VYPR

CVEs

355,873 total · page 5840 of 7,118

AllCriticalHighKEV
  • CVE-2014-5890Sep 15, 2014
    Sports2i
    Kbo Sports2i 2014
    risk 0.00cvss —epss 0.00

    The KBO sports2i 2014 (aka com.sports2i) application 5.1.00 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-5889Sep 15, 2014
    Androidforums
    Forum For Android
    risk 0.00cvss —epss 0.00

    The Android Forums (aka com.tapatalk.androidforumscom) application 2.4.4.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-5407Sep 15, 2014
    Schneider Electric
    Vampset
    risk 0.00cvss —epss 0.00

    Multiple stack-based buffer overflows in Schneider Electric VAMPSET 2.2.136 and earlier allow local users to cause a denial of service (application halt) via a malformed (1) setting file or (2) disturbance recording file.

  • CVE-2014-4763Sep 15, 2014
    IBM
    Filenet Content Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Content Navigator in Content Engine in IBM FileNet Content Manager 5.2.x before 5.2.0.3-P8CPE-IF003 and Content Foundation 5.2.x before 5.2.0.3-P8CPE-IF003 allows remote authenticated users to inject arbitrary web script or HTML via a…

  • CVE-2014-3796Sep 15, 2014
    VMware
    Nsx
    risk 0.00cvss —epss 0.02

    VMware NSX 6.0 before 6.0.6, and vCloud Networking and Security (vCNS) 5.1 before 5.1.4.2 and 5.5 before 5.5.3, does not properly validate input, which allows attackers to obtain sensitive information via unspecified vectors.

  • CVE-2014-3617Sep 15, 2014
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    The forum_print_latest_discussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the…

  • CVE-2014-3077Sep 15, 2014
    IBM
    SONAS
    risk 0.00cvss —epss 0.00

    IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file.

  • CVE-2014-2377Sep 15, 2014
    Ecava
    Integraxor
    risk 0.00cvss —epss 0.02

    Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag.

  • CVE-2014-2376Sep 15, 2014
    Ecava
    Integraxor
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2014-2375Sep 15, 2014
    Ecava
    Integraxor
    risk 0.00cvss —epss 0.02

    Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service (disk consumption), via the CSV export feature.

  • CVE-2014-0993Sep 15, 2014
    Embarcadero
    Delphi XE6
    risk 0.00cvss —epss 0.06

    Buffer overflow in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows remote attackers to execute arbitrary code via a crafted BMP file.

  • CVE-2014-5888Sep 12, 2014
    Topfreegames
    SLOTS: Bible Slots Free
    risk 0.00cvss —epss 0.00

    The SLOTS: Bible Slots Free (aka com.topfreegames.topbibleslots) application 1.122 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-5887Sep 12, 2014
    Yell
    Yell Local Search
    risk 0.00cvss —epss 0.00

    The Yell Local Search (aka com.yell.launcher2) application 4.2.1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-5886Sep 12, 2014
    Ceskatelevize
    Ivysilani Ceske Televize
    risk 0.00cvss —epss 0.00

    The iVysilani ceske televize (aka cz.motion.ivysilani) application 1.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-5885Sep 12, 2014
    Pdc
    Disaster Alert
    risk 0.00cvss —epss 0.00

    The Disaster Alert (aka disasterAlert.PDC) application 3.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-5884Sep 12, 2014
    1&1 Internet
    1&1 Online Storage
    risk 0.00cvss —epss 0.00

    The 1&1 Online Storage (aka de.einsundeins.smartdrive) application 5.0.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-5883Sep 12, 2014
    7 Eleven
    7 Eleven
    risk 0.00cvss —epss 0.00

    The 7-ELEVEN (aka ecowork.seven) application 2.08.000 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-6270Sep 12, 2014
    Squid Cache
    Squid
    risk 0.02cvss —epss 0.23

    Off-by-one error in the snmpHandleUdp function in snmp_core.cc in Squid 2.x and 3.x, when an SNMP port is configured, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted UDP SNMP request, which triggers a heap-based…

  • CVE-2014-5441Sep 12, 2014
    Fatfreecrm
    Fat Free CRM
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in app/views/layouts/application.html.haml in Fat Free CRM before 0.13.3 allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) first name, or (3) last name in a (a) create or (b) edit user…

  • CVE-2014-5440Sep 12, 2014
    MPEX Business Solutions
    MX-SmartTimer
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in Login.aspx in MPEX Business Solutions MX-SmartTimer before 13.19.18 allows remote attackers to execute arbitrary SQL commands via the ct100%24CPHContent%24password parameter.

  • CVE-2014-5259Sep 12, 2014
    Blackcat CMS
    Blackcat CMS
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in cattranslate.php in the CatTranslate JQuery plugin in BlackCat CMS 1.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

  • CVE-2014-4735Sep 12, 2014
    Mywebsql
    Mywebsql
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in MyWebSQL 3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the table parameter to index.php.

  • CVE-2014-2009Sep 12, 2014
    Prestashop
    mPAY24 payment module
    risk 0.04cvss —epss 0.07

    The mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to obtain credentials, the installation path, and other sensitive information via a direct request to api/curllog.log.

  • CVE-2014-2008Sep 12, 2014
    Mpay24 Project
    Mpay24
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in confirm.php in the mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to execute arbitrary SQL commands via the TID parameter.

  • CVE-2012-1556Sep 12, 2014
    Synology
    Diskstation Manager
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Synology Photo Station 5 for DiskStation Manager (DSM) 3.2-1955 allows remote attackers to inject arbitrary web script or HTML via the name parameter to photo/photo_one.php.

