CVE-database
129.141 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2014-0246 MEDIUM · 4.3 SOSreport stores the md5 hash of the GRUB bootloader password in an archive, which allows local users to obtain sensitive information by reading the archive. Sosreport Project
- CVE-2014-0201 LOW · 2.1 ovirt-engine-reports, as used in the Red Hat Enterprise Virtualization reports package (rhevm-reports) before 3.3.3, uses world-readable permissions on configuration files, which allows local users to… Redhat
- CVE-2014-0200 LOW · 2.1 The Red Hat Enterprise Virtualization Manager reports (rhevm-reports) package before 3.3.3-1 uses world-readable permissions on the datasource configuration file (js-jboss7-ds.xml), which allows local users to… Redhat
- CVE-2014-0199 LOW · 2.1 Het setup-script in ovirt-engine-reports, zoals gebruikt in het Red Hat Enterprise Virtualization-rapporten (rhevm-reports) -pakket vóór 3.3.3, slaat het databasewachtwoord van de rapporten op in leesbare… Redhat
- CVE-2013-4178 MEDIUM · 5.0 The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to obtain access by replaying the username, password,… Google Authenticator Login Project Drupal
- CVE-2013-4177 MEDIUM · 5.0 The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal does not properly identify user account names, which might allow remote… Google Authenticator Login Project Drupal
- CVE-2013-2193 MEDIUM · 4.3 Apache HBase 0.92.x before 0.92.3 and 0.94.x before 0.94.9, when the Kerberos features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive… Apache
- CVE-2013-0199 MEDIUM · 5.0 The default LDAP ACIs in FreeIPA 3.0 before 3.1.2 do not restrict access to the (1) ipaNTTrustAuthIncoming and (2) ipaNTTrustAuthOutgoing attributes, which allow remote attackers… Redhat
- CVE-2012-4915 MEDIUM · 5.0 Directory traversal-kwetsbaarheid in de Google Doc Embedder-plug-in vóór 2.5.4 voor WordPress stelt externe aanvallers in staat om willekeurige bestanden te lezen via een .. (dot… Davistribe Wordpress
- CVE-2014-0239 MEDIUM · 5.0 De interne DNS-server in Samba 4.x vóór 4.0.18 controleert het QR-veld in de koptekstsectie van een inkomend DNS-bericht niet voordat een antwoord wordt verzonden, waardoor… Samba
- CVE-2014-0178 LOW · 3.5 Samba 3.6.6 through 3.6.23, 4.0.x before 4.0.18, and 4.1.x before 4.1.8, when a certain vfs shadow copy configuration is enabled, does not properly initialize the… Samba
- CVE-2014-0240 MEDIUM · 6.2 The mod_wsgi module before 3.5 for Apache, when daemon mode is enabled, does not properly handle error codes returned by setuid when run on certain… Modwsgi
- CVE-2014-0177 LOW · 3.6 The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary patch file. Github
- CVE-2013-5036 HIGH · 7.5 The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the (1) namespace parameter to the deobfuscation function or (2)… Squash
- CVE-2013-4598 MEDIUM · 5.0 The Groups, Communities and Co (GCC) module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permission, which allows remote attackers to access the configuration… Groups Communities And Co Project
- CVE-2013-3477 MEDIUM · 6.8 Cross-site request forgery (CSRF) -kwetsbaarheid in de Related Posts by Zemanta-plug-in vóór 1.3.2 voor WordPress stelt externe aanvallers in staat om de authenticatie van niet-gespecificeerde… Zemanta
- CVE-2013-2698 MEDIUM · 6.8 Cross-site request forgery (CSRF) vulnerability in the Calendar plugin before 1.3.3 for WordPress allows remote attackers to hijack the authentication of users for requests that… Kieranoshea
