VYPR

CVEs

390,577 total · page 6548 of 7,812

AllCriticalHighKEV
  • CVE-2014-5097Aug 22, 2014
    Freereprintables
    Articlefr
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Free Reprintables ArticleFR 3.0.4 and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter in a (1) get or (2) set action to rate.php.

  • CVE-2014-4197Aug 22, 2014
    Bank Soft Systems
    RBS BS-Client. Private Client
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Bank Soft Systems (BSS) RBS BS-Client 3.17.9 allow remote attackers to execute arbitrary SQL commands via the (1) CARDS or (2) XACTION parameter.

  • CVE-2014-3594Aug 22, 2014
    OpenStack
    Horizon
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.

  • CVE-2014-3525Aug 22, 2014
    Apache
    trafficserver
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Apache Traffic Server 3.x through 3.2.5, 4.x before 4.2.1.1, and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks.

  • CVE-2014-0232Aug 22, 2014
    Apache
    Ofbiz
    risk 0.01cvss —epss 0.08

    Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not…

  • CVE-2014-5274Aug 22, 2014
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the view operations page in phpMyAdmin 4.1.x before 4.1.14.3 and 4.2.x before 4.2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted view name, related to js/functions.js.

  • CVE-2014-5273Aug 22, 2014
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor…

  • CVE-2014-4767Aug 22, 2014
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.03

    IBM WebSphere Application Server (WAS) Liberty Profile 8.5.x before 8.5.5.3 does not properly use the Liberty Repository for feature installation, which allows remote authenticated users to execute arbitrary code via unspecified vectors.

  • CVE-2014-4764Aug 22, 2014
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    IBM WebSphere Application Server (WAS) 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.3, when Load Balancer for IPv4 Dispatcher is enabled, allows remote attackers to cause a denial of service (Load Balancer crash) via unspecified vectors.

  • CVE-2014-3436Aug 22, 2014
    Symantec
    Encryption Desktop
    risk 0.00cvss —epss 0.01

    Symantec Encryption Desktop 10.3.x before 10.3.2 MP3, and Symantec PGP Desktop 10.0.x through 10.2.x, allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted encrypted e-mail message that decompresses to a larger size.

  • CVE-2014-3089Aug 22, 2014
    IBM
    Rational Directory Server
    risk 0.00cvss —epss 0.00

    The RDS Java Client library in IBM Rational Directory Server (RDS) 5.1.1.x before 5.1.1.2 iFix004 and 5.2.x before 5.2.1 iFix003, and Rational Directory Administrator (RDA) 6.0 before iFix002, includes the cleartext root password, which allows local users to obtain sensitive…

  • CVE-2014-3083Aug 22, 2014
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.35, 8.0.x before 8.0.0.10, and 8.5.x before 8.5.5.3 does not properly restrict resource access, which allows remote attackers to obtain sensitive information via unspecified vectors.

  • CVE-2014-3070Aug 22, 2014
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    The addFileRegistryAccount Virtual Member Manager (VMM) SPI Admin Task in IBM WebSphere Application Server (WAS) 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.3 does not properly create accounts, which allows remote attackers to bypass intended access restrictions via unspecified…

  • CVE-2014-3022Aug 22, 2014
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.3 allows remote attackers to obtain sensitive information via a crafted URL that triggers an error condition.

  • CVE-2014-0965Aug 22, 2014
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.3 allows remote attackers to obtain sensitive information via a crafted SOAP response.

  • CVE-2014-5385Aug 21, 2014
    Shopizer Ecommerce
    Shopizer
    risk 0.00cvss —epss 0.01

    com/salesmanager/central/profile/ProfileAction.java in Shopizer 1.1.5 and earlier does not restrict the number of authentication attempts, which makes it easier for remote attackers to guess passwords via a brute force attack.

  • CVE-2010-5303Aug 21, 2014
    TimThumb
    TimThumb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the displayError function in timthumb.php in TimThumb before 1.15 (r85), as used in multiple products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to $errorString.

  • CVE-2010-5302Aug 21, 2014
    TimThumb
    TimThumb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb before 1.15 as of 20100908 (r88), as used in multiple products, allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING.

  • CVE-2009-5142Aug 21, 2014
    TimThumb
    TimThumb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the src parameter.

