VYPR

CVEs

390,399 total · page 6550 of 7,808

AllCriticalHighKEV
  • CVE-2014-5160Aug 1, 2014
    Microfocus
    Storage Data Protector
    risk 0.03cvss —epss 0.35

    Multiple directory traversal vulnerabilities in crs.exe in the Cell Request Service in HP Data Protector allow remote attackers to create arbitrary files via an opcode-1091 request, or create or delete arbitrary files via an opcode-305 request. NOTE: the vendor reportedly…

  • CVE-2014-5077Aug 1, 2014
    Linux
    Kernel
    risk 0.00cvss —epss 0.06

    The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints…

  • CVE-2014-5045Aug 1, 2014
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The mountpoint_last function in fs/namei.c in the Linux kernel before 3.15.8 does not properly maintain a certain reference count during attempts to use the umount system call in conjunction with a symlink, which allows local users to cause a denial of service (memory…

  • CVE-2014-3534Aug 1, 2014
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    arch/s390/kernel/ptrace.c in the Linux kernel before 3.15.8 on the s390 platform does not properly restrict address-space control operations in PTRACE_POKEUSR_AREA requests, which allows local users to obtain read and write access to kernel memory locations, and consequently…

  • CVE-2014-0972Aug 1, 2014
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The kgsl graphics driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly prevent write access to IOMMU context registers, which allows local users to select a custom page table,…

  • CVE-2014-3302Aug 1, 2014
    Cisco Systems, Inc.
    Webex Meetings Server
    risk 0.00cvss —epss 0.01

    user.php in Cisco WebEx Meetings Server 1.5(.1.131) and earlier does not properly implement the token timer for authenticated encryption, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCuj81708.

  • CVE-2014-3009Aug 1, 2014
    IBM
    Infosphere Master Data Management Server For Product Information Management
    risk 0.00cvss —epss 0.01

    The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 through 11.0 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 does not properly handle FRAME elements, which makes it easier for remote…

  • CVE-2014-2627Aug 1, 2014
    Microfocus
    NonStop NetBatch
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in HP NonStop NetBatch G06.14 through G06.32.01, H06 through H06.28, and J06 through J06.17.01 allows remote authenticated users to gain privileges for NetBatch job execution via unknown vectors.

  • CVE-2014-5176Jul 31, 2014
    SAP
    Fi Manager Self Service
    risk 0.00cvss —epss 0.02

    SAP FI Manager Self-Service has a hard-coded user name, which makes it easier for remote attackers to obtain access via unspecified vectors.

  • CVE-2014-5175Jul 31, 2014
    SAP
    Solution Manager
    risk 0.00cvss —epss 0.02

    The License Measurement servlet in SAP Solution Manager 7.1 allows remote attackers to bypass authentication via unspecified vectors, related to a verb tampering attack and SAP_JTECHS.

  • CVE-2014-5174Jul 31, 2014
    SAP
    Netweaver Business Warehouse
    risk 0.00cvss —epss 0.02

    The SAP Netweaver Business Warehouse component does not properly restrict access to the functions in the BW-SYS-DB-DB4 function group, which allows remote authenticated users to obtain sensitive information via unspecified vectors.

  • CVE-2014-5173Jul 31, 2014
    SAP
    Hana Extended Application Services
    risk 0.00cvss —epss 0.03

    SAP HANA Extend Application Services (XS) allows remote attackers to bypass access restrictions via a request to a private IU5 SDK application that was once public.

  • CVE-2014-5172Jul 31, 2014
    SAP
    Hana
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in the XS Administration Tools in SAP HANA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-5171Jul 31, 2014
    SAP
    Hana Extended Application Services
    risk 0.00cvss —epss 0.02

    SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authentication using SSL, which allows remote attackers to obtain credentials and other sensitive information by sniffing the network.

  • CVE-2014-3554Jul 31, 2014
    Libndp
    Libndp
    risk 0.00cvss —epss 0.03

    Buffer overflow in the ndp_msg_opt_dnssl_domain function in libndp allows remote routers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS Search List (DNSSL) in an IPv6 router advertisement.

  • CVE-2014-3488Jul 31, 2014
    Netty
    Netty
    risk 0.00cvss —epss 0.04

    The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.

