- CPXX
- NRG
- FIVE
- DYN
- MIK
- CNP
- LULU
- DG
- SE
- LNT
- VEEV
- NNN
- GLOG
- DLTR
- BGS
- HR
- ETR
- AGR
- BDN
- EPD
- CSOD
Showing posts with label Investment Info. Show all posts
Showing posts with label Investment Info. Show all posts
Sunday, June 5, 2016
Thursday, May 12, 2016
Best Earnings Winners 1Q16
Best Earnings Winners 1Q16:
| SYM | NAME | YTD PERCENT |
| KHC | Kraft Heinz Co Cmn | 18.76% |
| VTR | Ventas Inc | 17.54% |
| NOC | Northrop Grumman Corp | 14.69% |
| FB | Facebook Inc | 14.52% |
| STZ | Constellation Brands Inc | 14.43% |
| MMM | 3M Company | 12.77% |
| LMT | Lockheed Martin Corp | 12.31% |
| JNJ | Johnson & Johnson | 11.31% |
| ACN | Accenture Plc | 11.13% |
| UNH | Unitedhealth Group Inc | 10.54% |
| HON | Honeywell International Inc | 10.21% |
| MCD | McDonald's Corp | 9.74% |
| FRT | Federal Realty Investment Trust | 6.76% |
| PEP | Pepsico Inc | 6.33% |
| AMZN | Amazon.Com Inc | 6.01% |
| GD | General Dynamics Corp | 5.55% |
| CLX | Clorox Company | 4.86% |
| SPG | Simon Property Group | 3.82% |
Sunday, April 24, 2016
Stocks Up 5 Days In A Row 4/22/16 Close
List created by the following TC2000 Scan Criteria:
1st Set Of Charts For Scan Stocks Up 5 Days In A Row
2nd Set Of Charts For Scan Stocks Up 5 Days In A Row
SPDR Select Sector ETFs: All Sector Charts On One Page
- List to scan: US Common Stocks
- Price Per Share > 10 - Daily
- Capitalization > 1000
- Volume > 450000 - Daily
- Up 5 Days In A Row Is True - Daily
1st Set Of Charts For Scan Stocks Up 5 Days In A Row
2nd Set Of Charts For Scan Stocks Up 5 Days In A Row
SPDR Select Sector ETFs: All Sector Charts On One Page
Saturday, April 23, 2016
New Highs 4/22/16 Close:
Charts 1 - 12 for today's New Highs: All Charts On One Page
Charts 13 - 18 for today's New Highs: All Charts On One Page
SPDR Select
Sector ETFs: All Sector Charts
On One Page
Friday, April 8, 2016
Source: The Key Short-Term Test Has Begun
The Key Short-Term Test Has Begun
The red shaded area shows a resistance zone where rallies have died since the heavy volume August selling. The Dow Jones was beginning to test that price resistance zone when the negative divergence emerged, signaling slowing momentum to the upside. That's key here because the rising 20 day EMA has continually offered solid support for the bulls while momentum was accelerating to the upside. Now it's being challenged, but with slowing momentum more apparent.
Trading Places with Tom Bowley - Market Recap for Thursday, April 7, 2016
It was a rough day yesterday. All of our major indices were down. All nine sectors were lower. Unless you were trading gambling stocks or mining for gold, you probably saw red numbers. The selling was truly across the board. But there was a silver lining in there. We have seen 20 day EMAs hold as support on our major indices throughout the rally off the February 11th bottom and they did so again on Thursday. For the bears, closing the market below those rising 20 day EMAs is job #1 because you cannot begin to muster a bear attack with prices remaining above critical short-term support. The Dow Jones, S&P 500 and Russell 2000 all hit their 20 day EMAs during Thursday's rout, but all three closed above that moving average. Here's the visual of the Dow Jones:
The red shaded area shows a resistance zone where rallies have died since the heavy volume August selling. The Dow Jones was beginning to test that price resistance zone when the negative divergence emerged, signaling slowing momentum to the upside. That's key here because the rising 20 day EMA has continually offered solid support for the bulls while momentum was accelerating to the upside. Now it's being challenged, but with slowing momentum more apparent.
The worst hit areas of the market on Thursday were the financials (XLF) where banks ($DJUSBK) fell by 2.77% and lost key support. For a more detailed look at the banks, see the Sector/Industry Watch section below.
