 5.0 CVE-2014-4937MISC

cisco --

adaptive_security_a

ppliance_software

Cisco Adaptive Security Appliance (ASA) Software

8.4(.6) and earlier, when using an unsupported

configuration with overlapping criteria for filtering

and inspection, allows remote attackers to cause a

denial of service (traffic loop and device crash) via a

packet that triggers multiple matches, aka Bug ID

CSCui45606.

2014-07-14 5.4 CVE-2013-5567XFSECTRACKBID

cisco --

adaptive_security_a

ppliance_software

The WebVPN CIFS implementation in Cisco

Adaptive Security Appliance (ASA) Software

9.0(.4.1) and earlier allows remote CIFS servers to

cause a denial of service (device reload) via a long

share list, aka Bug ID CSCuj83344.

2014-07-14 6.8 CVE-2013-6691XFSECTRACKBID

cisco --

unified_communica

tions_manager

Directory traversal vulnerability in the Multiple

Analyzer in the Dialed Number Analyzer (DNA)

component in Cisco Unified Communications

Manager 10.0(1) allows remote authenticated users

to delete arbitrary files via a crafted URL, aka Bug ID

CSCup76314.

2014-07-14 5.5 CVE-2014-3317XFSECTRACKBIDSECUNIA

cisco --

unified_communica

tions_manager

Directory traversal vulnerability in the Real-Time

Monitoring Tool (RTMT) in Cisco Unified

Communications Manager (CM) 10.0(1) allows

remote authenticated users to read arbitrary files

via a crafted URL, aka Bug ID CSCup57676.

2014-07-14 6.8 CVE-2014-3319XFSECTRACKSECUNIA

cisco --

unified_communica

tions_domain_man

ager

Multiple open redirect vulnerabilities in the admin

web interface in the web framework in Cisco

Unified Communications Domain Manager (CDM)

8.1(.4) and earlier allow remote attackers to redirect

2014-07-17 5.8 CVE-2014-3320

users to arbitrary web sites and conduct phishing

attacks via crafted URLs for unspecified scripts, aka

Bug ID CSCuo48835.

cisco --

asr_9000_rsp440_r

outer

Cisco IOS XR 4.3.4 and earlier on ASR 9000 devices,

when bridge-group virtual interface (BVI) routing is

enabled, allows remote attackers to cause a denial

of service (chip and card hangs) via a series of

crafted MPLS packets, aka Bug ID CSCuo91149.

2014-07-17 5.7 CVE-2014-3321

cisco --

unified_contact_ce

nter_enterprise

Directory traversal vulnerability in Cisco Unified

Contact Center Enterprise allows remote

authenticated users to read arbitrary web-root files

via a crafted URL, aka Bug ID CSCun25262.

2014-07-17 4.0 CVE-2014-3323

citrix --

netscaler_access_ga

teway

Cross-site scripting (XSS) vulnerability in

administration user interface in Citrix NetScaler

Application Delivery Controller (ADC) and NetScaler

Gateway (formerly Access Gateway Enterprise

Edition) 10.1 before 10.1-126.12 allows remote

attackers to inject arbitrary web script or HTML via

unspecified vectors.

2014-07-16 4.3 CVE-2014-4346SECTRACKSECTRACK

citrix --

netscaler_access_ga

teway

Citrix NetScaler Application Delivery Controller

(ADC) and NetScaler Gateway (formerly Access

Gateway Enterprise Edition) before 9.3-62.4 and

10.x before 10.1-126.12 allows attackers to obtain

sensitive information via vectors related to a cookie.

2014-07-16 5.0 CVE-2014-4347SECTRACKSECTRACK

citrix -- xendesktop Citrix XenDesktop 7.x, 5.x, and 4.x, when pooled

random desktop groups is enabled and

ShutdownDesktopsAfterUse is disabled, allows

local guest users to gain access to another user's

desktop via unspecified vectors.

2014-07-11 4.9 CVE-2014-4700XFSECTRACKBIDSECUNIA

cross-

rss_plugin_project

-- wp-cross-rss

Absolute path traversal vulnerability in Cross-RSS

(wp-cross-rss) plugin 1.7 for WordPress allows

remote attackers to read arbitrary files via a full

pathname in the rss parameter to proxy.php.

2014-07-11 5.0 CVE-2014-4941MISC

dell --

sonicwall_scrutinize

r

Dell SonicWall Scrutinizer 11.0.1 allows remote

authenticated users to change the change user

passwords via the user ID in the savePrefs

parameter in a change password request to cgi-

bin/admin.cgi.

2014-07-16 5.5 CVE-2014-4976MISCMISCXFBIDFULLDISC

MISC

dell --

sonicwall_scrutinize

r

Multiple SQL injection vulnerabilities in Dell

SonicWall Scrutinizer 11.0.1 allow remote

authenticated users to execute arbitrary SQL

commands via the (1) selectedUserGroup

parameter in a create new user request to cgi-

bin/admin.cgi or the (2) user_id parameter in the

changeUnit function, (3) methodDetail parameter

in the methodDetail function, or (4)

xcNetworkDetail parameter in the xcNetworkDetail

function in d4d/exporters.php.

