VYPR

CVEs

390,345 total · page 6555 of 7,807

AllCriticalHighKEV
  • CVE-2014-2482Jul 17, 2014
    Oracle Corporation
    E Business Suite
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Oracle Concurrent Processing component in Oracle E-Business Suite 12.1.3, 12.2.2, and 12.2.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.

  • CVE-2014-2481Jul 17, 2014
    Oracle Corporation
    Fusion Middleware
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than…

  • CVE-2014-2480Jul 17, 2014
    Oracle Corporation
    Fusion Middleware
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than…

  • CVE-2014-2479Jul 17, 2014
    Oracle Corporation
    Fusion Middleware
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS - Web Services.

  • CVE-2014-2477Jul 17, 2014
    Oracle Corporation
    VM Virtualbox
    risk 0.04cvss —epss 0.07

    Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, and 4.3.12 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than…

  • CVE-2014-2456Jul 17, 2014
    Oracle Corporation
    Peoplesoft Products
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the PeopleSoft Enterprise ELS Enterprise Learning Management component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.

  • CVE-2014-0436Jul 17, 2014
    Oracle Corporation
    Hyperion
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Hyperion BI+ component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote attackers to affect integrity via unknown vectors related to Web Analysis.

  • CVE-2013-5855Jul 17, 2014
    Oracle Corporation
    Mojarra
    risk 0.00cvss —epss 0.05

    Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via…

  • CVE-2014-4977Jul 16, 2014
    SonicWall
    Scrutinizer
    risk 0.09cvss —epss 0.75

    Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) selectedUserGroup parameter in a create new user request to cgi-bin/admin.cgi or the (2) user_id parameter in the changeUnit…

  • CVE-2014-4976Jul 16, 2014
    SonicWall
    Scrutinizer
    risk 0.00cvss —epss 0.03

    Dell SonicWall Scrutinizer 11.0.1 allows remote authenticated users to change user passwords via the user ID in the savePrefs parameter in a change password request to cgi-bin/admin.cgi.

  • CVE-2014-4347Jul 16, 2014
    Citrix Systems
    Access Gateway
    risk 0.00cvss —epss 0.02

    Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (formerly Access Gateway Enterprise Edition) before 9.3-62.4 and 10.x before 10.1-126.12 allows attackers to obtain sensitive information via vectors related to a cookie.

  • CVE-2014-4346Jul 16, 2014
    Citrix Systems
    Access Gateway
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in administration user interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (formerly Access Gateway Enterprise Edition) 10.1 before 10.1-126.12 allows remote attackers to inject arbitrary web script…

  • CVE-2014-4154Jul 16, 2014
    Zte
    Zxv10 W300 Firmware
    risk 0.04cvss —epss 0.07

    ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the PPPoE/PPPoA password via a direct request for basic/tc2wanfun.js.

  • CVE-2014-4018Jul 16, 2014
    Zte
    Zxv10 W300 Firmware
    risk 0.04cvss —epss 0.06

    The ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK has a default password of admin for the admin account, which makes it easier for remote attackers to obtain access via unspecified vectors.

  • CVE-2014-3777Jul 16, 2014
    Reportico Web
    PHP Report Designer
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in Reportico PHP Report Designer before 4.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the xmlin parameter.

  • CVE-2014-3427Jul 16, 2014
    Yealink
    phones
    risk 0.03cvss —epss 0.05

    CRLF injection vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the model parameter to servlet.

  • CVE-2013-5755Jul 16, 2014
    Yealink
    Sip T38g
    risk 0.03cvss —epss 0.04

    config/.htpasswd in Yealink IP Phone SIP-T38G has a hardcoded password of (1) user (s7C9Cx.rLsWFA) for the user account, (2) admin (uoCbM.VEiKQto) for the admin account, and (3) var (jhl3iZAe./qXM) for the var account, which makes it easier for remote attackers to obtain access…

  • CVE-2014-2622Jul 16, 2014
    Microfocus
    Intelligent Management Center
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in HP Intelligent Management Center (iMC) before 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before 7.0 E0201P02 allows remote authenticated users to obtain sensitive information or modify data via unknown vectors, aka ZDI-CAN-2312.

  • CVE-2014-2621Jul 16, 2014
    Microfocus
    Intelligent Management Center
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in HP Intelligent Management Center (iMC) before 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before 7.0 E0201P02 allows remote attackers to obtain sensitive information via unknown vectors, aka ZDI-CAN-2090.