Thursday, April 7, 2016
Source: The Direction Of Treasury Yields Remains A Major Concern
The Direction Of Treasury Yields Remains A Major Concern
Tom Bowley | April 07, 2016 at 09:00 AM
Market Recap for Wednesday, April 6, 2016
Healthcare (XLV) and energy (XLE) had huge days on Wednesday as our major indices rose throughout the day and finished on its high. Strength was seen across nearly every sector with only the defensive utilities down slightly. The best performing aggressive sector - technology (XLK) - rose .98% and ranked the XLK fourth in sector performance on the session. The hesitation of money to rotate toward aggressive areas of the market remains a key factor in my current cautious approach to trading. I discuss this in greater detail in the Current Outlook section below.
Despite the huge 2.69% gain in the XLV, there remain significant challenges ahead for the group, particularly on the longer-term weekly chart. Check it out:
The XLV closed at 70.31, but there are two obvious reasons that healthcare could struggle in the 70-71 area. First, there's a down channel in play off the July 2015 highs. Remember those weekly negative divergences that warned us of trouble ahead? Here was my June 2015 article that discussed the potential troubles that healthcare faced at the time.
Also, the selling really began in 2016 from the current level. The entire stock market was extremely weak in January and the XLV was no exception. Now we've rallied back to that level. Finally, the 50 week SMA currently resides at 70.42. It seems unlikely we'll simply go blasting through, but we'll see.
Energy's strength resulted from the bounce in crude oil prices ($WTIC) as the price of crude rose 3.20% and for a second consecutive session, ending the two week decline from $42 per barrel to $36.
Tom Bowley | April 07, 2016 at 09:00 AM
Market Recap for Wednesday, April 6, 2016
Healthcare (XLV) and energy (XLE) had huge days on Wednesday as our major indices rose throughout the day and finished on its high. Strength was seen across nearly every sector with only the defensive utilities down slightly. The best performing aggressive sector - technology (XLK) - rose .98% and ranked the XLK fourth in sector performance on the session. The hesitation of money to rotate toward aggressive areas of the market remains a key factor in my current cautious approach to trading. I discuss this in greater detail in the Current Outlook section below.
Despite the huge 2.69% gain in the XLV, there remain significant challenges ahead for the group, particularly on the longer-term weekly chart. Check it out:
The XLV closed at 70.31, but there are two obvious reasons that healthcare could struggle in the 70-71 area. First, there's a down channel in play off the July 2015 highs. Remember those weekly negative divergences that warned us of trouble ahead? Here was my June 2015 article that discussed the potential troubles that healthcare faced at the time.Also, the selling really began in 2016 from the current level. The entire stock market was extremely weak in January and the XLV was no exception. Now we've rallied back to that level. Finally, the 50 week SMA currently resides at 70.42. It seems unlikely we'll simply go blasting through, but we'll see.
Energy's strength resulted from the bounce in crude oil prices ($WTIC) as the price of crude rose 3.20% and for a second consecutive session, ending the two week decline from $42 per barrel to $36.
Wednesday, April 6, 2016
German Shares Suggesting Caution In U.S.
German Shares Suggesting Caution In U.S.
Tom Bowley | April 06, 2016 at 09:00 AM
Germany had a rough day on Tuesday, losing 259 points or 2.63%. I view this as a big negative for U.S. stocks and I explain why in the Sector/Industry Watch section below. The weekly downtrend appears to be resuming and that could put pressure on stocks here.
Among sectors on Tuesday, the red-hot utilities sector sold off 1.88% to approach its rising 20 day EMA. Despite leading to the downside on Tuesday, the XLU remains the best performing sector over the past three months, six months and year.
Tom Bowley | April 06, 2016 at 09:00 AM
Market Recap for Tuesday, April 5, 2016
U.S. equities had a rough day from the opening bell on Tuesday. The Dow Jones fell more than 100 points in a session for the first time in nearly a month as the rally off the February 11th bottom has continued to unfold. The largest percentage loss was felt on the Russell 2000 ($RUT), where that small cap index fell 1.14% and closed on its low of the day. I'm highlighting the potential downside target for the RUT in the Current Outlook section below.Germany had a rough day on Tuesday, losing 259 points or 2.63%. I view this as a big negative for U.S. stocks and I explain why in the Sector/Industry Watch section below. The weekly downtrend appears to be resuming and that could put pressure on stocks here.
Among sectors on Tuesday, the red-hot utilities sector sold off 1.88% to approach its rising 20 day EMA. Despite leading to the downside on Tuesday, the XLU remains the best performing sector over the past three months, six months and year.