  • CVE-2012-6651Jul 31, 2014
    WordPress
    Vitamin
    risk 0.00cvss —epss 0.03

    Multiple directory traversal vulnerabilities in the Vitamin plugin before 1.1.0 for WordPress allow remote attackers to access arbitrary files via a .. (dot dot) in the path parameter to (1) add_headers.php or (2) minify.php.

  • CVE-2014-5117Jul 30, 2014
    Tor
    Tor
    risk 0.00cvss —epss 0.02

    Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAY_EARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAY_EARLY cells as a means of…

  • CVE-2014-2356Jul 30, 2014
    Phoenixcontact
    mGuard
    risk 0.00cvss —epss 0.03

    Innominate mGuard before 7.6.4 and 8.x before 8.0.3 does not require authentication for snapshot downloads, which allows remote attackers to obtain sensitive information via a crafted HTTPS request.

  • CVE-2014-3025Jul 30, 2014
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management 6.2 through 6.2.8, 6.x and 7.1 through 7.1.1.2, and 7.5 through 7.5.0.6; Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk; and Maximo Asset…

  • CVE-2014-0948Jul 30, 2014
    IBM
    Rational Software Architect Design Manager
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in IBM Rational Software Architect Design Manager and Rational Rhapsody Design Manager 3.x and 4.x before 4.0.7 allows remote authenticated users to execute arbitrary code via a crafted ZIP archive.

  • CVE-2014-0947Jul 30, 2014
    IBM
    Rational Software Architect Design Manager
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the server in IBM Rational Software Architect Design Manager 4.0.6 allows remote authenticated users to execute arbitrary code via a crafted update site.

  • CVE-2014-0915Jul 30, 2014
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management 6.2 through 6.2.8, 6.x and 7.1 through 7.1.1.2, and 7.5 through 7.5.0.6; Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk; and Maximo Asset…

  • CVE-2014-0914Jul 30, 2014
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8 and 6.x and 7.x through 7.5.0.6, Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, and Maximo Asset Management 6.2 through 6.2.8 for Tivoli…

  • CVE-2014-3897Jul 29, 2014
    Homepage Decorator
    PerlMailer
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Homepage Decorator PerlMailer 3.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-3896Jul 29, 2014
    Seeds
    Acmailer
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in CGI programs in Seeds acmailer before 3.8.17 and 3.9.x before 3.9.10 Beta allow remote attackers to hijack the authentication of arbitrary users for requests that modify or delete data, as demonstrated by modifying…

  • CVE-2014-3895Jul 29, 2014
    I-O DATA
    TS-WPTCAM
    risk 0.00cvss —epss 0.02

    The I-O DATA TS-WLCAM camera with firmware 1.06 and earlier, TS-WLCAM/V camera with firmware 1.06 and earlier, TS-WPTCAM camera with firmware 1.08 and earlier, TS-PTCAM camera with firmware 1.08 and earlier, TS-PTCAM/POE camera with firmware 1.08 and earlier, and TS-WLC2 camera…

  • CVE-2014-3329Jul 29, 2014
    Cisco Systems, Inc.
    Prime Data Center Network Manager
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the web-server component in Cisco Prime Data Center Network Manager (DCNM) 6.3(2) and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCum86620.

  • CVE-2014-3057Jul 29, 2014
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Unified Task List (UTL) Portlet for IBM WebSphere Portal 7.x and 8.x through 8.0.0.1 CF12 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2014-3056Jul 29, 2014
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.02

    The Unified Task List (UTL) Portlet for IBM WebSphere Portal 7.x and 8.x through 8.0.0.1 CF12 allows remote attackers to obtain potentially sensitive information about environment variables and JAR versions via unspecified vectors.

  • CVE-2014-3055Jul 29, 2014
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the Unified Task List (UTL) Portlet for IBM WebSphere Portal 7.x and 8.x through 8.0.0.1 CF12 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2014-3054Jul 29, 2014
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.02

    Multiple open redirect vulnerabilities in the Unified Task List (UTL) Portlet for IBM WebSphere Portal 7.x and 8.x through 8.0.0.1 CF12 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  • CVE-2014-3050Jul 29, 2014
    IBM
    Rational Team Concert
    risk 0.00cvss —epss 0.01

    IBM Rational Team Concert (RTC) 3.x before 3.0.1.6 IF3 and 4.x before 4.0.7 does not properly integrate with build engines, which allows remote authenticated users to discover credentials via unspecified vectors.

