CVE-database
125.649 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2014-3031 LOW · 3.5 Cross-site scripting (XSS) vulnerability in IBM Tivoli Business Service Manager 4.2.0 before 4.2.0.0 IF12 and 4.2.1 before 4.2.1.3 IF9 allows remote authenticated users to inject… Ibm
- CVE-2014-2631 MEDIUM · 4.6 Unspecified vulnerability in HP Application Lifecycle Management (aka Quality Center) 11.5x and 12.0x allows local users to gain privileges via unknown vectors, aka ZDI-CAN-2138. Hp
- CVE-2014-2628 MEDIUM · 4.0 Niet-gespecificeerde kwetsbaarheid in HP Enterprise Maps 1 stelt externe geverifieerde gebruikers in staat om gevoelige informatie te verkrijgen via onbekende vectoren. Hp
- CVE-2013-5433 MEDIUM · 4.0 The Data Growth Solution for JD Edwards EnterpriseOne in IBM InfoSphere Optim 3.0 through 9.1 has hardcoded database credentials, which allows remote authenticated users to… Ibm
- CVE-2014-3330 MEDIUM · 5.0 Cisco NX-OS 6.1(2)I2(1) on Nexus 9000 switches does not properly process packet-drop policy checks for logged packets, which allows remote attackers to bypass intended access… Cisco
- CVE-2014-3327 HIGH · 7.8 The EnergyWise module in Cisco IOS 12.2, 15.0, 15.1, 15.2, and 15.4 and IOS XE 3.2.xXO, 3.3.xSG, 3.4.xSG, and 3.5.xE before 3.5.3E allows remote attackers… Cisco
- CVE-2014-3076 MEDIUM · 5.0 IBM Business Process Manager (BPM) 8.5 through 8.5.5 allows remote attackers to obtain potentially sensitive information by visiting an unspecified JSP diagnostic page. Ibm
- CVE-2014-2357 HIGH · 8.3 The GPT library in the Telegyr 8979 Master Protocol application in SUBNET SubSTATION Server 2 before SSNET 2.12 HF18808 allows remote attackers to cause a… Subnet
- CVE-2014-3336 MEDIUM · 6.5 SQL injection vulnerability in the web framework in Cisco Unity Connection 9.1(2) and earlier allows remote authenticated users to execute arbitrary SQL commands via a… Cisco
- CVE-2014-3333 HIGH · 9.0 De server in Cisco Unity Connection 9.1(1) en 9.1(2) stelt op afstand geverifieerde gebruikers in staat om bevoorrechte toegang te verkrijgen door een "HTTP Intercept"… Cisco
- CVE-2014-3332 MEDIUM · 4.0 Cisco Unified Communications Manager (CM) 8.6(.2) and earlier has an incorrect CLI restrictions setting, which allows remote authenticated users to establish undetected concurrent logins via… Cisco
- CVE-2014-5195 HIGH · 7.2 Unity before 7.2.3 and 7.3.x before 7.3.1, as used in Ubuntu, does not properly take focus of the keyboard when switching to the lock screen,… Ayatana Project Canonical
- CVE-2014-5194 MEDIUM · 6.5 Static code injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote authenticated users to inject arbitrary PHP code into settings/conf.php via the _word_upper_bound parameter. Sphider
- CVE-2014-5193 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the category parameter. NOTE: the… Sphider
- CVE-2014-5192 HIGH · 7.5 SQL injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to execute arbitrary SQL commands via the filter parameter. Sphider
- CVE-2014-5191 MEDIUM · 4.3 Cross-site scripting (XSS) -kwetsbaarheid in de Preview-plug-in vóór 4.4.3 in CKEditor stelt externe aanvallers in staat om willekeurig webscript of HTML te injecteren via niet-gespecificeerde… Ckeditor
- CVE-2014-5190 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in captcha-secureimage/test/index.php in the SI CAPTCHA Anti-Spam plugin 2.7.4 for WordPress allows remote attackers to inject arbitrary web script or HTML… Si Captcha Anti-spam Project
