CVEs

390,379 total · page 6553 of 7,808

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2014-4341	Mit Kerberos 5	0.00	—	0.07	Jul 20, 2014	MIT Kerberos 5 (aka krb5) before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) by injecting invalid tokens into a GSSAPI application session.
CVE-2014-3894	Phpkobo Multifunctional Mailform Free	0.00	—	0.01	Jul 20, 2014	Cross-site scripting (XSS) vulnerability in PHP Kobo Multifunctional MailForm Free 2014/1/28 and earlier allows remote attackers to inject arbitrary web script or HTML via an HTTP Referer header.
CVE-2014-3892	Nexa Meridian	0.00	—	0.01	Jul 20, 2014	Cross-site scripting (XSS) vulnerability in Nexa Meridian before 2014 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-3886	Webmin Webmin	0.00	—	0.01	Jul 20, 2014	Cross-site scripting (XSS) vulnerability in Webmin before 1.690, when referrer checking is disabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this might overlap CVE-2014-3924.
CVE-2014-3885	Webmin Webmin	0.00	—	0.01	Jul 20, 2014	Cross-site scripting (XSS) vulnerability in Webmin before 1.690 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. NOTE: this might overlap CVE-2014-3924.
CVE-2014-3884	Usermin Usermin	0.00	—	0.01	Jul 20, 2014	Cross-site scripting (XSS) vulnerability in Usermin before 1.600 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this might overlap CVE-2014-3924.
CVE-2014-3523	Apache HTTP Server	0.01	—	0.16	Jul 20, 2014	Memory leak in the winnt_accept function in server/mpm/winnt/child.c in the WinNT MPM in the Apache HTTP Server 2.4.x before 2.4.10 on Windows, when the default AcceptFilter is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted…
CVE-2014-3162	Google Chrome	0.00	—	0.01	Jul 20, 2014	Multiple unspecified vulnerabilities in Google Chrome before 36.0.1985.125 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVE-2014-3161	Google Chrome	0.00	—	0.01	Jul 20, 2014	The WebMediaPlayerAndroid::load function in content/renderer/media/android/webmediaplayer_android.cc in Google Chrome before 36.0.1985.122 on Android does not properly interact with redirects, which allows remote attackers to bypass the Same Origin Policy via a crafted web site…
CVE-2014-3160	Google Chrome	0.00	—	0.01	Jul 20, 2014	The ResourceFetcher::canRequest function in core/fetch/ResourceFetcher.cpp in Blink, as used in Google Chrome before 36.0.1985.125, does not properly restrict subresource requests associated with SVG files, which allows remote attackers to bypass the Same Origin Policy via a…
CVE-2014-3159	Google Chrome	0.00	—	0.01	Jul 20, 2014	The WebContentsDelegateAndroid::OpenURLFromTab function in components/web_contents_delegate_android/web_contents_delegate_android.cc in Google Chrome before 36.0.1985.122 on Android does not properly restrict URL loading, which allows remote attackers to spoof the URL in the…
CVE-2014-1999	Fuelphp Fuelphp	0.00	—	0.03	Jul 20, 2014	The auto-format feature in the Request_Curl class in FuelPHP 1.1 through 1.7.1 allows remote attackers to execute arbitrary code via a crafted response.
CVE-2014-1996	Cybozu Garoon	0.00	—	0.03	Jul 20, 2014	Cybozu Garoon 3.7 before SP4 allows remote authenticated users to bypass intended access restrictions, and execute arbitrary code or cause a denial of service, via an API call.
CVE-2014-1995	Cybozu Garoon	0.00	—	0.01	Jul 20, 2014	Cross-site scripting (XSS) vulnerability in the Map search functionality in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-1994	Cybozu Garoon	0.00	—	0.01	Jul 20, 2014	Cross-site scripting (XSS) vulnerability in the Notices portlet in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-1993	Cybozu Garoon	0.00	—	0.01	Jul 20, 2014	The Portlets subsystem in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to bypass intended access restrictions via unspecified vectors.
