CVE-database
125.649 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2014-3020 MEDIUM · 6.9 install.sh in the Embedded WebSphere Application Server (eWAS) 7.0 before FP33 in IBM Tivoli Integrated Portal (TIP) 2.1 and 2.2 sets world-writable permissions for the… Ibm
- CVE-2014-0889 MEDIUM · 4.3 Meerdere cross-site scripting (XSS) kwetsbaarheden in IBM Atlas Suite (ook bekend als Atlas Policy Suite), zoals gebruikt in Atlas eDiscovery Process Management via 6.0.3, Disposal… Ibm
- CVE-2014-5116 MEDIUM · 5.0 The cairo_image_surface_get_data function in Cairo 1.10.2, as used in GTK+ and Wireshark, allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via… Cairographics
- CVE-2014-5115 MEDIUM · 5.0 Absolute path traversal vulnerability in DirPHP 1.0 allows remote attackers to read arbitrary files via a full pathname in the phpfile parameter to index.php. Dirphp Project
- CVE-2014-5114 HIGH · 7.5 WeBid 1.1.1 allows remote attackers to conduct an LDAP injection attack via the (1) js or (2) cat parameter. Webidsupport
- CVE-2014-5031 MEDIUM · 5.0 The web interface in CUPS before 2.0 does not check that files have world-readable permissions, which allows remote attackers to obtains sensitive information via unspecified… Apple Canonical
- CVE-2014-5030 LOW · 1.9 CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3) index.pl, (4) index.php, (5) index.pyc,… Canonical Apple
- CVE-2014-5029 LOW · 1.5 Met de webinterface in CUPS 1.7.4 kunnen lokale gebruikers in de lp-groep willekeurige bestanden lezen via een symlink-aanval op een bestand in /var/cache/cups/rss/ en taal[0]… Apple Canonical
- CVE-2014-4909 MEDIUM · 6.8 Integer overflow in the tr_bitfieldEnsureNthBitAlloced function in bitfield.c in Transmission before 2.84 allows remote attackers to cause a denial of service and possibly execute arbitrary… Canonical Fedoraproject Gentoo Transmissionbt
- CVE-2014-4710 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in zero_user_account.php in ZeroCMS 1.0 allows remote attackers to inject arbitrary web script or HTML via the Full Name field. Aas9
- CVE-2014-2226 LOW · 2.6 Ubiquiti UniFi Controller vóór 3.2.1 registreert de administratieve wachtwoordhash in syslog-berichten, waarmee man-in-the-middle-aanvallers gevoelige informatie kunnen verkrijgen via niet-gespecificeerde vectoren. Ui
- CVE-2014-0475 MEDIUM · 6.8 Door meerdere kwetsbaarheden in de GNU C-bibliotheek (ook bekend als glibc of libc6) vóór 2.20 kunnen contextafhankelijke aanvallers ForceCommand-beperkingen omzeilen en mogelijk andere niet-gespecificeerde impact… Gnu
- CVE-2014-0103 LOW · 2.1 WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the… Zarafa Fedoraproject
- CVE-2014-3553 MEDIUM · 4.9 mod/forum/classes/post_form.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce the moodle/site:accessallgroups capability requirement… Moodle
- CVE-2014-3552 MEDIUM · 6.0 De Shibboleth-authenticatieplugin in auth/shibboleth/index.php in Moodle tot en met versie 2.3.11, 2.4.x vóór 2.4.11 en 2.5.x vóór 2.5.7 controleert niet of een sessie-ID leeg is.… Moodle
- CVE-2014-3551 LOW · 3.5 Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before… Moodle
- CVE-2014-3550 MEDIUM · 4.3 Multiple cross-site scripting (XSS) vulnerabilities in admin/tool/task/scheduledtasks.php in Moodle 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via vectors that… Moodle
- CVE-2014-3549 MEDIUM · 4.3 Cross-site scripting (XSS) -kwetsbaarheid in de get_description-functie in lib/classes/event/user_login_failed.php in Moodle 2.7.x vóór 2.7.1 stelt externe aanvallers in staat om willekeurig webscript of HTML te… Moodle
- CVE-2014-3548 MEDIUM · 4.3 Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers… Moodle
- CVE-2014-3547 MEDIUM · 4.3 Multiple cross-site scripting (XSS) vulnerabilities in badges/renderer.php in Moodle 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary… Moodle
- CVE-2014-3546 MEDIUM · 5.0 Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce certain capability requirements in (1) notes/index.php… Moodle
- CVE-2014-3545 MEDIUM · 6.0 Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to execute arbitrary code via… Moodle
- CVE-2014-3544 LOW · 3.5 Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote… Moodle
- CVE-2014-3543 MEDIUM · 4.3 mod/imscp/locallib.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files… Moodle
- CVE-2014-3542 MEDIUM · 4.3 mod/lti/service.php in Moodle via 2.3.11, 2.4.x vóór 2.4.11, 2.5.x vóór 2.5.7, 2.6.x vóór 2.6.4 en 2.7.x vóór 2.7.1 stelt aanvallers op afstand in staat om… Moodle
- CVE-2014-3541 HIGH · 7.5 The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct… Moodle
