CVE-database
129.141 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2015-4551 MEDIUM · 4.3 LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 uses the stored LinkUpdateMode configuration information in OpenDocument Format files and templates when handling links, which might… Libreoffice Canonical Debian Apache
- CVE-2015-8100 LOW · 2.1 The net-snmp package in OpenBSD through 5.8 uses 0644 permissions for snmpd.conf, which allows local users to obtain sensitive community information by reading this file. Net-snmp
- CVE-2015-6362 MEDIUM · 4.0 The web GUI in Cisco Connected Grid Network Management System (CG-NMS) 3.0(0.35) and 3.0(0.54) allows remote authenticated users to bypass intended access restrictions and modify… Cisco
- CVE-2015-5655 MEDIUM · 5.8 De Adways Party Track SDK vóór 1.6.6 voor iOS verifieert geen X.509-certificaten van SSL-servers, waardoor man-in-the-middle-aanvallers servers kunnen vervalsen en gevoelige informatie kunnen verkrijgen via… Adways
- CVE-2015-8007 MEDIUM · 4.0 The Echo extension for MediWiki does not properly implement the hideuser functionality, which allows remote authenticated users to see hidden usernames in "non-revision based" notifications,… Echo Project
- CVE-2015-8006 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in the PageTriage toolbar in the PageTriage extension for MediWiki allows remote attackers to inject arbitrary web script or HTML via… Pagetriage Project
- CVE-2015-8005 MEDIUM · 5.0 MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 uses the thumbnail ImageMagick command line argument, which allows remote attackers to obtain the installation… Mediawiki
- CVE-2015-8004 MEDIUM · 4.0 MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not properly restrict access to revisions, which allows remote authenticated users with the viewsuppressed… Mediawiki
- CVE-2015-8003 MEDIUM · 6.8 MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not throttle file uploads, which allows remote authenticated users to have unspecified impact via… Mediawiki
- CVE-2015-8002 MEDIUM · 6.8 The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated users to cause a denial of… Mediawiki
- CVE-2015-8001 LOW · 3.5 The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not restrict the uploaded data to the claimed… Mediawiki
- CVE-2015-8096 HIGH · 10.0 Integer overflow in Google Picasa 3.9.140 Build 239 en Build 248 stelt externe aanvallers in staat om willekeurige code uit te voeren via niet-gespecificeerde vectoren… Google
- CVE-2015-8095 MEDIUM · 5.0 De prullenbakfunctie in de Monster Menu 's-module 7.x-1.21 vóór 7.x-1.24 voor Drupal verwijdert knooppunten niet correct uit het zicht, waardoor externe aanvallers gevoelige informatie kunnen… Monster Menus Project Drupal
- CVE-2015-8041 MEDIUM · 5.0 Multiple integer overflows in the NDEF record parser in hostapd before 2.5 and wpa_supplicant before 2.5 allow remote attackers to cause a denial of service… W1.fi Opensuse
- CVE-2015-7940 MEDIUM · 5.0 The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to… Opensuse Bouncycastle Oracle
- CVE-2015-7295 MEDIUM · 5.0 hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allows remote attackers to cause a… Qemu Fedoraproject Debian
- CVE-2015-5218 LOW · 2.1 Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a crafted file, related… Kernel Opensuse Opensuse Project
- CVE-2015-3240 MEDIUM · 4.3 The pluto IKE daemon in libreswan before 3.15 and Openswan before 2.6.45, when built with NSS, allows remote attackers to cause a denial of service… Libreswan
- CVE-2014-8873 HIGH · 10.0 A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime-support, which allows remote attackers… Oracle
- CVE-2015-5734 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or… Wordpress
- CVE-2015-5733 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via… Wordpress
- CVE-2015-5732 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web… Wordpress
- CVE-2015-5731 MEDIUM · 6.8 Cross-site request forgery (CSRF) -kwetsbaarheid in wp-admin/post.php in WordPress vóór 4.2.4 stelt externe aanvallers in staat om de authenticatie van beheerders te kapen voor verzoeken… Wordpress
- CVE-2015-5730 MEDIUM · 5.0 The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing… Wordpress
- CVE-2015-2213 HIGH · 7.5 SQL-injectiekwetsbaarheid in de wp_untrash_post_comments-functie in wp-includes/post.php in WordPress vóór 4.2.4 stelt externe aanvallers in staat om willekeurige SQL-opdrachten uit te voeren via een opmerking die… Wordpress
