CVE-database
126.505 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2014-9175 HIGH · 7.5 SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the table_id… Wpdatatables
- CVE-2014-9174 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in the Google Analytics by Yoast (google-analytics-for-wordpress) plugin before 5.1.3 for WordPress allows remote attackers to inject arbitrary web script or… Yoast
- CVE-2014-9173 HIGH · 7.5 SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote attackers to execute arbitrary SQL commands via the… Google Doc Embedder Project
- CVE-2014-9116 MEDIUM · 5.0 De write_one_header-functie in mutt 1.5.23 verwerkt geen newline-tekens aan het begin van een header, waardoor externe aanvallers een denial of service (crash) kunnen veroorzaken via… Suse Mutt Debian Mageia
- CVE-2014-9113 HIGH · 7.2 CCH Wolters Kluwer ProSystem fx Engagement (aka PFX Engagement) 7.1 and earlier uses weak permissions (Authenticated Users: Modify and Write) for the (1) Pfx.Engagement.WcfServices, (2)… Cchgroup
- CVE-2014-9112 MEDIUM · 5.0 Op heap gebaseerde bufferoverloop in de process_copy_in-functie in GNU Cpio 2.11 stelt externe aanvallers in staat om een denial of service te veroorzaken via een… Gnu Debian
- CVE-2014-8874 MEDIUM · 5.0 The ke_questionnaire extension 2.5.2 and earlier for TYPO3 uses predictable names for the questionnaire answer forms, which makes it easier for remote attackers to obtain… Kennziffer
- CVE-2014-8789 MEDIUM · 6.5 GleamTech FileVista before 6.1 allows remote authenticated users to create arbitrary files and possibly execute arbitrary code via a crafted path in a zip archive,… Gleamtech
- CVE-2014-8788 MEDIUM · 4.0 GleamTech FileVista before 6.1 allows remote authenticated users to obtain sensitive information via a crafted path when saving a zip file, which reveals the installation… Gleamtech
- CVE-2014-8754 MEDIUM · 5.8 Open redirect vulnerability in track-click.php in the Ad-Manager plugin 1.1.2 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing… Ad-manager Project
- CVE-2014-8728 HIGH · 7.5 SQL injection vulnerability in the login page (login/login) in Subex ROC Fraud Management (aka Fraud Management System and FMS) 7.4 and earlier allows remote attackers… Subex
- CVE-2014-8791 MEDIUM · 6.0 project/register.php in Tuleap before 7.7, when sys_create_project_in_one_step is disabled, allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via… Enalean
- CVE-2014-5284 HIGH · 7.2 host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without verifying ownership, which allows local users to modify access restrictions in hosts.deny… Ossec
- CVE-2014-3703 MEDIUM · 5.0 OpenStack PackStack 2012.2.1, when the Open vSwitch (OVS) monolithic plug-in is not used, does not properly set the libvirt_vif_driver configuration option when generating the nova.conf… Redhat
- CVE-2014-3068 MEDIUM · 6.4 IBM Java Runtime Environment (JRE) 7 R1 before SR1 FP1 (7.1.1.1), 7 before SR7 FP1 (7.0.7.1), 6 R1 before SR8 FP1 (6.1.8.1), 6 before SR16… Ibm
- CVE-2014-3065 MEDIUM · 6.9 Unspecified vulnerability in IBM Java Runtime Environment (JRE) 7 R1 before SR2 (7.1.2.0), 7 before SR8 (7.0.8.0), 6 R1 before SR8 FP2 (6.1.8.2), 6 before… Ibm
- CVE-2013-6494 LOW · 2.1 fedup 0.9.0 in Fedora 19, 20, and 21 uses a temporary directory with a static name for its download cache, which allows local users to… Fedup Project Fedoraproject
- CVE-2014-9156 MEDIUM · 4.0 The FileField module 6.x-3.x before 6.x-3.13 for Drupal does not properly check permissions to view files, which allows remote authenticated users with permission to create… Filefield Project
- CVE-2014-9155 MEDIUM · 4.0 Directory traversal vulnerability in the Avatar Uploader module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.0-beta6 for Drupal allows remote authenticated users to read arbitrary files… Avatar Uploader Project
- CVE-2014-9154 MEDIUM · 4.0 De Notify-module 7.x-1.x voor 7.x-1.1 voor Drupal beperkt de toegang niet goed tot (1) nieuwe of (2) gewijzigde knooppunten of (3) hun velden, waardoor op… Notify Project
- CVE-2014-9153 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in the Services module 7.x-3.x before 7.x-3.10 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via… Services Project
- CVE-2014-9152 HIGH · 7.5 The _user_resource_create function in the Services module 7.x-3.x before 7.x-3.10 for Drupal uses a password of 1 when creating new user accounts, which makes it… Services Project
- CVE-2014-9151 HIGH · 7.5 The Services module 7.x-3.x before 7.x-3.10 for Drupal does not properly limit the rate of authentication attempts, which makes it easier for remote attackers to… Services Project
- CVE-2014-5268 MEDIUM · 5.8 The Fasttoggle module 7.x-1.3 and 7.x-1.4 for Drupal allows remote attackers to block or unblock an account via a crafted user status link. Fasttoggle Project
- CVE-2014-9087 HIGH · 7.5 Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of service (crash) via… Mageia Debian Gnupg Canonical