CVE-2014-1992	Cybozu Garoon	0.00	—	0.01	Jul 20, 2014	Cross-site scripting (XSS) vulnerability in the Messages functionality in Cybozu Garoon 3.1.x, 3.5.x, and 3.7.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-1987	Cybozu Garoon	0.00	—	0.03	Jul 20, 2014	The CGI component in Cybozu Garoon 3.1.0 through 3.7 SP3 allows remote attackers to execute arbitrary commands via unspecified vectors.
CVE-2014-1973	Nextapp File Explorer	0.00	—	0.02	Jul 20, 2014	Directory traversal vulnerability in the NextApp File Explorer application before 2.1.0.3 for Android allows remote attackers to overwrite or create arbitrary files via a crafted filename.
CVE-2014-0231	Apache HTTP Server	0.04	—	0.44	Jul 20, 2014	The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.
CVE-2014-0226	Apache HTTP Server	0.10	—	0.86	Jul 20, 2014	Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers…
CVE-2014-0118	Apache HTTP Server	0.03	—	0.37	Jul 20, 2014	The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses…
CVE-2014-0117	Apache HTTP Server	0.03	—	0.36	Jul 20, 2014	The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.
CVE-2013-4352	Apache HTTP Server	0.01	—	0.12	Jul 20, 2014	The cache_invalidate function in modules/cache/cache_storage.c in the mod_cache module in the Apache HTTP Server 2.4.6, when a caching forward proxy is enabled, allows remote HTTP servers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that…
CVE-2014-4331	Octavocms Octavocms	0.00	—	0.02	Jul 19, 2014	Cross-site scripting (XSS) vulnerability in admin/viewer.php in OctavoCMS allows remote attackers to inject arbitrary web script or HTML via the src parameter.
CVE-2014-4943	Linux Kernel	0.00	—	0.02	Jul 19, 2014	The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket.
CVE-2014-3533	Xorg Dbus	0.00	—	0.00	Jul 19, 2014	dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allows local users to cause a denial of service (disconnect) via a certain sequence of crafted messages that cause the dbus-daemon to forward a message containing an invalid file descriptor.
CVE-2014-3532	Xorg Dbus	0.00	—	0.00	Jul 19, 2014	dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users to cause a denial of service (system-bus disconnect of other services or applications) by sending a message containing a file descriptor, then exceeding the maximum…
CVE-2014-3325	Cisco Systems, Inc. Unified Customer Voice Portal	0.00	—	0.01	Jul 19, 2014	Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Customer Voice Portal (CVP) allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug IDs CSCuh61711, CSCuh61720, CSCuh61723, CSCuh61726, CSCuh61727, CSCuh61731, and…
CVE-2014-2519	EMC Corporation Recoverpoint Appliance	0.00	—	0.02	Jul 19, 2014	The default configuration of EMC RecoverPoint Appliance (RPA) 4.1 before 4.1.0.1 does not enable a firewall, which allows remote attackers to obtain potentially sensitive information about open ports, or cause a denial of service, by sending packets to many ports.
CVE-2012-2682	Red Hat Enterprise Mrg	0.00	—	0.02	Jul 19, 2014	Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, allows attackers with certain database privileges to cause a denial of service (inaccessible page) via a non-ASCII character in the name of a link.
CVE-2013-7391	Drupal Entity API	0.00	—	0.01	Jul 19, 2014	The Entity API module 7.x-1.x before 7.x-1.2 for Drupal, when using the (a) Views field or (b) area plugins, allows remote attackers to read restricted entities via the (1) field, (2) header, or (3) footer of a View. NOTE: this identifier was SPLIT from CVE-2013-4273 per ADT5…
CVE-2013-4273	Drupal Entity API	0.00	—	0.01	Jul 19, 2014	The Entity API module 7.x-1.x before 7.x-1.2 for Drupal does not properly restrict access to node comments, which allows remote authenticated users to read the comments via unspecified vectors. NOTE: this identifier was SPLIT per ADT5 due to different researcher organizations.…
CVE-2014-3064	IBM Infosphere Master Data Management Server For Product Information Management	0.00	—	0.01	Jul 19, 2014	The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0 FP4 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote authenticated users to read arbitrary files via a crafted…
CVE-2014-3045	IBM Scale Out Network Attached Storage	0.00	—	0.00	Jul 19, 2014	IBM Scale Out Network Attached Storage (SONAS) 1.3.x and 1.4.x before 1.4.3.3 places an administrative password in the shell history upon use of the -p option to chuser, which allows local users to obtain sensitive information by leveraging root access.
