CVE-database
126.505 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2015-2790 MEDIUM · 4.3 Foxit Reader, Enterprise Reader, and PhantomPDF before 7.1 allow remote attackers to cause a denial of service (memory corruption and crash) via a crafted (1)… Foxitsoftware
- CVE-2015-2789 MEDIUM · 4.4 Unquoted Windows search path vulnerability in the Foxit Cloud Safe Update Service in the Cloud plugin in Foxit Reader 6.1 through 7.0.6.1126 allows local users… Foxitsoftware
- CVE-2015-2172 MEDIUM · 6.5 DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add… Dokuwiki
- CVE-2015-2171 HIGH · 7.5 Middleware/SessionCookie.php in Slim before 2.6.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted session data. Slimframework
- CVE-2015-1827 MEDIUM · 5.0 The get_user_grouplist function in the extdom plug-in in FreeIPA before 4.1.4 does not properly reallocate memory when processing user accounts, which allows remote attackers to… Freeipa Fedoraproject
- CVE-2015-1815 HIGH · 10.0 The get_rpm_nvr_by_file_path_temporary function in util.py in setroubleshoot before 3.2.22 allows remote attackers to execute arbitrary commands via shell metacharacters in a file name. Selinux Fedoraproject
- CVE-2015-1609 MEDIUM · 5.0 MongoDB before 2.4.13 and 2.6.x before 2.6.8 allows remote attackers to cause a denial of service via a crafted UTF-8 string in a BSON request. Fedoraproject Mongodb
- CVE-2015-0283 HIGH · 7.8 The slapi-nis plug-in before 0.54.2 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (infinite… Redhat
- CVE-2015-2787 HIGH · 7.5 Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary… Php Apple Redhat Opensuse
- CVE-2015-2348 MEDIUM · 5.0 De move_uploaded_file-implementatie in ext/standard/basic_functions.c in PHP vóór 5.4.39, 5.5.x vóór 5.5.23 en 5.6.x vóór 5.6.7 verkort een padnaam bij het tegenkomen van een x00-teken, waarmee… Redhat Apple Opensuse Php
- CVE-2015-2331 HIGH · 7.5 Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before… Nih Php Debian Fedoraproject
- CVE-2015-2305 MEDIUM · 6.8 Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5… Rxspencer Project Canonical Debian Opensuse
- CVE-2015-2301 HIGH · 7.5 Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote attackers to cause a denial of service… Canonical Debian Opensuse Php
- CVE-2015-1352 MEDIUM · 5.0 De build_tablename-functie in pgsql.c in de PostgreSQL (ook bekend als pgsql) -extensie in PHP tot en met 5.6.7 valideert geen token-extractie voor tabelnamen, waardoor externe… Apple Php
- CVE-2015-1351 HIGH · 7.5 Use-after-free kwetsbaarheid in de _zend_shared_memdup-functie in zend_shared_alloc.c in de OPcache-extensie in PHP via 5.6.7 stelt externe aanvallers in staat om een denial of service te… Oracle Apple Php
- CVE-2015-0273 HIGH · 7.5 Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allow remote attackers to execute arbitrary code via crafted… Php
- CVE-2014-9709 MEDIUM · 5.0 The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause… Php Opensuse Libgd Debian
- CVE-2014-9705 HIGH · 7.5 Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute… Php
- CVE-2014-9653 HIGH · 7.5 readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider… File Project Php Debian
- CVE-2014-9652 MEDIUM · 5.0 The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before… Php File Project
- CVE-2013-6501 MEDIUM · 4.6 The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users… Php Suse
- CVE-2015-2786 HIGH · 10.0 Unspecified vulnerability in MyBB (aka MyBulletinBoard) before 1.8.4 has unknown attack vectors related to "Group join request notifications sent to wrong group leaders." Mybb
- CVE-2015-2785 HIGH · 7.5 Met de GIF-encoder in Byzanz kunnen externe aanvallers een denial of service veroorzaken (out-of-bounds heap write en crash) of mogelijk willekeurige code uitvoeren via een… Gnome
- CVE-2013-7438 HIGH · 7.5 Multiple buffer overflows in pbm212030 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted PBM image,… Pbm212030 Project
- CVE-2013-7437 MEDIUM · 5.0 Multiple integer overflows in potrace 1.11 allow remote attackers to cause a denial of service (crash) via large dimensions in a BMP image, which triggers… Icoasoft
- CVE-2015-0999 LOW · 2.1 Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 store cleartext OPC User credentials… Aveva Schneider-electric
- CVE-2015-0998 LOW · 3.3 Schneider Electric InduSoft Web Studio vóór 7.1.3.4 SP3 Patch 4 en InTouch Machine Edition 2014 vóór 7.1.3.4 SP3 Patch 4 verzenden cleartext-referenties, waarmee externe aanvallers… Aveva Schneider-electric
