CVE-database
124.464 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2014-5350 MEDIUM · 5.0 Meerdere kwetsbaarheden voor directorytraversal in Bitdefender GravityZone vóór 5.1.11.432 stellen externe aanvallers in staat om willekeurige bestanden te lezen via een (1) .. (dot dot)… Bitdefender
- CVE-2014-5349 MEDIUM · 5.0 Op stapels gebaseerde bufferoverloop in Baidu Spark Browser 26.5.9999.3511 stelt externe aanvallers in staat om een denial of service (applicatiecrash) te veroorzaken via geneste oproepen… Baidu
- CVE-2014-5348 MEDIUM · 4.3 Cross-site scripting (XSS) kwetsbaarheid in apps/zxtm/locallog.cgi in Riverbed Stingray (ook bekend als SteelApp) Traffic Manager Virtual Appliance 9.6 patchlevel 9620140312 stelt aanvallers op afstand in… Riverbed
- CVE-2014-5347 MEDIUM · 6.8 Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress allow remote attackers to hijack the authentication of administrators… Disqus
- CVE-2014-5346 MEDIUM · 6.8 Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow remote attackers to hijack the authentication of administrators for… Disqus
- CVE-2014-5345 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress allows remote attackers to inject arbitrary web script or… Disqus
- CVE-2014-5344 MEDIUM · 4.3 Multiple cross-site scripting (XSS) vulnerabilities in the Mobiloud (mobiloud-mobile-app-plugin) plugin before 2.3.8 for WordPress allow remote attackers to inject arbitrary web script or HTML via… Mobiloud
- CVE-2014-5343 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in Feng Office allows remote attackers to inject arbitrary web script or HTML via a client Name field. Fengoffice
- CVE-2014-5033 MEDIUM · 6.9 KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass… Debian Canonical Kde
- CVE-2014-4615 MEDIUM · 5.0 The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before… Redhat Canonical Openstack
- CVE-2014-3528 MEDIUM · 4.0 Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials,… Opensuse Apache Canonical Apple
- CVE-2014-3522 MEDIUM · 4.0 The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name… Apache Opensuse Canonical Apple
- CVE-2014-3504 MEDIUM · 4.0 The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a… Apache Canonical Serf Project
- CVE-2014-3490 HIGH · 7.5 RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when… Redhat
- CVE-2014-3472 MEDIUM · 4.9 The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly… Redhat
- CVE-2014-3464 MEDIUM · 5.5 The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the… Redhat
- CVE-2014-5333 MEDIUM · 4.3 Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows… Adobe Google Apple Microsoft
- CVE-2014-3906 HIGH · 7.5 SQL injection vulnerability in OSK Advance-Flow 4.41 and earlier and Advance-Flow Forms 4.41 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified… Kk-osk
- CVE-2014-3903 LOW · 3.5 Cross-site scripting (XSS) vulnerability in the Cakifo theme 1.x before 1.6.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via… Jayj
- CVE-2014-3341 MEDIUM · 5.0 The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether… Cisco
- CVE-2014-5266 MEDIUM · 5.0 The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number… Wordpress Drupal Debian
- CVE-2014-5265 MEDIUM · 5.0 The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering… Wordpress Drupal Debian
- CVE-2014-5240 LOW · 2.1 Cross-site scripting (XSS) kwetsbaarheid in wp-includes/pluggable.php in WordPress vóór 3.9.2, wanneer Multisite is ingeschakeld, stelt externe geverifieerde beheerders in staat om willekeurig webscript of HTML… Wordpress Debian
- CVE-2014-5207 MEDIUM · 6.2 fs/namespace.c in the Linux kernel through 3.16.1 does not properly restrict clearing MNT_NODEV, MNT_NOSUID, and MNT_NOEXEC and changing MNT_ATIME_MASK during a remount of a bind… Linux Canonical
- CVE-2014-5206 HIGH · 7.2 The do_remount function in fs/namespace.c in the Linux kernel through 3.16.1 does not maintain the MNT_LOCK_READONLY bit across a remount of a bind mount, which… Linux Canonical
- CVE-2014-5205 MEDIUM · 6.8 wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tokens, which makes it easier for… Wordpress
- CVE-2014-5204 MEDIUM · 6.8 wp-includes/pluggable.php in WordPress vóór 3.9.2 verwerpt ongeldige CSRF-nonces met een andere timing, afhankelijk van welke tekens in de nonce onjuist zijn, wat het voor externe… Debian Wordpress