2014-07-16 6.5 CVE-2014-4977MISCMISCXFBIDFULLDISCMISC

enl_newsletter_plu

gin_project -- enl-

newsletter

SQL injection vulnerability in the ENL Newsletter

(enl-newsletter) plugin 1.0.1 for WordPress allows

remote authenticated administrators to execute

arbitrary SQL commands via the id parameter in the

enl-add-new page to wp-admin/admin.php.

2014-07-11 6.5 CVE-2014-4939MISC

fortinet -- fortiweb Multiple cross-site scripting (XSS) vulnerabilities in

FortiGuard FortiWeb 5.0.x, 5.1.x, and 5.2.x before

5.2.1 allow remote attackers to inject arbitrary web

script or HTML via unspecified vectors to (1)

user/ldap_user/check_dlg or (2)

user/radius_user/check_dlg.

2014-07-11 4.3 CVE-2014-4738SECTRACKBIDSECUNIA

freebsd -- freebsd FreeBSD 8.4 before p14, 9.1 before p17, 9.2 before

p10, and 10.0 before p7 does not properly initialize

the buffer between the header and data of a control

message, which allows local users to obtain

sensitive information from kernel memory via

unspecified vectors.

2014-07-15 4.9 CVE-2014-3952XFSECTRACKBID

freebsd -- freebsd FreeBSD 8.4 before p14, 9.1 before p17, 9.2 before

p10, and 10.0 before p7 does not properly initialize

certain data structures, which allows local users to

obtain sensitive information from kernel memory

via a (1) SCTP_SNDRCV, (2) SCTP_EXTRCV, or (3)

SCTP_RCVINFO SCTP cmsg or a (4)

SCTP_PEER_ADDR_CHANGE, (5)

SCTP_REMOTE_ERROR, or (6)

SCTP_AUTHENTICATION_EVENT notification.

2014-07-15 4.9 CVE-2014-3953SECTRACK

horde -- groupware Multiple cross-site scripting (XSS) vulnerabilities in 2014-07-14 4.3 CVE-2014-4945CONFIRM

Horde Internet Mail Program (IMP) before 6.1.8, as

used in Horde Groupware Webmail Edition before

5.1.5, allow remote attackers to inject arbitrary web

script or HTML via an unspecified flag in the basic

(1) mailbox or (2) message view.

CONFIRMSECUNIASECUNIA

horde -- groupware Multiple cross-site scripting (XSS) vulnerabilities in

Horde Internet Mail Program (IMP) before 6.1.8, as

used in Horde Groupware Webmail Edition before

5.1.5, allow remote attackers to inject arbitrary web

script or HTML via (1) unspecified flags or (2) a

mailbox name in the dynamic mailbox view.

2014-07-14 4.3 CVE-2014-4946CONFIRMCONFIRMSECUNIASECUNIAMLIST

hp --

storage_manageme

nt_software

Unspecified vulnerability in HP StoreVirtual 4000

Storage and StoreVirtual VSA 9.5 through 11.0

allows remote attackers to obtain sensitive

information via unknown vectors.

2014-07-16 5.0 CVE-2014-2605

ibm --

business_process_

manager

Cross-site scripting (XSS) vulnerability in IBM

Business Process Manager 7.5 through 8.5.5, and

WebSphere Lombardi Edition 7.2, allows remote

attackers to inject arbitrary web script or HTML via a

crafted URL that triggers a service failure.

2014-07-17 4.3 CVE-2014-0957XF

juniper -- junos Cross-site scripting (XSS) vulnerability in SRX Web

Authentication (webauth) in Juniper Junos 11.4

before 11.4R11, 12.1X44 before 12.1X44-D34,

12.1X45 before 12.1X45-D25, 12.1X46 before

12.1X46-D20, and 12.1X47 before 12.1X47-D10

allows remote attackers to inject arbitrary web

script or HTML via unspecified vectors.

2014-07-11 4.3 CVE-2014-3821SECTRACKBID

juniper -- srx100 Juniper Junos 11.4 before 11.4R8, 12.1 before

12.1R5, 12.1X44 before 12.1X44-D20, 12.1X45

before 12.1X45-D15, 12.1X46 before 12.1X46-D10,

and 12.1X47 before 12.1X47-D10 on SRX Series

devices, allows remote attackers to cause a denial

of service (flowd crash) via a malformed packet,

related to translating IPv6 to IPv4.