Tuesday, April 5, 2016
Friday, March 25, 2016
Wednesday, March 16, 2016
Saturday, March 12, 2016
Source: Blowout numbers and a breakout stock. Here's how you trade Ulta Salon (ULTA). (March 11, 2016)
Blowout numbers and a breakout stock. Here's how you trade Ulta Salon (ULTA). (March 11, 2016)
Today I want to look at Ulta ( NASDAQ:ULTA ), this is why: You can see this had a heck of a move on Friday. They blew away their earnings number, there’s basically nothing to dislike about it unless you were short. Lets just look at the chart. This stock has essentially been trading sideways since this breakout here. It’s been trading sideways for a LONG time. Honestly just look at the 50-day moving average here and the 200-day moving average here. They have kind of been converging to where (lets zoom in), if this thing hadn’t popped up here, give it another week or two, not even that, and you’ve got a 50-day moving average that’s going to cross DOWN over the 200-day moving average; that’s kind of a bearish development.
Today I want to look at Ulta ( NASDAQ:ULTA ), this is why: You can see this had a heck of a move on Friday. They blew away their earnings number, there’s basically nothing to dislike about it unless you were short. Lets just look at the chart. This stock has essentially been trading sideways since this breakout here. It’s been trading sideways for a LONG time. Honestly just look at the 50-day moving average here and the 200-day moving average here. They have kind of been converging to where (lets zoom in), if this thing hadn’t popped up here, give it another week or two, not even that, and you’ve got a 50-day moving average that’s going to cross DOWN over the 200-day moving average; that’s kind of a bearish development.
Now, here’s how you trade Ulta ( NASDAQ:ULTA ): You can’t go back and buy it here. You see the weekly chart, a complete round tripper here. But if this move is real, this gap, which starts, in other words, the top of the gap right where the stock opened, was right above this resistance level here. So if this move is REAL, and I think it is, you don’t put your stop down here, that’s kind of silly. You put your stop just a little bit below 185.00. The low was 184.10, so put your stop at 184.00. Make it fun and do 183.82, whatever the case may be. But just put your stop down there and what you’re going to have is, look at the box on the left-hand side of the screen here, you’ve got about 4 percent between where the stock closed here at 191.62 and where the LOW was. So you can put a stop, 5 percent maybe, 5 percent below where this stock is now, and that’s an acceptable risk for you to be taking.
Also, no matter HOW this gets up here the buy point here on this stock was on a new high, right here. Anything is possible, but I don’t see this thing reversing on Monday or Tuesday. We’ve seen these kind of moves lately, I’ll just say this, and this is a REALLY modest price target, this thing should go at least to 200.00. If it goes above 200.00, then it’s likely going to go a long way above 200.00. But right now I will just say this: You put your stop a little bit BELOW Friday’s intraday low, so it’s just barely inside the gap, and then ride this thing up.
Sunday, August 2, 2015
Sharpraders.com Top IIC 100 Stocks
Sharpraders.com Top IIC 100 Stocks
SharpTraders.com: The IIC 100 is a weekly list of the Top Stocks in my Relative Strength Database of 5800 equities with very good recent EPS increases and projections.
BSTC, SKX, BLDR, SCMP, HZNP, IRMD, IBP, DPLO, ANIP, INFN, COKE, VRX, FIX, TCX, PANW, AMWD, HQY, WETF, INBK, SQBG, CRTO, AYI, RTIX, MWW, PENN, RCL, INTL, HILL, MNK, THC, PAYC, AAC, BEAT, IPHI, WCIC, MDXG, ADBE, EPAM, GIMO, TILE, BYD, PN, MBLY, PLPM, ACHC, OPB, CALD, SPLK, EQIX, NCOM, FSB, CBPX, GPRO, LYTS, ZBRA, VMC, APOG, LGIH, CMGE, ESNT, AXTA, MTSI, GFF, FSGI, ASC, NXST, MHO, CRM, MLVF, CELG, BCO, XXIA, RENT, NWHM, VBTX, TTMI, RH, MYCC, CSH, NVR, TREX, BLD, DRII, BZH, CNTY, DGII, AKRX, DB, TISI, SIRI, DLA, CCS, CUNB, BNK, RT, GPP, CARB, TBK, CTRN, SLP
SharpTraders.com: The IIC 100 is a weekly list of the Top Stocks in my Relative Strength Database of 5800 equities with very good recent EPS increases and projections.