- CVE-2014-5203 HIGH · 7.5 wp-includes/class-wp-customize-widgets.php in de widgetimplementatie in WordPress 3.9.x vóór 3.9.2 kunnen externe aanvallers willekeurige code laten uitvoeren via vervaardigde geserialiseerde gegevens. Wordpress
- CVE-2014-2388 MEDIUM · 6.1 The Storage and Access service in BlackBerry OS 10.x before 10.2.1.1925 on Q5, Q10, Z10, and Z30 devices does not enforce the password requirement for… Blackberry
- CVE-2014-1469 MEDIUM · 4.9 BlackBerry Enterprise Server 5.x before 5.0.4 MR7 and Enterprise Service 10.x before 10.2.2 log cleartext credentials during exception handling, which allows local users to obtain… Blackberry
- CVE-2014-5074 HIGH · 7.1 Siemens SIMATIC S7-1500 CPU devices with firmware before 1.6 allow remote attackers to cause a denial of service (device restart and STOP transition) via crafted… Siemens
- CVE-2014-4775 MEDIUM · 5.0 IBM InfoSphere Master Data Management - Collaborative Edition 10.x voor 10.1-FP11 en 11.x voor 11.0-FP5 en InfoSphere Master Data Management Server voor Product Information Management… Ibm
- CVE-2014-3087 MEDIUM · 4.0 callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files… Ibm
- CVE-2014-3085 HIGH · 7.1 systest.php on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allows remote authenticated users to execute arbitrary commands via shell metacharacters… Ibm
- CVE-2014-3081 MEDIUM · 6.3 prodtest.php op IBM GCM16 en GCM32 Global Console Manager schakelt over met firmware vóór 1.20.20.23447 stelt op afstand geverifieerde gebruikers in staat om willekeurige bestanden… Ibm
- CVE-2014-3080 MEDIUM · 4.3 Meerdere cross-site scripting (XSS) -kwetsbaarheden op IBM GCM16- en GCM32 Global Console Manager-switches met firmware vóór 1.20.20.23447 stellen externe aanvallers in staat om willekeurig webscript… Ibm
- CVE-2014-3063 HIGH · 7.5 IBM InfoSphere Master Data Management - Collaborative Edition 10.x voor 10.1-FP11 en 11.x voor 11.0-FP5 en InfoSphere Master Data Management Server voor Product Information Management… Ibm
- CVE-2014-0969 MEDIUM · 6.8 Cross-site request forgery (CSRF) -kwetsbaarheid in de GDS-component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x en 11.x vóór 11.0-FP5 en InfoSphere Master… Ibm
- CVE-2014-0966 MEDIUM · 6.5 SQL injection vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0-FP5 and InfoSphere Master Data… Ibm
- CVE-2014-0905 LOW · 2.9 IBM InfoSphere BigInsights 2.0 t/m 2.1.2 stelt de beveiligde vlag voor de LTPA-cookie niet in een https-sessie in, wat het voor externe aanvallers gemakkelijker maakt… Ibm
- CVE-2014-0876 LOW · 2.1 Een bufferoverloop in de Java GUI-configuratiewizard en de voorkeureneditor van de back-up- en archiveringsclient in IBM Tivoli Storage Manager (TSM) 5.x en 6.x vóór 6.2.5.2,… Ibm Apple Microsoft
- CVE-2014-0327 HIGH · 9.3 The Terminal Upgrade Tool in the Pilot Below Deck Equipment (BDE) and OpenPort implementations on Iridium satellite terminals allows remote attackers to execute arbitrary code… Iridium
- CVE-2014-0326 HIGH · 9.3 The Pilot Below Deck Equipment (BDE) and OpenPort implementations on Iridium satellite terminals allow remote attackers to read hardcoded credentials via the web interface. Iridium
- CVE-2014-3905 MEDIUM · 4.3 Cross-site scripting (XSS) -kwetsbaarheid in tenfourzero Shutter 0.1.4 stelt externe aanvallers in staat om willekeurig webscript of HTML te injecteren via niet-gespecificeerde vectoren. Tenfourzero
- CVE-2014-3904 HIGH · 7.5 SQL injection vulnerability in lib/admin.php in tenfourzero Shutter 0.1.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Tenfourzero
- CVE-2014-3900 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in admin/picture_modify.php in the photo-edit subsystem in Piwigo 2.6.3 and earlier allows remote attackers to inject arbitrary web script or HTML… Piwigo
- CVE-2014-0609 HIGH · 10.0 Unspecified vulnerability in Novell Open Enterprise Server (OES) 11 SP1 before Scheduled Maintenance Update 9415 and 11 SP2 before Scheduled Maintenance Update 9413 for Linux… Novell
- CVE-2014-5260 MEDIUM · 6.3 The (1) mkxmltype and (2) mkdtskel scripts in XML-DT before 0.64 allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_xml_#####… Xml-dt Project
- CVE-2014-0852 MEDIUM · 4.3 IBM WebSphere DataPower SOA appliances through 4.0.2.15, 5.x through 5.0.0.17, 6.0.0.x through 6.0.0.9, and 6.0.1.x through 6.0.1.5 make it easier for remote attackers to obtain… Ibm
- CVE-2013-7144 MEDIUM · 4.3 LINE 3.2.1.83 and earlier on Windows and 3.2.1 and earlier on OS X does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers… Linecorp Microsoft Apple