  • CVE-2014-3026Jul 29, 2014
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    CRLF injection vulnerability in IBM Maximo Asset Management 7.5 through 7.5.0.6, and 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via…

  • CVE-2014-3020Jul 29, 2014
    IBM
    Tivoli Integrated Portal
    risk 0.00cvss —epss 0.00

    install.sh in the Embedded WebSphere Application Server (eWAS) 7.0 before FP33 in IBM Tivoli Integrated Portal (TIP) 2.1 and 2.2 sets world-writable permissions for the installRoot directory tree, which allows local users to gain privileges via a Trojan horse program.

  • CVE-2014-0889Jul 29, 2014
    IBM
    Atlas Ediscovery Process Management
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in IBM Atlas Suite (aka Atlas Policy Suite), as used in Atlas eDiscovery Process Management through 6.0.3, Disposal and Governance Management for IT through 6.0.3, and Global Retention Policy and Schedule Management through…

  • CVE-2014-5116Jul 29, 2014
    Cairographics
    Cairo
    risk 0.04cvss —epss 0.08

    The cairo_image_surface_get_data function in Cairo 1.10.2, as used in GTK+ and Wireshark, allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via a large string.

  • CVE-2014-5115Jul 29, 2014
    DirPHP
    DirPHP
    risk 0.04cvss —epss 0.06

    Absolute path traversal vulnerability in DirPHP 1.0 allows remote attackers to read arbitrary files via a full pathname in the phpfile parameter to index.php.

  • CVE-2014-5114Jul 29, 2014
    Webidsupport
    Webid
    risk 0.00cvss —epss 0.02

    WeBid 1.1.1 allows remote attackers to conduct an LDAP injection attack via the (1) js or (2) cat parameter.

  • CVE-2014-5031Jul 29, 2014
    Apple Inc.
    Cups
    risk 0.00cvss —epss 0.03

    The web interface in CUPS before 2.0 does not check that files have world-readable permissions, which allows remote attackers to obtains sensitive information via unspecified vectors.

  • CVE-2014-5030Jul 29, 2014
    Apple Inc.
    Cups
    risk 0.00cvss —epss 0.00

    CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3) index.pl, (4) index.php, (5) index.pyc, or (6) index.py.

  • CVE-2014-5029Jul 29, 2014
    Apple Inc.
    Cups
    risk 0.00cvss —epss 0.00

    The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language[0] set to null. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3537.

  • CVE-2014-4909Jul 29, 2014
    Transmissionbt
    Transmission
    risk 0.00cvss —epss 0.05

    Integer overflow in the tr_bitfieldEnsureNthBitAlloced function in bitfield.c in Transmission before 2.84 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted peer message, which triggers an out-of-bounds write.

  • CVE-2014-4710Jul 29, 2014
    Zero CMS
    Zerocms
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in zero_user_account.php in ZeroCMS 1.0 allows remote attackers to inject arbitrary web script or HTML via the Full Name field.

  • CVE-2014-2226Jul 29, 2014
    UI
    Unifi Controller
    risk 0.00cvss —epss 0.01

    Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors.

  • CVE-2014-0475Jul 29, 2014
    GNU
    Glibc
    risk 0.00cvss —epss 0.03

    Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment…

  • CVE-2014-0103Jul 29, 2014
    Zarafa
    Zarafa
    risk 0.00cvss —epss 0.00

    WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.

  • CVE-2014-3553Jul 29, 2014
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    mod/forum/classes/post_form.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce the moodle/site:accessallgroups capability requirement before proceeding with a post to all groups, which allows remote…

  • CVE-2014-3552Jul 29, 2014
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    The Shibboleth authentication plugin in auth/shibboleth/index.php in Moodle through 2.3.11, 2.4.x before 2.4.11, and 2.5.x before 2.5.7 does not check whether a session ID is empty, which allows remote authenticated users to hijack sessions via crafted plugin interaction.

  • CVE-2014-3551Jul 29, 2014
    Moodle
    Moodle
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via a…