VYPR

CVEs

391,139 total · page 6528 of 7,823

AllCriticalHighKEV
  • CVE-2014-6940Oct 11, 2014
    Absolute Lending Solutions
    com.soln.S008F6C05EC0B63264B429F6D76286562
    risk 0.00cvss —epss 0.00

    The Absolute Lending Solutions (aka com.soln.S008F6C05EC0B63264B429F6D76286562) application 1.0073.b0073 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted…

  • CVE-2014-6939Oct 11, 2014
    Xlabz
    Sketch W Friends Free Tablets
    risk 0.00cvss —epss 0.00

    The Sketch W Friends FREE -Tablets (aka air.com.xlabz.SketchWFriendsFree) application 5.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-6938Oct 11, 2014
    Webizz
    Apostilas Musicais
    risk 0.00cvss —epss 0.00

    The Apostilas musicais (aka com.apostilas) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-6937Oct 11, 2014
    Ecitic
    China Citic Bank Credit Card
    risk 0.00cvss —epss 0.00

    The China CITIC Bank Credit Card (aka com.citiccard.mobilebank) application 3.3.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-6936Oct 11, 2014
    Mobileeventguide
    Ids 2013
    risk 0.00cvss —epss 0.00

    The IDS 2013 (aka de.mobileeventguide.ids2013) application 1.21 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-6935Oct 11, 2014
    ColorMania
    ColorMania
    risk 0.00cvss —epss 0.00

    The ColorMania - Color Quiz Game (aka com.ColormaniaColoringGames) application 1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-6934Oct 11, 2014
    Physics Chemistry Biology Quiz Project
    Physics Chemistry Biology Quiz
    risk 0.00cvss —epss 0.00

    The Physics Chemistry Biology Quiz (aka com.pdevsmcqs.pcbmcqseries) application 1.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-6904Oct 11, 2014
    Cloudacl
    Safe Browser The Web Filter
    risk 0.00cvss —epss 0.00

    The Safe Browser - The Web Filter (aka com.cloudacl) application 1.2.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-6891Oct 11, 2014
    Vodafone
    Vodafone Avantaj Cepte
    risk 0.00cvss —epss 0.00

    The Vodafone Avantaj Cepte (aka com.vodafone.avantajcepte.main) application 1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-6887Oct 11, 2014
    Express
    Express
    risk 0.00cvss —epss 0.00

    The EXPRESS (aka com.gpshopper.express.android) application 2.5.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-7201Oct 10, 2014
    TYPO3
    Jobcontrol
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in the search function in pi1/class.tx_dmmjobcontrol_pi1.php in the JobControl (dmmjobcontrol) extension 2.14.0 and earlier for TYPO3 allow remote attackers to execute arbitrary SQL commands via the (1) education, (2) region, or (3) sector…

  • CVE-2014-7200Oct 10, 2014
    TYPO3
    Jobcontrol
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in pi1/class.tx_dmmjobcontrol_pi1.php in the JobControl (dmmjobcontrol) extension 2.14.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via the tx_dmmjobcontrol_pi1[search][keyword] parameter to jobs/.

  • CVE-2014-7139Oct 10, 2014
    WordPress
    Contact Form DB
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.16 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) form or (2) enc parameter in the…

  • CVE-2014-6315Oct 10, 2014
    Photo Gallery Plugin Project
    Photo Gallery Plugin
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Web-Dorado Photo Gallery plugin 1.1.30 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) callback, (2) dir, or (3) extensions parameter in an addImages action to…

  • CVE-2014-6243Oct 10, 2014
    Ewww
    Ewww Image Optimizer Plugin
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the EWWW Image Optimizer plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the error parameter in the ewww-image-optimizer.php page to wp-admin/options-general.php, which is not…

  • CVE-2014-4737Oct 10, 2014
    Textpattern
    Textpattern
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Textpattern CMS before 4.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to setup/index.php.

  • CVE-2014-4313Oct 10, 2014
    Epicor
    Epicor Procurement
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in Epicor Procurement before 7.4 SP2 allows remote attackers to execute arbitrary SQL commands via the User field.

  • CVE-2014-4312Oct 10, 2014
    Epicor
    Epicor Enterprise
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in Epicor Enterprise 7.4 before FS74SP6_HotfixTL054181 allow remote attackers to inject arbitrary web script or HTML via the (1) Notes section to Order details; (2) Description section to "Order to consume"; (3) Favorites name…

  • CVE-2014-3678Oct 10, 2014
    Jenkins Project
    Monitoring Plugin
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-4874Oct 10, 2014
    BMC Software
    Track It\!
    risk 0.04cvss —epss 0.09

    BMC Track-It! 11.3.0.355 allows remote authenticated users to read arbitrary files by visiting the TrackItWeb/Attachment page.

