CVE-database
126.123 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2014-3399 MEDIUM · 5.5 The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.2(.2.4) and earlier does not properly manage session information during creation of a SharePoint… Cisco
- CVE-2014-0940 MEDIUM · 4.3 Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Service Automation Manager 7.2.2.2 before 7.2.2.2-TIV-TSAM-LA0041 allow remote attackers to inject arbitrary web script or HTML via… Ibm
- CVE-2014-6607 HIGH · 7.5 M/Monit 3.3.2 and earlier does not verify the original password before changing passwords, which allows remote attackers to change the password of other users and… Mmonit
- CVE-2014-6409 MEDIUM · 6.8 Cross-site request forgery (CSRF) vulnerability in M/Monit 3.3.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that change user passwords… Mmonit
- CVE-2014-6389 HIGH · 7.5 backup.php in PHPCompta/NOALYSS before 6.7.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the d parameter. Phpcompta
- CVE-2014-4510 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in job.cc in apt-cacher-ng 0.7.26 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Debian
- CVE-2014-4043 HIGH · 7.5 The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, which allows context-dependent attackers to trigger… Gnu Opensuse
- CVE-2014-2044 HIGH · 7.5 Incomplete blacklist vulnerability in ajax/upload.php in ownCloud before 5.0, when running on Windows, allows remote authenticated users to bypass intended access restrictions, upload files with… Owncloud
- CVE-2014-1875 LOW · 3.6 The Capture::Tiny module before 0.24 for Perl allows local users to write to arbitrary files via a symlink attack on a temporary file. Cspan
- CVE-2014-1868 MEDIUM · 5.0 Restlet Framework 2.1.x before 2.1.7 and 2.x.x before 2.2 RC1, when using XMLRepresentation or XML serializers, allows attackers to cause a denial of service via… Restlet
- CVE-2014-1224 MEDIUM · 4.3 Incomplete blacklist vulnerability in the user registration feature in rexx Recruitment R6.1 and R7 without "fixes from 2014-01-15" allows remote attackers to conduct cross-site scripting… Rexx-systems
- CVE-2014-0397 HIGH · 10.0 Multiple unspecified vulnerabilities in libXtsol in Oracle Solaris 10 and 11.1 have unspecified impact and attack vectors related to "Buffer errors." Oracle
- CVE-2013-7329 MEDIUM · 5.0 The CGI::Application module before 4.50_50 and 4.50_51 for Perl, when run modes are not specified, allows remote attackers to obtain sensitive information (web queries and… Perl
- CVE-2013-1436 HIGH · 7.5 The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the… Xmonad
- CVE-2014-7870 LOW · 3.5 Cross-site scripting (XSS) vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows remote authenticated users with the "administer… Drupal
- CVE-2014-7869 LOW · 3.5 Cross-site scripting (XSS) vulnerability in the configuration UI in the Context Form Alteration module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the… Drupal
- CVE-2014-6054 MEDIUM · 4.3 The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier allows remote attackers to cause a denial of service (divide-by-zero error and server crash) via… Libvncserver Debian Canonical
- CVE-2014-5389 HIGH · 7.5 SQL-injectiekwetsbaarheid in content-audit-schedule.php in de Content Audit-plug-in vóór 1.6.1 voor WordPress stelt externe aanvallers in staat om willekeurige SQL-opdrachten uit te voeren via de optie… Content Audit Project
- CVE-2014-3657 MEDIUM · 5.0 The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to… Libvirt
- CVE-2014-3642 MEDIUM · 6.5 vmdb/app/controllers/application_controller/performance.rb in Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to gain privileges via unspecified vectors, related to an "insecure… Redhat
- CVE-2014-3633 MEDIUM · 5.8 De qemuDomainGetBlockIoTune-functie in qemu/qemu_driver.c in libvirt vóór 1.2.9, wanneer een schijf hot-plugged is of uit het live-image is verwijderd, stelt externe aanvallers in staat om… Canonical Libvirt
- CVE-2014-3608 LOW · 2.7 The VMWare driver in OpenStack Compute (Nova) before 2014.1.3 allows remote authenticated users to bypass the quota limit and cause a denial of service (resource… Openstack
- CVE-2014-3521 MEDIUM · 5.5 Met het component in (1) /luci/homebase en (2) /luci/clustermenu in Red Hat Conga 0.12.2 kunnen op afstand geverifieerde gebruikers beoogde toegangsbeperkingen omzeilen via een vervaardigde… Redhat
- CVE-2014-0994 MEDIUM · 6.8 Heap-gebaseerde bufferoverloop in de ReadDIB-functie in de Vcl.Graphics.TPicture.Bitmap-implementatie in de Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 en C++ Builder XE6 20.0.15596.9843 stelt… Embarcadero
- CVE-2014-0168 MEDIUM · 6.8 Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via… Jolokia