2014-07-11 5.4 CVE-2014-3822SECTRACK

levelfourdevelopme

nt -- wp-easycart

The EasyCart (wp-easycart) plugin before 2.0.6 for

WordPress allows remote attackers to obtain

configuration information via a direct request to

inc/admin/phpinfo.php, which calls the phpinfo

2014-07-11 5.0 CVE-2014-4942MISC

function.

mysql -- mysql Unspecified vulnerability in the MySQL Server

component in Oracle MySQL 5.5.37 and earlier and

5.6.17 and earlier allows remote authenticated

users to affect confidentiality, integrity, and

availability via vectors related to SRINFOSC.

2014-07-17 6.5 CVE-2014-4258

mysql -- mysql Unspecified vulnerability in the MySQL Server

component in Oracle MySQL 5.5.37 and earlier, and

5.6.17 and earlier, allows remote authenticated

users to affect integrity and availability via vectors

related to SRCHAR.

2014-07-17 5.5 CVE-2014-4260

op5 -- monitor Cross-site scripting (XSS) vulnerability in

share/pnp/application/views/kohana_error_page.p

hp in PNP4Nagios before 0.6.22 allows remote

attackers to inject arbitrary web script or HTML via a

parameter that is not properly handled in an error

message.

2014-07-11 4.3 CVE-2014-4907CONFIRMBIDSECUNIASECUNIAMLIST

oracle -- mojarra Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before

2.1.28 does not perform appropriate encoding

when a (1) <h:outputText> tag or (2) EL expression

is used after a scriptor style block, which allows

remote attackers to conduct cross-site scripting

(XSS) attacks via application-specific vectors.

2014-07-17 4.3 CVE-2013-5855CONFIRMCONFIRMMISC

oracle -- hyperion Unspecified vulnerability in the Hyperion BI+

component in Oracle Hyperion 11.1.2.2 and 11.1.2.3

allows remote attackers to affect integrity via

unknown vectors related to Web Analysis.

2014-07-17 4.3 CVE-2014-0436

oracle --

peoplesoft_product

s

Unspecified vulnerability in the PeopleSoft

Enterprise ELS Enterprise Learning Management

component in Oracle PeopleSoft Products 9.1 and

9.2 allows remote authenticated users to affect

confidentiality and integrity via unknown vectors.

2014-07-17 5.5 CVE-2014-2456

oracle --

fusion_middleware

Unspecified vulnerability in the Oracle WebLogic

Server component in Oracle Fusion Middleware

10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows

remote attackers to affect confidentiality, integrity,

and availability via vectors related to WLS - Web

Services.

2014-07-17 6.8 CVE-2014-2479

oracle --

fusion_middleware

Unspecified vulnerability in the Oracle WebLogic

Server component in Oracle Fusion Middleware

10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows

remote attackers to affect confidentiality, integrity,

and availability via unknown vectors, a different

vulnerability than CVE-2014-2481.

2014-07-17 6.8 CVE-2014-2480

oracle --

fusion_middleware

Unspecified vulnerability in the Oracle WebLogic

Server component in Oracle Fusion Middleware

10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows

remote attackers to affect confidentiality, integrity,

and availability via unknown vectors, a different

vulnerability than CVE-2014-2480.

2014-07-17 6.8 CVE-2014-2481

oracle -- e-

business_suite

Unspecified vulnerability in the Oracle Concurrent

Processing component in Oracle E-Business Suite

12.1.3, 12.2.2, and 12.2.3 allows remote

authenticated users to affect confidentiality and

integrity via unknown vectors.

2014-07-17 5.5 CVE-2014-2482

oracle -- mysql Unspecified vulnerability in the MySQL Server

component in Oracle MySQL 5.6.17 and earlier

allows remote authenticated users to affect

confidentiality, integrity, and availability via vectors

related to SRFTS.

2014-07-17 6.5 CVE-2014-2484

oracle --

vm_virtualbox

Unspecified vulnerability in the Oracle VM

VirtualBox component in Oracle Virtualization

VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, and

4.3.14, when running on Windows, allows local

users to affect confidentiality, integrity, and

availability via unknown vectors related to Core, a

different vulnerability than CVE-2014-4261.

2014-07-17 6.9 CVE-2014-2487

oracle --

vm_virtualbox

Unspecified vulnerability in the Oracle VM

VirtualBox component in Oracle Virtualization

VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, and

4.3.12 allows local users to affect confidentiality,

integrity, and availability via unknown vectors

related to Core.

2014-07-17 4.1 CVE-2014-2489

oracle -- siebel_crm Unspecified vulnerability in the Siebel UI

Framework component in Oracle Siebel CRM 8.1.1

and 8.2.2 allows remote attackers to affect integrity

2014-07-17 4.3 CVE-2014-2491

via unknown vectors related to Portal Framework, a

different vulnerability than CVE-2014-4205.

oracle --

supply_chain_prod

ucts_suite

Unspecified vulnerability in the Oracle Agile

Product Collaboration component in Oracle Supply

Chain Products Suite 9.3.3 allows remote attackers

to affect integrity via unknown vectors related to

Web client (PC).

