CVE-database
133.515 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2014-4750 LOW · 2.9 IBM PowerVC Express Edition 1.2.0 before FixPack3 establishes an FTP session for transferring files to a managed IVM, which allows remote attackers to discover credentials… Ibm
- CVE-2014-4749 MEDIUM · 4.3 IBM PowerVC 1.2.0 vóór FixPack3 maakt niet correct gebruik van het known_hosts-bestand, waarmee man-in-the-middle-aanvallers SSH-servers kunnen vervalsen via een willekeurige serversleutel. Ibm
- CVE-2014-4618 HIGH · 8.5 EMC Documentum Content Server before 6.7 SP2 P16 and 7.x before 7.1 P07 allows remote authenticated users to gain privileges via a user-created system object. Emc
- CVE-2014-3514 HIGH · 7.5 activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x vóór 4.0.9 en 4.1.x vóór 4.1.5 stelt externe aanvallers in staat om het sterke parameterbeveiligingsmechanisme te… Rubyonrails
- CVE-2014-3340 MEDIUM · 4.0 Directory traversal vulnerability in an unspecified PHP script in the server in Cisco WebEx MeetMeNow allows remote authenticated users to read arbitrary files via a… Cisco
- CVE-2014-3331 MEDIUM · 4.3 De Session Manager-component in Packet Data Network Gateway (ook bekend als PGW) in Cisco ASR 5000 Series Software 11.0, 12.0, 12.1, 12.2, 14.0, 15.0, 16.x… Cisco
- CVE-2014-2521 MEDIUM · 6.3 EMC Documentum Content Server before 6.7 SP2 P16 and 7.x before 7.1 P07 allows remote authenticated users to read sensitive object metadata via an RPC… Emc
- CVE-2014-2520 MEDIUM · 6.3 EMC Documentum Content Server before 6.7 SP2 P16 and 7.x before 7.1 P07, when Oracle Database is used, does not properly restrict DQL hints, which… Emc
- CVE-2014-2518 MEDIUM · 6.8 Multiple cross-site request forgery (CSRF) vulnerabilities in EMC Documentum WDK before 6.7SP1 P28 and 6.7SP2 before P15 allow remote attackers to hijack the authentication of… Emc
- CVE-2014-2517 MEDIUM · 6.5 Unspecified vulnerability in EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote authenticated users to gain privileges via unknown vectors. Emc
- CVE-2014-2515 HIGH · 8.5 EMC Documentum D2 3.1 vóór P24, 3.1SP1 vóór P02, 4.0 vóór P11, 4.1 vóór P16 en 4.2 vóór P05 beperkt tickets verstrekt door D2GetAdminTicketMethod en… Emc
- CVE-2014-2511 MEDIUM · 4.3 Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop before 6.7 SP1 P28 and 6.7 SP2 before P14 allow remote attackers to inject arbitrary web… Emc
- CVE-2014-2505 MEDIUM · 5.4 EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to trigger the download of arbitrary code, and consequently change the product's functionality,… Emc
- CVE-2014-0641 MEDIUM · 6.8 Cross-site request forgery (CSRF) vulnerability in EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to hijack the authentication of arbitrary users. Emc
- CVE-2014-0640 MEDIUM · 4.0 Met EMC RSA Archer GRC Platform 5.x voor 5.5 SP1 kunnen op afstand geverifieerde gebruikers de beoogde beperkingen op toegang tot bronnen omzeilen via niet-gespecificeerde… Emc
- CVE-2014-5350 MEDIUM · 5.0 Meerdere kwetsbaarheden voor directorytraversal in Bitdefender GravityZone vóór 5.1.11.432 stellen externe aanvallers in staat om willekeurige bestanden te lezen via een (1) .. (dot dot)… Bitdefender
- CVE-2014-5349 MEDIUM · 5.0 Op stapels gebaseerde bufferoverloop in Baidu Spark Browser 26.5.9999.3511 stelt externe aanvallers in staat om een denial of service (applicatiecrash) te veroorzaken via geneste oproepen… Baidu
- CVE-2014-5348 MEDIUM · 4.3 Cross-site scripting (XSS) kwetsbaarheid in apps/zxtm/locallog.cgi in Riverbed Stingray (ook bekend als SteelApp) Traffic Manager Virtual Appliance 9.6 patchlevel 9620140312 stelt aanvallers op afstand in… Riverbed
- CVE-2014-5347 MEDIUM · 6.8 Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress allow remote attackers to hijack the authentication of administrators… Disqus
- CVE-2014-5346 MEDIUM · 6.8 Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow remote attackers to hijack the authentication of administrators for… Disqus
- CVE-2014-5345 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress allows remote attackers to inject arbitrary web script or… Disqus
- CVE-2014-5344 MEDIUM · 4.3 Multiple cross-site scripting (XSS) vulnerabilities in the Mobiloud (mobiloud-mobile-app-plugin) plugin before 2.3.8 for WordPress allow remote attackers to inject arbitrary web script or HTML via… Mobiloud