CVE-2014-3043	IBM Storwize Unified V7000	0.00	—	0.02	Jul 19, 2014	IBM Storwize V7000 Unified 1.3.x and 1.4.x before 1.4.3.3 allows remote authenticated users to gain privileges by leveraging access to the service account.
CVE-2014-2368	Advantech Webaccess	0.00	—	0.02	Jul 19, 2014	The BrowseFolder method in the bwocxrun ActiveX control in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call.
CVE-2014-2367	Advantech Webaccess	0.00	—	0.02	Jul 19, 2014	The ChkCookie subroutine in an ActiveX control in broadweb/include/gChkCook.asp in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call.
CVE-2014-2366	Advantech Webaccess	0.00	—	0.01	Jul 19, 2014	upAdminPg.asp in Advantech WebAccess before 7.2 allows remote authenticated users to discover credentials by reading HTML source code.
CVE-2014-2365	Advantech Webaccess	0.00	—	0.02	Jul 19, 2014	Unspecified vulnerability in Advantech WebAccess before 7.2 allows remote authenticated users to create or delete arbitrary files via unknown vectors.
CVE-2014-2364	Advantech Webaccess	0.08	—	0.61	Jul 19, 2014	Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4) CCDParameter, (5) SetColor, (6) AlarmImage, (7) GetParameter, (8) GetColor, (9)…
CVE-2014-0970	IBM Infosphere Master Data Management Server For Product Information Management	0.00	—	0.01	Jul 19, 2014	The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0 FP4 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote authenticated users to inject links via unspecified vectors.
CVE-2014-0968	IBM Infosphere Master Data Management Server For Product Information Management	0.00	—	0.01	Jul 19, 2014	Cross-site scripting (XSS) vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0 FP4 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote authenticated…
CVE-2014-0967	IBM Infosphere Master Data Management Server For Product Information Management	0.00	—	0.01	Jul 19, 2014	Cross-site scripting (XSS) vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0 FP4 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote authenticated…
CVE-2014-3323	Cisco Systems, Inc. Unified Contact Center Enterprise	0.00	—	0.02	Jul 18, 2014	Directory traversal vulnerability in Cisco Unified Contact Center Enterprise allows remote authenticated users to read arbitrary web-root files via a crafted URL, aka Bug ID CSCun25262.
CVE-2014-3321	Cisco Systems, Inc. iOS Xr	0.00	—	0.01	Jul 18, 2014	Cisco IOS XR 4.3.4 and earlier on ASR 9000 devices, when bridge-group virtual interface (BVI) routing is enabled, allows remote attackers to cause a denial of service (chip and card hangs) via a series of crafted MPLS packets, aka Bug ID CSCuo91149.
CVE-2014-3320	Cisco Systems, Inc. Unified Communications Domain Manager	0.00	—	0.02	Jul 18, 2014	Multiple open redirect vulnerabilities in the admin web interface in the web framework in Cisco Unified Communications Domain Manager (CDM) 8.1(.4) and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted URLs for…
CVE-2014-3306	Cisco Systems, Inc. Epc3925	0.01	—	0.07	Jul 18, 2014	The web server on Cisco DPC3010, DPC3212, DPC3825, DPC3925, DPQ3925, EPC3010, EPC3212, EPC3825, and EPC3925 Wireless Residential Gateway products allows remote attackers to execute arbitrary code via a crafted HTTP request, aka Bug ID CSCup40808.
CVE-2014-2623	Microfocus Storage Data Protector	0.10	—	0.91	Jul 18, 2014	Unspecified vulnerability in HP Storage Data Protector 8.x allows remote attackers to execute arbitrary code via unknown vectors.
CVE-2014-0957	IBM Business Process Manager	0.00	—	0.01	Jul 18, 2014	Cross-site scripting (XSS) vulnerability in IBM Business Process Manager 7.5 through 8.5.5, and WebSphere Lombardi Edition 7.2, allows remote attackers to inject arbitrary web script or HTML via a crafted URL that triggers a service failure.