2014-07-17 4.3 CVE-2014-2492

oracle --

fusion_middleware

Unspecified vulnerability in the Oracle JDeveloper

component in Oracle Fusion Middleware 11.1.1.7.0,

11.1.2.4.0, and 12.1.2.0.0 allows remote attackers to

affect confidentiality and availability via vectors

related to ADF Faces.

2014-07-17 6.4 CVE-2014-2493

oracle -- mysql Unspecified vulnerability in the MySQL Server

component in Oracle MySQL 5.5.37 and earlier

allows remote authenticated users to affect

availability via vectors related to ENARC.

2014-07-17 4.0 CVE-2014-2494

oracle --

peoplesoft_product

s

Unspecified vulnerability in the PeopleSoft

Enterprise PT PeopleTools component in Oracle

PeopleSoft Products 8.52 and 8.53 allows remote

authenticated users to affect confidentiality and

integrity via unknown vectors related to Test

Framework.

2014-07-17 5.5 CVE-2014-2496

oracle --

fusion_middleware

Unspecified vulnerability in the Oracle WebLogic

Server component in Oracle Fusion Middleware

10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote

attackers to affect availability via vectors related to

WLS - Web Services.

2014-07-17 5.0 CVE-2014-4201

oracle --

fusion_middleware

Unspecified vulnerability in the Oracle WebLogic

Server component in Oracle Fusion Middleware

10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows

remote attackers to affect availability via vectors

related to WLS - Web Services.

2014-07-17 5.0 CVE-2014-4202

oracle -- hyperion Unspecified vulnerability in the Hyperion Enterprise

Performance Management Architect component in

Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows local

users to affect confidentiality, integrity, and

availability via unknown vectors related to Property

Editing.

2014-07-17 4.1 CVE-2014-4203

oracle -- siebel_crm Unspecified vulnerability in the Siebel UI

Framework component in Oracle Siebel CRM 8.1.1

and 8.2.2 allows remote attackers to affect integrity

via unknown vectors related to Portal Framework, a

different vulnerability than CVE-2014-2491.

2014-07-17 4.3 CVE-2014-4205

oracle -- mysql Unspecified vulnerability in the MySQL Server

component in Oracle MySQL 5.5.37 and earlier

allows remote authenticated users to affect

availability via vectors related to SROPTZR.

2014-07-17 4.0 CVE-2014-4207

oracle -- jdk Unspecified vulnerability in Oracle Java SE 5.0u65,

6u75, 7u60, and 8u5 allows remote attackers to

affect confidentiality and integrity via vectors

related to JMX.

2014-07-17 6.4 CVE-2014-4209

oracle --

fusion_middleware

Unspecified vulnerability in the Oracle WebLogic

Server component in Oracle Fusion Middleware

10.0.2.0 and 10.3.6.0 allows remote attackers to

affect confidentiality via vectors related to WLS -

Web Services.

2014-07-17 5.0 CVE-2014-4210

oracle --

fusion_middleware

Unspecified vulnerability in the Oracle WebCenter

Portal component in Oracle Fusion Middleware

11.1.1.7 and 11.1.1.8 allows remote attackers to

affect integrity via unknown vectors related to

Portlet Services.

2014-07-17 5.0 CVE-2014-4211

oracle --

fusion_middleware

Unspecified vulnerability in the Oracle Fusion

Middleware component in Oracle Fusion

Middleware 11.1.1.7 allows remote attackers to

affect confidentiality via unknown vectors related

to Process Mgmt and Notification.

2014-07-17 4.3 CVE-2014-4212

oracle -- e-

business_suite

Unspecified vulnerability in the Oracle Applications

Manager component in Oracle E-Business Suite

12.0.6, 12.1.3, 12.2.2, and 12.2.3 allows remote

attackers to affect integrity via unknown vectors.

2014-07-17 4.3 CVE-2014-4213

oracle -- sunos Unspecified vulnerability in Oracle Solaris 10 and

11.1 allows local users to affect availability via

vectors related to CPU performance counters (CPC)

drivers.

2014-07-17 4.9 CVE-2014-4215

oracle -- Unspecified vulnerability in the Oracle WebLogic 2014-07-17 4.3 CVE-2014-4217

fusion_middleware Server component in Oracle Fusion Middleware

10.0.2.0, 10.3.6.0, and 12.1.1.0 allows remote

attackers to affect integrity via vectors related to

WLS - Web Services.

oracle -- jdk Unspecified vulnerability in Oracle Java SE 5.0u65,

6u75, 7u60, and 8u5 allows remote attackers to

affect integrity via unknown vectors related to

Libraries.

2014-07-17 5.0 CVE-2014-4218

oracle -- jdk Unspecified vulnerability in Oracle Java SE 7u60 and

8u5 allows remote attackers to affect integrity via

unknown vectors related to Deployment, a different

vulnerability than CVE-2014-4208.