  • CVE-2014-5384Aug 21, 2014
    FreeBSD
    FreeBSD
    risk 0.00cvss —epss 0.02

    The VIQR module in the iconv implementation in FreeBSD 10.0 before p6 and NetBSD allows context-dependent attackers to cause a denial of service (out-of-bounds array access) via a crafted argument to the iconv_open function. NOTE: this issue was SPLIT from CVE-2014-3951 per…

  • CVE-2014-3951Aug 21, 2014
    FreeBSD
    FreeBSD
    risk 0.00cvss —epss 0.02

    The HZ module in the iconv implementation in FreeBSD 10.0 before p6 and NetBSD allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via a crafted argument to the iconv_open function. NOTE: this issue was SPLIT per ADT2 due to different…

  • CVE-2014-5383Aug 21, 2014
    Alienvault
    Ossim
    risk 0.05cvss —epss 0.21

    SQL injection vulnerability in AlienVault OSSIM before 4.7.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2014-5210Aug 21, 2014
    Alienvault
    Ossim
    risk 0.04cvss —epss 0.15

    The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) remote_task or (2) get_license request, a different vulnerability than CVE-2014-3804 and CVE-2014-3805.

  • CVE-2014-5159Aug 21, 2014
    Alienvault
    Ossim
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the ossim-framework service in AlienVault OSSIM before 4.6.0 allows remote attackers to execute arbitrary SQL commands via the ws_data parameter.

  • CVE-2014-5158Aug 21, 2014
    Alienvault
    Ossim
    risk 0.00cvss —epss 0.04

    The (1) av-centerd SOAP service and (2) backup command in the ossim-framework service in AlienVault OSSIM before 4.6.0 allows remote attackers to execute arbitrary commands via unspecified vectors.

  • CVE-2014-3577Aug 21, 2014
    Apache
    Httpclient
    risk 0.00cvss —epss 0.09

    org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate,…

  • CVE-2014-3562Aug 21, 2014
    Fedoraproject
    389 Directory Server
    risk 0.00cvss —epss 0.02

    Red Hat Directory Server 8 and 389 Directory Server, when debugging is enabled, allows remote attackers to obtain sensitive replicated metadata by searching the directory.

  • CVE-2014-5382Aug 20, 2014
    Schrack
    Technik Microcontrol
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the web interface in Schrack Technik microControl with firmware 1.7.0 (937) allow remote attackers to inject arbitrary web script or HTML via the position textbox in the configuration menu or other unspecified vectors.

  • CVE-2014-4929Aug 20, 2014
    OwnCloud
    Owncloud
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the routing component in ownCloud Server before 5.0.17 and 6.0.x before 6.0.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in a filename, related to index.php.

  • CVE-2014-2524Aug 20, 2014
    GNU
    Readline
    risk 0.00cvss —epss 0.00

    The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite arbitrary files via a symlink attack on a /var/tmp/rltrace.[PID] file.

  • CVE-2014-4750Aug 20, 2014
    IBM
    Powervc
    risk 0.00cvss —epss 0.01

    IBM PowerVC Express Edition 1.2.0 before FixPack3 establishes an FTP session for transferring files to a managed IVM, which allows remote attackers to discover credentials by sniffing the network.

  • CVE-2014-4749Aug 20, 2014
    IBM
    Powervc
    risk 0.00cvss —epss 0.01

    IBM PowerVC 1.2.0 before FixPack3 does not properly use the known_hosts file, which allows man-in-the-middle attackers to spoof SSH servers via an arbitrary server key.

  • CVE-2014-4618Aug 20, 2014
    EMC Corporation
    Documentum Content Server
    risk 0.00cvss —epss 0.02

    EMC Documentum Content Server before 6.7 SP2 P16 and 7.x before 7.1 P07 allows remote authenticated users to gain privileges via a user-created system object.

  • CVE-2014-3514Aug 20, 2014
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.03

    activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.

  • CVE-2014-3340Aug 20, 2014
    Cisco Systems, Inc.
    Webex Meetmenow
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in an unspecified PHP script in the server in Cisco WebEx MeetMeNow allows remote authenticated users to read arbitrary files via a crafted request, aka Bug ID CSCuo16166.

