CVE-database
128.783 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2014-2140 MEDIUM · 5.0 Cisco ONS 15454 controller cards with software 9.6 and earlier allow remote attackers to cause a denial of service (card reset) via a TCP FIN… Cisco
- CVE-2014-2139 MEDIUM · 5.0 Cisco ONS 15454 controller cards with software 9.6 and earlier allow remote attackers to cause a denial of service (flash write outage) via a TCP… Cisco
- CVE-2014-0787 HIGH · 10.0 Stack-based buffer overflow in WellinTech KingSCADA before 3.1.2.13 allows remote attackers to execute arbitrary code via a crafted packet. Wellintech
- CVE-2014-0773 HIGH · 7.5 The BWOCXRUN.BwocxrunCtrl.1 control contains a method named “CreateProcess.” This method contains validation to ensure an attacker cannot run arbitrary command lines. After validation, the values… Advantech
- CVE-2014-0772 MEDIUM · 5.0 The BWOCXRUN.BwocxrunCtrl.1 control contains a method named OpenUrlToBufferTimeout. This method takes a URL as a parameter and returns its contents to the caller in JavaScript.… Advantech
- CVE-2014-0771 HIGH · 7.5 The BWOCXRUN.BwocxrunCtrl.1 control contains a method named “OpenUrlToBuffer.” This method takes a URL as a parameter and returns its contents to the caller in JavaScript.… Advantech
- CVE-2014-0770 HIGH · 7.5 By providing an overly long string to the UserName parameter, an attacker may be able to overflow the static stack buffer. The attacker may then… Advantech
- CVE-2014-0768 HIGH · 7.5 An attacker may pass an overly long value from the AccessCode2 argument to the control to overflow the static stack buffer. The attacker may then… Advantech
- CVE-2014-0767 HIGH · 7.5 An attacker may exploit this vulnerability by passing an overly long value from the AccessCode argument to the control. This will overflow the static stack… Advantech
- CVE-2014-0766 HIGH · 7.5 An attacker can exploit this vulnerability by copying an overly long NodeName2 argument into a statically sized buffer on the stack to overflow the static… Advantech
- CVE-2014-0765 HIGH · 7.5 To exploit this vulnerability, the attacker sends data from the GotoCmd argument to control. If the value of the argument is overly long, the static… Advantech
- CVE-2014-0764 HIGH · 7.5 By providing an overly long string to the NodeName parameter, an attacker may be able to overflow the static stack buffer. The attacker may then… Advantech
- CVE-2014-0763 HIGH · 7.5 An attacker using SQL injection may use arguments to construct queries without proper sanitization. The DBVisitor.dll is exposed through SOAP interfaces, and the exposed functions… Advantech
- CVE-2014-0349 HIGH · 10.0 Meerdere niet-gespecificeerde kwetsbaarheden in J2k-Codec stellen externe aanvallers in staat om willekeurige code uit te voeren via een vervaardigd JPEG 2000-bestand. J2k-codec
- CVE-2014-0347 LOW · 3.5 The Settings module in Websense Triton Unified Security Center 7.7.3 before Hotfix 31, Web Filter 7.7.3 before Hotfix 31, Web Security 7.7.3 before Hotfix 31,… Websense
- CVE-2013-6216 LOW · 2.1 Unspecified vulnerability in HP Array Configuration Utility, Array Diagnostics Utility, ProLiant Array Diagnostics, and SmartSSD Wear Gauge Utility 9.40 and earlier allows local users to… Hp
- CVE-2013-2828 MEDIUM · 4.7 The DNP Master Driver in the OSIsoft PI Interface before 3.1.2.54 for DNP3 allows physically proximate attackers to cause a denial of service (interface shutdown)… Osisoft
- CVE-2013-2809 HIGH · 7.1 The DNP Master Driver in the OSIsoft PI Interface before 3.1.2.54 for DNP3 allows remote attackers to cause a denial of service (interface shutdown) via… Osisoft
- CVE-2014-1210 MEDIUM · 5.8 VMware vSphere Client 5.0 before Update 3 and 5.1 before Update 2 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof SSL… Vmware
- CVE-2014-1209 HIGH · 9.3 VMware vSphere Client 4.0, 4.1, 5.0 before Update 3, and 5.1 before Update 2 does not properly validate updates to Client files, which allows remote… Vmware
- CVE-2014-0636 MEDIUM · 5.8 EMC RSA BSAFE Micro Edition Suite (MES) 3.2.x before 3.2.6 and 4.0.x before 4.0.5 does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers… Dell
- CVE-2014-1969 MEDIUM · 5.8 Directory traversal vulnerability in the apps4u@android SD Card Manager application before 20140224 for Android allows attackers to overwrite or create arbitrary files via a crafted…
- CVE-2014-0777 HIGH · 8.3 The Modbus slave/outstation driver in the OPC Drivers 1.0.20 and earlier in IOServer OPC Server allows remote attackers to cause a denial of service (out-of-bounds… Ioserver
- CVE-2014-2850 HIGH · 8.5 The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address… Sophos