2014-07-17 5.0 CVE-2014-4220

oracle -- jdk Unspecified vulnerability in Oracle Java SE 7u60 and

8u5 allows remote attackers to affect confidentiality

via unknown vectors related to Libraries.

2014-07-17 4.3 CVE-2014-4221

oracle -- sunos Unspecified vulnerability in Oracle Sun Solaris 8, 9,

10, and 11.1 allows local users to affect availability

via unknown vectors related to sockfs.

2014-07-17 4.9 CVE-2014-4224

oracle --

peoplesoft_product

s

Unspecified vulnerability in the PeopleSoft

Enterprise FIN Install component in Oracle

PeopleSoft Products 9.1 and 9.2 allows remote

attackers to affect confidentiality, integrity, and

availability via unknown vectors.

2014-07-17 5.1 CVE-2014-4226

oracle --

vm_virtualbox

Unspecified vulnerability in the Oracle VM

VirtualBox component in Oracle Virtualization

VirtualBox before 4.1.34, 4.2.26, and 4.3.12 allows

local users to affect confidentiality, integrity, and

availability via vectors related to Graphics driver

(WDDM) for Windows guests.

2014-07-17 4.4 CVE-2014-4228

oracle --

supply_chain_prod

ucts_suite

Unspecified vulnerability in the Oracle

Transportation Management component in Oracle

Supply Chain Products Suite 6.2, 6.3, 6.3.1, 6.3.2,

6.3.3, and 6.3.4 allows remote authenticated users

to affect confidentiality and integrity via unknown

vectors related to Data, Domain, and Function

Security.

2014-07-17 5.5 CVE-2014-4229

oracle -- siebel_crm Unspecified vulnerability in the Siebel UI 2014-07-17 4.3 CVE-2014-4230

Framework component in Oracle Siebel CRM 8.1.1

and 8.2.2 allows remote attackers to affect integrity

via vectors related to Open_UI.

oracle -- siebel_crm Unspecified vulnerability in the Siebel Travel &

Transportation component in Oracle Siebel CRM

8.1.1 and 8.2.2 allows remote attackers to affect

integrity via unknown vectors related to Diary.

2014-07-17 4.3 CVE-2014-4231

oracle --

virtualization

Unspecified vulnerability in the Oracle Secure

Global Desktop (SGD) component in Oracle

Virtualization 4.63, 4.71, 5.0, and 5.1 allows remote

attackers to affect integrity via unknown vectors

related to Workspace Web Application.

2014-07-17 4.3 CVE-2014-4232

oracle -- mysql Unspecified vulnerability in the MySQL Server

component in Oracle MySQL 5.6.17 and earlier

allows remote authenticated users to affect

availability via vectors related to SRREP.

2014-07-17 4.0 CVE-2014-4233

oracle --

supply_chain_prod

ucts_suite

Unspecified vulnerability in the Oracle

Transportation Management component in Oracle

Supply Chain Products Suite 6.1, 6.2, 6.3, 6.3.1,

6.3.2, 6.3.3, and 6.3.4 allows remote attackers to

affect confidentiality via unknown vectors related

to Data, Domain & Function Security.

2014-07-17 5.0 CVE-2014-4234

oracle --

database_server

Unspecified vulnerability in the RDBMS Core

component in Oracle Database Server 11.2.0.4 and

12.1.0.1 allows remote authenticated users to affect

confidentiality, integrity, and availability via

unknown vectors.

2014-07-17 6.5 CVE-2014-4236

oracle --

database_server

Unspecified vulnerability in the RDBMS Core

component in Oracle Database Server 11.2.0.4 and

12.1.0.1 allows remote authenticated users to affect

confidentiality via unknown vectors.

2014-07-17 4.0 CVE-2014-4237

oracle -- mysql Unspecified vulnerability in the MySQL Server

component in Oracle MySQL 5.6.17 and earlier

allows remote authenticated users to affect

availability via vectors related to SROPTZR.

2014-07-17 4.0 CVE-2014-4238

oracle -- sunos Unspecified vulnerability in Oracle Sun Solaris 8, 9,

10, and 11.1 allows remote authenticated users to

2014-07-17 4.0 CVE-2014-4239

affect confidentiality via unknown vectors related

to Common Agent Container (Cacao).

oracle --

fusion_middleware

Unspecified vulnerability in the Oracle WebLogic

Server component in Oracle Fusion Middleware

10.0.2.0 and 10.3.6.0 allows remote attackers to

affect integrity via vectors related to WLS - Web

Services.

2014-07-17 4.3 CVE-2014-4241

oracle --

fusion_middleware

Unspecified vulnerability in the Oracle WebLogic

Server component in Oracle Fusion Middleware

10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows

remote attackers to affect integrity via unknown

vectors related to Console.