BSTC, SKX, BLDR, SCMP, HZNP, IRMD, IBP, DPLO, ANIP, INFN, COKE, VRX, FIX, TCX, PANW, AMWD, HQY, WETF, INBK, SQBG, CRTO, AYI, RTIX, MWW, PENN, RCL, INTL, HILL, MNK, THC, PAYC, AAC, BEAT, IPHI, WCIC, MDXG, ADBE, EPAM, GIMO, TILE, BYD, PN, MBLY, PLPM, ACHC, OPB, CALD, SPLK, EQIX, NCOM, FSB, CBPX, GPRO, LYTS, ZBRA, VMC, APOG, LGIH, CMGE, ESNT, AXTA, MTSI, GFF, FSGI, ASC, NXST, MHO, CRM, MLVF, CELG, BCO, XXIA, RENT, NWHM, VBTX, TTMI, RH, MYCC, CSH, NVR, TREX, BLD, DRII, BZH, CNTY, DGII, AKRX, DB, TISI, SIRI, DLA, CCS, CUNB, BNK, RT, GPP, CARB, TBK, CTRN, SLP
Monday, September 8, 2014
Vulnerability Summary for the Week of September 1, 2014 | US-CERT
Source: Vulnerability Summary for the Week of September 1, 2014 | US-CERT
The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology(NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit theNVD, which contains historical vulnerability information.
The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:
- High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0
- Medium - Vulnerabilities will be labeled Medium severity if they have a CVSS base score of 4.0 - 6.9
- Low - Vulnerabilities will be labeled Low severity if they have a CVSS base score of 0.0 - 3.9
Entries may include additional information provided by organizations and efforts sponsored by US-CERT. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletins is compiled from external, open source reports and is not a direct result of US-CERT analysis.
High Vulnerabilities
| Primary Vendor -- Product | Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| arubanetworks -- clearpass_policy_manager | The management console in Aruba Networks ClearPass Policy Manager 6.3.0.60730 allows local users to execute arbitrary commands via shell metacharacters in certain arguments of a valid command, as demonstrated by the (1) system status-rasession and (2) network ping commands. | 2014-08-29 | 9.0 | CVE-2014-2593 MISC XF BID OSVDB |
| check_mk_project -- check_mk | The wato component in Check_MK before 1.2.4p4 and 1.2.5 before 1.2.5i4 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, related to an automation URL. | 2014-09-02 | 9.3 | CVE-2014-5340 BUGTRAQ MISC |
| cisco -- ios_xr | Cisco IOS XR 4.3(.2) and earlier, as used in Cisco Carrier Routing System (CRS), allows remote attackers to cause a denial of service (CPU consumption and IPv6 packet drops) via a malformed IPv6 packet, aka Bug ID CSCuo95165. | 2014-09-04 | 7.1 | CVE-2014-3353 |
| codeaurora -- android-msm | The device-initialization functionality in the MSM camera driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, enables MSM_CAM_IOCTL_SET_MEM_MAP_INFO ioctl calls for an unrestricted mmap interface, which allows attackers to gain privileges via a crafted application. | 2014-08-31 | 7.2 | CVE-2013-2595 |
| codeaurora -- android-msm | Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via an application that leverages /dev/msm_acdb access and provides a large size value in an ioctl argument. | 2014-08-31 | 7.2 | CVE-2013-2597 |
| gnu -- glibc | Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors related to the CHARSET environment variable and gconv transliteration modules. | 2014-08-29 | 7.5 | CVE-2014-5119 CONFIRM MISC BID MLIST MLIST FULLDISC MISC |
| ibm -- db2 | Stack-based buffer overflow in IBM DB2 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linux, UNIX, and Windows allows remote authenticated users to execute arbitrary code via a crafted ALTER MODULE statement. | 2014-09-04 | 8.5 | CVE-2014-3094 XF AIXAPAR AIXAPAR AIXAPAR AIXAPAR |
| mozilla -- firefox | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. | 2014-09-03 | 10.0 | CVE-2014-1553 CONFIRM CONFIRM CONFIRM CONFIRM CONFIRM CONFIRM CONFIRM |
| mozilla -- firefox | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 32.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. | 2014-09-03 | 10.0 | CVE-2014-1554 CONFIRM CONFIRM CONFIRM CONFIRM |
| mozilla -- firefox | Unspecified vulnerability in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. | 2014-09-03 | 10.0 | CVE-2014-1562 CONFIRM |
| mozilla -- firefox | Use-after-free vulnerability in the mozilla::DOMSVGLength::GetTearOff function in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG animation with DOM interaction that triggers incorrect cycle collection. | 2014-09-03 | 10.0 | CVE-2014-1563 CONFIRM |