- CVE-2014-5189 HIGH · 7.5 SQL injection vulnerability in lib/optin/optin_page.php in the Lead Octopus plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter. Leadoctopus
- CVE-2014-5188 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in doemailpassword.tml in Lyris ListManager (LM) 8.95a allows remote attackers to inject arbitrary web script or HTML via the EmailAddr parameter. Lyris
- CVE-2014-4647 MEDIUM · 6.8 Op stapels gebaseerde bufferoverloop in de loadExtensionFactory-methode in het TSVisualization ActiveX-besturingselement in Embarcadero ER/Studio Data Architect stelt externe aanvallers in staat om willekeurige code uit… Embarcadero
- CVE-2014-3914 HIGH · 10.0 Directory traversal vulnerability in the Admin Center for Tivoli Storage Manager (TSM) in Rocket ServerGraph 1.2 allows remote attackers to (1) create arbitrary files via… Rocketsoftware
- CVE-2014-3855 MEDIUM · 5.0 Directory traversal vulnerability in download.py in Pyplate 0.08 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter. Pyplate
- CVE-2014-3854 MEDIUM · 6.8 Cross-site request forgery (CSRF) -kwetsbaarheid in admin/addScript.py in Pyplate 0.08 stelt externe aanvallers in staat om de authenticatie van beheerders te kapen voor verzoeken die… Pyplate
- CVE-2014-3853 MEDIUM · 5.0 Pyplate 0.08 does not set the secure flag for the id cookie in an https session, which makes it easier for remote attackers to capture… Pyplate
- CVE-2014-3852 MEDIUM · 5.0 Pyplate 0.08 bevat niet de HTTPOnly-vlag in een Set-Cookie-header voor de id-cookie, waardoor het voor externe aanvallers gemakkelijker wordt om potentieel gevoelige informatie te verkrijgen… Pyplate
- CVE-2014-3851 LOW · 2.1 usr/lib/cgi-bin/create_passwd_file.py in Pyplate 0.08 uses world-readable permissions for passwd.db, which allows local users to obtain the administrator password by reading this file. Pyplate
- CVE-2014-3800 LOW · 2.1 XBMC 13.0 gebruikt wereldwijd leesbare machtigingen voor .xbmc/userdata/sources.xml, waarmee lokale gebruikers gebruikers gebruikersnamen en wachtwoorden kunnen verkrijgen door dit bestand te lezen. Xbmc
- CVE-2014-3774 MEDIUM · 4.3 Multiple cross-site scripting (XSS) vulnerabilities in items.php in TeamPass before 2.1.20 allow remote attackers to inject arbitrary web script or HTML via the group parameter,… Teampass
- CVE-2014-3773 HIGH · 7.5 Multiple SQL injection vulnerabilities in TeamPass before 2.1.20 allow remote attackers to execute arbitrary SQL commands via the login parameter in a (1) send_pw_by_email or… Teampass
- CVE-2014-3772 HIGH · 7.5 TeamPass vóór 2.1.20 stelt externe aanvallers in staat om toegangsbeperkingen te omzeilen via een verzoek aan index.php, gevolgd door een direct verzoek aan een bestand… Teampass
- CVE-2014-3771 HIGH · 7.5 TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via the language file path in a (1) request to index.php or (2) "change_user_language" request… Teampass
- CVE-2014-3517 MEDIUM · 4.3 In OpenStack Compute (Nova) vóór versie 2013.2.4, 2014.x vóór versie 2014.1.2 en Juno vóór Juno-2, maakt het bestand api/metadata/handler.py, wanneer metadataverzoeken via Neutron worden geproxyd,… Openstack
- CVE-2014-3459 MEDIUM · 6.8 Heap-based buffer overflow in SolarWinds Network Configuration Manager (NCM) before 7.3 allows remote attackers to execute arbitrary code via the PEstrarg1 property. Solarwinds
- CVE-2014-3429 MEDIUM · 6.8 IPython Notebook 0.12 t/m 1.x before 1.2 valideert de oorsprong van websocket-aanvragen niet, waardoor externe aanvallers willekeurige code kunnen uitvoeren door gebruik te maken van… Opensuse Ipython Mageia