2014-07-17 4.3 CVE-2014-4242

oracle -- jdk Unspecified vulnerability in Oracle Java SE 5.0u65,

6u75, 7u60, and 8u5, and JRockit R27.8.2 and

JRockit R28.3.2, allows remote attackers to affect

confidentiality and integrity via unknown vectors

related to Security.

2014-07-17 4.0 CVE-2014-4244

oracle --

fusion_middleware

Unspecified vulnerability in the BI Publisher

component in Oracle Fusion Middleware 11.1.1.7

allows remote attackers to affect confidentiality via

unknown vectors related to Mobile Service.

2014-07-17 5.0 CVE-2014-4249

oracle -- jdk Unspecified vulnerability in Oracle Java SE 5.0u65,

6u75, 7u60, and 8u5 allows remote attackers to

affect confidentiality via unknown vectors related

to Security.

2014-07-17 5.0 CVE-2014-4252

oracle --

fusion_middleware

Unspecified vulnerability in the Oracle WebLogic

Server component in Oracle Fusion Middleware

10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows

remote attackers to affect availability via vectors

related to WebLogic Server JVM.

2014-07-17 5.0 CVE-2014-4253

oracle --

fusion_middleware

Unspecified vulnerability in the Oracle WebLogic

Server component in Oracle Fusion Middleware

10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote

attackers to affect confidentiality, integrity, and

availability via vectors related to WLS - Web

Services.

2014-07-17 6.8 CVE-2014-4254

oracle -- Unspecified vulnerability in the Oracle WebLogic 2014-07-17 6.8 CVE-2014-4255

fusion_middleware Server component in Oracle Fusion Middleware

10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote

attackers to affect confidentiality, integrity, and

availability via vectors related to WLS - Security and

Policy.

oracle --

fusion_middleware

Unspecified vulnerability in the Oracle WebLogic

Server component in Oracle Fusion Middleware

10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows

remote attackers to affect confidentiality and

integrity via vectors related to WLS - Deployment.

2014-07-17 5.8 CVE-2014-4256

oracle --

vm_virtualbox

Unspecified vulnerability in the Oracle VM

VirtualBox component in Oracle Virtualization

VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, and

4.3.14 allows local users to affect confidentiality,

integrity, and availability via unknown vectors

related to Core, a different vulnerability than CVE-

2014-2487.

2014-07-17 6.9 CVE-2014-4261

oracle -- jdk Unspecified vulnerability in Oracle Java SE 5.0u65,

6u75, 7u60, and 8u5, and JRockit R27.8.2 and

R28.3.2, allows remote attackers to affect

confidentiality and integrity via unknown vectors

related to "Diffie-Hellman key agreement."

2014-07-17 4.0 CVE-2014-4263

oracle -- jdk Unspecified vulnerability in Oracle Java SE 7u60 and

8u5 allows remote attackers to affect availability via

unknown vectors related to Security.

2014-07-17 5.0 CVE-2014-4264

oracle -- jdk Unspecified vulnerability in Oracle Java SE 6u75,

7u60, and 8u5 allows remote attackers to affect

integrity via unknown vectors related to

Deployment.

2014-07-17 5.0 CVE-2014-4265

oracle -- jdk Unspecified vulnerability in Oracle Java SE 7u60 and

8u5 allows remote attackers to affect integrity via

unknown vectors related to Serviceability.

2014-07-17 5.0 CVE-2014-4266

oracle --

fusion_middleware

Unspecified vulnerability in the Oracle WebLogic

Server component in Oracle Fusion Middleware

10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows

remote attackers to affect confidentiality, integrity,

and availability via vectors related to WLS Core

Components.

2014-07-17 6.8 CVE-2014-4267

oracle -- jdk Unspecified vulnerability in Oracle Java SE 5.0u65,

6u75, 7u60, and 8u5 allows remote attackers to

affect confidentiality via unknown vectors related

to Swing.

2014-07-17 5.0 CVE-2014-4268

oracle -- hyperion Unspecified vulnerability in the Hyperion Common

Admin component in Oracle Hyperion 11.1.2.2 and

11.1.2.3 allows remote authenticated users to affect

confidentiality via unknown vectors related to User

Interface, a different vulnerability than CVE-2014-

4270.

2014-07-17 4.0 CVE-2014-4269

oracle -- hyperion Unspecified vulnerability in the Hyperion Common

Admin component in Oracle Hyperion 11.1.2.2 and

11.1.2.3 allows remote authenticated users to affect

confidentiality via unknown vectors related to User

Interface, a different vulnerability than CVE-2014-

4269.

2014-07-17 4.0 CVE-2014-4270

oracle -- hyperion Unspecified vulnerability in the Hyperion Essbase

component in Oracle Hyperion 11.1.2.2 and 11.1.2.3

allows remote attackers to affect availability via

unknown vectors related to Agent.