  • CVE-2014-2620Jul 16, 2014
    Microfocus
    Intelligent Management Center
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in HP Intelligent Management Center (iMC) before 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before 7.0 E0201P02 allows remote attackers to obtain sensitive information via unknown vectors, aka ZDI-CAN-2089.

  • CVE-2014-2619Jul 16, 2014
    Microfocus
    Intelligent Management Center
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in HP Intelligent Management Center (iMC) before 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before 7.0 E0201P02 allows remote attackers to obtain sensitive information via unknown vectors, aka ZDI-CAN-2088.

  • CVE-2014-2618Jul 16, 2014
    Microfocus
    Intelligent Management Center
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in HP Intelligent Management Center (iMC) before 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before 7.0 E0201P02 allows remote attackers to obtain sensitive information via unknown vectors, aka ZDI-CAN-2080.

  • CVE-2014-2606Jul 16, 2014
    Microfocus
    StoreVirtual 4000 Storage
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in HP StoreVirtual 4000 Storage and StoreVirtual VSA 9.5 through 11.0 allows remote authenticated users to gain privileges via unknown vectors.

  • CVE-2014-2605Jul 16, 2014
    Microfocus
    StoreVirtual 4000 Storage
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in HP StoreVirtual 4000 Storage and StoreVirtual VSA 9.5 through 11.0 allows remote attackers to obtain sensitive information via unknown vectors.

  • CVE-2014-4965Jul 15, 2014
    Shopizer Ecommerce
    Shopizer
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) customername parameter to central/orders/searchcriteria.action; (2) productname, (3) availability, or (4) status parameter…

  • CVE-2014-4964Jul 15, 2014
    Shopizer Ecommerce
    Shopizer
    risk 0.03cvss —epss 0.02

    Multiple cross-site request forgery (CSRF) vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to hijack the authentication of users for requests that (1) modify customer settings or hijack the authentication of administrators for requests that change (2)…

  • CVE-2014-4963Jul 15, 2014
    Shopizer Ecommerce
    Shopizer
    risk 0.03cvss —epss 0.04

    Shopizer 1.1.5 and earlier allows remote attackers to modify the account settings of arbitrary users via the customer.customerId parameter to shop/profile/register.action.

  • CVE-2014-4962Jul 15, 2014
    Shopizer Ecommerce
    Shopizer
    risk 0.03cvss —epss 0.05

    Shopizer 1.1.5 and earlier allows remote attackers to reduce the total cost of their shopping cart via a negative number in the productQuantity parameter, which causes the price of the item to be subtracted from the total cost.

  • CVE-2014-4663Jul 15, 2014
    TimThumb
    TimThumb
    risk 0.04cvss —epss 0.10

    TimThumb 2.8.13 and WordThumb 1.07, when Webshot (aka Webshots) is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the src parameter.

  • CVE-2014-4031Jul 15, 2014
    Arubanetworks
    Clearpass
    risk 0.00cvss —epss 0.01

    The Policy Manager in Aruba Networks ClearPass 5.x, 6.0.x, 6.1.x through 6.1.4.61696, 6.2.x through 6.2.6.62196, and 6.3.x before 6.3.4 allows remote authenticated users to obtain database credentials via unspecified vectors.

  • CVE-2014-3953Jul 15, 2014
    FreeBSD
    FreeBSD
    risk 0.00cvss —epss 0.00

    FreeBSD 8.4 before p14, 9.1 before p17, 9.2 before p10, and 10.0 before p7 does not properly initialize certain data structures, which allows local users to obtain sensitive information from kernel memory via a (1) SCTP_SNDRCV, (2) SCTP_EXTRCV, or (3) SCTP_RCVINFO SCTP cmsg or a…

  • CVE-2014-3952Jul 15, 2014
    FreeBSD
    FreeBSD
    risk 0.00cvss —epss 0.00

    FreeBSD 8.4 before p14, 9.1 before p17, 9.2 before p10, and 10.0 before p7 does not properly initialize the buffer between the header and data of a control message, which allows local users to obtain sensitive information from kernel memory via unspecified vectors.

  • CVE-2014-3419Jul 15, 2014
    Infoblox
    Netmri
    risk 0.00cvss —epss 0.00

    Infoblox NetMRI before 6.8.5 has a default password of admin for the "root" MySQL database account, which makes it easier for local users to obtain access via unspecified vectors.

