CVE-database
126.123 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2014-0116 MEDIUM · 5.8 CookieInterceptor in Apache Struts 2.x vóór 2.3.20, wanneer een wildcard-cookiesName-waarde wordt gebruikt, beperkt de toegang tot de getClass-methode niet correct, waardoor externe aanvallers de ClassLoader… Apache
- CVE-2013-5016 HIGH · 7.6 Symantec Critical System Protection (SCSP) before 5.2.9, when installed on an unpatched Windows Server 2003 R2 platform, allows remote attackers to bypass policy settings via… Broadcom Microsoft
- CVE-2014-3124 MEDIUM · 6.7 The HVMOP_set_mem_type control in Xen 4.1 through 4.4.x allows local guest HVM administrators to cause a denial of service (hypervisor crash) or possibly execute arbitrary… Xen
- CVE-2014-2913 HIGH · 7.5 Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character… Nagios Opensuse
- CVE-2014-2891 MEDIUM · 5.0 strongSwan voor 5.1.2 stelt externe aanvallers in staat om een denial of service (NULL pointer dereference en IKE daemon crash) te veroorzaken via een vervaardigde… Debian Strongswan
- CVE-2014-2191 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in the web framework in Cisco Broadcast Access Center for Telco and Wireless (aka BAC-TW) allows remote attackers to inject arbitrary… Cisco
- CVE-2014-2190 MEDIUM · 6.8 Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Broadcast Access Center for Telco and Wireless (aka BAC-TW) allows remote attackers to hijack… Cisco
- CVE-2014-2181 MEDIUM · 6.8 Cisco Adaptive Security Appliance (ASA) Software allows remote authenticated users to read files by sending a crafted URL to the HTTP server, as demonstrated by… Cisco
- CVE-2014-0911 MEDIUM · 4.3 inetd in IBM WebSphere MQ 7.1.x vóór 7.1.0.5 en 7.5.x vóór 7.5.0.4 kunnen externe aanvallers een denial of service (schijf- of CPU-verbruik) veroorzaken via niet-gespecificeerde… Ibm
- CVE-2014-0685 MEDIUM · 5.0 Cisco Nexus 1000V InterCloud 5.2(1)IC1(1.2) and earlier for VMware allows remote attackers to bypass ACL deny statements via crafted (1) IGMPv2 or (2) IGMPv3 packets,… Cisco
- CVE-2014-0684 MEDIUM · 4.6 Cisco NX-OS 6.2(2) op Nexus 7000-switches stelt lokale gebruikers in staat om een denial of service te veroorzaken via vervaardigde sed-invoer, ook bekend als Bug… Cisco
- CVE-2013-7336 LOW · 1.9 The qemuMigrationWaitForSpice function in qemu/qemu_migration.c in libvirt before 1.1.3 does not properly enter a monitor when performing seamless SPICE migration, which allows local users to… Redhat Opensuse
- CVE-2013-6726 LOW · 3.5 Meerdere cross-site scripting (XSS) kwetsbaarheden in WebProcess.srv in IBM TRIRIGA Application Platform 3.2.x en 3.3.x vóór 3.3.1.2 stellen op afstand geverifieerde gebruikers in staat om… Ibm
- CVE-2014-3204 MEDIUM · 4.4 Unity before 7.2.1, as used in Ubuntu 14.04, does not properly handle keyboard shortcuts, which allows physically proximate attackers to bypass the lock screen and… Ayatana Project Canonical
- CVE-2014-3203 MEDIUM · 4.4 Unity before 7.2.1, as used in Ubuntu 14.04, does not properly restrict access to the Dash when the lock screen is active, which allows physically… Ayatana Project Canonical
- CVE-2014-3202 MEDIUM · 4.4 Unity before 7.2.1 handelt de activering van toegang niet goed af, waardoor fysiek nabije aanvallers het vergrendelingsscherm kunnen omzeilen door de ENTER-TOETS ingedrukt te houden,… Ayatana Project
- CVE-2014-2558 MEDIUM · 6.5 The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a '… Skyphe
- CVE-2014-0193 MEDIUM · 5.0 WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a… Netty
- CVE-2013-7354 MEDIUM · 6.5 Multiple integer overflows in libpng before 1.5.14rc03 allow remote attackers to cause a denial of service (crash) via a crafted image to the (1) png_set_sPLT… Libpng
- CVE-2013-7353 MEDIUM · 6.5 Integer overflow in the png_set_unknown_chunks function in libpng/pngset.c in libpng before 1.5.14beta08 allows context-dependent attackers to cause a denial of service (segmentation fault and crash)… Libpng
- CVE-2014-2347 HIGH · 7.0 Amtelco miSecureMessages (aka MSM) 6.2 does not properly manage sessions, which allows remote authenticated users to obtain sensitive information via a modified message request. Amtelco
- CVE-2014-1736 HIGH · 7.5 Integer overflow in api.cc in Google V8, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, allows… Google Apple Microsoft Linux
- CVE-2014-0198 MEDIUM · 4.3 The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls,… Openssl Mariadb Fedoraproject Debian
- CVE-2014-0185 HIGH · 7.2 sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local… Php
- CVE-2014-3220 HIGH · 9.0 Met F5 BIG-IQ Cloud en Security 4.0.0 tot en met 4.1.0 kunnen op afstand geverifieerde gebruikers het wachtwoord van willekeurige gebruikers wijzigen via de naamparameter… F5