- CVE-2013-7394 HIGH · 9.0 Met het "runshellscript echo.sh" -script in Splunk vóór 5.0.5 kunnen op afstand geverifieerde gebruikers willekeurige opdrachten uitvoeren via een vervaardigde tekenreeks. OPMERKING: dit probleem is… Splunk
- CVE-2013-6771 HIGH · 9.3 Directory traversal-kwetsbaarheid in het collect-script in Splunk vóór 5.0.5 stelt externe aanvallers in staat om willekeurige opdrachten uit te voeren via een .. (dot dot)… Splunk
- CVE-2014-5187 MEDIUM · 5.0 Directory traversal vulnerability in the Tom M8te (tom-m8te) plugin 1.5.3 for WordPress allows remote attackers to read arbitrary files via the file parameter to tom-download-file.php. Tom M8te Plugin Project
- CVE-2014-5186 MEDIUM · 6.5 SQL injection vulnerability in the All Video Gallery (all-video-gallery) plugin 1.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id… All Video Gallery Plugin Project
- CVE-2014-5185 MEDIUM · 6.0 SQL-injectiekwetsbaarheid in de Quartz-plug-in 1.01.1 voor WordPress stelt externe geverifieerde gebruikers met Contributor-privileges in staat om willekeurige SQL-opdrachten uit te voeren via de offerteparameter in… Quartz Plugin Project
- CVE-2014-5184 MEDIUM · 6.5 SQL injection vulnerability in the stripshow-storylines page in the stripShow plugin 2.5.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the… Stripshow Plugin Project
- CVE-2014-5183 MEDIUM · 6.5 SQL injection vulnerability in includes/mode-edit.php in the Simple Retail Menus (simple-retail-menus) plugin before 4.1 for WordPress allows remote authenticated editors to execute arbitrary SQL commands… Simple Retail Menus Plugin Project
- CVE-2014-5182 MEDIUM · 6.0 Multiple SQL injection vulnerabilities in the yawpp plugin 1.2 for WordPress allow remote authenticated users with Contributor privileges to execute arbitrary SQL commands via vectors… Ostenta
- CVE-2014-5181 MEDIUM · 5.0 Directory traversal vulnerability in lastfm-proxy.php in the Last.fm Rotation (lastfm-rotation) plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a .. (dot… Last.fm Rotation Plugin Project
- CVE-2014-5180 MEDIUM · 6.5 SQL injection vulnerability in the videos page in the HDW Player Plugin (hdw-player-video-player-video-gallery) 2.4.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands… Hdwplayer
- CVE-2014-3559 LOW · 3.5 The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots when deleting a VM, even when wipe-after-delete (WAD) is configured… Redhat
- CVE-2014-3434 MEDIUM · 6.9 Buffer overflow in the sysplant driver in Symantec Endpoint Protection (SEP) Client 11.x and 12.x before 12.1 RU4 MP1b, and Small Business Edition before SEP… Symantec
- CVE-2014-0479 MEDIUM · 6.8 reportbug before 6.4.4+deb7u1 and 6.5.x before 6.5.0+nmu1 allows remote attackers to execute arbitrary commands via vectors related to compare_versions and reportbug/checkversions.py. Canonical Debian
- CVE-2012-6653 HIGH · 7.5 Unspecified vulnerability in the All Video Gallery (all-video-gallery) plugin before 1.2.0 for WordPress has unspecified impact and attack vectors. All Video Gallery Plugin Project
- CVE-2014-5179 MEDIUM · 4.3 De freelinking-module voor Drupal, zoals gebruikt in de Freelinking for Case Tracker-module, controleert niet goed de toegangsrechten voor (1) knooppunten of (2) gebruikers, waardoor externe… Freelinking For Case Tracker Project Freelinking Project
- CVE-2014-5178 MEDIUM · 4.3 Multiple cross-site scripting (XSS) vulnerabilities in Easy File Sharing (EFS) Web Server 6.8 allow remote authenticated users to inject arbitrary web script or HTML via… Efssoft