| mozilla -- firefox | Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout. | 2014-09-03 | 9.3 | CVE-2014-1567 CONFIRM |
| novell -- groupwise | The client in Novell GroupWise before 8.0.3 HP4, 2012 before SP3, and 2014 before SP1 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference) via unspecified vectors. | 2014-09-04 | 10.0 | CVE-2014-0610 CONFIRM |
| s3ql_project -- s3ql | S3QL 1.18.1 and earlier uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object in (1) common.py or (2) local.py in backends/. | 2014-09-02 | 7.5 | CVE-2014-0485 MLIST DEBIAN |
| solarwinds -- log_and_event_manager | SolarWinds Log and Event Manager before 6.0 uses "static" credentials, which makes it easier for remote attackers to obtain access to the database and execute arbitrary code via unspecified vectors, related to HyperSQL. | 2014-09-04 | 7.5 | CVE-2014-5504 MISC CONFIRM |
| tibco -- spotfire_server | Unspecified vulnerability in the Authentication Module in TIBCO Spotfire Server before 4.5.2, 5.0.x before 5.0.3, 5.5.x before 5.5.2, 6.0.x before 6.0.3, and 6.5.x before 6.5.1 allows remote attackers to gain privileges, and obtain sensitive information or modify data, via unknown vectors. | 2014-09-04 | 7.5 | CVE-2014-5285 |
| vmturbo -- operations_manager | vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 allows remote attackers to execute arbitrary commands via shell metacharacters in the fileDate parameter in a DOWN call. | 2014-08-29 | 7.5 | CVE-2014-5073 XF BID OSVDB EXPLOIT-DB MISC SECUNIA MISC MISC |
| zend -- zend_framework | The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider. | 2014-09-04 | 7.5 | CVE-2014-2685 MANDRIVA MLIST CONFIRM |
Medium Vulnerabilities
| Primary Vendor -- Product | Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| amazon -- kindle | The Amazon.com Kindle application before 4.5.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. | 2014-08-30 | 5.8 | CVE-2014-3908 JVNDB JVN |
| apache -- commons-httpclient | http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5783. | 2014-09-04 | 4.3 | CVE-2012-6153 CONFIRM BID CONFIRM REDHAT |
| apache -- poi | The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. | 2014-09-04 | 4.3 | CVE-2014-3529 CONFIRM SECUNIA CONFIRM |
| apache -- poi | Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack. | 2014-09-04 | 4.3 | CVE-2014-3574 SECUNIA CONFIRM |
| check_mk_project -- check_mk | Check_MK before 1.2.4p4 and 1.2.5 before 1.2.5i4 allows remote authenticated users to write check_mk config files (.mk files) to arbitrary locations via vectors related to row selections. | 2014-09-02 | 4.9 | CVE-2014-5339 BUGTRAQ MISC |
| cisco -- cloud_portal | Cisco Intelligent Automation for Cloud (aka Cisco Cloud Portal) 2008.3_SP9 and earlier does not properly consider whether a session is a problematic NULL session, which allows remote attackers to obtain sensitive information via crafted packets, related to an "iFrame vulnerability," aka Bug ID CSCuh84801. | 2014-08-30 | 4.3 | CVE-2014-3352 |
| codeaurora -- android-msm | app/aboot/aboot.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to overwrite signature-verification code via crafted boot-image load-destination header values that specify memory locations within bootloader memory. | 2014-08-31 | 6.6 | CVE-2013-2598 |
| codeaurora -- android-msm | A certain Qualcomm Innovation Center (QuIC) patch to the NativeDaemonConnector class in services/java/com/android/server/NativeDaemonConnector.java in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.3.x enables debug logging, which allows attackers to obtain sensitive disk-encryption passwords via a logcat call. | 2014-08-31 | 5.0 | CVE-2013-2599 |
| exim -- exim | The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expand_string function. | 2014-09-04 | 6.8 | CVE-2014-2957 CONFIRM |
| exim -- exim | expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and execute arbitrary commands via a crafted lookup value. | 2014-09-04 | 4.6 | CVE-2014-2972 CONFIRM FEDORA FEDORA CONFIRM |
| freedesktop -- poppler | DCTStream.cc in Poppler before 0.13.3 allows remote attackers to cause a denial of service (crash) via a crafted PDF file. | 2014-08-29 | 4.3 | CVE-2010-5110 SUSE CONFIRM SECUNIA MLIST |
| google -- android_browser | The Android Browser application 4.2.1 on Android allows remote attackers to bypass the Same Origin Policy via a crafted attribute containing a \u0000 character, as demonstrated by an onclick="window.open('\u0000javascript: sequence. | 2014-09-02 | 5.8 | CVE-2014-6041 MISC |