  • CVE-2014-4811Sep 12, 2014
    IBM
    San Volume Controller Software
    risk 0.00cvss —epss 0.03

    IBM Storwize 3500, 3700, 5000, and 7000 devices and SAN Volume Controller 6.x and 7.x before 7.2.0.8 allow remote attackers to reset the administrator superuser password to its default value via a direct request to the administrative IP address.

  • CVE-2014-4792Sep 12, 2014
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.02

    IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF28, 8.0.0 through 8.0.0.1 CF13, and 8.5.0 before CF02 allows remote authenticated users to cause a denial of service (disk consumption) by uploading large files.

  • CVE-2014-4762Sep 12, 2014
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.0 through 8.0.0.1 CF13 and 8.5.0 before CF02 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2014-3363Sep 12, 2014
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the web framework in Cisco Unified Communications Manager (UCM) 9.1(2.10000.28) allows remote authenticated users to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuq68443.

  • CVE-2014-3362Sep 12, 2014
    Cisco Systems, Inc.
    TelePresence System Edge MXP Series
    risk 0.00cvss —epss 0.03

    Memory leak in Cisco TelePresence System Edge MXP Series Software F9.3.3 and earlier allows remote attackers to cause a denial of service (management outage) via multiple TELNET connections, aka Bug ID CSCuo63677.

  • CVE-2014-3342Sep 12, 2014
    Cisco Systems, Inc.
    iOS Xr
    risk 0.00cvss —epss 0.01

    The CLI in Cisco IOS XR allows remote authenticated users to obtain sensitive information via unspecified commands, aka Bug IDs CSCuq42336, CSCuq76853, CSCuq76873, and CSCuq45383.

  • CVE-2014-3092Sep 12, 2014
    IBM
    Rational Quality Manager
    risk 0.00cvss —epss 0.02

    IBM Jazz Team Server, as used in Rational Collaborative Lifecycle Management; Rational Quality Manager 3.x before 3.0.1.6 iFix 3, 4.x before 4.0.7, and 5.x before 5.0.1; and other Rational products, does not set the secure flag for the session cookie in an https session, which…

  • CVE-2013-4444Sep 12, 2014
    Apache
    Tomcat
    risk 0.01cvss —epss 0.14

    Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

  • CVE-2014-3985Sep 11, 2014
    Miniupnp Project
    Miniupnpd
    risk 0.00cvss —epss 0.03

    The getHTTPResponse function in miniwget.c in MiniUPnP 1.9 allows remote attackers to cause a denial of service (crash) via crafted headers that trigger an out-of-bounds read.

  • CVE-2014-3740Sep 11, 2014
    Spiceworks
    Spiceworks
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in SpiceWorks before 7.2.00195 allows remote authenticated users to inject arbitrary web script or HTML via the Summary field in a ticket request to the portal page.

  • CVE-2014-3609Sep 11, 2014
    Squid Cache
    Squid
    risk 0.04cvss —epss 0.56

    HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via a request with crafted "Range headers with unidentifiable byte-range values."

  • CVE-2014-5882Sep 11, 2014
    Applica
    Homoo Ijiri
    risk 0.00cvss —epss 0.00

    The Homoo Ijiri (aka jp.co.applica) application 3.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-5881Sep 11, 2014
    Yahoo Japan
    Yahoo! Japan Box
    risk 0.00cvss —epss 0.00

    The Yahoo! Japan Box (aka jp.co.yahoo.android.ybox) application 1.5.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-5879Sep 11, 2014
    Kenneth
    tvguide
    risk 0.00cvss —epss 0.00

    The tvguide (aka kenneth.tvguide) application 1.9.14 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-6043Sep 11, 2014
    Zohocorp
    Manageengine Eventlog Analyzer
    risk 0.04cvss —epss 0.13

    ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 does not properly restrict access to the database browser, which allows remote authenticated users to obtain access to the database via a direct request to event/runQuery.do. Fixed in Build 10000.

  • CVE-2014-5460Sep 11, 2014
    Tribulant
    Slideshow Gallery
    risk 0.09cvss —epss 0.71

    Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitrary code by uploading a PHP file, then accessing it via a direct request to the file in…

  • CVE-2014-5393Sep 11, 2014
    Sos
    Jobscheduler
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in the JobScheduler Operations Center (JOC) in SOS JobScheduler before 1.6.4246 and 1.7.x before 1.7.4241 allows remote authenticated users with the info permission to read arbitrary files in the webroot via unspecified vectors.

  • CVE-2014-5391Sep 11, 2014
    Sos
    Jobscheduler
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the JobScheduler Operations Center (JOC) in SOS JobScheduler before 1.6.4246 and 1.7.x before 1.7.4241 allows remote attackers to inject arbitrary web script or HTML via the hash property (location.hash).

  • CVE-2014-5129Sep 11, 2014
    Avolvesoftware
    Projectdox
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Avolve Software ProjectDox 8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-6241Sep 11, 2014
    TYPO3
    wt_directory
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the wt_directory extension before 1.4.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2014-6240Sep 11, 2014
    TYPO3
    Google Sitemap
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Google Sitemap (weeaar_googlesitemap) extension 0.4.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-6239Sep 11, 2014
    Address Visualization With Google Maps Project
    Address Visualization With Google Maps
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Address visualization with Google Maps (st_address_map) extension before 0.3.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2014-6238Sep 11, 2014
    TYPO3
    Akronymmanager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Akronymmanager (aka SB Folderdownload) extension 0.5.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-6237Sep 11, 2014
    TYPO3
    News Pack
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the News Pack extension 0.1.0 and earlier for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-6236Sep 11, 2014
    TYPO3
    LumoNet PHP Include
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the LumoNet PHP Include (lumophpinclude) extension before 1.2.1 for TYPO3 allows remote attackers to execute arbitrary scripts via vectors related to extension links.