CVE-database
126.505 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2014-2273 HIGH · 7.2 Met het hx170dec-apparaatstuurprogramma in Huawei P2-6011 vóór V100R001C00B043 kunnen lokale gebruikers willekeurige geheugenlocaties lezen en schrijven via niet-gespecificeerde vectoren. Huawei
- CVE-2012-6656 MEDIUM · 5.0 iconvdata/ibm930.c in GNU C Library (aka glibc) before 2.16 allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a multibyte character value… Debian Canonical Gnu
- CVE-2014-9215 HIGH · 7.5 SQL-injectiekwetsbaarheid in de CheckEmail-functie in includes/functions.class.php in PBBoard 3.0.1 vóór 20141128 stelt externe aanvallers in staat om willekeurige SQL-opdrachten uit te voeren via de e-mailparameter… Pbboard
- CVE-2014-9212 MEDIUM · 4.3 Multiple cross-site scripting (XSS) vulnerabilities in Altitude uAgent in Altitude uCI (Unified Customer Interaction) 7.5 allow remote attackers to inject arbitrary web script or HTML… Altitude
- CVE-2014-9144 HIGH · 7.5 Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to execute arbitrary commands via shell metacharacters in the ping field (setobject_ip parameter). Technicolor
- CVE-2014-9143 MEDIUM · 4.3 Open redirect-kwetsbaarheid in Technicolor Router TD5130 met firmware 2.05.C29GV stelt externe aanvallers in staat om gebruikers om te leiden naar willekeurige websites en phishing-aanvallen uit… Technicolor
- CVE-2014-9142 MEDIUM · 4.3 Cross-site scripting (XSS) -kwetsbaarheid in Technicolor Router TD5130 met firmware 2.05.C29GV stelt externe aanvallers in staat om willekeurig webscript of HTML te injecteren via de… Technicolor
- CVE-2014-9129 MEDIUM · 6.8 Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager plugin before 2.0.7 for WordPress allows remote attackers to hijack the authentication of administrators… Cminds
- CVE-2014-8800 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect plugin before 1.5.1 for WordPress allows remote attackers to inject arbitrary web script or… Nextendweb
- CVE-2014-3997 HIGH · 7.5 SQL-injectiekwetsbaarheid in de MetadataServlet-servlet in ManageEngine Password Manager Pro (PMP) en Password Manager Pro Managed Service Providers (MSP) editie 5 tot en met 7 build… Zohocorp
- CVE-2014-3996 HIGH · 7.5 SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build 90043, Password… Manageengine
- CVE-2014-7868 HIGH · 7.5 Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote… Zohocorp
- CVE-2014-7867 HIGH · 7.5 SQL-injectiekwetsbaarheid in de com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus-servlet in ZOHO ManageEngine OpManager 11.3 en 11.4, IT360 10.3 en 10.4, en Social IT Plus 11.0 stelt externe aanvallers of op… Zohocorp
- CVE-2014-6036 MEDIUM · 6.4 Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows… Zohocorp
- CVE-2014-6035 HIGH · 7.5 Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attackers to write and execute arbitrary files via… Zohocorp
- CVE-2014-6034 MEDIUM · 5.0 Directory traversal kwetsbaarheid in de com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 t/m 11.3, Social IT Plus 11.0 en IT360 10.4 en eerder staat externe… Zohocorp
- CVE-2014-5446 MEDIUM · 5.0 Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users… Zohocorp
- CVE-2014-5445 MEDIUM · 5.0 Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read… Zohocorp
- CVE-2014-9243 MEDIUM · 4.3 Multiple cross-site scripting (XSS) vulnerabilities in WebsiteBaker 2.8.3 allow remote attackers to inject arbitrary web script or HTML via the (1) QUERY_STRING to wb/admin/admintools/tool.php or… Websitebaker
- CVE-2014-9242 HIGH · 7.5 SQL-injectiekwetsbaarheid in admin/pages/modify.php in WebsiteBaker 2.8.3 stelt externe aanvallers in staat om willekeurige SQL-opdrachten uit te voeren via de parameter page_id. Websitebaker
- CVE-2014-9241 MEDIUM · 4.3 Meerdere cross-site scripting (XSS) -kwetsbaarheden in MyBB (ook bekend als MyBulletinBoard) 1.8.x vóór 1.8.2 stellen externe aanvallers in staat om willekeurig webscript of HTML te… Mybb
- CVE-2014-9240 HIGH · 7.5 SQL injection vulnerability in member.php in MyBB (aka MyBulletinBoard) 1.8.x before 1.8.2 allows remote attackers to execute arbitrary SQL commands via the question_id parameter in… Mybb
- CVE-2014-9239 HIGH · 7.5 SQL-injectiekwetsbaarheid in de IPS Connect-service (interface/ipsconnect/ipsconnect.php) in Invision Power Board (ook bekend als IPB of IP.Board) 3.3.x en 3.4.x tot 3.4.7 voordat 20141114 aanvallers op… Invisioncommunity Invisionpower
- CVE-2014-9238 MEDIUM · 5.0 Met D-link IP-camera DCS-2103 met firmware 1.0.0 kunnen externe aanvallers het installatiepad verkrijgen via de bestandsparameter naar cgi-bin/sddownload.cgi, zoals blijkt uit een / (voorwaartse schuine… D-link
