CVE-database
126.505 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2014-9190 HIGH · 10.0 Stack-based buffer overflow in Schneider Electric Wonderware InTouch Access Anywhere Server 10.6 and 11.0 allows remote attackers to execute arbitrary code via a request for… Schneider-electric
- CVE-2014-8036 MEDIUM · 5.0 The outlookpa component in Cisco WebEx Meetings Server does not properly validate API input, which allows remote attackers to modify a meeting's invite list via… Cisco
- CVE-2014-8035 MEDIUM · 5.0 The web framework in Cisco WebEx Meetings Server produces different returned messages for URL requests depending on whether a username exists, which allows remote attackers… Cisco
- CVE-2014-8020 MEDIUM · 5.0 Cisco Unified Communication Domain Manager Platform Software allows remote attackers to cause a denial of service (CPU consumption, and performance degradation or service outage) via… Cisco
- CVE-2014-6212 MEDIUM · 4.0 The Echo API in IBM Emptoris Contract Management 9.5.x before 9.5.0.6 iFix11, 10.0.0.x before 10.0.0.1 iFix12, 10.0.1.x before 10.0.1.5 iFix2, and 10.0.2.x before 10.0.2.2 iFix5;… Ibm
- CVE-2014-6199 MEDIUM · 5.0 Met de HTTP-serveradapter in IBM Sterling B2B Integrator 5.1 en 5.2.x en Sterling File Gateway 2.1 en 2.2 kunnen externe aanvallers een denial of service… Ibm
- CVE-2014-6158 HIGH · 9.0 Multiple directory traversal vulnerabilities in the file-upload feature in IBM PureApplication System 1.0 before 1.0.0.4 iFix 10, 1.1 before 1.1.0.5, and 2.0 before 2.0.0.1 and… Ibm
- CVE-2014-3096 LOW · 3.5 Cross-site scripting (XSS) kwetsbaarheid in IBM Curam Social Program Management vóór 6.0.5.5a stelt externe geverifieerde gebruikers in staat om willekeurig webscript of HTML te injecteren… Ibm
- CVE-2014-9585 LOW · 2.1 De functie vdso_addr in arch/x86/vdso/vma.c in de Linux-kernel tot en met 3.18.2 kiest niet correct geheugenlocaties voor het vDSO-gebied, waardoor het voor lokale gebruikers gemakkelijker… Linux Redhat Opensuse Suse
- CVE-2014-9584 LOW · 2.1 The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 does not validate a length value in the Extensions Reference (ER) System Use Field,… Linux Redhat Opensuse Suse
- CVE-2014-9529 MEDIUM · 6.9 Race condition in the key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 3.18.2 allows local users to cause a denial of service (memory corruption… Linux Redhat Opensuse Fedoraproject
- CVE-2015-0922 MEDIUM · 5.0 McAfee ePolicy Orchestrator (ePO) vóór 4.6.9 en 5.x vóór 5.1.2 gebruikt dezelfde geheime sleutel voor de installaties van verschillende klanten, waardoor aanvallers het beheerderswachtwoord kunnen… Mcafee
- CVE-2015-0921 MEDIUM · 4.0 XML external entity (XXE) vulnerability in the Server Task Log in McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 allows remote authenticated users… Mcafee
- CVE-2014-9510 MEDIUM · 6.8 Cross-site request forgery (CSRF) -kwetsbaarheid in de beheerconsole in TP-Link TL-WR840N (V1) -router met firmware vóór 3.13.27 build 141120 stelt externe aanvallers in staat om… Tp-link
- CVE-2014-9505 LOW · 3.5 Cross-site scripting (XSS) -kwetsbaarheid in de Schooladministratiemodule 7.x-1.x vóór 7.x-1.8 voor Drupal stelt externe geverifieerde gebruikers met toestemming in staat om een klasseknooppunt te maken… School Administration Project
- CVE-2014-9501 LOW · 3.5 Cross-site scripting (XSS) kwetsbaarheid in de Poll Chart Block module 7.x-1.x voor 7.x-1.2 voor Drupal stelt op afstand geverifieerde gebruikers in staat om willekeurig webscript… Poll Chart Block Project
- CVE-2014-9500 MEDIUM · 4.3 Cross-site scripting (XSS) -kwetsbaarheid in de Moip-module 7.x-1.x vóór 7.x-1.4 voor Drupal stelt externe aanvallers in staat om willekeurig webscript of HTML via niet-gespecificeerde vectoren… Moip Project
- CVE-2014-9499 LOW · 3.5 Cross-site scripting (XSS) kwetsbaarheid in de Godwin's Law-module vóór 7.x-1.1 voor Drupal, bij gebruik van de dblog-module, stelt op afstand geverifieerde gebruikers in staat om…
- CVE-2014-9498 LOW · 3.5 Cross-site scripting (XSS) -kwetsbaarheid in de Webform-uitnodigingsmodule 7.x-1.x vóór 7.x-1.3 en 7.x-2.x vóór 7.x-2.4 voor Drupal staat op afstand geverifieerde gebruikers toe met het webformulier:… Webform Invitation Project
- CVE-2014-9272 MEDIUM · 4.3 The string_insert_href function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows remote attackers to conduct cross-site scripting… Debian Mantisbt
- CVE-2014-9271 MEDIUM · 5.4 Cross-site scripting (XSS) vulnerability in file_download.php in MantisBT before 1.2.18 allows remote authenticated users to inject arbitrary web script or HTML via a Flash file… Debian Mantisbt
- CVE-2014-9269 LOW · 2.6 Cross-site scripting (XSS) vulnerability in helper_api.php in MantisBT 1.1.0a1 through 1.2.x before 1.2.18, when Extended project browser is enabled, allows remote attackers to inject arbitrary… Mantisbt Debian
- CVE-2013-7419 MEDIUM · 4.3 Cross-site scripting (XSS) kwetsbaarheid in includes/refreshDate.php in de Joomlaskin JS Multi Hotel (ook bekend als JS MultiHotel en Js-Multi-Hotel) plugin 2.2.1 voor WordPress stelt externe… Joomlaskin
