CVE-database
126.123 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2013-2566 MEDIUM · 5.9 The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct… Oracle Fujitsu Canonical Mozilla
- CVE-2013-0248 MEDIUM · 6.8 De standaardconfiguratie van javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 tot en met 1.2.2 gebruikt de map/tmp voor geüploade bestanden, waarmee lokale gebruikers willekeurige bestanden kunnen… Apache
- CVE-2013-0266 MEDIUM · 5.5 A flaw was found in the `puppetlabs-cinder` module, as used in PackStack. This vulnerability is due to incorrect file permissions, specifically world-readable permissions, on the… Openstack
- CVE-2013-0261 HIGH · 8.8 A flaw was found in PackStack. A local user could exploit a symlink attack on a temporary file with a predictable name in the `/tmp`… Openstack
- CVE-2010-5107 HIGH · 7.5 De standaardconfiguratie van OpenSSH tot 6.1 dwingt een vaste tijdslimiet af tussen het tot stand brengen van een TCP-verbinding en het voltooien van een login,… Openbsd
- CVE-2012-6442 HIGH · 7.5 When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP… Rockwellautomation
- CVE-2012-6440 MEDIUM · 4.8 The Web server password authentication mechanism used by the products is vulnerable to a MitM and Replay attack. Successful exploitation of this vulnerability will allow… Rockwellautomation
- CVE-2012-6438 HIGH · 7.5 The device does not properly validate the data being sent to the buffer. An attacker can send a malformed CIP packet to Port 2222/TCP, Port… Rockwellautomation
- CVE-2012-6437 CRITICAL · 9.8 The device does not properly authenticate users and the potential exists for a remote user to upload a new firmware image to the Ethernet card,… Rockwellautomation
- CVE-2012-6436 HIGH · 7.5 The device does not properly validate the data being sent to the buffer. An attacker can send a malformed CIP packet to Port 2222/TCP, Port… Rockwellautomation
- CVE-2012-6435 HIGH · 7.5 When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP… Rockwellautomation
- CVE-2012-4550 MEDIUM · 5.3 A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans (EJB) access, the system does not correctly… Redhat
- CVE-2012-4549 MEDIUM · 6.5 Er is een fout gevonden in JBoss Enterprise Application Platform. De `processInvocation` -functie binnen de `org.jboss.as.ejb3.security.AuthorizationInterceptor` -component autoriseert ten onrechte alle verzoeken wanneer er geen… Redhat
- CVE-2012-5605 LOW · 3.3 Er is een fout gevonden in Grinder, een onderdeel van Red Hat CloudForms. Met dit beveiligingslek kan een lokale gebruiker de cachebestanden van Grinder wijzigen… Redhat
- CVE-2012-4574 MEDIUM · 5.5 A flaw was found in Pulp, as used in Red Hat CloudForms. This vulnerability allows a local user to read the administrative password due to… Redhat
- CVE-2012-5625 MEDIUM · 6.5 OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, does not properly clear physical volume (PV) content when reallocating… Openstack
- CVE-2012-4534 LOW · 2.6 org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO connector is used in conjunction with sendfile and HTTPS, allows remote… Apache
- CVE-2012-4431 MEDIUM · 4.3 org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a… Apache
- CVE-2012-5571 MEDIUM · 5.4 A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not… Openstack
- CVE-2012-5568 MEDIUM · 5.0 Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris. Apache Opensuse
- CVE-2012-5887 MEDIUM · 5.0 The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale… Apache
- CVE-2012-5886 MEDIUM · 5.0 De HTTP Digest Access Authentication-implementatie in Apache Tomcat 5.5.x vóór 5.5.36, 6.x vóór 6.0.36 en 7.x vóór 7.0.30 slaat informatie op over de geverifieerde gebruiker… Apache
- CVE-2012-5885 MEDIUM · 5.0 The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce… Apache
- CVE-2012-5825 HIGH · 7.4 Tweepy does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate,… Tweepy
- CVE-2012-1624 LOW · 3.5 Multiple cross-site scripting (XSS) vulnerabilities in the Lingotek module 6.x-1.x before 6.x-1.40 for Drupal allow remote authenticated users to inject arbitrary web script or HTML… Lingotek Drupal