2014-07-17 5.0 CVE-2014-4271

reportico --

php_report_design

er

Directory traversal vulnerability in Reportico PHP

Report Designer before 4.0 allows remote attackers

to read arbitrary files via a .. (dot dot) in the xmlin

parameter.

2014-07-16 5.0 CVE-2014-3777MISCOSVDBFULLDISCMISC

shopizer -- shopizer Shopizer 1.1.5 and earlier allows remote attackers

to reduce the total cost of their shopping cart via a

negative number in the productQuantity

parameter, which causes the price of the item to be

subtracted from the total cost.

2014-07-15 6.4 CVE-2014-4962BUGTRAQFULLDISC

shopizer -- shopizer Shopizer 1.1.5 and earlier allows remote attackers

to modify the account settings of arbitrary users via

the customer.customerId parameter to

shop/profile/register.action.

2014-07-15 6.8 CVE-2014-4963BUGTRAQFULLDISC

shopizer -- shopizer Multiple cross-site request forgery (CSRF)

vulnerabilities in Shopizer 1.1.5 and earlier allow

remote attackers to hijack the authentication of

users for requests that (1) modify customer settings

or hijack the authentication of administrators for

2014-07-15 6.8 CVE-2014-4964BUGTRAQFULLDISC

requests that change (2) customer passwords, (3)

shop configuration, or (4) product details, as

demonstrated by (5) modify a product's price via a

crafted request to

central/catalog/saveproduct.action or (6) creating a

product review via a crafted request to

shop/product/createReview.action.

shopizer -- shopizer Multiple cross-site scripting (XSS) vulnerabilities in

Shopizer 1.1.5 and earlier allow remote attackers to

inject arbitrary web script or HTML via the (1)

customername parameter to

central/orders/searchcriteria.action; (2)

productname, (3) availability, or (4) status

parameter to central/catalog/productlist.action; or

unspecified vectors in (5)

WebContent/orders/orderlist.jsp.

2014-07-15 4.3 CVE-2014-4965BUGTRAQFULLDISC

sun -- sunos Unspecified vulnerability in Oracle Sun Solaris 10

allows local users to affect confidentiality, integrity,

and availability via unknown vectors related to

Patch installation scripts.

2014-07-17 6.9 CVE-2014-4225

tera_charts_plugin_

project -- tera-charts

Multiple directory traversal vulnerabilities in Tera

Charts (tera-charts) plugin 0.1 for WordPress allow

remote attackers to read arbitrary files via a .. (dot

dot) in the fn parameter to (1) charts/treemap.php

or (2) charts/zoomabletreemap.php.

2014-07-11 5.0 CVE-2014-4940MISC

yealink --

voip_phone_firmwa

re

CRLF injection vulnerability in Yealink VoIP Phones

with firmware 28.72.0.2 allows remote attackers to

inject arbitrary HTTP headers and conduct HTTP

response splitting attacks via the model parameter

to servlet.

2014-07-16 5.0 CVE-2014-3427BUGTRAQFULLDISC

zte -- zxv10_w300 ZTE ZXV10 W300 router with firmware

W300V1.0.0a_ZRD_LK stores sensitive information

under the web root with insufficient access control,

which allows remote attackers to obtain the

PPPoE/PPPoA password via a direct request for

basic/tc2wanfun.js.

2014-07-16 5.0 CVE-2014-4154MISCEXPLOIT-DBMISC

Low Severity Vulnerabilities

The Primary Vendor --- Product

Description Date Published CVSSScore

The CVE Identity

kaseya --

virtual_system_ad

ministrator

kapfa.sys in Kaseya Virtual System Administrator

(VSA) 6.5 before 6.5.0.17 and 7.0 before 7.0.0.16

allows local users to cause a denial of service (NULL

pointer dereference and application crash) via

unspecified vectors.

2014-07-14 1.7 CVE-2014-2926

mysql -- mysql Unspecified vulnerability in the MySQL Server

component in Oracle MySQL 5.5.35 and earlier and

5.6.15 and earlier allows remote authenticated users

to affect availability via vectors related to ENFED.

2014-07-17 2.8 CVE-2014-4243

oracle --

vm_virtualbox

Unspecified vulnerability in the Oracle VM VirtualBox

component in Oracle Virtualization VirtualBox before

3.2.24, 4.0.26, 4.1.34, 4.2.26, and 4.3.12 allows local

users to affect integrity and availability via unknown

vectors related to Core.

2014-07-17 3.6 CVE-2014-2477

oracle -- siebel_crm Unspecified vulnerability in the Siebel Core - EAI

component in Oracle Siebel CRM 8.1.1 and 8.2.2

allows local users to affect confidentiality via

unknown vectors related to Integration Business

Services.

