CVE-database
126.123 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2014-6037 HIGH · 7.5 Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote attackers to execute arbitrary… Zohocorp
- CVE-2014-6133 LOW · 2.1 IBM API Management 3.x vóór 3.0.1.0 stelt lokale gebruikers in staat om gevoelige cijfertekstinformatie te verkrijgen via niet-gespecificeerde vectoren. Ibm
- CVE-2014-6099 MEDIUM · 5.0 The Change Password feature in IBM Sterling B2B Integrator 5.2.x through 5.2.4 does not have a lockout protection mechanism for invalid login requests, which makes… Ibm
- CVE-2014-4812 LOW · 1.8 The installer in IBM Security AppScan Source 8.x and 9.x through 9.0.1 has an open network port for a debug service, which allows remote attackers… Ibm
- CVE-2014-2987 MEDIUM · 6.8 Meerdere cross-site request forgery (CSRF) -kwetsbaarheden in EGroupware Enterprise Line (EPL) vóór 1.1.20140505, EGroupware Community Edition vóór 1.8.007.20140506 en EGroupware vóór 14.1 beta stellen externe… Egroupware
- CVE-2013-1641 HIGH · 7.8 Directory traversal vulnerability in the zip download functionality in QuiXplorer before 2.5.5 allows remote attackers to read arbitrary files via a .. (dot dot) in… Quixplorer
- CVE-2014-3137 MEDIUM · 6.8 Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access… Bottlepy
- CVE-2014-0476 LOW · 3.7 The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse… Chkrootkit Canonical
- CVE-2013-4594 MEDIUM · 4.3 The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous users to use the… Payment For Webform Project
- CVE-2014-5075 MEDIUM · 6.8 The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server… Redhat Igniterealtime
- CVE-2014-1929 MEDIUM · 4.4 python-gnupg 0.3.5 en 0.3.6 stelt contextafhankelijke aanvallers in staat om een niet-gespecificeerde impact te hebben via vectoren die verband houden met "optie-injectie via positionele argumenten."… Python-gnupg Project
- CVE-2014-1928 MEDIUM · 4.6 De shell_quote-functie in python-gnupg 0.3.5 ontsnapt niet goed aan tekens, waardoor contextafhankelijke aanvallers willekeurige code kunnen uitvoeren via shell-metakarakters in niet-gespecificeerde vectoren, zoals aangetoond met… Python-gnupg Project
- CVE-2014-1927 HIGH · 7.5 De shell_quote-functie in python-gnupg 0.3.5 citeert niet correct strings, waardoor contextafhankelijke aanvallers willekeurige code kunnen uitvoeren via shell-metakarakters in niet-gespecificeerde vectoren, zoals aangetoond met "$("… Python-gnupg Project
- CVE-2014-3636 LOW · 1.9 Met DBUS 1.3.0 tot 1.6.x vóór 1.6.24 en 1.8.x vóór 1.8.8 kunnen lokale gebruikers (1) een denial of service veroorzaken (voorkomen van nieuwe verbindingen en… D-bus Project Freedesktop Opensuse
- CVE-2014-6611 MEDIUM · 4.3 The BlackBerry World app before 5.0.0.262 on BlackBerry 10 OS 10.2.0, before 5.0.0.263 on BlackBerry 10 OS 10.2.1, and before 5.1.0.53 on BlackBerry 10 OS… Blackberry
- CVE-2014-6152 LOW · 3.5 Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Integrated Portal (TIP) 2.2.x allow remote authenticated users to inject arbitrary web script or HTML via unspecified… Ibm
- CVE-2014-6151 LOW · 3.5 CRLF injection vulnerability in IBM Tivoli Integrated Portal (TIP) 2.2.x allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks… Ibm
- CVE-2014-4624 MEDIUM · 5.0 EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x through 7.0.2-43 do not require authentication for Java API calls, which allows… Avamar Virtual Edition
- CVE-2014-4623 MEDIUM · 4.3 EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store (ADS) GEN4(S) and Avamar Virtual Edition (AVE), when Password Hardening before 2.0.0.4 is enabled, uses… Emc
- CVE-2014-4620 LOW · 2.1 The EMC NetWorker Module for MEDITECH (aka NMMEDI) 3.0 build 87 through 90, when EMC RecoverPoint and Plink are used, stores cleartext RecoverPoint Appliance credentials… Meditech Emc
- CVE-2014-3409 MEDIUM · 6.1 Met de Ethernet Connectivity Fault Management (CFM) afhandelingsfunctie in Cisco IOS 12.2(33) SRE9a en eerder en IOS XE 3.13S en eerder kunnen externe aanvallers een… Cisco
- CVE-2014-8760 MEDIUM · 5.0 ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption. Process-one
- CVE-2014-7180 MEDIUM · 4.6 Electric Cloud ElectricCommander before 4.2.6 and 5.x before 5.0.3 uses world-writable permissions for (1) eccert.pl and (2) ecconfigure.pl, which allows local users to execute arbitrary… Electric Cloud
- CVE-2014-6251 MEDIUM · 6.0 Stack-based buffer overflow in CPUMiner before 2.4.1 allows remote attackers to have an unspecified impact by sending a mining.subscribe response with a large nonce2 length,… Cpuminer Project
- CVE-2014-6230 MEDIUM · 4.3 WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the IP blacklist via a crafted X-Forwarded-For header. Wp-ban Project