  • CVE-2014-3418Jul 15, 2014
    Infoblox
    Netmri
    risk 0.04cvss —epss 0.07

    config/userAdmin/login.tdf in Infoblox NetMRI before 6.8.5 allows remote attackers to execute arbitrary commands via shell metacharacters in the skipjackUsername parameter.

  • CVE-2014-1474Jul 15, 2014
    Bestpractical
    Rt
    risk 0.00cvss —epss 0.02

    Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remote attackers to cause a denial of service (CPU consumption) via a string without an address.

  • CVE-2014-3319Jul 14, 2014
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in the Real-Time Monitoring Tool (RTMT) in Cisco Unified Communications Manager (CM) 10.0(1) allows remote authenticated users to read arbitrary files via a crafted URL, aka Bug ID CSCup57676.

  • CVE-2014-3317Jul 14, 2014
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in the Multiple Analyzer in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager 10.0(1) allows remote authenticated users to delete arbitrary files via a crafted URL, aka Bug ID CSCup76314.

  • CVE-2014-2955Jul 14, 2014
    Raritan
    Px
    risk 0.00cvss —epss 0.03

    Raritan PX before 1.5.11 on DPXR20A-16 devices allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password.

  • CVE-2014-2951Jul 14, 2014
    Datumsystems
    Snip
    risk 0.00cvss —epss 0.02

    Datum Systems SnIP on PSM-500 and PSM-4500 devices has a hardcoded password of admin for the admin account, which makes it easier for remote attackers to obtain access via unspecified vectors.

  • CVE-2014-2950Jul 14, 2014
    Datumsystems
    Snip
    risk 0.00cvss —epss 0.02

    Datum Systems SnIP on PSM-500 and PSM-4500 devices does not require authentication for FTP sessions, which allows remote attackers to obtain sensitive information via RETR commands.

  • CVE-2014-2926Jul 14, 2014
    Kaseya
    Virtual System Administrator
    risk 0.00cvss —epss 0.00

    kapfa.sys in Kaseya Virtual System Administrator (VSA) 6.5 before 6.5.0.17 and 7.0 before 7.0.0.16 allows local users to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors.

  • CVE-2013-6691Jul 14, 2014
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.02

    The WebVPN CIFS implementation in Cisco Adaptive Security Appliance (ASA) Software 9.0(.4.1) and earlier allows remote CIFS servers to cause a denial of service (device reload) via a long share list, aka Bug ID CSCuj83344.

  • CVE-2013-5567Jul 14, 2014
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.02

    Cisco Adaptive Security Appliance (ASA) Software 8.4(.6) and earlier, when using an unsupported configuration with overlapping criteria for filtering and inspection, allows remote attackers to cause a denial of service (traffic loop and device crash) via a packet that triggers…

  • CVE-2014-4946Jul 14, 2014
    Horde (software)
    Groupware
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via (1) unspecified flags or (2) a mailbox name in the…

  • CVE-2014-4945Jul 14, 2014
    Horde (software)
    Groupware
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via an unspecified flag in the basic (1) mailbox or (2)…

  • CVE-2014-4944Jul 14, 2014
    WordPress
    Bsk PDF Manager
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) categoryid or (2) pdfid parameter to wp-admin/admin.php.

  • CVE-2014-4013Jul 14, 2014
    Arubanetworks
    Clearpass
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Policy Manager in Aruba Networks ClearPass 5.x, 6.0.x, 6.1.x through 6.1.4.61696, 6.2.x through 6.2.6.62196, and 6.3.x before 6.3.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2014-4942Jul 11, 2014
    WordPress
    Wp Easycart
    risk 0.00cvss —epss 0.05

    The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo function.

  • CVE-2014-4941Jul 11, 2014
    WordPress
    Cross-RSS
    risk 0.00cvss —epss 0.04

    Absolute path traversal vulnerability in Cross-RSS (wp-cross-rss) plugin 1.7 for WordPress allows remote attackers to read arbitrary files via a full pathname in the rss parameter to proxy.php.

  • CVE-2014-4940Jul 11, 2014
    WordPress
    Tera Charts
    risk 0.05cvss —epss 0.19

    Multiple directory traversal vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the fn parameter to (1) charts/treemap.php or (2) charts/zoomabletreemap.php.