- CVE-2014-2849 HIGH · 8.5 In het dialoogvenster Wachtwoord wijzigen (change_password) in Sophos Web Appliance vóór 3.8.2 kunnen op afstand geverifieerde gebruikers het beheerderswachtwoord wijzigen via een vervaardigd verzoek. Sophos
- CVE-2014-2848 MEDIUM · 6.9 Een raceconditie in de wmi_malware_scan.nbin-plug-in vóór 201402262215 voor Nessus 5.2.1 stelt lokale gebruikers in staat om privileges te verkrijgen door het uitvoerbare bestand van de… Tenable
- CVE-2014-2847 HIGH · 7.5 SQL injection vulnerability in default.asp in CIS Manager CMS allows remote attackers to execute arbitrary SQL commands via the TroncoID parameter. Construtiva
- CVE-2014-0172 MEDIUM · 6.8 Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used in elfutils 0.153 and possibly through 0.158 allows remote attackers to… Elfutils Project
- CVE-2012-6131 MEDIUM · 4.3 Cross-site scripting (XSS) kwetsbaarheid in cgi/client.py in Roundup vóór 1.4.20 stelt externe aanvallers in staat om willekeurig webscript of HTML te injecteren via de @action… Roundup-tracker
- CVE-2012-6130 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username,… Roundup-tracker
- CVE-2014-2540 HIGH · 7.5 SQL-injectiekwetsbaarheid in OrbitScripts Orbit Open Ad Server vóór 1.1.1 stelt externe aanvallers in staat om willekeurige SQL-opdrachten uit te voeren via de parameter site_directory_sort_field naar… Orbitscripts
- CVE-2014-2333 LOW · 2.6 Cross-site scripting (XSS) vulnerability in the Lazyest Gallery plugin before 1.1.21 for WordPress allows remote attackers to inject arbitrary web script or HTML via an… Marcel Brinkkemper
- CVE-2014-1985 MEDIUM · 5.8 Open redirect vulnerability in the redirect_back_or_default function in app/controllers/application_controller.rb in Redmine before 2.4.5 and 2.5.x before 2.5.1 allows remote attackers to redirect users to arbitrary… Redmine
- CVE-2013-6369 MEDIUM · 6.8 Stapelgebaseerde bufferoverloop in de jbg_dec_in-functie in libjbig/jbig.c in JBIG-KIT vóór 2.1 stelt externe aanvallers in staat om een denial of service (applicatiecrash) te veroorzaken en… Cambridge Enterprise
- CVE-2013-4795 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in the Submitters list in Review Board 1.6.x before 1.6.18 and 1.7.x before 1.7.12 allows remote attackers to inject arbitrary web… Reviewboard
- CVE-2013-2708 MEDIUM · 6.8 Cross-site request forgery (CSRF) -kwetsbaarheid in de Content Slide-plug-in 1.4.2 voor WordPress stelt externe aanvallers in staat om de authenticatie van beheerders te kapen voor… Snilesh
- CVE-2013-2706 MEDIUM · 6.8 Cross-site request forgery (CSRF) vulnerability in the Stream Video Player plugin 1.4.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests… Rodrigo Polo Wordpress
- CVE-2014-2829 HIGH · 7.8 Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial… Erlang-solutions
- CVE-2014-2746 HIGH · 7.8 net/IOService.java in Tigase before 5.2.1 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service… Tigase
- CVE-2014-2745 HIGH · 7.8 Prosody before 0.9.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption)… Prosody
- CVE-2014-2744 HIGH · 7.8 plugins/mod_compression.lua in (1) Prosody vóór 0.9.4 en (2) Lightwitch Metronome via 3.4 onderhandelt over streamcompressie terwijl een sessie niet is geverifieerd, waardoor externe aanvallers een… Lightwitch Prosody
- CVE-2014-2743 HIGH · 7.8 plugins/mod_compression.lua in Lightwitch Metronome through 3.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of… Lightwitch
- CVE-2014-2742 HIGH · 7.8 Isode M-Link before 16.0v7 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource… Isode
- CVE-2014-2741 HIGH · 7.8 nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial… Igniterealtime
- CVE-2014-0920 MEDIUM · 4.0 IBM SPSS Analytic Server 1.0 before IF002 and 1.0.1 before IF004 logs cleartext passwords, which allows remote authenticated users to obtain sensitive information via unspecified… Ibm
- CVE-2014-0908 MEDIUM · 6.0 The User Attribute implementation in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.2, and 8.5.x through 8.5.0.1 does not verify authorization for… Ibm
- CVE-2014-2752 HIGH · 7.5 SAP Business Object Processing Framework (BOPF) for ABAP has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. Sap
- CVE-2014-2751 HIGH · 7.5 SAP Print and Output Management heeft hardgecodeerde referenties, waardoor externe aanvallers gemakkelijker toegang kunnen krijgen via niet-gespecificeerde vectoren. Sap
- CVE-2014-2749 MEDIUM · 5.0 The HANA ICM process in SAP HANA allows remote attackers to obtain the platform version, host name, instance number, and possibly other sensitive information via… Sap
- CVE-2014-2748 HIGH · 7.5 Met de Security Audit Log-faciliteit in SAP Enhancement Package (EHP) 6 voor SAP ERP 6.0 kunnen aanvallers op afstand willekeurige logklassen wijzigen of verwijderen via… Sap