- CVE-2014-9050 MEDIUM · 5.0 Heap-based buffer overflow in the cli_scanpe function in libclamav/pe.c in ClamAV before 0.98.5 allows remote attackers to cause a denial of service (crash) via a… Clamav
- CVE-2014-8867 MEDIUM · 4.9 The acceleration support for the "REP MOVS" instruction in Xen 4.4.x, 3.2.x, and earlier lacks properly bounds checking for memory mapped I/O (MMIO) emulated in… Redhat Xen Debian Opensuse
- CVE-2014-8866 MEDIUM · 4.7 De hypercall-argumentvertaling in de compatibiliteitsmodus in Xen 3.3.x tot 4.4.x, wanneer deze op een 64-bits hypervisor wordt uitgevoerd, stelt lokale 32-bits HVM-gasten in staat om… Debian Xen Opensuse
- CVE-2014-8749 MEDIUM · 5.0 Server-side request forgery (SSRF) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to trigger outbound requests that authenticate… Ait-pro
- CVE-2014-7816 MEDIUM · 5.0 Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read… Redhat Microsoft
- CVE-2014-7291 MEDIUM · 4.3 Meerdere cross-site scripting (XSS) kwetsbaarheden in api_events.php in Springshare LibCal 2.0 stellen externe aanvallers in staat om willekeurig webscript of HTML te injecteren via de… Springshare
- CVE-2014-5237 MEDIUM · 4.3 Server-side request forgery (SSRF) vulnerability in the documentconverter component in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allows remote attackers to trigger requests… Open-xchange
- CVE-2014-2233 MEDIUM · 5.0 Server-side request forgery (SSRF) -kwetsbaarheid in de MapAPI in Infoware MapSuite vóór 1.0.36 en 1.1.x vóór 1.1.49 stelt externe aanvallers in staat om verzoeken naar… Infoware
- CVE-2014-2232 MEDIUM · 5.0 Absolute kwetsbaarheid voor het doorkruisen van paden in de MapAPI in Infoware MapSuite vóór 1.0.36 en 1.1.x vóór 1.1.49 stelt aanvallers op afstand in staat… Infoware
- CVE-2013-6497 LOW · 2.1 clamscan in ClamAV before 0.98.5, when using -a option, allows remote attackers to cause a denial of service (crash) as demonstrated by the jwplayer.js file. Clamav
- CVE-2014-8961 MEDIUM · 4.0 Directory traversal vulnerability in libraries/error_report.lib.php in the error-reporting feature in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote authenticated users to obtain potentially… Phpmyadmin Opensuse
- CVE-2014-8960 LOW · 3.5 Cross-site scripting (XSS) vulnerability in libraries/error_report.lib.php in the error-reporting feature in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote authenticated users to inject… Phpmyadmin
- CVE-2014-8959 MEDIUM · 6.5 Directory traversal kwetsbaarheid in bibliotheken/gis/GIS_Factory.class.php in de GIS-editor in phpMyAdmin 4.0.x vóór 4.0.10.6, 4.1.x vóór 4.1.14.7 en 4.2.x vóór 4.2.12 stelt op afstand geverifieerde gebruikers… Opensuse Phpmyadmin
- CVE-2014-8958 MEDIUM · 4.3 Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web… Phpmyadmin
- CVE-2014-9150 MEDIUM · 6.4 Race condition in the MoveFileEx call hook feature in Adobe Reader and Acrobat 11.x before 11.0.09 on Windows allows attackers to bypass a sandbox protection… Adobe Microsoft
- CVE-2014-9090 MEDIUM · 4.9 The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel through 3.17.4 does not properly handle faults associated with the Stack Segment (SS) segment register, which… Linux
- CVE-2014-8989 MEDIUM · 4.6 The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended… Linux
- CVE-2014-8884 MEDIUM · 6.1 Stack-based buffer overflow in the ttusbdecfe_dvbs_diseqc_send_master_cmd function in drivers/media/usb/ttusb-dec/ttusbdecfe.c in the Linux kernel before 3.17.4 allows local users to cause a denial of service (system… Linux
- CVE-2014-7843 MEDIUM · 4.9 The __clear_user function in arch/arm64/lib/clear_user.S in the Linux kernel before 3.17.4 on the ARM64 platform allows local users to cause a denial of service (system… Linux
- CVE-2014-7842 MEDIUM · 4.9 Raceconditie in arch/x86/kvm/x86.c in de Linux-kernel vóór 3.17.4 stelt gastbesturingssysteemgebruikers in staat om een denial of service (crash van het gastbesturingssysteem) te veroorzaken via een… Linux
- CVE-2014-7841 MEDIUM · 5.0 The sctp_process_param function in net/sctp/sm_make_chunk.c in the SCTP implementation in the Linux kernel before 3.17.4, when ASCONF is used, allows remote attackers to cause a… Linux
- CVE-2014-3688 MEDIUM · 5.0 The SCTP implementation in the Linux kernel before 3.17.4 allows remote attackers to cause a denial of service (memory consumption) by triggering a large number… Linux
- CVE-2010-5313 MEDIUM · 4.9 Raceconditie in arch/x86/kvm/x86.c in de Linux-kernel vóór 2.6.38 stelt L2-gastbesturingssysteemgebruikers in staat om een denial of service (L1-gastbesturingssysteemcrash) te veroorzaken via een vervaardigde instructie die… Linux
- CVE-2014-9089 HIGH · 7.5 Meerdere kwetsbaarheden voor SQL-injectie in view_all_bug_page.php in MantisBT vóór 1.2.18 stellen externe aanvallers in staat om willekeurige SQL-opdrachten uit te voeren via de parameter (1)… Debian Mantisbt
- CVE-2014-8994 LOW · 3.6 The check_diskio plugin 3.2.6 and earlier for Nagios and Icinga allows local users to write to arbitrary files via a symlink attack on a temporary… Check Diskio Project