- CVE-2015-0997 MEDIUM · 5.0 Schneider Electric InduSoft Web Studio vóór 7.1.3.4 SP3 Patch 4 en InTouch Machine Edition 2014 vóór 7.1.3.4 SP3 Patch 4 bieden een HMI-gebruikersinterface met alle… Aveva Schneider-electric
- CVE-2015-0996 LOW · 2.1 Schneider Electric InduSoft Web Studio vóór 7.1.3.4 SP3 Patch 4 en InTouch Machine Edition 2014 vóór 7.1.3.4 SP3 Patch 4 vertrouwen op een hardgecodeerd cleartext-wachtwoord… Aveva Schneider-electric
- CVE-2015-0528 HIGH · 7.2 Met de RPC-daemon in EMC Isilon OneFS 6.5.x en 7.0.x vóór 7.0.2.13, 7.1.0 vóór 7.1.0.6, 7.1.1 vóór 7.1.1.2 en 7.2.0 vóór 7.2.0.1 kunnen lokale gebruikers… Emc
- CVE-2014-9205 HIGH · 7.5 Stack-based buffer overflow in the PmBase64Decode function in an unspecified demonstration application in MICROSYS PROMOTIC stable before 8.2.19 and PROMOTIC development before 8.3.2 allows remote… Microsys
- CVE-2014-5428 HIGH · 10.0 Unrestricted file upload vulnerability in unspecified web services in Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application… Johnsoncontrols
- CVE-2014-5427 MEDIUM · 5.0 Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server 85… Johnsoncontrols
- CVE-2015-0680 MEDIUM · 4.0 Cisco Unified Call Manager (CM) 9.1(2.1000.28) does not properly restrict resource requests, which allows remote authenticated users to read arbitrary files via unspecified vectors, aka… Cisco
- CVE-2015-0679 MEDIUM · 6.1 The web-authentication functionality on Cisco Wireless LAN Controller (WLC) devices 7.3(103.8) and 7.4(110.0) allows remote attackers to cause a denial of service (device reload) via… Cisco
- CVE-2015-0658 HIGH · 7.9 The DHCP implementation in the PowerOn Auto Provisioning (POAP) feature in Cisco NX-OS does not properly restrict the initialization process, which allows remote attackers to… Cisco
- CVE-2015-2773 MEDIUM · 5.0 SVM in Websense TRITON V-serie apparaten vóór 8.0.0 stelt aanvallers in staat om willekeurige bestanden te lezen via niet-gespecificeerde vectoren. Websense
- CVE-2015-2772 HIGH · 7.5 SVM in Websense TRITON V-serie apparaten vóór 8.0.0 stelt aanvallers in staat om willekeurige bestanden te uploaden via niet-gespecificeerde vectoren. Websense
- CVE-2015-2771 MEDIUM · 5.0 The Mail Server in Websense TRITON AP-EMAIL and V-Series appliances before 8.0.0 uses plaintext credentials, which allows remote attackers to obtain sensitive information via unspecified… Websense
- CVE-2015-2770 MEDIUM · 6.8 Cross-site request forgery (CSRF) vulnerability in the command line page in Websense TRITON V-Series appliances before 8.0.0 allows remote attackers to hijack the authentication of… Websense
- CVE-2015-2769 MEDIUM · 6.8 Multiple cross-site request forgery (CSRF) vulnerabilities in the Personal Email Manager (PEM) in Websense TRITON AP-EMAIL before 8.0.0 allow remote attackers to hijack the authentication… Websense
- CVE-2015-2768 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in Websense TRITON AP-EMAIL before 8.0.0 and V-Series 7.7 appliances allows remote attackers to inject arbitrary web script or HTML via… Websense
- CVE-2015-2767 HIGH · 10.0 Ongespecificeerde kwetsbaarheid in Websense TRITON AP-EMAIL vóór 8.0.0 heeft onbekende impact- en aanvalsvectoren, gerelateerd aan "Automatisch aanvullen ingeschakeld." Websense
- CVE-2015-2766 MEDIUM · 5.0 The Personal Email Manager (PEM) in Websense TRITON AP-EMAIL before 8.0.0 allows attackers to have unspecified impact via a brute force attack. Websense
- CVE-2015-2765 MEDIUM · 4.3 Met de Email Security Gateway in Websense TRITON AP-EMAIL vóór 8.0.0 kunnen externe aanvallers clickjacking-aanvallen uitvoeren via niet-gespecificeerde vectoren. Websense
- CVE-2015-2764 MEDIUM · 4.3 Meerdere cross-site scripting (XSS) kwetsbaarheden in Websense TRITON AP-DATA vóór 8.0.0 stellen externe aanvallers in staat om willekeurig webscript of HTML te injecteren via niet-gespecificeerde… Websense
- CVE-2015-2763 HIGH · 10.0 Ongespecificeerde kwetsbaarheid in Websense TRITON AP-EMAIL vóór 8.0.0 heeft onbekende impact- en aanvalsvectoren, gerelateerd aan poort 17703. Websense
- CVE-2015-2762 MEDIUM · 5.0 Websense TRITON AP-WEB before 8.0.0 allows remote attackers to enumerate Windows domain user accounts via vectors related to HTTP authentication. Websense
- CVE-2015-2761 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in the Exceptions and Scanning Exceptions Pages in Websense TRITON AP-WEB before 8.0.0 allows remote attackers to inject arbitrary web script… Websense
- CVE-2015-2760 LOW · 3.5 Cross-site scripting (XSS) vulnerability in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allows remote authenticated… Mcafee