| hl7 -- c-cda | Cross-site scripting (XSS) vulnerability in CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted reference element within a nonXMLBody element. | 2014-09-02 | 4.3 | CVE-2014-3861 MISC |
| hl7 -- c-cda | CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to discover potentially sensitive URLs via a crafted reference element that triggers creation of an IMG element with an arbitrary URL in its SRC attribute, leading to information disclosure in a Referer log. | 2014-09-02 | 4.3 | CVE-2014-3862 MISC |
| hl7 -- c-cda | CDA.xsl in HL7 C-CDA 1.1 and earlier does not anticipate the possibility of invalid C-CDA documents with crafted XML attributes, which allows remote attackers to conduct XSS attacks via a document containing a table that is improperly handled during unrestricted xsl:copy operations. | 2014-09-02 | 4.3 | CVE-2014-5452 MISC |
| ibm -- cognos_tm1 | The client in IBM Cognos TM1 9.5.2.3 before IF5, 10.1.1.2 before IF1, 10.2.0.2 before IF1, and 10.2.2.0 before IF1 stores obfuscated passwords in memory, which allows remote authenticated users to obtain sensitive cleartext information via an unspecified security tool. | 2014-09-04 | 4.0 | CVE-2014-0863 XF |
| ibm -- business_process_manager | IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.x allow remote authenticated users to bypass intended access restrictions and send requests to internal services via a callService URL. | 2014-09-04 | 4.0 | CVE-2014-4758 XF AIXAPAR |
| ibm -- business_process_manager | An unspecified Ajax service in the Content Management toolkit in IBM Business Process Manager (BPM) 8.5.x through 8.5.5 allows remote authenticated users to obtain sensitive information by performing a document-attachment search and then reading document properties in the search results. | 2014-09-04 | 4.0 | CVE-2014-4759 XF |
| iii -- encore_discovery_solution | Open redirect vulnerability in Innovative Interfaces Encore Discovery Solution 4.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in an unspecified parameter. | 2014-08-29 | 5.8 | CVE-2014-5127 BID BUGTRAQ |
| iii -- encore_discovery_solution | Innovative Interfaces Encore Discovery Solution 4.3 places a session token in the URI, which might allow remote attackers to obtain sensitive information via unspecified vectors. | 2014-08-29 | 5.0 | CVE-2014-5128 BID BUGTRAQ |
| iii -- sierra | Cross-site scripting (XSS) vulnerability in Innovative Interfaces Sierra Library Services Platform 1.2_3 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters. | 2014-09-02 | 4.3 | CVE-2014-5136 BUGTRAQ |
| iii -- sierra | Innovative Interfaces Sierra Library Services Platform 1.2_3 provides different responses for login request depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of login requests, possibly related to the Webpac Pro submodule. | 2014-09-02 | 5.0 | CVE-2014-5137 BUGTRAQ |
| labanquepostale -- labanquepostale | The La Banque Postale application before 3.2.6 for Android does not prevent the launching of an activity by a component of another application, which allows attackers to obtain sensitive cached banking information via crafted intents, as demonstrated by the drozer framework. | 2014-09-02 | 4.3 | CVE-2014-5076 MISC |
| linux -- linux_kernel | The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.16.1 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to (1) cause a denial of service (host OS memory corruption) or possibly have unspecified other impact by triggering a large gfn value or (2) cause a denial of service (host OS memory consumption) by triggering a small gfn value that leads to permanently pinned pages. | 2014-08-31 | 4.3 | CVE-2014-3601 CONFIRM |
| linux -- linux_kernel | Stack consumption vulnerability in the parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (uncontrolled recursion, and system crash or reboot) via a crafted iso9660 image with a CL entry referring to a directory entry that has a CL entry. | 2014-08-31 | 4.0 | CVE-2014-5471 MISC CONFIRM MLIST |
| linux -- linux_kernel | The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (unkillable mount process) via a crafted iso9660 image with a self-referential CL entry. | 2014-08-31 | 4.0 | CVE-2014-5472 MISC CONFIRM MLIST |
| lua -- lua | Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments. | 2014-09-04 | 5.0 | CVE-2014-5461 BID MLIST DEBIAN DEBIAN |