  • CVE-2014-4873Oct 10, 2014
    BMC Software
    Track It\!
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in TrackItWeb/Grid/GetData in BMC Track-It! 11.3.0.355 allows remote authenticated users to execute arbitrary SQL commands via crafted POST data.

  • CVE-2014-4872Oct 10, 2014
    BMC Software
    Track It\!
    risk 0.09cvss —epss 0.79

    BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows remote attackers to upload arbitrary files, execute arbitrary code, or obtain sensitive credential and configuration information via a .NET Remoting request to (1) FileStorageService or (2)…

  • CVE-2014-4867Oct 10, 2014
    Cryoserver
    Cryoserver Security Appliance
    risk 0.00cvss —epss 0.00

    Cryoserver Security Appliance 7.3.x uses weak permissions for /etc/init.d/cryoserver, which allows local users to gain privileges by leveraging access to the support account and running the /bin/cryo-mgmt program.

  • CVE-2014-4761Oct 10, 2014
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.02

    IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 before 8.0.0.1 CF14, and 8.5.0 through 8.5.0.0 CF02 allows remote authenticated users to discover credentials by reading HTML source code.

  • CVE-2014-3581Oct 10, 2014
    Apache
    HTTP Server
    risk 0.00cvss —epss 0.14

    The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server before 2.4.11 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty HTTP Content-Type header.

  • CVE-2014-3402Oct 10, 2014
    Cisco Systems, Inc.
    Intrusion Prevention System
    risk 0.00cvss —epss 0.01

    The authentication-manager process in the web framework in Cisco Intrusion Prevention System (IPS) 7.0(8)E4 and earlier in Cisco Intrusion Detection System (IDS) does not properly manage user tokens, which allows remote attackers to cause a denial of service (temporary MainApp…

  • CVE-2014-3394Oct 10, 2014
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.01

    The Smart Call Home (SCH) implementation in Cisco ASA Software 8.2 before 8.2(5.50), 8.4 before 8.4(7.15), 8.6 before 8.6(1.14), 8.7 before 8.7(1.13), 9.0 before 9.0(4.8), and 9.1 before 9.1(5.1) allows remote attackers to bypass certificate validation via an arbitrary VeriSign…

  • CVE-2014-3393Oct 10, 2014
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.02

    The Clientless SSL VPN portal customization framework in Cisco ASA Software 8.2 before 8.2(5.51), 8.3 before 8.3(2.42), 8.4 before 8.4(7.23), 8.6 before 8.6(1.14), 9.0 before 9.0(4.24), 9.1 before 9.1(5.12), and 9.2 before 9.2(2.4) does not properly implement authentication,…

  • CVE-2014-3392Oct 10, 2014
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.02

    The Clientless SSL VPN portal in Cisco ASA Software 8.2 before 8.2(5.51), 8.3 before 8.3(2.42), 8.4 before 8.4(7.23), 8.6 before 8.6(1.15), 9.0 before 9.0(4.24), 9.1 before 9.1(5.12), 9.2 before 9.2(2.8), and 9.3 before 9.3(1.1) allows remote attackers to obtain sensitive…

  • CVE-2014-3391Oct 10, 2014
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in Cisco ASA Software 8.x before 8.4(3), 8.5, and 8.7 before 8.7(1.13) allows local users to gain privileges by placing a Trojan horse library file in external memory, leading to library use after device reload because of an incorrect…

  • CVE-2014-3390Oct 10, 2014
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.00

    The Virtual Network Management Center (VNMC) policy implementation in Cisco ASA Software 8.7 before 8.7(1.14), 9.2 before 9.2(2.8), and 9.3 before 9.3(1.1) allows local users to obtain Linux root access by leveraging administrative privileges and executing a crafted script, aka…

  • CVE-2014-3389Oct 10, 2014
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.03

    The VPN implementation in Cisco ASA Software 7.2 before 7.2(5.15), 8.2 before 8.2(5.51), 8.3 before 8.3(2.42), 8.4 before 8.4(7.23), 8.6 before 8.6(1.15), 9.0 before 9.0(4.24), 9.1 before 9.1(5.12), 9.2 before 9.2(2.6), and 9.3 before 9.3(1.1) does not properly implement a…

  • CVE-2014-3388Oct 10, 2014
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.01

    The DNS inspection engine in Cisco ASA Software 9.0 before 9.0(4.13), 9.1 before 9.1(5.7), and 9.2 before 9.2(2) allows remote attackers to cause a denial of service (device reload) via crafted DNS packets, aka Bug ID CSCuo68327.