- CVE-2013-2225 MEDIUM · 6.4 inc/ticket.class.php in GLPI 0.83.9 and earlier allows remote attackers to unserialize arbitrary PHP objects via the _predefined_fields parameter to front/ticket.form.php. Glpi-project
- CVE-2013-2125 MEDIUM · 5.0 OpenSMTPD before 5.3.2 does not properly handle SSL sessions, which allows remote attackers to cause a denial of service (connection blocking) by keeping a connection… Openbsd
- CVE-2013-2124 MEDIUM · 4.3 Double free vulnerability in inspect-fs.c in LibguestFS 1.20.x before 1.20.7, 1.21.x, 1.22.0, and 1.23.0 allows remote attackers to cause a denial of service (crash) via… Libguestfs
- CVE-2013-2111 MEDIUM · 5.0 The IMAP functionality in Dovecot before 2.2.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via invalid APPEND parameters. Dovecot
- CVE-2013-2090 HIGH · 9.3 The set_meta_data function in lib/cremefraiche.rb in the Creme Fraiche gem before 0.6.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in… Uplawski
- CVE-2013-1883 MEDIUM · 5.0 Mantis Bug Tracker (aka MantisBT) 1.2.12 before 1.2.15 allows remote attackers to cause a denial of service (resource consumption) via a filter using a criteria,… Mantisbt
- CVE-2013-0724 HIGH · 7.5 PHP remote file inclusion vulnerability in includes/generate-pdf.php in the WP ecommerce Shop Styling plugin for WordPress before 1.8 allows remote attackers to execute arbitrary PHP… Wpshopstyling
- CVE-2012-6452 MEDIUM · 5.0 Axway Secure Messenger vóór 6.5 Update Release 7, zoals gebruikt in Axway Email Firewall, biedt verschillende antwoorden op authenticatieverzoeken, afhankelijk van of de gebruiker bestaat,… Axway
- CVE-2012-5662 MEDIUM · 5.8 x3270 before 3.3.12ga12 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the… Paul Mattes
- CVE-2014-3872 HIGH · 7.5 Multiple SQL injection vulnerabilities in the administration login page in D-Link DAP-1350 (Rev. A1) with firmware 1.14 and earlier allow remote attackers to execute arbitrary… Dlink
- CVE-2014-3871 HIGH · 7.5 Multiple SQL injection vulnerabilities in register.php in Geodesic Solutions GeoCore MAX 7.3.3 (formerly GeoClassifieds and GeoAuctions) allow remote attackers to execute arbitrary SQL commands via… Geodesicsolutions
- CVE-2014-3870 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in the bib2html plugin 0.9.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the styleShortName parameter… Bib2html Project
- CVE-2014-3840 LOW · 3.5 Multiple cross-site scripting (XSS) vulnerabilities in apps/common/templates/calculate_form_title.html in Mayan EDMS 0.13 allow remote authenticated users to inject arbitrary web script or HTML via a (1)… Mayan-edms
- CVE-2014-2720 MEDIUM · 6.8 IZArc 4.1.8 displays a file's name on the basis of a ZIP archive's Central Directory entry, but launches this file on the basis of a… Izarc
- CVE-2014-0218 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in the URL downloader repository in repository/url/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3… Moodle
- CVE-2014-0217 MEDIUM · 4.3 enrol/index.php in Moodle 2.6.x before 2.6.3 does not check for the moodle/course:viewhiddencourses capability before listing hidden courses, which allows remote attackers to obtain sensitive name… Moodle
- CVE-2014-0216 MEDIUM · 5.0 De My Home-implementatie in de block_html_pluginfile-functie in blocks/html/lib.php in Moodle via 2.3.11, 2.4.x vóór 2.4.10, 2.5.x vóór 2.5.6 en 2.6.x vóór 2.6.3 beperkt de toegang… Moodle