- CVE-2014-0164 LOW · 2.1 openshift-origin-broker-util, as used in Red Hat OpenShift Enterprise 1.2.7 and 2.0.5, uses world-readable permissions for the mcollective client.cfg configuration file, which allows local users to… Redhat
- CVE-2014-0149 MEDIUM · 4.3 Multiple cross-site scripting (XSS) vulnerabilities in Red Hat JBoss Web Framework Kit 2.5.0 allow remote attackers to inject arbitrary web script or HTML via a… Redhat
- CVE-2013-7375 HIGH · 7.5 SQL-injectiekwetsbaarheid in includes/classes/Authenticate.class.php in PHP-Fusion 7.02.01 tot en met 7.02.05 stelt externe aanvallers in staat om willekeurige SQL-opdrachten uit te voeren via de gebruikers-ID in… Php-fusion
- CVE-2013-7034 HIGH · 7.5 Met de setCookieValue-functie in _lib/functions.global.inc.php in LiveZilla vóór 5.1.2.1 kunnen externe aanvallers willekeurige PHP-code uitvoeren via een geserialiseerd PHP-object in een cookie. Livezilla
- CVE-2013-7003 MEDIUM · 4.3 Meerdere cross-site scripting (XSS) kwetsbaarheden in LiveZilla vóór 5.1.2.0 stellen externe aanvallers in staat om willekeurig webscript of HTML te injecteren via het (1) volledige… Livezilla
- CVE-2013-6444 MEDIUM · 5.8 PyWBEM 0.7 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of… Pywbem Project
- CVE-2013-6418 MEDIUM · 5.8 PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate. Pywbem Project
- CVE-2013-4215 MEDIUM · 4.4 Met de OPDRACHT IPXPING_in contrib/check_ipxping.c in Nagios Plugins 1.4.16 kunnen lokale gebruikers privileges krijgen via een symlink-aanval op /tmp/ipxping/ipxping. Nagios
- CVE-2013-3736 MEDIUM · 4.3 Cross-site scripting (XSS) kwetsbaarheid in de MobileUI (ook bekend als RT-Extension-MobileUI) extensie vóór 1.04 in Request Tracker (RT) 4.0.0 vóór 4.0.13 stelt aanvallers op afstand… Bestpractical
- CVE-2013-1803 HIGH · 7.5 Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php; or remote… Php-fusion
- CVE-2013-0350 MEDIUM · 6.3 tmp_smtp.c in pktstat 1.8.5 allows local users to overwrite arbitrary files via a symlink attack on /tmp/smtp.log. David Leonard
- CVE-2010-5109 MEDIUM · 4.3 Off-by-one error in the DecompressRTF function in ytnef.c in Yerase's TNEF Stream Reader allows remote attackers to cause a denial of service (crash) via a… Randall Hand Fedoraproject
- CVE-2014-2916 MEDIUM · 6.8 Cross-site request forgery (CSRF) vulnerability in the subscription page editor (spageedit) in phpList before 3.0.6 allows remote attackers to hijack the authentication of administrators via… Phplist
- CVE-2014-0469 MEDIUM · 6.8 Op stapels gebaseerde bufferoverloop in een bepaalde Debian-patch voor xbuffy vóór 3.3.bl.3.dfsg-9 stelt externe aanvallers in staat om willekeurige code uit te voeren via het… Debian
- CVE-2014-3125 MEDIUM · 6.2 Xen 4.4.x, wanneer het op een ARM-SYSTEEM wordt uitgevoerd, schakelt het CNTKCTL_EL1-register niet naar de juiste context, waardoor lokale gastgebruikers de hardwaretimers kunnen wijzigen en… Xen
- CVE-2014-3006 MEDIUM · 6.8 Sitepark Information Enterprise Server (IES) 2.9 before 2.9.6, when upgraded from an earlier version, does not properly restrict access, which allows remote attackers to change… Sitepark
- CVE-2014-3001 MEDIUM · 5.8 The device file system (aka devfs) in FreeBSD 10.0 before p2 does not load default rulesets when booting, which allows context-dependent attackers to bypass intended… Freebsd
- CVE-2014-3000 HIGH · 7.8 The TCP reassembly function in the inet module in FreeBSD 8.3 before p16, 8.4 before p9, 9.1 before p12, 9.2 before p5, and 10.0 before… Freebsd
- CVE-2014-2905 MEDIUM · 6.9 fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credentials, which allows local users to gain privileges via the universal variable socket, related… Fishshell
- CVE-2014-2322 HIGH · 7.5 lib/string_utf_support.rb in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) downloaded_file or (2)… Dynamixsolutions
- CVE-2014-1899 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in Citrix NetScaler Gateway (formerly Citrix Access Gateway Enterprise Edition) 9.x before 9.3.66.5 and 10.x before 10.1.123.9 allows remote attackers to… Citrix
- CVE-2014-0189 LOW · 2.1 virt-who uses world-readable permissions for /etc/sysconfig/virt-who, which allows local users to obtain password for hypervisors by reading the file. Redhat Virt-who Project
- CVE-2013-7061 MEDIUM · 5.5 Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API. Plone
- CVE-2013-7060 MEDIUM · 5.0 Met Products/CMFPlone/FactoryTool.py in Plone 3.3 t/m 4.3.2 kunnen externe aanvallers het installatiepad verkrijgen via vectoren met betrekking tot een bestandsobject voor niet-gespecificeerde documentatie die is… Plone
- CVE-2014-3139 HIGH · 7.5 recoveryconsole/bpl/snmpd.php in Unitrends Enterprise Backup 7.3.0 allows remote attackers to bypass authentication by setting the auth parameter to a certain string. Unitrends