- CVE-2014-9237 HIGH · 7.5 SQL-injectiekwetsbaarheid in Proticaret E-Commerce 3.0 stelt externe aanvallers in staat om willekeurige SQL-opdrachten uit te voeren via een tem:Code-element in EEN SOAP-verzoek. Proticaret
- CVE-2014-9236 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in php/edit_photos.php in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allows remote attackers to inject arbitrary web script or HTML… Zoph
- CVE-2014-9235 MEDIUM · 6.5 Multiple SQL injection vulnerabilities in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1)… Zoph
- CVE-2014-9234 MEDIUM · 5.0 Directory traversal vulnerability in cgi-bin/sddownload.cgi in D-link IP camera DCS-2103 with firmware 1.0.0 allows remote attackers to read arbitrary files via a .. (dot dot)… D-link
- CVE-2014-9157 HIGH · 7.5 Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vectors,… Debian Graphviz
- CVE-2014-9134 HIGH · 10.0 Unrestricted file upload vulnerability in Huawei Honor Cube Wireless Router WS860s before V100R001C02B222 allows remote attackers to execute arbitrary code by uploading a file with… Huawei
- CVE-2013-7416 HIGH · 7.5 canto_curses/guibase.py in Canto Curses before 0.9.0 allows remote feed servers to execute arbitrary commands via shell metacharacters in a URL in a feed. Canto
- CVE-2014-9018 MEDIUM · 5.0 Icecast vóór 2.4.1 verzendt de uitvoer van het on-connect script, waardoor externe aanvallers mogelijk gevoelige informatie kunnen verkrijgen, gerelateerd aan gedeelde bestandsdescriptoren. Icecast
- CVE-2014-8775 MEDIUM · 5.0 MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote… Modx
- CVE-2014-8774 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in manager/index.php in MODX Revolution 2.x before 2.2.15 allows remote attackers to inject arbitrary web script or HTML via the context_key… Modx
- CVE-2014-8773 MEDIUM · 6.8 MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism by (1) omitting the CSRF token or via… Modx
- CVE-2014-8772 LOW · 3.5 Cross-site scripting (XSS) vulnerability in the search_controller in X3 CMS 0.5.1 and 0.5.1.1 allows remote authenticated users to inject arbitrary web script or HTML via… X3cms
- CVE-2014-8771 MEDIUM · 6.8 Multiple cross-site request forgery (CSRF) vulnerabilities in the admin area in X3 CMS 0.5.1 and 0.5.1.1 allow remote attackers to hijack the authentication of administrators… X3cms
- CVE-2014-8104 MEDIUM · 6.8 OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service (server crash) via… Mageia Debian Opensuse Openvpn
- CVE-2014-9220 HIGH · 7.5 SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote attackers to execute arbitrary SQL commands via the timezone parameter in… Fedoraproject Openvas Opensuse
- CVE-2014-9141 HIGH · 7.2 Het installatieprogramma in Thomson Reuters Fixed Assets CS 13.1.4 en eerder gebruikt zwakke machtigingen voor connectbgdl.exe, waarmee lokale gebruikers willekeurige code kunnen uitvoeren door dit… Thomsonreuters
- CVE-2014-3988 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in index.php in SunHater KCFinder 3.11 and earlier allows remote attackers to inject arbitrary web script or HTML via (1) file… Sunhater
- CVE-2014-9184 MEDIUM · 5.0 ZTE ZXDSL 831CII allows remote attackers to bypass authentication via a direct request to (1) main.cgi, (2) adminpasswd.cgi, (3) userpasswd.cgi, (4) upload.cgi, (5) conprocess.cgi, or… Zte
- CVE-2014-9183 HIGH · 10.0 ZTE ZXDSL 831CII has a default password of admin for the admin account, which allows remote attackers to gain administrator privileges. Zte
- CVE-2014-9182 MEDIUM · 4.3 modellen/comment.php in Anchor CMS 0.9.2 en eerder stelt externe aanvallers in staat om willekeurige headers in e-mailberichten te injecteren via een vervaardigde Host: header. Anchorcms
- CVE-2014-9181 MEDIUM · 5.0 Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrary files via a .. (dot dot) in the URI… Plex
- CVE-2014-9180 MEDIUM · 5.0 Open redirect vulnerability in go.php in Eleanor CMS allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL… Eleanor-cms
- CVE-2014-9179 MEDIUM · 4.0 Cross-site scripting (XSS) vulnerability in the SupportEzzy Ticket System plugin 1.2.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via… Supportezzy Ticket System Project
- CVE-2014-9178 HIGH · 7.5 Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-document-manager) 2.4.1 and earlier for WordPress allow remote… Smartypantsplugins
- CVE-2014-9177 MEDIUM · 5.0 The HTML5 MP3 Player with Playlist Free plugin before 2.7 for WordPress allows remote attackers to obtain the installation path via a request to html5plus/playlist.php. Svnlabs
- CVE-2014-9176 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in the InstaSqueeze Sexy Squeeze Pages plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the… Instasqueeze