2014-07-17 1.4 CVE-2014-2485

oracle --

vm_virtualbox

Unspecified vulnerability in the Oracle VM VirtualBox

component in Oracle Virtualization VirtualBox before

3.2.24, 4.0.26, 4.1.34, 4.2.26, and 4.3.12 allows local

users to affect integrity and availability via unknown

vectors related to Core.

2014-07-17 3.0 CVE-2014-2486

oracle --

vm_virtualbox

Unspecified vulnerability in the Oracle VM VirtualBox

component in Oracle Virtualization VirtualBox before

3.2.24, 4.0.26, 4.1.34, 4.2.26, and 4.3.12 allows local

2014-07-17 1.0 CVE-2014-2488

users to affect confidentiality via unknown vectors

related to Core.

oracle --

peoplesoft_product

s

Unspecified vulnerability in the PeopleSoft

Enterprise SCM Purchasing component in Oracle

PeopleSoft Products 9.1 and 9.2 allows remote

authenticated users to affect confidentiality via

unknown vectors related to Purchasing.

2014-07-17 2.3 CVE-2014-2495

oracle --

peoplesoft_product

s

Unspecified vulnerability in the PeopleSoft

Enterprise PT PeopleTools component in Oracle

PeopleSoft Products 8.53 allows remote

authenticated users to affect integrity via vectors

related to PIA Core Technology.

2014-07-17 3.5 CVE-2014-4204

oracle -- hyperion Unspecified vulnerability in the Hyperion Enterprise

Performance Management Architect component in

Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows local

users to affect integrity and availability via unknown

vectors related to Data Synchronizer.

2014-07-17 3.3 CVE-2014-4206

oracle -- jdk Unspecified vulnerability in the Java SE component

in Oracle Java SE 7u60 and 8u5 allows remote

attackers to affect integrity via unknown vectors

related to Deployment, a different vulnerability than

CVE-2014-4220.

2014-07-17 2.6 CVE-2014-4208

oracle -- mysql Unspecified vulnerability in the MySQL Server

component in Oracle MySQL 5.6.17 and earlier

allows remote authenticated users to affect

availability via vectors related to SRSP.

2014-07-17 3.3 CVE-2014-4214

oracle --

fusion_middleware

Unspecified vulnerability in the Oracle HTTP Server

component in Oracle Fusion Middleware 11.1.1.7.0

and 12.1.2.0 allows remote authenticated users to

affect confidentiality via vectors related to plugin

1.1.

2014-07-17 2.1 CVE-2014-4222

oracle -- e-

business_suite

Unspecified vulnerability in the Oracle iStore

component in Oracle E-Business Suite 11.5.10.2,

12.0.6, 12.1.3, 12.2.2, and 12.2.3 allows remote

authenticated users to affect integrity via unknown

vectors.

2014-07-17 3.5 CVE-2014-4235

oracle -- mysql Unspecified vulnerability in the MySQL Server 2014-07-17 3.6 CVE-2014-4240

component in Oracle MySQL 5.6.17 and earlier

allows local users to affect confidentiality and

integrity via vectors related to SRREP.

oracle --

database_server

Unspecified vulnerability in the RDBMS Core

component in Oracle Database Server 11.1.0.7,

11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote

authenticated users to affect confidentiality via

unknown vectors.

2014-07-17 3.5 CVE-2014-4245

oracle -- hyperion Unspecified vulnerability in the Hyperion Analytic

Provider Services component in Oracle Hyperion

11.1.2.2 and 11.1.2.3 allows remote authenticated

users to affect confidentiality via vectors related to

SVP.

2014-07-17 3.5 CVE-2014-4246

oracle -- e-

business_suite

Unspecified vulnerability in the Oracle Application

Object Library component in Oracle E-Business Suite

11.5.10.2, 12.0.6, 12.1.3, 12.2.2, and 12.2.3 allows

local users to affect confidentiality via unknown

vectors related to Logging.

2014-07-17 1.0 CVE-2014-4248

oracle -- siebel_crm Unspecified vulnerability in the Siebel Core - Server

OM Frwks component in Oracle Siebel CRM 8.1.1 and

8.2.2 allows remote authenticated users to affect

confidentiality via unknown vectors related to

Object Manager.

2014-07-17 3.5 CVE-2014-4250

oracle --

fusion_middleware

Unspecified vulnerability in the Oracle HTTP Server

component in Oracle Fusion Middleware 11.1.1.7.0

and 12.1.2.0 allows remote authenticated users to

affect integrity via vectors related to plugin 1.1.

2014-07-17 3.5 CVE-2014-4251

• Sources: http://nvd.nist.gov (For more information visit the National Vulnerabilities Database (NVD) which

contains a database of every vulnerability that has ever been published).

Uganda Communications Commission – UGCERTEmail: info@ug-cert.ug Tel + 256 414 302 100/150 Toll Free: 0800 133 911

Website www.ug-cert.ug Face book / Twitter: UGCERT