CVE-2014-4341Jul 20, 2014
Mit
Kerberos 5
risk 0.00cvss —epss 0.07
MIT Kerberos 5 (aka krb5) before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) by injecting invalid tokens into a GSSAPI application session.
CVE-2014-3894Jul 20, 2014
Phpkobo
Multifunctional Mailform Free
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in PHP Kobo Multifunctional MailForm Free 2014/1/28 and earlier allows remote attackers to inject arbitrary web script or HTML via an HTTP Referer header.
CVE-2014-3892Jul 20, 2014
Nexa
Meridian
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Nexa Meridian before 2014 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-3886Jul 20, 2014
Webmin
Webmin
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Webmin before 1.690, when referrer checking is disabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this might overlap CVE-2014-3924.
CVE-2014-3885Jul 20, 2014
Webmin
Webmin
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Webmin before 1.690 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. NOTE: this might overlap CVE-2014-3924.
CVE-2014-3884Jul 20, 2014
Usermin
Usermin
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Usermin before 1.600 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this might overlap CVE-2014-3924.
CVE-2014-3523Jul 20, 2014
Apache
HTTP Server
risk 0.01cvss —epss 0.16
Memory leak in the winnt_accept function in server/mpm/winnt/child.c in the WinNT MPM in the Apache HTTP Server 2.4.x before 2.4.10 on Windows, when the default AcceptFilter is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted…
CVE-2014-3162Jul 20, 2014
Google
Chrome
risk 0.00cvss —epss 0.01
Multiple unspecified vulnerabilities in Google Chrome before 36.0.1985.125 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVE-2014-3161Jul 20, 2014
Google
Chrome
risk 0.00cvss —epss 0.01
The WebMediaPlayerAndroid::load function in content/renderer/media/android/webmediaplayer_android.cc in Google Chrome before 36.0.1985.122 on Android does not properly interact with redirects, which allows remote attackers to bypass the Same Origin Policy via a crafted web site…
CVE-2014-3160Jul 20, 2014
Google
Chrome
risk 0.00cvss —epss 0.01
The ResourceFetcher::canRequest function in core/fetch/ResourceFetcher.cpp in Blink, as used in Google Chrome before 36.0.1985.125, does not properly restrict subresource requests associated with SVG files, which allows remote attackers to bypass the Same Origin Policy via a…
CVE-2014-3159Jul 20, 2014
Google
Chrome
risk 0.00cvss —epss 0.01
The WebContentsDelegateAndroid::OpenURLFromTab function in components/web_contents_delegate_android/web_contents_delegate_android.cc in Google Chrome before 36.0.1985.122 on Android does not properly restrict URL loading, which allows remote attackers to spoof the URL in the…
CVE-2014-1999Jul 20, 2014
Fuelphp
Fuelphp
risk 0.00cvss —epss 0.03
The auto-format feature in the Request_Curl class in FuelPHP 1.1 through 1.7.1 allows remote attackers to execute arbitrary code via a crafted response.
CVE-2014-1996Jul 20, 2014
Cybozu
Garoon
risk 0.00cvss —epss 0.03
Cybozu Garoon 3.7 before SP4 allows remote authenticated users to bypass intended access restrictions, and execute arbitrary code or cause a denial of service, via an API call.
CVE-2014-1995Jul 20, 2014
Cybozu
Garoon
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Map search functionality in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-1994Jul 20, 2014
Cybozu
Garoon
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Notices portlet in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-1993Jul 20, 2014
Cybozu
Garoon
risk 0.00cvss —epss 0.01
The Portlets subsystem in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to bypass intended access restrictions via unspecified vectors.
CVE-2014-1992Jul 20, 2014
Cybozu
Garoon
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Messages functionality in Cybozu Garoon 3.1.x, 3.5.x, and 3.7.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-1987Jul 20, 2014
Cybozu
Garoon
risk 0.00cvss —epss 0.03
The CGI component in Cybozu Garoon 3.1.0 through 3.7 SP3 allows remote attackers to execute arbitrary commands via unspecified vectors.