| manageengine -- device_expert | ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request. | 2014-09-04 | 5.0 | CVE-2014-5377 MISC XF BID BUGTRAQ EXPLOIT-DB FULLDISC FULLDISC FULLDISC MISC |
| mcafee -- network_security_manager | Cross-site request forgery (CSRF) vulnerability in the User Management module in McAfee Network Security Manager (NSM) before 6.1.15.39 7.1.5.x before 7.1.5.15, 7.1.15.x before 7.1.15.7, 7.5.x before 7.5.5.9, and 8.x before 8.1.7.3 allows remote attackers to hijack the authentication of users for requests that modify user accounts via unspecified vectors. | 2014-08-29 | 6.8 | CVE-2014-2390 SECTRACK |
| mcafee -- web_gateway | The Accounts tab in the administrative user interface in McAfee Web Gateway (MWG) before 7.3.2.9 and 7.4.x before 7.4.2 allows remote authenticated users to obtain the hashed user passwords via unspecified vectors. | 2014-09-02 | 4.0 | CVE-2014-6064 SECTRACK |
| mikejolley -- download_monitor | Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the default URI. | 2014-09-04 | 4.3 | CVE-2012-4768 CONFIRM SECUNIA MISC OSVDB BUGTRAQ |
| mozilla -- firefox | Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 do not properly initialize memory for GIF rendering, which allows remote attackers to obtain sensitive information from process memory via crafted web script that interacts with a CANVAS element associated with a malformed GIF image. | 2014-09-03 | 4.3 | CVE-2014-1564 CONFIRM |
| mozilla -- firefox | The mozilla::dom::AudioEventTimeline function in the Web Audio API implementation in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 does not properly create audio timelines, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via crafted API calls. | 2014-09-03 | 5.0 | CVE-2014-1565 CONFIRM |
| mozilla -- firefox | Mozilla Firefox before 31.1 on Android does not properly restrict copying of local files onto the SD card during processing of file: URLs, which allows attackers to obtain sensitive information from the Firefox profile directory via a crafted application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1515. | 2014-09-03 | 4.3 | CVE-2014-1566 CONFIRM |
| phorum -- phorum | Cross-site scripting (XSS) vulnerability in the group moderation screen in the control center (control.php) in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via the group parameter. | 2014-09-04 | 4.3 | CVE-2012-4234 MISC XF BID SECUNIA MISC BUGTRAQ |
| plack_project -- plack | Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to bypass the whitelist of generated files and obtain sensitive information via a crafted path, related to Plack::Middleware::Static. | 2014-09-04 | 5.0 | CVE-2014-5269 OSVDB MLIST FEDORA FEDORA CONFIRM |
| qpw.famvanakkeren -- quick_post_widget | Multiple cross-site scripting (XSS) vulnerabilities in Quick Post Widget plugin 1.9.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) Title, (2) Content, or (3) New category field to wordpress/ or (4) query string to wordpress/. | 2014-09-03 | 4.3 | CVE-2012-4226 XF BID MISC MISC BUGTRAQ |
| sap -- crystal_reports | Stack-based buffer overflow in SAP Crystal Reports allows remote attackers to execute arbitrary code via a crafted data source string in an RPT file. | 2014-09-04 | 6.8 | CVE-2014-5505 CONFIRM MISC CONFIRM |
| sap -- crystal_reports | Double free vulnerability in SAP Crystal Reports allows remote attackers to execute arbitrary code via crafted connection string record in an RPT file. | 2014-09-04 | 6.8 | CVE-2014-5506 CONFIRM MISC CONFIRM |
| sap -- netweaver | Buffer overflow in disp+work.exe 7000.52.12.34966 and 7200.117.19.50294 in the Dispatcher in SAP NetWeaver 7.00 and 7.20 allows remote authenticated users to cause a denial of service or execute arbitrary code via unspecified vectors. | 2014-09-05 | 6.5 | CVE-2014-6252 CONFIRM SECUNIA CONFIRM MISC |
| sixapart -- movable_type | Cross-site scripting (XSS) vulnerability in Six Apart (formerly Six Apart KK) Movable Type (MT) Pro 5.13 allows remote attackers to inject arbitrary web script or HTML via the comment section. | 2014-08-29 | 4.3 | CVE-2012-1503 XF BID EXPLOIT-DB MISC MISC OSVDB |
| torrentflux -- torrentflux | TorrentFlux 2.4 allows remote authenticated users to obtain other users' cookies via the cid parameter in an editCookies action to profile.php. | 2014-09-05 | 4.0 | CVE-2014-6028 MISC SECTRACK MLIST MLIST |
