CVE-database
126.123 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2014-5201 HIGH · 7.5 SQL injection vulnerability in the Gallery Objects plugin 0.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the viewid parameter in a… Gallery Objects Project
- CVE-2014-5200 HIGH · 7.5 SQL injection vulnerability in game_play.php in the FB Gorilla plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter. Fb Gorilla Project
- CVE-2014-5199 MEDIUM · 6.8 Cross-site request forgery (CSRF) kwetsbaarheid in de WordPress File Upload plugin (wp-file-upload) vóór 2.4.2 voor WordPress stelt externe aanvallers in staat om de authenticatie van… Wordpress File Upload Project
- CVE-2014-5198 MEDIUM · 4.3 Cross-site scripting (XSS) kwetsbaarheid in Splunk Web in Splunk Enterprise 6.1.x vóór 6.1.3 stelt externe aanvallers in staat om willekeurig webscript of HTML te injecteren… Splunk
- CVE-2014-5197 MEDIUM · 4.0 Directory traversal vulnerability in (1) Splunk Web or the (2) Splunkd HTTP Server in Splunk Enterprise 6.1.x before 6.1.3 allows remote authenticated users to read… Splunk
- CVE-2014-5196 MEDIUM · 4.3 Cross-site request forgery (CSRF) vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5 for WordPress allows remote attackers… Improved User Search In Backend Project
- CVE-2012-4241 MEDIUM · 4.3 Multiple cross-site scripting (XSS) vulnerabilities in Microcart 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO or (2) query… Microcart Project
- CVE-2011-2944 HIGH · 7.5 SQL injection vulnerability in login.php in MegaLab The Uploader before 2.0.5 allows remote attackers to execute arbitrary SQL commands via the username parameter. Megalab
- CVE-2011-2593 MEDIUM · 6.8 Integer overflow in the StartEpa method in the nsepacom ActiveX control (nsepa.exe) in Citrix Access Gateway Enterprise Edition Plug-in for Windows 9.x before 9.3-57.5 and… Citrix
- CVE-2013-7395 MEDIUM · 4.9 ZOLL Defibrillator / Monitor X Series has a default (1) supervisor password and (2) service password, which allows physically proximate attackers to modify device configuration… Zoll
- CVE-2007-6756 MEDIUM · 4.9 ZOLL Defibrillator / Monitor M Series, E Series, and R Series have a default password for System Configuration mode, which allows physically proximate attackers to… Zoll
- CVE-2014-3072 HIGH · 7.2 Niet-gespecificeerde kwetsbaarheid in de automatiseringsserver in IBM Security AppScan Source 8 t/m 8.0.0.2, 8.5 t/m 8.5.0.1, 8.6 t/m 8.6.0.2, 8.7 t/m 8.7.0.1, 8.8 en 9.0… Ibm
- CVE-2014-2629 MEDIUM · 4.0 HP NonStop Safeguard Security Software G, H06.03 through H06.28.01, and J06.03 through J06.17.01 does not properly evaluate the DISKFILE-PATTERN ACL of a program object file,… Hp
- CVE-2014-4760 MEDIUM · 5.8 Open redirect vulnerability in IBM WebSphere Portal 6.1.0.0 through 6.1.0.6 CF27, 6.1.5.0 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF28, 8.0.0 before 8.0.0.1 CF13, and 8.5.0… Ibm
- CVE-2014-4751 MEDIUM · 4.3 Een XSS-kwetsbaarheid (cross-site scripting) in IBM Security Access Manager for Mobile 8.0.0.0, 8.0.0.1 en 8.0.0.3 stelt externe aanvallers in staat om willekeurige webscripts of HTML… Ibm
- CVE-2014-4746 MEDIUM · 5.0 IBM WebSphere Portal 8.0.0 vóór 8.0.0.1 CF13 en 8.5.0 tot en met CF01 biedt verschillende foutcodes voor firewall-verzoeken, afhankelijk van of de intranethost bestaat, waarmee… Ibm