CVE-2014-1973Jul 20, 2014
Nextapp
File Explorer
risk 0.00cvss —epss 0.02
Directory traversal vulnerability in the NextApp File Explorer application before 2.1.0.3 for Android allows remote attackers to overwrite or create arbitrary files via a crafted filename.
CVE-2014-0231Jul 20, 2014
Apache
HTTP Server
risk 0.04cvss —epss 0.44
The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.
CVE-2014-0226Jul 20, 2014
Apache
HTTP Server
risk 0.10cvss —epss 0.86
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers…
CVE-2014-0118Jul 20, 2014
Apache
HTTP Server
risk 0.03cvss —epss 0.37
The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses…
CVE-2014-0117Jul 20, 2014
Apache
HTTP Server
risk 0.03cvss —epss 0.36
The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.
CVE-2013-4352Jul 20, 2014
Apache
HTTP Server
risk 0.01cvss —epss 0.12
The cache_invalidate function in modules/cache/cache_storage.c in the mod_cache module in the Apache HTTP Server 2.4.6, when a caching forward proxy is enabled, allows remote HTTP servers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that…
CVE-2014-4331Jul 19, 2014
Octavocms
Octavocms
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in admin/viewer.php in OctavoCMS allows remote attackers to inject arbitrary web script or HTML via the src parameter.
CVE-2014-4943Jul 19, 2014
Linux
Kernel
risk 0.00cvss —epss 0.02
The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket.
CVE-2014-3533Jul 19, 2014
Xorg
Dbus
risk 0.00cvss —epss 0.00
dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allows local users to cause a denial of service (disconnect) via a certain sequence of crafted messages that cause the dbus-daemon to forward a message containing an invalid file descriptor.
CVE-2014-3532Jul 19, 2014
Xorg
Dbus
risk 0.00cvss —epss 0.00
dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users to cause a denial of service (system-bus disconnect of other services or applications) by sending a message containing a file descriptor, then exceeding the maximum…
CVE-2014-3325Jul 19, 2014
Cisco Systems, Inc.
Unified Customer Voice Portal
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Customer Voice Portal (CVP) allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug IDs CSCuh61711, CSCuh61720, CSCuh61723, CSCuh61726, CSCuh61727, CSCuh61731, and…
CVE-2014-2519Jul 19, 2014
EMC Corporation
Recoverpoint Appliance
risk 0.00cvss —epss 0.02
The default configuration of EMC RecoverPoint Appliance (RPA) 4.1 before 4.1.0.1 does not enable a firewall, which allows remote attackers to obtain potentially sensitive information about open ports, or cause a denial of service, by sending packets to many ports.
CVE-2012-2682Jul 19, 2014
Red Hat
Enterprise Mrg
risk 0.00cvss —epss 0.02
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, allows attackers with certain database privileges to cause a denial of service (inaccessible page) via a non-ASCII character in the name of a link.
CVE-2013-7391Jul 19, 2014
Drupal
Entity API
risk 0.00cvss —epss 0.01
The Entity API module 7.x-1.x before 7.x-1.2 for Drupal, when using the (a) Views field or (b) area plugins, allows remote attackers to read restricted entities via the (1) field, (2) header, or (3) footer of a View. NOTE: this identifier was SPLIT from CVE-2013-4273 per ADT5…
CVE-2013-4273Jul 19, 2014
Drupal
Entity API
risk 0.00cvss —epss 0.01
The Entity API module 7.x-1.x before 7.x-1.2 for Drupal does not properly restrict access to node comments, which allows remote authenticated users to read the comments via unspecified vectors. NOTE: this identifier was SPLIT per ADT5 due to different researcher organizations.…
CVE-2014-3064Jul 19, 2014
IBM
Infosphere Master Data Management Server For Product Information Management
risk 0.00cvss —epss 0.01
The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0 FP4 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote authenticated users to read arbitrary files via a crafted…
CVE-2014-3045Jul 19, 2014
IBM
Scale Out Network Attached Storage
risk 0.00cvss —epss 0.00
IBM Scale Out Network Attached Storage (SONAS) 1.3.x and 1.4.x before 1.4.3.3 places an administrative password in the shell history upon use of the -p option to chuser, which allows local users to obtain sensitive information by leveraging root access.