| torrentflux -- torrentflux | TorrentFlux 2.4 allows remote authenticated users to delete or modify other users' cookies via the cid parameter in an editCookies action to profile.php. | 2014-09-05 | 4.9 | CVE-2014-6029 MISC SECTRACK MLIST MLIST |
| werdswords -- download_shortcode | Directory traversal vulnerability in force-download.php in the Download Shortcode plugin 0.2.3 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. | 2014-09-03 | 5.0 | CVE-2014-5465 BID EXPLOIT-DB CONFIRM |
| wordpress_mobile_pack_project -- wordpress_mobile_pack | The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remote attackers to obtain sensitive information via an exportarticles action to export/content.php. | 2014-08-29 | 5.0 | CVE-2014-5337 MISC BID SECUNIA |
| xen -- xen | Xen 4.4.x, when running a 64-bit kernel on an ARM system, does not properly handle traps from the guest domain that use a different address width, which allows local guest users to cause a denial of service (host crash) via a crafted 32-bit process. | 2014-08-29 | 4.3 | CVE-2014-5147 |
| xrms_crm_project -- xrms_crm | plugins/useradmin/fingeruser.php in XRMS CRM, possibly 1.99.2, allows remote authenticated users to execute arbitrary code via shell metacharacters in the username parameter. | 2014-09-02 | 6.5 | CVE-2014-5521 MLIST MLIST EXPLOIT-DB FULLDISC MISC |
| zohocorp -- manageengine_eventlog_analyzer | Multiple cross-site scripting (XSS) vulnerabilities in event/index2.do in ManageEngine EventLog Analyzer before 9.0 build 9002 allow remote attackers to inject arbitrary web script or HTML via the (1) width, (2) height, (3) url, (4) helpP, (5) tab, (6) module, (7) completeData, (8) RBBNAME, (9) TC, (10) rtype, (11) eventCriteria, (12) q, (13) flushCache, or (14) product parameter. | 2014-08-29 | 4.3 | CVE-2014-4930 BID FULLDISC |
Low Vulnerabilities
| Primary Vendor -- Product | Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| codeaurora -- android-msm | The Qualcomm Innovation Center (QuIC) init scripts in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.4.x allow local users to modify file metadata via a symlink attack on a file accessed by a (1) chown or (2) chmod command, as demonstrated by changing the permissions of an arbitrary file via an attack on the sensor-settings file. | 2014-08-31 | 3.3 | CVE-2013-6124 |
| dhcpcd_project -- dhcpcd | The get_option function in dhcpcd 4.0.0 through 6.x before 6.4.3 allows remote DHCP servers to cause a denial of service by resetting the DHO_OPTIONSOVERLOADED option in the (1) bootfile or (2) servername section, which triggers the option to be processed again. | 2014-09-04 | 3.3 | CVE-2014-6060 BID MLIST MLIST MANDRIVA CONFIRM CONFIRM |
| eucalyptus -- eucalyptus | The Storage Controller (SC) component in Eucalyptus 3.4.2 through 4.0.x before 4.0.1, when Dell Equallogic SAN is used, logs the CHAP user credentials, which allows local users to obtain sensitive information by reading the logs. | 2014-09-05 | 2.1 | CVE-2014-5036 SECUNIA SECUNIA |
| ganeti_project -- ganeti | The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information by reading the file, related to the upgrade command. | 2014-08-29 | 2.1 | CVE-2014-5247 MISC XF BID BUGTRAQ MLIST MISC |
| ibm -- business_process_manager | Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.0.x allows remote authenticated users to inject arbitrary web script or HTML via an uploaded file. | 2014-09-04 | 3.5 | CVE-2014-3075 XF |
| ibm -- db2 | The SQL engine in IBM DB2 9.5 through FP10, 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linux, UNIX, and Windows allows remote authenticated users to cause a denial of service (daemon crash) via a crafted UNION clause in a subquery of a SELECT statement. | 2014-09-04 | 3.5 | CVE-2014-3095 XF AIXAPAR AIXAPAR AIXAPAR AIXAPAR |
| ibm -- db2 | IBM DB2 10.5 before FP4 on Linux and AIX creates temporary files during CDE table LOAD operations, which allows local users to obtain sensitive information by reading a file while a LOAD is occurring. | 2014-09-04 | 2.1 | CVE-2014-4805 CONFIRM |
| opensuse -- srvx | Multiple integer overflows in the HelpServ module (mod-helpserv.c) in srvx 1.3.1 allow remote authenticated IRCops or HelpServ bot managers to cause a denial of service (infinite loop) via a large value in the EmptyInterval parameter or certain other interval configurations. | 2014-09-05 | 3.5 | CVE-2014-5508 BID MLIST MLIST |
Subscribe to:
Posts (Atom)
BookMark
