VYPR

CVEs

390,383 total · page 6551 of 7,808

AllCriticalHighKEV
  • CVE-2014-2974Jul 28, 2014
    Silver Peak
    Vx
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in php/user_account.php in Silver Peak VX through 6.2.4 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts.

  • CVE-2013-4840Jul 28, 2014
    Microfocus
    Secbladefw
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in HP and H3C VPN Firewall Module products SECPATH1000FE before 5.20.R3177 and SECBLADEFW before 5.20.R3177 allows remote attackers to cause a denial of service via unknown vectors.

  • CVE-2014-5113Jul 28, 2014
    Visualware
    Myconnection Server
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in test.php in Visualware MyConnection Server 9.7i allow remote attackers to inject arbitrary web script or HTML via the (1) testtype, (2) ver, (3) cm, (4) map, (5) lines, (6) pps, (7) bpp, (8) codec, (9) provtext, (10)…

  • CVE-2014-5112Jul 28, 2014
    Fonality
    trixbox
    risk 0.04cvss —epss 0.09

    maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter.

  • CVE-2014-5111Jul 28, 2014
    Fonality
    trixbox
    risk 0.05cvss —epss 0.22

    Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a .. (dot dot) in the lang parameter to (1) home/index.php, (2) asterisk_info/asterisk_info.php, (3) repo/repo.php, or (4) endpointcfg/endpointcfg.php in…

  • CVE-2014-5110Jul 28, 2014
    Fonality
    trixbox
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in user/help/html/index.php in Fonality trixbox allows remote attackers to inject arbitrary web script or HTML via the id_nodo parameter.

  • CVE-2014-5109Jul 28, 2014
    Fonality
    trixbox
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in maint/modules/endpointcfg/endpoint_generic.php in Fonality trixbox allows remote attackers to execute arbitrary SQL commands via the mac parameter in a Submit action.

  • CVE-2014-5108Jul 28, 2014
    Concrete5
    Concrete5
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in single_pages\download_file.php in concrete5 before 5.6.3 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to index.php/download_file.

  • CVE-2014-5107Jul 28, 2014
    Concrete5
    Concrete5
    risk 0.00cvss —epss 0.03

    concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a direct request to (1) system/basics/editor.php, (2) system/view.php, (3) system/environment/file_storage_locations.php, (4) system/mail/importers.php, (5) system/mail/method.php, (6)…

  • CVE-2014-5106Jul 28, 2014
    Invision Power Services
    Power Board
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.4.x through 3.4.6 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to admin/install/index.php.

  • CVE-2014-5105Jul 28, 2014
    Ol Commerce Project
    Ol Commerce
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ol-commerce 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) a_country parameter in a process action to affiliate_signup.php or (2) entry_country_id parameter in an edit action to…

  • CVE-2014-5104Jul 28, 2014
    Ol Commerce Project
    Ol Commerce
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) a_country parameter in a process action to affiliate_signup.php, (2) affiliate_banner_id parameter to affiliate_show_banner.php, (3) country parameter…

  • CVE-2014-4726Jul 27, 2014
    Mailpoet
    Mailpoet Newsletters
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.8 for WordPress has unspecified impact and attack vectors.

  • CVE-2014-4725Jul 27, 2014
    Mailpoet
    Mailpoet Newsletters
    risk 0.01cvss —epss 0.61

    The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in…

  • CVE-2014-4971Jul 26, 2014
    Microsoft
    Windows Xp
    risk 0.05cvss —epss 0.23

    Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ…

  • CVE-2014-4857Jul 26, 2014
    Gurock
    Testrail
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Gurock TestRail before 3.1.3 allows remote attackers to inject arbitrary web script or HTML via the Created By field in a project activity.

  • CVE-2014-4748Jul 26, 2014
    IBM
    Sametime
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Classic Meeting Server in IBM Sametime 8.x through 8.5.2.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2014-4747Jul 26, 2014
    IBM
    Sametime
    risk 0.00cvss —epss 0.01

    The Classic Meeting Server in IBM Sametime 8.x through 8.5.2.1 allows physically proximate attackers to discover a meeting password hash by leveraging access to an unattended workstation to read HTML source code within a victim's browser.