- CVE-2012-2524 HIGH · 9.3 Microsoft Office 2007 SP2 and SP3 and 2010 SP1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via… Microsoft
- CVE-2011-4045 MEDIUM · 4.3 Bufferoverloop in een niet-gespecificeerd ActiveX-besturingselement in aipgctl.ocx in ARC Informatique PcVue 6.0 tot en met 10.0, FrontVue en PlantVue stelt externe aanvallers in staat om… Arcinfo
- CVE-2011-4044 MEDIUM · 5.8 Een niet-gespecificeerde ActiveX-besturing in SVUIGrd.ocx in ARC Informatique PcVue 6.0 tot en met 10.0, FrontVue en PlantVue stelt externe aanvallers in staat bestanden te wijzigen… Arcinfo
- CVE-2011-4043 HIGH · 9.3 Integer overflow in een niet-gespecificeerd ActiveX-besturingselement in SVUIGrd.ocx in ARC Informatique PcVue 6.0 tot en met 10.0, FrontVue en PlantVue stelt externe aanvallers in staat… Arcinfo
- CVE-2011-4042 HIGH · 9.3 An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to execute arbitrary code by using… Arcinfo
- CVE-2011-4899 HIGH · 7.5 wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers… Wordpress
- CVE-2012-0814 LOW · 3.5 The auth_parse_options function in auth-options.c in sshd in OpenSSH before 5.7 provides debug messages containing authorized_keys command options, which allows remote authenticated users to obtain… Openbsd
- CVE-2011-4346 MEDIUM · 4.6 Cross-site scripting (XSS) vulnerability in the web interface in Red Hat Network (RHN) Satellite allows remote authenticated users to inject arbitrary web script or HTML… Redhat
- CVE-2011-3389 MEDIUM · 4.3 The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data… Google Microsoft Mozilla Opera
- CVE-2009-4139 MEDIUM · 6.8 A flaw was found in Spacewalk Java site packages. This cross-site request forgery (CSRF) vulnerability allows a remote attacker to hijack the authentication of arbitrary… Redhat
- CVE-2011-0539 HIGH · 7.5 De functie key_certify in usr.bin/ssh/key.c in OpenSSH 5.6 en 5.7 initialiseert het nonce-veld niet wanneer legacy-certificaten worden gegenereerd met de opdrachtregeloptie -t in ssh-keygen. Dit… Openbsd
- CVE-2010-4634 MEDIUM · 5.0 Directory traversal vulnerability in osTicket 1.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to module.php, a… Enhancesoft
- CVE-2010-4478 CRITICAL · 9.8 OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass… Openbsd
- CVE-2010-3190 HIGH · 7.8 Untrusted search path vulnerability in the Microsoft Foundation Class (MFC) Library in Microsoft Visual Studio .NET 2003 SP1; Visual Studio 2005 SP1, 2008 SP1, and… Apple Microsoft
- CVE-2010-2965 CRITICAL · 9.8 De WDB-doelagent debug-service in Wind River VxWorks 6.x, 5.x en eerder, zoals gebruikt op de Rockwell Automation 1756-ENBT-serie A met firmware 3.2.6 en 3.6.1 en… Rockwellautomation Windriver
- CVE-2010-0606 LOW · 3.5 Cross-site scripting (XSS) kwetsbaarheid in scp/ajax.php in osTicket voor 1.6.0 Stabiel stelt op afstand geverifieerde gebruikers in staat om willekeurig webscript of HTML te injecteren… Enhancesoft Osticket
- CVE-2010-0605 HIGH · 7.5 SQL injection vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users, with "Staff" permissions, to execute arbitrary SQL commands via the input… Enhancesoft Osticket
- CVE-2010-0386 HIGH · 8.1 The default configuration of Sun Java System Application Server 7 and 7 2004Q2 enables the HTTP TRACE method, which makes it easier for remote attackers… Sun
- CVE-2009-3555 CRITICAL · 9.8 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP… Apache Gnu Mozilla Openssl
- CVE-2009-3720 MEDIUM · 5.0 The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a… Libexpat Project Python Apache
- CVE-2009-2495 MEDIUM · 6.5 The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005… Microsoft
- CVE-2009-2493 HIGH · 8.8 The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005… Microsoft
- CVE-2009-0901 HIGH · 8.8 The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 and… Microsoft
- CVE-2009-2361 HIGH · 7.5 SQL injection vulnerability in include/class.staff.php in osTicket before 1.6 RC5 allows remote attackers to execute arbitrary SQL commands via the staff username parameter. Enhancesoft
- CVE-2003-1567 HIGH · 7.5 The undocumented TRACK method in Microsoft Internet Information Services (IIS) 5.0 returns the content of the original request in the body of the response, which… Microsoft