- CVE-2014-5343 MEDIUM · 4.3 Cross-site scripting (XSS) vulnerability in Feng Office allows remote attackers to inject arbitrary web script or HTML via a client Name field. Fengoffice
- CVE-2014-5033 MEDIUM · 6.9 KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass… Debian Canonical Kde
- CVE-2014-4615 MEDIUM · 5.0 The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before… Redhat Canonical Openstack
- CVE-2014-3528 MEDIUM · 4.0 Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials,… Opensuse Apache Canonical Apple
- CVE-2014-3522 MEDIUM · 4.0 The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name… Apache Opensuse Canonical Apple
- CVE-2014-3504 MEDIUM · 4.0 The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a… Apache Canonical Serf Project
- CVE-2014-3490 HIGH · 7.5 RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when… Redhat
- CVE-2014-3472 MEDIUM · 4.9 The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly… Redhat
- CVE-2014-3464 MEDIUM · 5.5 The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the… Redhat
- CVE-2014-5333 MEDIUM · 4.3 Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows… Adobe Google Apple Microsoft
- CVE-2014-3906 HIGH · 7.5 SQL injection vulnerability in OSK Advance-Flow 4.41 and earlier and Advance-Flow Forms 4.41 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified… Kk-osk
- CVE-2014-3903 LOW · 3.5 Cross-site scripting (XSS) vulnerability in the Cakifo theme 1.x before 1.6.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via… Jayj
- CVE-2014-3341 MEDIUM · 5.0 The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether… Cisco
- CVE-2014-5266 MEDIUM · 5.0 The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number… Wordpress Drupal Debian
- CVE-2014-5265 MEDIUM · 5.0 The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering… Wordpress Drupal Debian
- CVE-2014-5240 LOW · 2.1 Cross-site scripting (XSS) kwetsbaarheid in wp-includes/pluggable.php in WordPress vóór 3.9.2, wanneer Multisite is ingeschakeld, stelt externe geverifieerde beheerders in staat om willekeurig webscript of HTML… Wordpress Debian
- CVE-2014-5207 MEDIUM · 6.2 fs/namespace.c in the Linux kernel through 3.16.1 does not properly restrict clearing MNT_NODEV, MNT_NOSUID, and MNT_NOEXEC and changing MNT_ATIME_MASK during a remount of a bind… Linux Canonical
- CVE-2014-5206 HIGH · 7.2 The do_remount function in fs/namespace.c in the Linux kernel through 3.16.1 does not maintain the MNT_LOCK_READONLY bit across a remount of a bind mount, which… Linux Canonical
- CVE-2014-5205 MEDIUM · 6.8 wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tokens, which makes it easier for… Wordpress
- CVE-2014-5204 MEDIUM · 6.8 wp-includes/pluggable.php in WordPress vóór 3.9.2 verwerpt ongeldige CSRF-nonces met een andere timing, afhankelijk van welke tekens in de nonce onjuist zijn, wat het voor externe… Debian Wordpress
- CVE-2014-5203 HIGH · 7.5 wp-includes/class-wp-customize-widgets.php in de widgetimplementatie in WordPress 3.9.x vóór 3.9.2 kunnen externe aanvallers willekeurige code laten uitvoeren via vervaardigde geserialiseerde gegevens. Wordpress
- CVE-2014-2388 MEDIUM · 6.1 The Storage and Access service in BlackBerry OS 10.x before 10.2.1.1925 on Q5, Q10, Z10, and Z30 devices does not enforce the password requirement for… Blackberry
- CVE-2014-1469 MEDIUM · 4.9 BlackBerry Enterprise Server 5.x before 5.0.4 MR7 and Enterprise Service 10.x before 10.2.2 log cleartext credentials during exception handling, which allows local users to obtain… Blackberry
- CVE-2014-5074 HIGH · 7.1 Siemens SIMATIC S7-1500 CPU devices with firmware before 1.6 allow remote attackers to cause a denial of service (device restart and STOP transition) via crafted… Siemens
- CVE-2014-4775 MEDIUM · 5.0 IBM InfoSphere Master Data Management - Collaborative Edition 10.x voor 10.1-FP11 en 11.x voor 11.0-FP5 en InfoSphere Master Data Management Server voor Product Information Management… Ibm
- CVE-2014-3087 MEDIUM · 4.0 callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files… Ibm
- CVE-2014-3085 HIGH · 7.1 systest.php on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allows remote authenticated users to execute arbitrary commands via shell metacharacters… Ibm
- CVE-2014-3081 MEDIUM · 6.3 prodtest.php op IBM GCM16 en GCM32 Global Console Manager schakelt over met firmware vóór 1.20.20.23447 stelt op afstand geverifieerde gebruikers in staat om willekeurige bestanden… Ibm