- CVE-2013-7393 LOW · 2.4 The daemonize.py module in Subversion 1.8.0 before 1.8.2 allows local users to gain privileges via a symlink attack on the pid file created for (1)… Apache
- CVE-2013-4262 LOW · 2.4 svnwcsub.py in Subversion 1.8.0 before 1.8.3, when using the --pidfile option and running in foreground mode, allows local users to gain privileges via a symlink… Apache
- CVE-2014-3304 MEDIUM · 5.0 The OutlookAction Class in Cisco WebEx Meetings Server allows remote attackers to enumerate user accounts by entering crafted URLs and examining the returned messages, aka… Cisco
- CVE-2014-3303 MEDIUM · 4.0 The web framework in Cisco WebEx Meetings Server does not properly restrict the content of query strings, which allows remote attackers to obtain sensitive information… Cisco
- CVE-2014-2975 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in php/user_account.php in Silver Peak VX before 6.2.4 allows remote attackers to inject arbitrary web script or HTML via the user_id… Silver-peak
- CVE-2014-2974 MEDIUM · 6.8 Cross-site request forgery (CSRF) vulnerability in php/user_account.php in Silver Peak VX through 6.2.4 allows remote attackers to hijack the authentication of administrators for requests that… Silver-peak
- CVE-2013-4840 HIGH · 7.8 Niet-gespecificeerde kwetsbaarheid in HP en H3C VPN Firewall Module-producten SECPATH1000FE vóór 5.20.R3177 en SECBLADEFW vóór 5.20.R3177 stelt externe aanvallers in staat om een denial of… H3c Hp
- CVE-2014-5113 MEDIUM · 4.3 Multiple cross-site scripting (XSS) vulnerabilities in test.php in Visualware MyConnection Server 9.7i allow remote attackers to inject arbitrary web script or HTML via the (1)… Visualware
- CVE-2014-5112 HIGH · 7.5 maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter. Netfortris
- CVE-2014-5111 MEDIUM · 5.0 Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a .. (dot dot) in the lang parameter to (1)… Netfortris
- CVE-2014-5110 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in user/help/html/index.php in Fonality trixbox allows remote attackers to inject arbitrary web script or HTML via the id_nodo parameter. Netfortris
- CVE-2014-5109 HIGH · 7.5 SQL injection vulnerability in maint/modules/endpointcfg/endpoint_generic.php in Fonality trixbox allows remote attackers to execute arbitrary SQL commands via the mac parameter in a Submit action. Netfortris
- CVE-2014-5108 MEDIUM · 4.3 Cross-site scripting (XSS) kwetsbaarheid in single_pagesdownload_file.php in beton5 vóór 5.6.3 stelt externe aanvallers in staat om willekeurig webscript of HTML te injecteren via de HTTP… Concrete5 Concretecms
- CVE-2014-5107 MEDIUM · 5.0 concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a direct request to (1) system/basics/editor.php, (2) system/view.php, (3) system/environment/file_storage_locations.php, (4) system/mail/importers.php, (5)… Concrete5 Concretecms
- CVE-2014-5106 MEDIUM · 4.3 Cross-site scripting (XSS) kwetsbaarheid in Invision Power IP.Board (ook bekend als IPB of Power Board) 3.4.x tot 3.4.6 stelt externe aanvallers in staat om willekeurig… Invisioncommunity
- CVE-2014-5105 MEDIUM · 4.3 Meerdere cross-site scripting (XSS) kwetsbaarheden in ol-commerce 2.1.1 stellen externe aanvallers in staat om willekeurig webscript of HTML te injecteren via de (1) a_country parameter… Ol-commerce Project
- CVE-2014-5104 HIGH · 7.5 Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) a_country parameter in a process action to… Ol-commerce Project
- CVE-2014-4726 HIGH · 7.5 Unspecified vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.8 for WordPress has unspecified impact and attack vectors. Mailpoet
- CVE-2014-4725 HIGH · 7.5 De MailPoet-nieuwsbrieven (wysija-nieuwsbrieven) plug-in vóór 2.6.7 voor WordPress stelt externe aanvallers in staat om authenticatie te omzeilen en willekeurige PHP-code uit te voeren door een… Mailpoet
- CVE-2014-4971 HIGH · 7.2 Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and… Microsoft
- CVE-2014-4857 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in Gurock TestRail before 3.1.3 allows remote attackers to inject arbitrary web script or HTML via the Created By field in… Gurock
- CVE-2014-4748 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in the Classic Meeting Server in IBM Sametime 8.x through 8.5.2.1 allows remote attackers to inject arbitrary web script or HTML… Ibm
- CVE-2014-4747 LOW · 2.1 The Classic Meeting Server in IBM Sametime 8.x through 8.5.2.1 allows physically proximate attackers to discover a meeting password hash by leveraging access to an… Ibm
- CVE-2014-2966 MEDIUM · 5.0 De ISO-8859-1-encoder in Resin Pro vóór 4.0.40 voert Unicode-transformaties niet goed uit, waardoor externe aanvallers beoogde tekstbeperkingen kunnen omzeilen via vervaardigde tekens, zoals aangetoond door… Caucho