- CVE-2014-3604 MEDIUM · 6.8 Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name… Not Yet Commons Ssl Project
- CVE-2014-2021 LOW · 3.5 Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.2.2 and earlier, and 5.0.x through 5.0.5 allows remote authenticated users to inject arbitrary web script or… Vbulletin
- CVE-2014-8346 HIGH · 7.8 The Remote Controls feature on Samsung mobile devices does not validate the source of lock-code data received over a network, which makes it easier for… Samsung
- CVE-2014-7298 MEDIUM · 4.9 adsetgroups in Centrify Server Suite 2008 through 2014.1 and Centrify DirectControl 3.x through 4.2.0 on Linux and UNIX allows local users to read arbitrary files… Centrify
- CVE-2014-8073 MEDIUM · 6.8 Cross-site request forgery (CSRF) -kwetsbaarheid in OpenMRS 2.1 Standalone Edition stelt externe aanvallers in staat om de authenticatie van beheerders te kapen voor verzoeken die… Openmrs
- CVE-2014-8072 MEDIUM · 4.0 De beheermodule in OpenMRS 2.1 Standalone Edition stelt externe, geauthenticeerde gebruikers in staat om leesrechten te verkrijgen via een direct verzoek aan /admin. Openmrs
- CVE-2014-8071 MEDIUM · 4.3 Multiple cross-site scripting (XSS) vulnerabilities in OpenMRS 2.1 Standalone Edition allow remote attackers to inject arbitrary web script or HTML via the (1) givenName, (2)… Openmrs
- CVE-2014-7292 MEDIUM · 5.8 Open redirect vulnerability in the Click-Through feature in Newtelligence dasBlog 2.1 (2.1.8102.813), 2.2 (2.2.8279.16125), and 2.3 (2.3.9074.18820) allows remote attackers to redirect users to arbitrary… Newtelligence
- CVE-2014-7281 MEDIUM · 6.8 Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN allows remote attackers to hijack the authentication of administrators for… Tenda
- CVE-2014-2230 MEDIUM · 5.8 Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to arbitrary web sites and… Openx
- CVE-2014-0619 MEDIUM · 6.9 Untrusted search path vulnerability in Hamster Free ZIP Archiver 2.0.1.7 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan… Hamstersoft
- CVE-2014-4766 MEDIUM · 5.0 IBM Sametime Classic Meeting Server 8.0.x and 8.5.x allows remote attackers to obtain sensitive information by reading an exported Record and Playback (RAP) file. Ibm
- CVE-2014-3829 HIGH · 10.0 displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allows remote attackers to execute arbitrary commands via shell metacharacters in… Merethis
- CVE-2014-3828 HIGH · 10.0 Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allow remote attackers to execute arbitrary SQL commands… Merethis
- CVE-2014-8764 MEDIUM · 5.0 DokuWiki 2014-05-05a and earlier, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a user name and password starting with… Mageia Project Dokuwiki
- CVE-2014-8763 MEDIUM · 5.0 DokuWiki before 2014-05-05b, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a password starting with a null () character… Dokuwiki Mageia Project
- CVE-2014-8762 MEDIUM · 5.0 Met de functie ajax_mediadiff in DokuWiki vóór 2014-05-05a kunnen aanvallers op afstand toegang krijgen tot willekeurige afbeeldingen via een bewerkte naamruimte in de parameter ns. Dokuwiki
- CVE-2014-8761 MEDIUM · 5.0 inc/template.php in DokuWiki before 2014-05-05a only checks for access to the root namespace, which allows remote attackers to access arbitrary images via a media file… Dokuwiki
- CVE-2014-8381 MEDIUM · 4.3 Multiple cross-site scripting (XSS) vulnerabilities in Megapolis.Portal Manager allow remote attackers to inject arbitrary web script or HTML via the (1) dateFrom or (2) dateTo… Megapolis
- CVE-2014-8325 HIGH · 7.8 Met de extensie Calendar Base (Cal) vóór 1.5.9 en 1.6.x vóór 1.6.1 voor TYPO3 kunnen externe aanvallers een denial of service (resourceverbruik) veroorzaken via vectoren… Calender Base Project
- CVE-2014-8088 MEDIUM · 5.0 The (1) Zend_Ldap class in Zend before 1.12.9 and (2) ZendLdap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote attackers to… Zend
- CVE-2014-7968 MEDIUM · 5.0 VDSM allows remote attackers to cause a denial of service (connection blocking) by keeping an SSL connection open. Redhat
- CVE-2014-7183 MEDIUM · 4.3 Meerdere cross-site scripting (XSS) kwetsbaarheden in de search.php in LiteCart 1.1.2.1 en eerder stellen externe aanvallers in staat om willekeurig webscript of HTML te injecteren… Litecart
- CVE-2014-7182 MEDIUM · 4.3 Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps plugin before 6.0.27 for WordPress allow remote attackers to inject arbitrary web script or HTML… Codecabin
- CVE-2014-6387 MEDIUM · 5.0 gpc_api.php in MantisBT 1.2.17 and earlier allows remote attackers to bypass authenticated via a password starting will a null byte, which triggers an unauthenticated bind. Mantisbt