- CVE-2014-3899 MEDIUM · 4.3 Gretech GOM Player 2.2.51.5149 and earlier allows remote attackers to cause a denial of service (launch outage) via a crafted image file. Gomlab
- CVE-2014-3102 LOW · 3.5 Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.0.0 through 7.0.0.2 CF28 and 8.0.0 before 8.0.0.1 CF13 allows remote authenticated users to inject arbitrary web… Ibm
- CVE-2014-2630 MEDIUM · 4.4 Ongespecificeerde kwetsbaarheid in HP Operations Agent 11.00, wanneer Glance wordt gebruikt, stelt lokale gebruikers in staat om privileges te verkrijgen via onbekende vectoren. Hp
- CVE-2014-0953 MEDIUM · 4.3 Cross-site scripting (XSS) kwetsbaarheid in IBM WebSphere Portal 6.1.0.0 tot en met 6.1.0.6 CF27, 6.1.5.0 tot en met 6.1.5.3 CF27, 7.0.0 tot en met 7.0.0.2… Ibm
- CVE-2014-4757 LOW · 2.1 The Outlook Extension in IBM Content Collector 4.0.0.x before 4.0.0.0-ICC-OE-IF004 allows local users to bypass the intended Reviewer privilege requirement and read e-mail messages from… Ibm
- CVE-2014-3086 HIGH · 7.5 Unspecified vulnerability in the IBM Java Virtual Machine, as used in IBM WebSphere Real Time 3 before Service Refresh 7 FP1 and other products, allows… Ibm
- CVE-2014-3069 LOW · 3.5 Multiple CRLF injection vulnerabilities in the Universal Access component in IBM Curam Social Program Management (SPM) 6.0.5.5, when WebSphere Application Server is not used, allow… Ibm
- CVE-2014-3031 LOW · 3.5 Cross-site scripting (XSS) vulnerability in IBM Tivoli Business Service Manager 4.2.0 before 4.2.0.0 IF12 and 4.2.1 before 4.2.1.3 IF9 allows remote authenticated users to inject… Ibm
- CVE-2014-2631 MEDIUM · 4.6 Unspecified vulnerability in HP Application Lifecycle Management (aka Quality Center) 11.5x and 12.0x allows local users to gain privileges via unknown vectors, aka ZDI-CAN-2138. Hp
- CVE-2014-2628 MEDIUM · 4.0 Niet-gespecificeerde kwetsbaarheid in HP Enterprise Maps 1 stelt externe geverifieerde gebruikers in staat om gevoelige informatie te verkrijgen via onbekende vectoren. Hp
- CVE-2013-5433 MEDIUM · 4.0 The Data Growth Solution for JD Edwards EnterpriseOne in IBM InfoSphere Optim 3.0 through 9.1 has hardcoded database credentials, which allows remote authenticated users to… Ibm
- CVE-2014-3330 MEDIUM · 5.0 Cisco NX-OS 6.1(2)I2(1) on Nexus 9000 switches does not properly process packet-drop policy checks for logged packets, which allows remote attackers to bypass intended access… Cisco
- CVE-2014-3327 HIGH · 7.8 The EnergyWise module in Cisco IOS 12.2, 15.0, 15.1, 15.2, and 15.4 and IOS XE 3.2.xXO, 3.3.xSG, 3.4.xSG, and 3.5.xE before 3.5.3E allows remote attackers… Cisco
- CVE-2014-3076 MEDIUM · 5.0 IBM Business Process Manager (BPM) 8.5 through 8.5.5 allows remote attackers to obtain potentially sensitive information by visiting an unspecified JSP diagnostic page. Ibm
- CVE-2014-2357 HIGH · 8.3 The GPT library in the Telegyr 8979 Master Protocol application in SUBNET SubSTATION Server 2 before SSNET 2.12 HF18808 allows remote attackers to cause a… Subnet
- CVE-2014-3336 MEDIUM · 6.5 SQL injection vulnerability in the web framework in Cisco Unity Connection 9.1(2) and earlier allows remote authenticated users to execute arbitrary SQL commands via a… Cisco
- CVE-2014-3333 HIGH · 9.0 De server in Cisco Unity Connection 9.1(1) en 9.1(2) stelt op afstand geverifieerde gebruikers in staat om bevoorrechte toegang te verkrijgen door een "HTTP Intercept"… Cisco