CVE-2014-3043Jul 19, 2014
IBM
Storwize Unified V7000
risk 0.00cvss —epss 0.02
IBM Storwize V7000 Unified 1.3.x and 1.4.x before 1.4.3.3 allows remote authenticated users to gain privileges by leveraging access to the service account.
CVE-2014-2368Jul 19, 2014
Advantech
Webaccess
risk 0.00cvss —epss 0.02
The BrowseFolder method in the bwocxrun ActiveX control in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call.
CVE-2014-2367Jul 19, 2014
Advantech
Webaccess
risk 0.00cvss —epss 0.02
The ChkCookie subroutine in an ActiveX control in broadweb/include/gChkCook.asp in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call.
CVE-2014-2366Jul 19, 2014
Advantech
Webaccess
risk 0.00cvss —epss 0.01
upAdminPg.asp in Advantech WebAccess before 7.2 allows remote authenticated users to discover credentials by reading HTML source code.
CVE-2014-2365Jul 19, 2014
Advantech
Webaccess
risk 0.00cvss —epss 0.02
Unspecified vulnerability in Advantech WebAccess before 7.2 allows remote authenticated users to create or delete arbitrary files via unknown vectors.
CVE-2014-2364Jul 19, 2014
Advantech
Webaccess
risk 0.08cvss —epss 0.61
Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4) CCDParameter, (5) SetColor, (6) AlarmImage, (7) GetParameter, (8) GetColor, (9)…
CVE-2014-0970Jul 19, 2014
IBM
Infosphere Master Data Management Server For Product Information Management
risk 0.00cvss —epss 0.01
The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0 FP4 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote authenticated users to inject links via unspecified vectors.
CVE-2014-0968Jul 19, 2014
IBM
Infosphere Master Data Management Server For Product Information Management
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0 FP4 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote authenticated…
CVE-2014-0967Jul 19, 2014
IBM
Infosphere Master Data Management Server For Product Information Management
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0 FP4 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote authenticated…
CVE-2014-3323Jul 18, 2014
Cisco Systems, Inc.
Unified Contact Center Enterprise
risk 0.00cvss —epss 0.02
Directory traversal vulnerability in Cisco Unified Contact Center Enterprise allows remote authenticated users to read arbitrary web-root files via a crafted URL, aka Bug ID CSCun25262.
CVE-2014-3321Jul 18, 2014
Cisco Systems, Inc.
iOS Xr
risk 0.00cvss —epss 0.01
Cisco IOS XR 4.3.4 and earlier on ASR 9000 devices, when bridge-group virtual interface (BVI) routing is enabled, allows remote attackers to cause a denial of service (chip and card hangs) via a series of crafted MPLS packets, aka Bug ID CSCuo91149.
CVE-2014-3320Jul 18, 2014
Cisco Systems, Inc.
Unified Communications Domain Manager
risk 0.00cvss —epss 0.02
Multiple open redirect vulnerabilities in the admin web interface in the web framework in Cisco Unified Communications Domain Manager (CDM) 8.1(.4) and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted URLs for…
CVE-2014-3306Jul 18, 2014
Cisco Systems, Inc.
Epc3925
risk 0.01cvss —epss 0.07
The web server on Cisco DPC3010, DPC3212, DPC3825, DPC3925, DPQ3925, EPC3010, EPC3212, EPC3825, and EPC3925 Wireless Residential Gateway products allows remote attackers to execute arbitrary code via a crafted HTTP request, aka Bug ID CSCup40808.
CVE-2014-2623Jul 18, 2014
Microfocus
Storage Data Protector
risk 0.10cvss —epss 0.91
Unspecified vulnerability in HP Storage Data Protector 8.x allows remote attackers to execute arbitrary code via unknown vectors.
CVE-2014-0957Jul 18, 2014
IBM
Business Process Manager
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in IBM Business Process Manager 7.5 through 8.5.5, and WebSphere Lombardi Edition 7.2, allows remote attackers to inject arbitrary web script or HTML via a crafted URL that triggers a service failure.