  • CVE-2014-3331Aug 20, 2014
    Cisco Systems, Inc.
    Asr 5000 Series Software
    risk 0.00cvss —epss 0.02

    The Session Manager component in Packet Data Network Gateway (aka PGW) in Cisco ASR 5000 Series Software 11.0, 12.0, 12.1, 12.2, 14.0, 15.0, 16.x through 16.1.2, and 17.0 allows remote attackers to cause a denial of service (process crash) via a crafted TCP packet, aka Bug ID…

  • CVE-2014-2521Aug 20, 2014
    EMC Corporation
    Documentum Content Server
    risk 0.00cvss —epss 0.02

    EMC Documentum Content Server before 6.7 SP2 P16 and 7.x before 7.1 P07 allows remote authenticated users to read sensitive object metadata via an RPC command.

  • CVE-2014-2520Aug 20, 2014
    EMC Corporation
    Documentum Content Server
    risk 0.00cvss —epss 0.02

    EMC Documentum Content Server before 6.7 SP2 P16 and 7.x before 7.1 P07, when Oracle Database is used, does not properly restrict DQL hints, which allows remote authenticated users to conduct DQL injection attacks and read sensitive database content via a crafted request.

  • CVE-2014-2518Aug 20, 2014
    EMC Corporation
    Documentum Wdk
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in EMC Documentum WDK before 6.7SP1 P28 and 6.7SP2 before P15 allow remote attackers to hijack the authentication of arbitrary users.

  • CVE-2014-2517Aug 20, 2014
    EMC Corporation
    Archer Grc Platform
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote authenticated users to gain privileges via unknown vectors.

  • CVE-2014-2515Aug 20, 2014
    EMC Corporation
    Documentum D2
    risk 0.00cvss —epss 0.02

    EMC Documentum D2 3.1 before P24, 3.1SP1 before P02, 4.0 before P11, 4.1 before P16, and 4.2 before P05 does not properly restrict tickets provided by D2GetAdminTicketMethod and D2RefreshCacheMethod, which allows remote authenticated users to gain privileges via a request for a…

  • CVE-2014-2511Aug 20, 2014
    EMC Corporation
    Documentum Webtop
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop before 6.7 SP1 P28 and 6.7 SP2 before P14 allow remote attackers to inject arbitrary web script or HTML via the (1) startat or (2) entryId parameter.

  • CVE-2014-2505Aug 20, 2014
    EMC Corporation
    Archer Grc Platform
    risk 0.00cvss —epss 0.01

    EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to trigger the download of arbitrary code, and consequently change the product's functionality, via unspecified vectors.

  • CVE-2014-0641Aug 20, 2014
    EMC Corporation
    Archer Grc Platform
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to hijack the authentication of arbitrary users.

  • CVE-2014-0640Aug 20, 2014
    EMC Corporation
    Archer Grc Platform
    risk 0.00cvss —epss 0.01

    EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote authenticated users to bypass intended restrictions on resource access via unspecified vectors.

  • CVE-2014-5350Aug 19, 2014
    Bitdefender
    Gravityzone
    risk 0.08cvss —epss 0.64

    Multiple directory traversal vulnerabilities in Bitdefender GravityZone before 5.1.11.432 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the id parameter to webservice/CORE/downloadFullKitEpc/a/1 in the Web Console or (2) %2E%2E (encoded dot dot) in the…

  • CVE-2014-5349Aug 19, 2014
    Baidu
    Spark Browser
    risk 0.03cvss —epss 0.04

    Stack-based buffer overflow in Baidu Spark Browser 26.5.9999.3511 allows remote attackers to cause a denial of service (application crash) via nested calls to the window.print JavaScript function.

  • CVE-2014-5348Aug 19, 2014
    Riverbed
    Steelapp Traffic Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in apps/zxtm/locallog.cgi in Riverbed Stingray (aka SteelApp) Traffic Manager Virtual Appliance 9.6 patchlevel 9620140312 allows remote attackers to inject arbitrary web script or HTML via the logfile parameter.

  • CVE-2014-5347Aug 19, 2014
    Disqus
    Disqus Comment System
    risk 0.03cvss —epss 0.05

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) disqus_replace,…

  • CVE-2014-5346Aug 19, 2014
    Disqus
    Disqus Comment System
    risk 0.03cvss —epss 0.03

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) activate or (2) deactivate the plugin via the active parameter to…