- CVE-2014-3332 MEDIUM · 4.0 Cisco Unified Communications Manager (CM) 8.6(.2) and earlier has an incorrect CLI restrictions setting, which allows remote authenticated users to establish undetected concurrent logins via… Cisco
- CVE-2014-5195 HIGH · 7.2 Unity before 7.2.3 and 7.3.x before 7.3.1, as used in Ubuntu, does not properly take focus of the keyboard when switching to the lock screen,… Ayatana Project Canonical
- CVE-2014-5194 MEDIUM · 6.5 Static code injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote authenticated users to inject arbitrary PHP code into settings/conf.php via the _word_upper_bound parameter. Sphider
- CVE-2014-5193 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the category parameter. NOTE: the… Sphider
- CVE-2014-5192 HIGH · 7.5 SQL injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to execute arbitrary SQL commands via the filter parameter. Sphider
- CVE-2014-5191 MEDIUM · 4.3 Cross-site scripting (XSS) -kwetsbaarheid in de Preview-plug-in vóór 4.4.3 in CKEditor stelt externe aanvallers in staat om willekeurig webscript of HTML te injecteren via niet-gespecificeerde… Ckeditor
- CVE-2014-5190 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in captcha-secureimage/test/index.php in the SI CAPTCHA Anti-Spam plugin 2.7.4 for WordPress allows remote attackers to inject arbitrary web script or HTML… Si Captcha Anti-spam Project
- CVE-2014-5189 HIGH · 7.5 SQL injection vulnerability in lib/optin/optin_page.php in the Lead Octopus plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter. Leadoctopus
- CVE-2014-5188 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in doemailpassword.tml in Lyris ListManager (LM) 8.95a allows remote attackers to inject arbitrary web script or HTML via the EmailAddr parameter. Lyris
- CVE-2014-4647 MEDIUM · 6.8 Op stapels gebaseerde bufferoverloop in de loadExtensionFactory-methode in het TSVisualization ActiveX-besturingselement in Embarcadero ER/Studio Data Architect stelt externe aanvallers in staat om willekeurige code uit… Embarcadero
- CVE-2014-3914 HIGH · 10.0 Directory traversal vulnerability in the Admin Center for Tivoli Storage Manager (TSM) in Rocket ServerGraph 1.2 allows remote attackers to (1) create arbitrary files via… Rocketsoftware
- CVE-2014-3855 MEDIUM · 5.0 Directory traversal vulnerability in download.py in Pyplate 0.08 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter. Pyplate
- CVE-2014-3854 MEDIUM · 6.8 Cross-site request forgery (CSRF) -kwetsbaarheid in admin/addScript.py in Pyplate 0.08 stelt externe aanvallers in staat om de authenticatie van beheerders te kapen voor verzoeken die… Pyplate
- CVE-2014-3853 MEDIUM · 5.0 Pyplate 0.08 does not set the secure flag for the id cookie in an https session, which makes it easier for remote attackers to capture… Pyplate
- CVE-2014-3852 MEDIUM · 5.0 Pyplate 0.08 bevat niet de HTTPOnly-vlag in een Set-Cookie-header voor de id-cookie, waardoor het voor externe aanvallers gemakkelijker wordt om potentieel gevoelige informatie te verkrijgen… Pyplate
- CVE-2014-3851 LOW · 2.1 usr/lib/cgi-bin/create_passwd_file.py in Pyplate 0.08 uses world-readable permissions for passwd.db, which allows local users to obtain the administrator password by reading this file. Pyplate
- CVE-2014-3800 LOW · 2.1 XBMC 13.0 gebruikt wereldwijd leesbare machtigingen voor .xbmc/userdata/sources.xml, waarmee lokale gebruikers gebruikers gebruikersnamen en wachtwoorden kunnen verkrijgen door dit bestand te lezen. Xbmc