CVE-database
129.550 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2016-2159 MEDIUM · 4.3 Met de save_submission-functie in mod/assign/externallib.php in Moodle via 2.6.11, 2.7.x vóór 2.7.13, 2.8.x vóór 2.8.11, 2.9.x vóór 2.9.5 en 3.0.x vóór 3.0.3 kunnen op afstand… Moodle
- CVE-2016-2158 MEDIUM · 4.3 lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3, when the forcelogin feature is enabled, allows… Moodle
- CVE-2016-2157 HIGH · 8.8 Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows… Moodle
- CVE-2016-2156 MEDIUM · 4.3 calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 provides calendar-event data without considering whether an… Moodle
- CVE-2016-2155 MEDIUM · 4.3 The grade-reporting feature in Singleview (aka Single View) in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/grade:manage… Moodle
- CVE-2016-2154 MEDIUM · 4.3 admin/tool/monitor/lib.php in Event Monitor in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/course:viewhiddencourses capability, which allows remote… Moodle
- CVE-2016-2153 MEDIUM · 6.1 Cross-site scripting (XSS) vulnerability in the advanced-search feature in mod_data in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x… Moodle
- CVE-2016-2152 MEDIUM · 6.1 Multiple cross-site scripting (XSS) vulnerabilities in auth/db/auth.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allow… Moodle
- CVE-2016-2151 MEDIUM · 4.3 user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on the basis of… Moodle
- CVE-2016-4567 MEDIUM · 6.1 Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or… Mediaelementjs Wordpress
- CVE-2016-4566 MEDIUM · 6.1 Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or… Wordpress Plupload
- CVE-2016-4544 CRITICAL · 9.8 The exif_process_TIFF_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate TIFF start data, which allows remote… Php Opensuse Fedoraproject Debian
- CVE-2016-4543 CRITICAL · 9.8 The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, which allows remote attackers… Hp Php Fedoraproject Opensuse
- CVE-2016-4542 CRITICAL · 9.8 The exif_process_IFD_TAG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not properly construct spprintf arguments, which allows remote… Php Opensuse Fedoraproject
- CVE-2016-4541 CRITICAL · 9.8 The grapheme_strpos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service… Fedoraproject Php Opensuse
- CVE-2016-4540 CRITICAL · 9.8 Met de functie grapheme_stripos in ext/intl/grapheme/grapheme_string.c in PHP vóór 5.5.35, 5.6.x vóór 5.6.21 en 7.x vóór 7.0.6 kunnen externe aanvallers een denial of service veroorzaken… Fedoraproject Opensuse Php
- CVE-2016-4539 CRITICAL · 9.8 The xml_parse_into_struct function in ext/xml/xml.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service… Php Opensuse Fedoraproject
- CVE-2016-4538 CRITICAL · 9.8 The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 modifies certain data structures without considering whether they are… Php Fedoraproject Opensuse
- CVE-2016-4537 CRITICAL · 9.8 De functie bcpowmod in ext/bcmath/bcmath.c in PHP vóór 5.5.35, 5.6.x vóór 5.6.21 en 7.x vóór 7.0.6 accepteert een negatief geheel getal voor het schaalargument, waardoor… Php Opensuse Fedoraproject
- CVE-2016-4346 CRITICAL · 9.8 Integer overflow in the str_pad function in ext/standard/string.c in PHP before 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified… Php Opensuse
- CVE-2016-4345 CRITICAL · 9.8 Integer overflow in the php_filter_encode_url function in ext/filter/sanitizing_filters.c in PHP before 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified… Php
- CVE-2016-4344 CRITICAL · 9.8 Integer overflow in the xml_utf8_encode function in ext/xml/xml.c in PHP before 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified… Php
- CVE-2016-4343 HIGH · 8.8 The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which allows remote attackers to cause a denial… Php Opensuse
- CVE-2016-4342 HIGH · 8.8 ext/phar/phar_object.c in PHP vóór 5.5.32, 5.6.x vóór 5.6.18 en 7.x vóór 7.0.3 misbruikt niet-gecomprimeerde gegevens met een lengte van nul, waardoor aanvallers op afstand een… Opensuse Php
- CVE-2016-2222 HIGH · 8.6 The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attacks via a zero value in the… Wordpress