  • CVE-2014-2966Jul 26, 2014
    Caucho Technology
    Resin
    risk 0.00cvss —epss 0.02

    The ISO-8859-1 encoder in Resin Pro before 4.0.40 does not properly perform Unicode transformations, which allows remote attackers to bypass intended text restrictions via crafted characters, as demonstrated by bypassing an XSS protection mechanism.

  • CVE-2014-2626Jul 26, 2014
    Microfocus
    Network Virtualization
    risk 0.02cvss —epss 0.19

    Directory traversal vulnerability in the toServerObject function in HP Network Virtualization 8.6 (aka Shunra Network Virtualization) allows remote attackers to create files, and consequently execute arbitrary code, via crafted input, aka ZDI-CAN-2024.

  • CVE-2014-2625Jul 26, 2014
    Microfocus
    Network Virtualization
    risk 0.01cvss —epss 0.10

    Directory traversal vulnerability in the storedNtxFile function in HP Network Virtualization 8.6 (aka Shunra Network Virtualization) allows remote attackers to read arbitrary files via crafted input, aka ZDI-CAN-2023.

  • CVE-2014-4979Jul 26, 2014
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.04

    Apple QuickTime allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a malformed version number and flags in an mvhd atom.

  • CVE-2014-4858Jul 26, 2014
    Sabreairlinesolutions
    AirCentre Crew
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in CWPLogin.aspx in Sabre AirCentre Crew products 2010.2.12.20008 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password field.

  • CVE-2014-3328Jul 26, 2014
    Cisco Systems, Inc.
    Unified Presence Server
    risk 0.00cvss —epss 0.03

    The Intercluster Sync Agent Service in Cisco Unified Presence Server allows remote attackers to cause a denial of service via a TCP SYN flood, aka Bug ID CSCun34125.

  • CVE-2014-3326Jul 26, 2014
    Cisco Systems, Inc.
    Security Manager
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the web framework in Cisco Security Manager 4.5 and 4.6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCup26957.

  • CVE-2014-3324Jul 26, 2014
    Cisco Systems, Inc.
    Telepresence Server Software
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the login page in the administrative web interface in Cisco TelePresence Server Software 4.0(2.8) allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug ID CSCup90060.

  • CVE-2014-3305Jul 26, 2014
    Cisco Systems, Inc.
    Webex Meetings Server
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCuj81735.

  • CVE-2014-3301Jul 26, 2014
    Cisco Systems, Inc.
    Webex Meetings Server
    risk 0.00cvss —epss 0.02

    The ProfileAction controller in Cisco WebEx Meetings Server (CWMS) 1.5(.1.131) and earlier allows remote attackers to obtain sensitive information by reading stack traces in returned messages, aka Bug ID CSCuj81700.

  • CVE-2014-3071Jul 26, 2014
    IBM
    Infosphere Information Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Data Quality Console in IBM InfoSphere Information Server 11.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL for adding a project connection.

  • CVE-2014-2363Jul 26, 2014
    Morpho
    Itemiser 3
    risk 0.00cvss —epss 0.02

    Morpho Itemiser 3 8.17 has hardcoded administrative credentials, which makes it easier for remote attackers to obtain access via a login request.

  • CVE-2014-5103Jul 25, 2014
    Zoho
    ManageEngine EventLog Analyzer
    risk 0.00cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine EventLog Analyzer 9 build 9000 allows remote attackers to inject arbitrary web script or HTML via the j_username parameter to event/j_security_check. Fixed in Version 10 Build 10000.

  • CVE-2014-5102Jul 25, 2014
    Jelsoft
    Vbulletin
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in vBulletin 5.0.4 through 5.1.3 Alpha 5 allows remote attackers to execute arbitrary SQL commands via the criteria[startswith] parameter to ajax/render/memberlist_items.

  • CVE-2014-5101Jul 25, 2014
    Webidsupport
    Webid
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in WeBid 1.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) TPL_name, (2) TPL_nick, (3) TPL_email, (4) TPL_year, (5) TPL_address, (6) TPL_city, (7) TPL_prov, (8) TPL_zip, (9) TPL_phone, (10)…

  • CVE-2014-5100Jul 25, 2014
    Omeka
    Omeka
    risk 0.03cvss —epss 0.02

    Multiple cross-site request forgery (CSRF) vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the authentication of administrators for requests that (1) add a new super user account via a request to admin/users/add, (2) insert cross-site scripting (XSS)…

  • CVE-2014-5027Jul 25, 2014
    Reviewboard
    Reviewboard
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via a query parameter to a diff fragment page.