- CVE-2014-0215 MEDIUM · 4.0 The blind-marking implementation in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows remote authenticated users to de-anonymize student identities… Moodle
- CVE-2014-0214 MEDIUM · 6.8 login/token.php in Moodle via 2.3.11, 2.4.x vóór 2.4.10, 2.5.x vóór 2.5.6 en 2.6.x vóór 2.6.3 creëert een MoodleMobile web-service token met een oneindige levensduur, waardoor… Moodle
- CVE-2014-0213 MEDIUM · 6.8 Meerdere cross-site request forgery (CSRF) -kwetsbaarheden in mod/assign/locallib.php in het Assignment-subsysteem in Moodle via 2.3.11, 2.4.x vóór 2.4.10, 2.5.x vóór 2.5.6 en 2.6.x vóór 2.6.3… Moodle
- CVE-2012-6647 MEDIUM · 4.9 De functie futex_wait_requeue_pi in kernel/futex.c in de Linux-kernel vóór 3.5.1 zorgt er niet voor dat oproepen twee verschillende futex-adressen hebben, waardoor lokale gebruikers een denial… Linux
- CVE-2014-3866 MEDIUM · 6.8 Multiple cross-site request forgery (CSRF) vulnerabilities in user_settings.php in Usercake 2.0.2 and earlier allow remote attackers to hijack the authentication of administrators for requests that… Usercake
- CVE-2014-0878 MEDIUM · 5.8 De IBMSecureRandom-component in de IBMJCE- en IBMSecureRandom-cryptografische providers in IBM SDK Java Technology Edition 5.0 vóór Service Refresh 16 FP6, 6 vóór Service Refresh 16,… Ibm
- CVE-2013-6714 MEDIUM · 4.1 De FlashCopy Manager voor VMware-component in IBM Tivoli Storage FlashCopy Manager 3.1 tot en met 4.1.0.1 controleert de autorisatie voor back-up- en herstelbewerkingen niet goed,… Ibm
- CVE-2013-6713 MEDIUM · 4.1 De Data Protection for VMware-component in IBM Tivoli Storage Manager for Virtual Environments (TSMVE) 6.3 t/m 7.1.0.2 controleert de autorisatie voor back-up- en herstelbewerkingen niet… Ibm
- CVE-2014-0893 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in customreport.jsp in IBM Maximo Asset Management 7.5.x before 7.5.0.5 IFIX006 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before… Ibm
- CVE-2014-0849 MEDIUM · 6.0 IBM Maximo Asset Management 7.x before 7.5.0.3 IFIX027 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2 allow remote authenticated users to gain… Ibm
- CVE-2014-0825 LOW · 3.5 Cross-site scripting (XSS) vulnerability in openreport.jsp in IBM Maximo Asset Management 7.x before 7.1.1.12 IFIX.20140321-1336 and 7.5.x before 7.5.0.5 IFIX006; SmartCloud Control Desk 7.x before… Ibm
- CVE-2014-0824 LOW · 3.5 Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.x before 7.1.1.8 LAFIX.20140319-0839 and 7.1.1.12 before IFIX.20140321-1336 and Tivoli IT Asset Management for IT, Tivoli… Ibm
- CVE-2013-6741 LOW · 3.5 IBM Maximo Asset Management 7.x before 7.1.1.7 LAFIX.20140319-0837 and 7.5.x before 7.5.0.5 IFIX006; SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2; and Tivoli… Ibm
- CVE-2013-5465 MEDIUM · 6.5 IBM Maximo Asset Management 7.x before 7.1.1.7 LAFIX.20140319-0837, 7.1.1.11 before IFIX.20140323-0749, 7.1.1.12 before IFIX.20140321-1336, 7.5.x before 7.5.0.3 IFIX027, and 7.5.0.4 before IFIX011; SmartCloud Control Desk… Ibm
- CVE-2013-5464 MEDIUM · 6.0 IBM Maximo Asset Management 7.5.x vóór 7.5.0.3 IFIX027, 7.5.0.4 vóór IFIX011 en 7.5.0.5 vóór IFIX006 en SmartCloud Control Desk 7.x vóór 7.5.0.3 en 7.5.1.x vóór… Ibm
- CVE-2013-5460 LOW · 3.5 IBM Maximo Asset Management 7.x before 7.5.0.6 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2 allow remote authenticated users to bypass intended… Ibm