- CVE-2015-0206 MEDIUM · 5.0 Geheugenlek in de dtls1_buffer_record-functie in d1_pkt.c in OpenSSL 1.0.0 vóór 1.0.0p en 1.0.1 vóór 1.0.1k stelt externe aanvallers in staat om een denial of service… Openssl
- CVE-2015-0205 MEDIUM · 5.0 The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a… Openssl
- CVE-2015-0204 MEDIUM · 4.3 The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks… Openssl
- CVE-2014-8275 MEDIUM · 5.0 OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a… Openssl
- CVE-2014-8033 MEDIUM · 5.0 The play/modules component in Cisco WebEx Meetings Server allows remote attackers to obtain administrator access via crafted API requests, aka Bug ID CSCuj40421. Cisco
- CVE-2014-8032 MEDIUM · 4.0 The OutlookAction LI in Cisco WebEx Meetings Server allows remote authenticated users to obtain sensitive encrypted-password information via unspecified vectors, aka Bug IDs CSCuj40453 and… Cisco
- CVE-2014-8031 MEDIUM · 6.8 Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj40456. Cisco
- CVE-2014-8030 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in sendPwMail.do in Cisco WebEx Meetings Server allows remote attackers to inject arbitrary web script or HTML via the email parameter,… Cisco
- CVE-2014-8029 MEDIUM · 5.8 Open redirect vulnerability in the web interface in Cisco Secure Access Control System (ACS) allows remote attackers to redirect users to arbitrary web sites and… Cisco
- CVE-2014-8028 MEDIUM · 4.3 Multiple cross-site scripting (XSS) vulnerabilities in the web framework in Cisco Secure Access Control System (ACS) allow remote attackers to inject arbitrary web script or… Cisco
- CVE-2014-8027 MEDIUM · 6.5 The RBAC component in Cisco Secure Access Control System (ACS) allows remote authenticated users to obtain Network Device Administrator privileges for Create, Delete, Read, and… Cisco
- CVE-2014-3572 MEDIUM · 5.0 Met de ssl3_get_key_exchange-functie in s3_clnt.c in OpenSSL vóór 0.9.8zd, 1.0.0 vóór 1.0.0p en 1.0.1 vóór 1.0.1k kunnen externe SSL-servers ECDHE-naar-ECDH downgrade-aanvallen uitvoeren en een verlies… Openssl
- CVE-2014-3571 MEDIUM · 5.0 OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (NULL pointer dereference and application crash)… Openssl
- CVE-2014-3570 MEDIUM · 5.0 The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of a BIGNUM value, which… Openssl
- CVE-2014-9583 HIGH · 10.0 common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC66U, RT-N66U, and other routers, does not properly check the… T-mobile Asus
- CVE-2014-9582 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in components/filemanager/dialog.php in Codiad 2.4.3 allows remote attackers to inject arbitrary web script or HTML via the short_name parameter in a… Codiad
- CVE-2014-9581 MEDIUM · 5.0 Directory traversal vulnerability in components/filemanager/download.php in Codiad 2.4.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter. NOTE:… Codiad
- CVE-2014-9580 MEDIUM · 4.3 Cross-site scripting (XSS) -kwetsbaarheid in ProjectSend (voorheen cFTP) r561 stelt externe aanvallers in staat om willekeurig webscript of HTML te injecteren via het veld Beschrijving… Projectsend
- CVE-2015-0920 MEDIUM · 6.8 Cross-site request forgery (CSRF) vulnerability in the Banner Effect Header plugin 1.2.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests… Banner Effect Header Project
- CVE-2015-0919 HIGH · 7.5 Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before 1.6.1 allow remote administrators to execute arbitrary SQL commands via the (1) idcat or… Sefrengo
- CVE-2015-0918 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in the administrative backend in Sefrengo before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the searchterm… Sefrengo
- CVE-2015-0917 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in the backend in Kajona before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the action parameter… Kajona
- CVE-2014-9579 MEDIUM · 5.0 VDG Security SENSE (formerly DIVA) 2.3.13 stores administrator credentials in cleartext, which allows attackers to obtain sensitive information by reading the plugin configuration files. Vdgsecurity
- CVE-2014-9578 MEDIUM · 5.0 VDG Security SENSE (formerly DIVA) 2.3.13 performs authentication with a password hash instead of a password, which allows remote attackers to gain login access by… Vdgsecurity
- CVE-2014-9577 MEDIUM · 4.0 VDG Security SENSE (formerly DIVA) 2.3.13 sends the user database when a user logs in, which allows remote authenticated users to obtain usernames and password… Vdgsecurity
- CVE-2014-9576 MEDIUM · 5.0 VDG Security SENSE (formerly DIVA) 2.3.13 has a hardcoded password of (1) ArpaRomaWi for the root Postgres account and !DVService for the (2) postgres and… Vdgsecurity
- CVE-2014-9575 MEDIUM · 6.4 VDG Security SENSE (voorheen DIVA) vóór 2.3.15 stelt externe aanvallers in staat om authenticatie te omzeilen en bijgevolg willekeurige plugin-instellingen te lezen en te wijzigen,… Vdgsecurity