CVE-database
125.649 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2014-1558 MEDIUM · 4.3 Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (X.509 certificate parsing outage) via a crafted certificate… Mozilla
- CVE-2014-1557 HIGH · 9.3 The ConvolveHorizontally function in Skia, as used in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, does not properly handle… Oracle Mozilla Debian
- CVE-2014-1556 HIGH · 9.3 Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to execute arbitrary code via crafted WebGL content constructed… Mozilla
- CVE-2014-1555 HIGH · 9.3 Use-after-free kwetsbaarheid in de nsDocLoader::OnProgress-functie in Mozilla Firefox vóór 31.0, Firefox ESR 24.x vóór 24.7 en Thunderbird vóór 24.7 stelt externe aanvallers in staat om… Mozilla
- CVE-2014-1552 MEDIUM · 5.8 Mozilla Firefox vóór 31.0 en Thunderbird vóór 31.0 implementeren het sandbox-attribuut van het IFRAME-ELEMENT niet correct, waardoor externe aanvallers de beoogde beperkingen op inhoud van… Mozilla
- CVE-2014-1551 HIGH · 10.0 Use-after-free vulnerability in the FontTableRec destructor in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 on Windows allows remote attackers… Mozilla Microsoft
- CVE-2014-1550 HIGH · 10.0 Use-after-free vulnerability in the MediaInputPort class in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allows remote attackers to execute arbitrary code or cause a… Mozilla
- CVE-2014-1549 HIGH · 9.3 The mozilla::dom::AudioBufferSourceNodeEngine::CopyFromInputBuffer function in Mozilla Firefox before 31.0 and Thunderbird before 31.0 does not properly allocate Web Audio buffer memory, which allows remote attackers to… Mozilla
- CVE-2014-1548 HIGH · 10.0 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service… Mozilla
- CVE-2014-1547 HIGH · 10.0 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to… Mozilla
- CVE-2014-1544 HIGH · 10.0 Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before… Mozilla
- CVE-2014-4948 MEDIUM · 6.4 Unspecified vulnerability in Citrix XenServer 6.2 Service Pack 1 and earlier allows attackers to cause a denial of service and obtain sensitive information by modifying… Citrix
- CVE-2014-4947 HIGH · 10.0 Bufferoverloop in de ondersteuning van de HVM grafische console in Citrix XenServer 6.2 Service Pack 1 en eerder heeft niet-gespecificeerde impact- en aanvalsvectoren. Citrix
- CVE-2014-3530 HIGH · 7.5 The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers… Redhat
- CVE-2014-3518 MEDIUM · 6.8 jmx-remoting.sar in JBoss Remoting, zoals gebruikt in Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform… Redhat
- CVE-2014-5023 MEDIUM · 6.8 Repository.php in Gitter, as used in Gitlist, allows remote attackers with commit privileges to execute arbitrary commands via shell metacharacters in a branch name, as… Gitlist
- CVE-2014-5022 MEDIUM · 4.3 Cross-site scripting (XSS) kwetsbaarheid in het Ajax-systeem in Drupal 7.x vóór 7.29 stelt externe aanvallers in staat om willekeurig webscript of HTML te injecteren via… Drupal
- CVE-2014-5021 LOW · 2.1 Cross-site scripting (XSS) -kwetsbaarheid in de Form API in Drupal 6.x vóór 6.32 en mogelijk 7.x vóór 7.29 stelt op afstand geverifieerde gebruikers met de… Drupal
- CVE-2014-5020 MEDIUM · 4.9 The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with certain permissions to… Drupal
- CVE-2014-5019 MEDIUM · 5.0 The multisite feature in Drupal 6.x before 6.32 and 7.x before 7.29 allows remote attackers to cause a denial of service via a crafted HTTP… Drupal
- CVE-2014-4911 MEDIUM · 5.0 The ssl_decrypt_buf function in library/ssl_tls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remote attackers to cause a denial of service (crash) via vectors… Polarssl Debian
- CVE-2014-4511 HIGH · 7.5 Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a… Gitlist
- CVE-2014-4326 HIGH · 7.5 Elasticsearch Logstash 1.0.14 tot en met 1.4.x vóór 1.4.2 stelt aanvallers op afstand in staat om willekeurige opdrachten uit te voeren via een vervaardigde gebeurtenis… Elastic
- CVE-2014-2385 MEDIUM · 4.3 Multiple cross-site scripting (XSS) vulnerabilities in the web UI in Sophos Anti-Virus for Linux before 9.6.1 allow local users to inject arbitrary web script or… Sophos
- CVE-2013-7392 HIGH · 7.5 Met Gitlist kunnen externe aanvallers willekeurige opdrachten uitvoeren via shell-metakarakters in een bestandsnaam naar Source/. Gitlist
- CVE-2014-5018 MEDIUM · 4.3 Incomplete blacklist vulnerability in the autoEscape function in common_helper.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to conduct cross-site scripting (XSS) attacks via the… Limesurvey
- CVE-2014-5017 HIGH · 7.5 SQL injection vulnerability in CPDB in application/controllers/admin/participantsaction.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to execute arbitrary SQL commands via the sidx parameter in… Limesurvey
