CVE-database
126.505 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2015-2811 MEDIUM · 5.0 XML external entity (XXE) vulnerability in ReportXmlViewer in SAP NetWeaver Portal 7.31.201109172004 allows remote attackers to send requests to intranet servers via crafted XML, aka… Sap
- CVE-2015-2756 MEDIUM · 4.9 QEMU, as used in Xen 3.3.x through 4.5.x, does not properly restrict access to PCI command registers, which might allow local HVM guest users to… Debian Xen Fedoraproject Canonical
- CVE-2015-2755 MEDIUM · 6.8 Multiple cross-site request forgery (CSRF) vulnerabilities in the AB Google Map Travel (AB-MAP) plugin before 4.0 for WordPress allow remote attackers to hijack the authentication… Ab Google Map Travel Project
- CVE-2015-2752 MEDIUM · 4.9 De XEN_DOMCTL_Memory_mapping hypercall in Xen 3.2.x tot 4.5.x, bij gebruik van een PCI passthrough-apparaat, is niet te voorkomen, waardoor lokale x86 HVM-domeingebruikers een denial of… Fedoraproject Xen
- CVE-2015-2751 HIGH · 7.1 Xen 4.3.x, 4.4.x en 4.5.x, bij gebruik van toolstack-uitsplitsing, kunnen externe domeinen met gedeeltelijke managementcontrole een denial of service (hostvergrendeling) veroorzaken via niet-gespecificeerde domctl-bewerkingen. Xen Fedoraproject
- CVE-2015-2294 MEDIUM · 4.3 Multiple cross-site scripting (XSS) vulnerabilities in the WebGUI in pfSense before 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1)… Netgate
- CVE-2015-0259 MEDIUM · 5.1 OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to… Openstack
- CVE-2014-9713 MEDIUM · 4.0 The default slapd configuration in the Debian openldap package 2.4.23-3 through 2.4.39-1.1 allows remote authenticated users to modify the user's permissions and other user attributes… Openldap Debian
- CVE-2015-0816 MEDIUM · 5.0 Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote… Mozilla
- CVE-2015-0815 HIGH · 7.5 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to… Mozilla
- CVE-2015-0814 HIGH · 7.5 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0 allow remote attackers to cause a denial of service (memory corruption and application… Mozilla
- CVE-2015-0813 MEDIUM · 5.1 Use-after-free vulnerability in the AppendElements function in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 on Linux, when the Fluendo… Mozilla Linux
- CVE-2015-0812 MEDIUM · 4.3 Mozilla Firefox before 37.0 does not require an HTTPS session for lightweight theme add-on installations, which allows man-in-the-middle attackers to bypass an intended user-confirmation requirement… Mozilla Opensuse Canonical
- CVE-2015-0811 MEDIUM · 6.4 The QCMS implementation in Mozilla Firefox before 37.0 allows remote attackers to obtain sensitive information from process heap memory or cause a denial of service… Mozilla Opensuse Canonical
- CVE-2015-0810 MEDIUM · 4.3 Mozilla Firefox before 37.0 on OS X does not ensure that the cursor is visible, which allows remote attackers to conduct clickjacking attacks via a… Mozilla Apple
- CVE-2015-0808 MEDIUM · 5.0 De webrtc::VPMContentAnalysis::Release-functie in de WebRTC-implementatie in Mozilla Firefox vóór 37.0 gebruikt incompatibele benaderingen voor de deallocatie van geheugen voor arrays van het eenvoudige type, waardoor… Opensuse Canonical Mozilla
- CVE-2015-0807 MEDIUM · 6.8 De navigator.sendBeacon-implementatie in Mozilla Firefox vóór 37.0, Firefox ESR 31.x vóór 31.6 en Thunderbird vóór 31.6 verwerkt HTTP 30x-statuscodes voor omleidingen nadat een preflight-verzoek is… Mozilla
- CVE-2015-0806 HIGH · 7.5 The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 attempts to use memset for a memory region of negative length during interaction… Canonical Mozilla Opensuse
- CVE-2015-0805 HIGH · 7.5 The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 makes an incorrect memset call during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows… Opensuse Mozilla Canonical
- CVE-2015-0804 HIGH · 7.5 The HTMLSourceElement::BindToTree function in Mozilla Firefox before 37.0 does not properly constrain a data type after omitting namespace validation during certain tree-binding operations, which allows… Mozilla Opensuse Canonical
- CVE-2015-0803 HIGH · 7.5 The HTMLSourceElement::AfterSetAttr function in Mozilla Firefox before 37.0 does not properly constrain the original data type of a casted value during the setting of a… Canonical Opensuse Mozilla
- CVE-2015-0802 MEDIUM · 5.0 Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute… Opensuse Canonical Mozilla
- CVE-2015-0801 HIGH · 7.5 Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary… Mozilla
- CVE-2015-0800 MEDIUM · 5.0 The PRNG implementation in the DNS resolver in Mozilla Firefox (aka Fennec) before 37.0 on Android does not properly generate random numbers for query ID… Mozilla Google
- CVE-2012-2808 MEDIUM · 5.0 The PRNG implementation in the DNS resolver in Bionic in Android before 4.1.1 incorrectly uses time and PID information during the generation of random numbers… Google