  • CVE-2014-3387Oct 10, 2014
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.01

    The SunRPC inspection engine in Cisco ASA Software 7.2 before 7.2(5.14), 8.2 before 8.2(5.51), 8.3 before 8.3(2.42), 8.4 before 8.4(7.23), 8.5 before 8.5(1.21), 8.6 before 8.6(1.14), 8.7 before 8.7(1.13), 9.0 before 9.0(4.5), and 9.1 before 9.1(5.3) allows remote attackers to…

  • CVE-2014-3386Oct 10, 2014
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.02

    The GPRS Tunneling Protocol (GTP) inspection engine in Cisco ASA Software 8.2 before 8.2(5.51), 8.4 before 8.4(7.15), 8.7 before 8.7(1.13), 9.0 before 9.0(4.8), and 9.1 before 9.1(5.1) allows remote attackers to cause a denial of service (device reload) via a crafted series of…

  • CVE-2014-3385Oct 10, 2014
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.01

    Race condition in the Health and Performance Monitoring (HPM) for ASDM feature in Cisco ASA Software 8.3 before 8.3(2.42), 8.4 before 8.4(7.11), 8.5 before 8.5(1.19), 8.6 before 8.6(1.13), 8.7 before 8.7(1.11), 9.0 before 9.0(4.8), and 9.1 before 9.1(4.5) allows remote attackers…

  • CVE-2014-3384Oct 10, 2014
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.02

    The IKEv2 implementation in Cisco ASA Software 8.4 before 8.4(7.15), 8.6 before 8.6(1.14), 9.0 before 9.0(4.8), and 9.1 before 9.1(5.1) allows remote attackers to cause a denial of service (device reload) via a crafted packet that is sent during tunnel creation, aka Bug ID…

  • CVE-2014-3383Oct 10, 2014
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.01

    The IKE implementation in the VPN component in Cisco ASA Software 9.1 before 9.1(5.1) allows remote attackers to cause a denial of service (device reload) via crafted UDP packets, aka Bug ID CSCul36176.

  • CVE-2014-3382Oct 10, 2014
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.01

    The SQL*Net inspection engine in Cisco ASA Software 7.2 before 7.2(5.13), 8.2 before 8.2(5.50), 8.3 before 8.3(2.42), 8.4 before 8.4(7.15), 8.5 before 8.5(1.21), 8.6 before 8.6(1.14), 8.7 before 8.7(1.13), 9.0 before 9.0(4.5), and 9.1 before 9.1(5.1) allows remote attackers to…

  • CVE-2014-7226Oct 10, 2014
    Rejetto
    HTTP File Server
    risk 0.04cvss —epss 0.09

    The file comment feature in Rejetto HTTP File Server (hfs) 2.3c and earlier allows remote attackers to execute arbitrary code by uploading a file with certain invalid UTF-8 byte sequences that are interpreted as executable macro symbols.

  • CVE-2014-7047Oct 10, 2014
    Oceanavenue
    Ocean Avenue Mobile Pro
    risk 0.00cvss —epss 0.00

    The Ocean Avenue Mobile Pro (aka com.oceanavenue.mobile) application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-7046Oct 10, 2014
    George Wassouf Project
    George Wassouf
    risk 0.00cvss —epss 0.00

    The George Wassouf (aka com.devkhr32.georgewassouf) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-6439Oct 10, 2014
    Elastic
    Elasticsearch
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-5351Oct 10, 2014
    Mit
    Kerberos 5
    risk 0.00cvss —epss 0.03

    The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote authenticated users to forge tickets by leveraging administrative access.

  • CVE-2014-5298Oct 10, 2014
    risk 0.00cvss —epss 0.03

    FileUploadsFilter.php in X2Engine 4.1.7 and earlier, when running on case-insensitive file systems, allows remote attackers to bypass the upload blacklist and conduct unrestricted file upload attacks by uploading a file with an executable extension that contains uppercase…

  • CVE-2014-5297Oct 10, 2014
    risk 0.00cvss —epss 0.03

    The actionSendErrorReport method in protected/controllers/SiteController.php in X2Engine 2.8 through 4.1.7 allows remote attackers to conduct PHP object injection and Server-Side Request Forgery (SSRF) attacks via crafted serialized data in the report parameter.

  • CVE-2014-5270Oct 10, 2014
    Gnupg
    Libgcrypt
    risk 0.00cvss —epss 0.01

    Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage…

  • CVE-2014-4661Oct 10, 2014
    Microfocus
    Records Manager
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in HP Records Manager before 7.3.5 and 8.x before 8.1 Patch 3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-3405Oct 10, 2014
    Cisco Systems, Inc.
    iOS Xe
    risk 0.00cvss —epss 0.01

    Cisco IOS XE enables the IPv6 Routing Protocol for Low-Power and Lossy Networks (aka RPL) on both the Autonomic Control Plane (ACP) and external Autonomic Networking Infrastructure (ANI) interfaces, which allows remote attackers to conduct route-injection attacks via crafted RPL…

  • CVE-2014-3404Oct 10, 2014
    Cisco Systems, Inc.
    iOS Xe
    risk 0.00cvss —epss 0.01

    The Autonomic Networking Infrastructure (ANI) component in Cisco IOS XE does not properly validate certificates, which allows remote attackers to trigger acceptance of an invalid message via crafted messages, aka Bug ID CSCuq22677.