- CVE-2014-5016 MEDIUM · 4.3 Multiple cross-site scripting (XSS) vulnerabilities in LimeSurvey 2.05+ Build 140618 allow remote attackers to inject arbitrary web script or HTML via (1) the pid attribute… Limesurvey
- CVE-2014-4960 HIGH · 7.5 Multiple SQL injection vulnerabilities in modelsgallery.php in Youtube Gallery (com_youtubegallery) component 4.x through 4.1.7, and possibly 3.x, for Joomla! allow remote attackers to execute arbitrary… Joomlaboat
- CVE-2014-4734 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in e107_admin/db.php in e107 2.0 alpha2 and earlier allows remote attackers to inject arbitrary web script or HTML via the type… E107
- CVE-2014-4987 MEDIUM · 4.0 server_user_groups.php in phpMyAdmin 4.1.x vóór 4.1.14.2 en 4.2.x vóór 4.2.6 stelt op afstand geverifieerde gebruikers in staat om beoogde toegangsbeperkingen te omzeilen en de MySQL-gebruikerslijst… Opensuse Phpmyadmin
- CVE-2014-4986 LOW · 3.5 Meerdere cross-site scripting (XSS) -kwetsbaarheden in js/functions.js in phpMyAdmin 4.0.x vóór 4.0.10.1, 4.1.x vóór 4.1.14.2 en 4.2.x vóór 4.2.6 stellen op afstand geverifieerde gebruikers in… Phpmyadmin
- CVE-2014-4955 LOW · 3.5 Cross-site scripting (XSS) vulnerability in the PMA_TRI_getRowForList function in libraries/rte/rte_list.lib.php in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allows remote authenticated… Phpmyadmin
- CVE-2014-4954 LOW · 3.5 Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks function in libraries/structure.lib.php in phpMyAdmin 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or… Phpmyadmin
- CVE-2014-4342 MEDIUM · 5.0 MIT Kerberos 5 (aka krb5) 1.7.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read or NULL pointer dereference,… Debian Mit Redhat
- CVE-2014-4341 MEDIUM · 5.0 MET MIT Kerberos 5 (ook bekend als krb5) vóór 1.12.2 kunnen externe aanvallers een denial of service (buffer over-read en applicatiecrash) veroorzaken door ongeldige tokens… Mit Redhat Debian Fedoraproject
- CVE-2014-3894 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in PHP Kobo Multifunctional MailForm Free 2014/1/28 and earlier allows remote attackers to inject arbitrary web script or HTML via an… Php Kobo
- CVE-2014-3892 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in Nexa Meridian before 2014 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Nexatechnologies
- CVE-2014-3886 LOW · 2.6 Cross-site scripting (XSS) vulnerability in Webmin before 1.690, when referrer checking is disabled, allows remote attackers to inject arbitrary web script or HTML via unspecified… Webmin
- CVE-2014-3885 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in Webmin before 1.690 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. NOTE: this might… Webmin
- CVE-2014-3884 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in Usermin before 1.600 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this might overlap… Webmin
- CVE-2014-3523 MEDIUM · 5.0 Geheugenlek in de winnt_accept-functie in server/mpm/winnt/child.c in de WinNT MPM in de Apache HTTP-server 2.4.x vóór 2.4.10 op Windows, wanneer de standaard AcceptFilter is ingeschakeld,… Apache Microsoft
- CVE-2014-3162 MEDIUM · 5.0 Multiple unspecified vulnerabilities in Google Chrome before 36.0.1985.125 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Debian Google
- CVE-2014-3161 HIGH · 7.5 De WebMediaPlayerAndroid:: laadfunctie in content/renderer/media/android/webmediaplayer_android.cc in Google Chrome vóór 36.0.1985.122 op Android werkt niet goed samen met omleidingen, waardoor aanvallers op afstand het Same Origin-beleid… Google
- CVE-2014-3160 MEDIUM · 6.8 De ResourceFetcher::canRequest-functie in core/fetch/ResourceFetcher.cpp in Blink, zoals gebruikt in Google Chrome vóór 36.0.1985.125, beperkt subresourceverzoeken die zijn gekoppeld aan SVG-bestanden niet correct, waardoor externe aanvallers… Debian Google
- CVE-2014-3159 MEDIUM · 6.4 The WebContentsDelegateAndroid::OpenURLFromTab function in components/web_contents_delegate_android/web_contents_delegate_android.cc in Google Chrome before 36.0.1985.122 on Android does not properly restrict URL loading, which allows remote attackers to spoof the… Google
- CVE-2014-1999 HIGH · 7.5 The auto-format feature in the Request_Curl class in FuelPHP 1.1 through 1.7.1 allows remote attackers to execute arbitrary code via a crafted response. Fuelphp
- CVE-2014-1996 HIGH · 7.5 Cybozu Garoon 3.7 before SP4 allows remote authenticated users to bypass intended access restrictions, and execute arbitrary code or cause a denial of service, via… Cybozu
- CVE-2014-1995 LOW · 3.5 Cross-site scripting (XSS) vulnerability in the Map search functionality in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary… Cybozu
- CVE-2014-1994 LOW · 3.5 Cross-site scripting (XSS) -kwetsbaarheid in de kennisgevingenportlet in Cybozu Garoon 2.x en 3.x vóór 3.7 SP4 stelt op afstand geverifieerde gebruikers in staat om willekeurig… Cybozu