- CVE-2015-2697 MEDIUM · 4.0 The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read… Mit Oracle Canonical Debian
- CVE-2015-2696 HIGH · 7.1 lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service… Mit Opensuse Suse Debian
- CVE-2015-2695 MEDIUM · 5.0 lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service… Mit Oracle Canonical Debian
- CVE-2015-7412 LOW · 2.6 The GatewayScript modules on IBM DataPower Gateways with software 7.2.0.x before 7.2.0.1, when the GatewayScript decryption API or a JWE decrypt action is enabled, do… Ibm
- CVE-2015-5044 LOW · 3.3 The Flow Collector in IBM Security QRadar QFLOW 7.1.x before 7.1 MR2 Patch 11 IF3 and 7.2.x before 7.2.5 Patch 4 IF3 allows remote attackers… Ibm
- CVE-2015-5043 HIGH · 7.2 diag in IBM Security Guardium 8.2 before p6015, 9.0 before p6015, 9.1, 9.5, and 10.0 before p6015 allows local users to obtain root access via… Ibm
- CVE-2015-5019 MEDIUM · 5.5 IBM Sterling Integrator 5.1 vóór 5010004_8 en Sterling B2B Integrator 5.2 vóór 5020500_9 staan op afstand geverifieerde gebruikers toe om bestanden te lezen of te… Ibm
- CVE-2015-5015 MEDIUM · 5.0 IBM WebSphere Commerce Enterprise 7.0.0.9 en 8.x vóór Feature Pack 8 stelt externe aanvallers in staat om gevoelige informatie te verkrijgen via een vervaardigde REST-URL. Ibm
- CVE-2015-5005 HIGH · 8.5 CSPOC in IBM PowerHA SystemMirror op Aix 6.1 en 7.1 stelt op afstand geverifieerde gebruikers in staat om een "su root" -actie uit te voeren… Ibm
- CVE-2015-4966 MEDIUM · 6.5 IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 FP009, and 7.6.0 before 7.6.0.2 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9 FP009, 7.5.1, and… Ibm
- CVE-2015-4963 HIGH · 7.5 IBM Security Access Manager for Web 7.x before 7.0.0.16 and 8.x before 8.0.1.3 mishandles WebSEAL HTTPTransformation requests, which allows remote attackers to read or write… Ibm
- CVE-2015-4940 LOW · 2.1 Apache Ambari before 2.1, as used in IBM Infosphere BigInsights 4.x before 4.1, stores a cleartext BigSheets password in a configuration file, which allows local… Apache Ibm
- CVE-2015-4928 MEDIUM · 4.3 Apache Ambari before 2.1, as used in IBM Infosphere BigInsights 4.x before 4.1, includes cleartext passwords on a Configs screen, which allows physically proximate attackers… Apache Ibm
- CVE-2015-2017 MEDIUM · 4.3 CRLF injection vulnerability in IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.8 allows remote attackers… Ibm
- CVE-2015-1999 MEDIUM · 5.0 IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 places session IDs in https URLs, which allows remote attackers to obtain sensitive information by… Ibm
- CVE-2015-1997 MEDIUM · 6.8 Cross-site request forgery (CSRF) -kwetsbaarheid in IBM Security QRadar Vulnerability Manager 7.2.x vóór 7.2.5 Patch 5 stelt externe aanvallers in staat om de authenticatie van… Ibm
- CVE-2015-1996 LOW · 2.1 IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not prevent caching of HTTPS responses, which allows physically proximate attackers to obtain sensitive… Ibm
- CVE-2015-1995 MEDIUM · 4.3 Multiple cross-site scripting (XSS) vulnerabilities in IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 allow remote attackers to inject arbitrary web script or… Ibm
- CVE-2015-1994 MEDIUM · 5.0 IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which… Ibm
- CVE-2015-1993 MEDIUM · 5.0 IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not set the secure flag for unspecified cookies in an https session, which makes… Ibm
- CVE-2015-1989 MEDIUM · 6.5 SQL injection vulnerability in IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 allows remote authenticated users to execute arbitrary SQL commands via unspecified… Ibm
- CVE-2015-7395 MEDIUM · 4.0 IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX005, and 7.6.0 before 7.6.0.2 FP002; Maximo Asset Management 7.5.0 before 7.5.0.8 IFIX005, 7.5.1, and… Ibm
- CVE-2015-7254 MEDIUM · 5.0 Directory traversal vulnerability on Huawei HG532e, HG532n, and HG532s devices allows remote attackers to read arbitrary files via a .. (dot dot) in an icon/… Huawei
- CVE-2015-6476 HIGH · 10.0 Advantech EKI-122x-BE devices with firmware before 1.65, EKI-132x devices with firmware before 1.98, and EKI-136x devices with firmware before 1.27 have hardcoded SSH keys, which… Advantech
- CVE-2015-8082 HIGH · 7.5 De Login Disable-module 6.x-1.x vóór 6.x-1.1 en 7.x-1.x vóór 7.x-1.2 voor Drupal laadt de user_logout-functie niet correct, waardoor externe aanvallers het uitlogbeveiligingsmechanisme kunnen omzeilen door… Login Disable Project