- CVE-2016-2221 HIGH · 7.4 Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct… Wordpress
- CVE-2016-1564 MEDIUM · 6.1 Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a (1) stylesheet… Wordpress
- CVE-2015-8880 CRITICAL · 9.8 Double free vulnerability in the format printer in PHP 7.x before 7.0.1 allows remote attackers to have an unspecified impact by triggering an error. Php
- CVE-2015-8879 HIGH · 7.5 The odbc_bindcols function in ext/odbc/php_odbc.c in PHP before 5.6.12 mishandles driver behavior for SQL_WVARCHAR columns, which allows remote attackers to cause a denial of service… Php
- CVE-2015-8878 MEDIUM · 5.9 main/php_open_temporary_file.c in PHP before 5.5.28 and 5.6.x before 5.6.12 does not ensure thread safety, which allows remote attackers to cause a denial of service (race… Php
- CVE-2015-8877 HIGH · 7.5 The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free… Libgd Php
- CVE-2015-8876 CRITICAL · 9.8 Zend/zend_exceptions.c in PHP vóór 5.4.44, 5.5.x vóór 5.5.28 en 5.6.x vóór 5.6.12 valideert bepaalde Exception-objecten niet, waardoor externe aanvallers een denial of service (NULL pointer… Php
- CVE-2015-8867 HIGH · 7.5 The openssl_random_pseudo_bytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 incorrectly relies on the deprecated RAND_pseudo_bytes function, which makes… Php Canonical
- CVE-2015-8866 CRITICAL · 9.6 ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which… Php Canonical Opensuse Suse
- CVE-2015-8834 MEDIUM · 6.1 Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a long comment that… Wordpress
- CVE-2015-7989 MEDIUM · 5.4 Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitrary web script or HTML via… Wordpress
- CVE-2015-5715 MEDIUM · 4.3 The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for… Wordpress
- CVE-2015-5714 MEDIUM · 6.1 Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML… Wordpress
- CVE-2014-9767 MEDIUM · 4.3 Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php_zip.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 and ext/zip/ext_zip.cpp in HHVM before… Php Hiphop Virtual Machine For Php Project
- CVE-2016-1402 HIGH · 7.5 The Active Directory (AD) integration component in Cisco Identity Service Engine (ISE) before 1.2.0.899 patch 7, when AD group-membership authorization is enabled, allows remote attackers… Cisco
- CVE-2016-1401 MEDIUM · 6.1 Cross-site scripting (XSS) vulnerability in the management interface in Cisco Unified Computing System (UCS) Central Software 1.4(1a) allows remote attackers to inject arbitrary web script… Cisco
- CVE-2016-4441 MEDIUM · 6.0 The get_cmd function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check DMA length, which allows local guest… Qemu Canonical Debian
- CVE-2016-4439 MEDIUM · 6.7 The esp_reg_write function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check command buffer length, which allows local… Canonical Qemu Debian
- CVE-2016-4348 HIGH · 7.5 Met de functie_rsvg_css_normalize_font_size in librsvg 2.40.2 kunnen contextafhankelijke aanvallers een denial of service (stackconsumptie en applicatiecrash) veroorzaken via circulaire definities in een SVG-document. Gnome Debian Opensuse
- CVE-2016-3739 MEDIUM · 5.3 The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or making a TLS… Haxx
- CVE-2016-3728 HIGH · 8.8 Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11.2 allows remote attackers to execute… Theforeman
- CVE-2016-3693 HIGH · 8.1 The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensitive information… Safemode Project
- CVE-2016-2100 MEDIUM · 5.4 Voorman vóór 1.10.3 en 1.11.0 vóór 1.11.0-RC2 staan op afstand geverifieerde gebruikers toe om privébladwijzers te lezen, te wijzigen of te verwijderen door gebruik te… Theforeman
- CVE-2015-7558 HIGH · 7.5 librsvg vóór 2.40.12 stelt contextafhankelijke aanvallers in staat om een denial of service (oneindige lus, stapelverbruik en applicatiecrash) te veroorzaken via cyclische verwijzingen in een… Debian Gnome
- CVE-2015-7557 HIGH · 7.5 De functie _rsvg_node_poly_build_path in rsvg-shapes.c in librsvg vóór versie 2.40.7 stelt contextafhankelijke aanvallers in staat een denial-of-service-aanval (een leesfout buiten de toegestane geheugenruimte) uit te… Gnome