- CVE-2014-0140 MEDIUM · 4.0 Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to access sensitive controllers and actions via a direct HTTP or HTTPS… Redhat
- CVE-2014-0074 HIGH · 7.5 Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username… Apache
- CVE-2013-6496 MEDIUM · 5.0 Red Hat Conga 0.12.2 allows remote attackers to obtain sensitive information via a crafted request to the (1) homebase, (2) cluster, (3) storage, (4) portal_skins/custom,… Redhat
- CVE-2014-2644 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in HP Systems Insight Manager (SIM) before 7.4 allows remote attackers to inject arbitrary web script or HTML via unknown vectors. Hp
- CVE-2013-2645 HIGH · 9.3 Multiple cross-site request forgery (CSRF) vulnerabilities on the TP-LINK WR1043N router with firmware TL-WR1043ND_V1_120405 allow remote attackers to hijack the authentication of administrators for requests… Tp-link
- CVE-2014-7861 HIGH · 9.3 De IOHIDSecurePromptClient-functie in Apple OS X valideert de pointerwaarden niet goed, waardoor externe aanvallers willekeurige code kunnen uitvoeren of een denial of service (systeemcrash) kunnen… Apple
- CVE-2014-3400 MEDIUM · 4.0 Cisco WebEx Meetings Server allows remote authenticated users to obtain sensitive information by reading logs, aka Bug IDs CSCuq36417 and CSCuq40344. Cisco
- CVE-2014-3398 MEDIUM · 5.0 De SSL VPN-implementatie in Cisco Adaptive Security Appliance (ASA) -software stelt externe aanvallers in staat om potentieel gevoelige softwareversie-informatie te verkrijgen door de uitgebreide responsgegevens… Cisco
- CVE-2014-3396 HIGH · 7.5 Cisco IOS XR on ASR 9000 devices does not properly use compression for port-range and address-range encoding, which allows remote attackers to bypass intended Typhoon… Cisco
- CVE-2014-2645 MEDIUM · 4.3 HP Systems Insight Manager (SIM) vóór 7.4 stelt aanvallers op afstand in staat om clickjacking-aanvallen uit te voeren via onbekende vectoren. Hp
- CVE-2014-2643 MEDIUM · 6.5 Unspecified vulnerability in HP Systems Insight Manager (SIM) before 7.4 allows remote authenticated users to gain privileges via unknown vectors. Hp
- CVE-2014-7278 MEDIUM · 5.0 De inlogpagina van de ZyXEL SBG-3300 Security Gateway met firmware 1.00(AADY.4)C0 en ouder stelt externe aanvallers in staat een denial-of-service-aanval (permanente uitval van de webinterface)… Zyxel
- CVE-2014-7277 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in the login page on the ZyXEL SBG-3300 Security Gateway with firmware 1.00(AADY.4)C0 and earlier allows remote attackers to inject arbitrary… Zyxel
- CVE-2014-6933 MEDIUM · 5.4 The Toraware Takojyou (aka ltd.pte.wavea.torawaretakojyou) application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and… Wavea
- CVE-2014-6932 MEDIUM · 5.4 The All Navalny (aka com.all.navalny) application 1.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and… All Navalny Project
- CVE-2014-6931 MEDIUM · 5.4 The Treves Dance Center (aka com.myapphone.android.myapptrvesdancecenter) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers… Myapp
- CVE-2014-6930 MEDIUM · 5.4 The Abram Radio Groove! (aka com.nobexinc.wls_79226887.rc) application 3.2.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers… Nobexrc
- CVE-2014-6929 MEDIUM · 5.4 The AIHce 2014 (aka com.coreapps.android.followme.aihce2014) application 6.1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and… Core-apps
- CVE-2014-6928 MEDIUM · 5.4 De Rastreador de Celulares (ook bekend als com.mobincube.android.sc_9KTH8) applicatie 5.0.0 voor Android verifieert geen X.509-certificaten van SSL-servers, waardoor man-in-the-middle-aanvallers servers kunnen vervalsen en gevoelige informatie… Rastreadordecelulares
- CVE-2014-6927 MEDIUM · 5.4 The Myanmar Housing : mmHome (aka com.mmhome3) application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof… Myanmars
- CVE-2014-6926 MEDIUM · 5.4 De Allt om Brollop (ook bekend als com.paperton.wl.alltombrollop) applicatie 1.53 voor Android verifieert geen X.509-certificaten van SSL-servers, waardoor man-in-the-middle-aanvallers servers kunnen vervalsen en gevoelige informatie… Paperton
- CVE-2014-6925 MEDIUM · 5.4 The Steyr Forum (aka com.tapatalk.steyrclubcomvb) application 3.9.12 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and… Gcspublishing
- CVE-2014-6924 MEDIUM · 5.4 The Metro News (aka com.netpia.ha.metro) application 1.6.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and… Metroseoul
- CVE-2014-6923 MEDIUM · 5.4 The Dubrovnik Guided Walking Tours (aka com.mytoursapp.android.app351) application 1.3.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof… Mobitrips
- CVE-2014-6922 MEDIUM · 5.4 De KFAI Community Radio (ook bekend als com.skyblue.pra.kfai) applicatie 2.0.4 voor Android verifieert geen X.509-certificaten van SSL-servers, waardoor man-in-the-middle-aanvallers servers kunnen vervalsen en gevoelige informatie… Listener-interactive