  • CVE-2014-2227Jul 25, 2014
    UI
    Unifi Video
    risk 0.03cvss —epss 0.02

    The default Flash cross-domain policy (crossdomain.xml) in Ubiquiti Networks UniFi Video (formerly AirVision aka AirVision Controller) before 3.0.1 does not restrict access to the application, which allows remote attackers to bypass the Same Origin Policy via a crafted SWF file.

  • CVE-2014-5024Jul 24, 2014
    SonicWall
    Analyzer
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in sgms/panelManager in Dell SonicWALL GMS, Analyzer, and UMA before 7.2 SP1 allows remote attackers to inject arbitrary web script or HTML via the node_id parameter.

  • CVE-2014-5015Jul 24, 2014
    Eterna
    Bozohttpd
    risk 0.00cvss —epss 0.02

    bozotic HTTP server (aka bozohttpd) before 20140708, as used in NetBSD, truncates paths when checking .htpasswd restrictions, which allows remote attackers to bypass the HTTP authentication scheme and access restrictions via a long path.

  • CVE-2014-4927Jul 24, 2014
    Netgear
    Wgr614
    risk 0.04cvss —epss 0.11

    Buffer overflow in ACME micro_httpd, as used in D-Link DSL2750U and DSL2740U and NetGear WGR614 and MR-ADSL-DG834 routers allows remote attackers to cause a denial of service (crash) via a long string in the URI in a GET request.

  • CVE-2014-4910Jul 24, 2014
    Xorg
    xf86-video-intel
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in tools/backlight_helper.c in X.Org xf86-video-intel 2.99.911 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the interface name.

  • CVE-2014-4736Jul 24, 2014
    Blogengine
    E2
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in E2 before 2.4 (2845) allows remote attackers to execute arbitrary SQL commands via the note-id parameter to @actions/comment-process.

  • CVE-2014-4686Jul 24, 2014
    Siemens Foundation
    Wincc
    risk 0.00cvss —epss 0.01

    The Project administration application in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, has a hardcoded encryption key, which allows remote attackers to obtain sensitive information by extracting this key from another product installation and then…

  • CVE-2014-4685Jul 24, 2014
    Siemens Foundation
    Wincc
    risk 0.00cvss —epss 0.00

    Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows local users to gain privileges by leveraging weak system-object access control.

  • CVE-2014-4684Jul 24, 2014
    Siemens Foundation
    Wincc
    risk 0.00cvss —epss 0.01

    The database server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote authenticated users to gain privileges via a request to TCP port 1433.

  • CVE-2014-4683Jul 24, 2014
    Siemens Foundation
    Wincc
    risk 0.00cvss —epss 0.01

    The WebNavigator server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote authenticated users to gain privileges via a (1) HTTP or (2) HTTPS request.

  • CVE-2014-4682Jul 24, 2014
    Siemens Foundation
    Wincc
    risk 0.00cvss —epss 0.02

    The WebNavigator server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote attackers to obtain sensitive information via an HTTP request.

  • CVE-2014-3322Jul 24, 2014
    Cisco Systems, Inc.
    iOS Xr
    risk 0.00cvss —epss 0.01

    Cisco IOS XR 4.3(.2) and earlier on ASR 9000 devices does not properly perform NetFlow sampling of IP packets, which allows remote attackers to cause a denial of service (chip and card hangs) via malformed (1) IPv4 or (2) IPv6 packets, aka Bug ID CSCuo68417.

  • CVE-2014-3110Jul 24, 2014
    Honeywell
    Falcon Xlweb Linux Controller
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities on Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to inject arbitrary web script or HTML via invalid input.

  • CVE-2014-2971Jul 24, 2014
    Micropact
    Icomplaints
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in AddStdLetter.jsp in MicroPact iComplaints before 8.0.2.1.8.8014 allows remote authenticated users to inject arbitrary web script or HTML via the description parameter.

  • CVE-2014-2968Jul 24, 2014
    Huawei
    E355
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the web interface on the Huawei E355 CH1E355SM modem with software 21.157.37.01.910 and Web UI 11.001.08.00.03 allows remote attackers to inject arbitrary web script or HTML via an SMS message.