- CVE-2015-2809 MEDIUM · 5.0 The Multicast DNS (mDNS) responder in Synology DiskStation Manager (DSM) before 3.1 inadvertently responds to unicast queries with source addresses that are not link-local, which… Synology
- CVE-2015-2808 LOW · 3.7 Het RC4-algoritme, zoals gebruikt in het TLS-protocol en het SSL-protocol, combineert tijdens de initialisatiefase geen statusgegevens met belangrijke gegevens, wat het voor externe aanvallers gemakkelijker… Oracle Debian Redhat Suse
- CVE-2015-1892 MEDIUM · 5.0 The Multicast DNS (mDNS) responder in IBM Security Access Manager for Web 7.x before 7.0.0 FP12 and 8.x before 8.0.1 FP1 inadvertently responds to unicast… Ibm
- CVE-2015-2776 MEDIUM · 4.3 The parse_SST function in FreeXL before 1.0.0i allows remote attackers to cause a denial of service (memory consumption) via a crafted shared strings table in… Debian Gaia-gis
- CVE-2015-2754 MEDIUM · 6.8 FreeXL before 1.0.0i allows remote attackers to cause a denial of service (stack corruption) and possibly execute arbitrary code via a crafted workbook, related to… Gaia-gis Debian
- CVE-2015-2753 MEDIUM · 6.8 FreeXL before 1.0.0i allows remote attackers to cause a denial of service (stack corruption) or possibly execute arbitrary code via a crafted sector in a… Debian Gaia-gis
- CVE-2015-2684 MEDIUM · 4.0 Shibboleth Service Provider (SP) before 2.5.4 allows remote authenticated users to cause a denial of service (crash) via a crafted SAML message. Shibboleth Debian
- CVE-2015-0838 HIGH · 7.5 Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a… Debian Dulwich Project
- CVE-2014-9708 MEDIUM · 5.0 Embedthis Appweb before 4.6.6 and 5.x before 5.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via a Range header with… Oracle Embedthis Juniper
- CVE-2014-9707 HIGH · 7.5 EmbedThis GoAhead 3.0.0 through 3.4.1 does not properly handle path segments starting with a . (dot), which allows remote attackers to conduct directory traversal attacks,… Embedthis
- CVE-2014-9706 HIGH · 7.5 The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with… Debian Dulwich Project
- CVE-2014-9462 HIGH · 7.5 Met de functie_validaterepo in sshpeer in Mercurial vóór 3.2.4 kunnen aanvallers op afstand willekeurige opdrachten uitvoeren via een vervaardigde repositorynaam in een kloonopdracht. Opensuse Mercurial
- CVE-2014-2830 HIGH · 10.0 Stack-based buffer overflow in cifskey.c of cifscreds.c in cifs-utils voor 6.4, zoals gebruikt in pam_cifscreds, stelt externe aanvallers in staat om niet-gespecificeerde impact te hebben… Debian
- CVE-2014-2027 HIGH · 7.5 eGroupware vóór 1.8.006.20140217 stelt externe aanvallers in staat om PHP-objectinjectieaanvallen uit te voeren, willekeurige bestanden te verwijderen en mogelijk willekeurige code uit te voeren via… Egroupware
- CVE-2015-2109 HIGH · 7.5 Unspecified vulnerability in HP Operations Orchestration 10.x allows remote attackers to bypass authentication, and obtain sensitive information or modify data, via unknown vectors. Hp
- CVE-2015-2108 LOW · 3.5 Unspecified vulnerability in Powershell Operations in HP Operations Orchestration 9.x and 10.x allows remote authenticated users to obtain sensitive information via unknown vectors. Hp
- CVE-2015-2106 MEDIUM · 6.4 Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 2 before 2.27, 3 before 1.82, and 4 before 2.10 allows remote attackers to bypass intended access… Hp
- CVE-2015-0901 MEDIUM · 4.3 Cross-site scripting (XSS) kwetsbaarheid in het duwasai flitsende thema 1.3 en eerder voor WordPress stelt externe aanvallers in staat om willekeurig webscript of HTML te… Flashy Project
- CVE-2015-0900 MEDIUM · 4.3 Cross-site scripting (XSS) kwetsbaarheid in schedule.cgi in Nishishi Factory Fumy Teacher's Schedule Board 1.10 tot 2.21 stelt externe aanvallers in staat om willekeurig webscript of… Nishishi
- CVE-2014-7876 HIGH · 10.0 Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 2 before 2.27 and 4 before 2.03 and iLO Chassis Management (CM) firmware before 1.30 allows remote… Hp
- CVE-2015-0985 MEDIUM · 6.8 Cross-site request forgery (CSRF) vulnerability in XZERES 442SR OS on 442SR wind turbines allows remote attackers to hijack the authentication of admins for requests that… Xzeres
- CVE-2015-0984 HIGH · 10.0 Directory traversal-kwetsbaarheid in de FTP-server op Honeywell Excel Web XL1000C50 52 I/O, XL1000C100 104 I/O, XL1000C500 300 I/O, XL1000C1000 600 I/O, XL1000C50U 52 I/O UUKL,… Honeywell
- CVE-2014-9209 MEDIUM · 6.9 Onbetrouwbare zoekpadkwetsbaarheid in de Clean Utility-applicatie in Rockwell Automation FactoryTalk Services Platform vóór 2.71.00 en FactoryTalk View Studio 8.00.00 en eerder stelt lokale gebruikers in… Rockwellautomation
- CVE-2015-2792 HIGH · 7.5 De WPML-plug-in vóór 3.1.9 voor WordPress verwerkt niet op de juiste manier meerdere acties in een verzoek, waardoor externe aanvallers nonce-controles kunnen omzeilen en willekeurige… Wpml
- CVE-2015-2791 MEDIUM · 6.4 The "menu sync" function in the WPML plugin before 3.1.9 for WordPress allows remote attackers to delete arbitrary posts, pages, and menus via a crafted… Wpml