VYPR

CVEs

390,341 total · page 6556 of 7,807

AllCriticalHighKEV
  • CVE-2014-3822Jul 11, 2014
    Juniper Networks
    Junos
    risk 0.00cvss —epss 0.02

    Juniper Junos 11.4 before 11.4R8, 12.1 before 12.1R5, 12.1X44 before 12.1X44-D20, 12.1X45 before 12.1X45-D15, 12.1X46 before 12.1X46-D10, and 12.1X47 before 12.1X47-D10 on SRX Series devices, allows remote attackers to cause a denial of service (flowd crash) via a malformed…

  • CVE-2014-3821Jul 11, 2014
    Juniper Networks
    Junos
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in SRX Web Authentication (webauth) in Juniper Junos 11.4 before 11.4R11, 12.1X44 before 12.1X44-D34, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, and 12.1X47 before 12.1X47-D10 allows remote attackers to inject arbitrary web…

  • CVE-2014-3819Jul 11, 2014
    Juniper Networks
    Junos
    risk 0.00cvss —epss 0.03

    Juniper Junos 11.4 before 11.4R12, 12.1 before 12.1R10, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, 12.1X47 before 12.1X47-D10, 12.2 before 12.2R8, 12.3 before 12.3R7, 13.1 before 13.1R4, 13.2 before 13.2R4, 13.3 before 13.3R2, and 14.1…

  • CVE-2014-3817Jul 11, 2014
    Juniper Networks
    Junos
    risk 0.00cvss —epss 0.03

    Juniper Junos 11.4 before 11.4R12, 12.1X44 before 12.1X44-D32, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, and 12.1X47 before 12.1X47-D10 on SRX Series devices, when NAT protocol translation from IPv4 to IPv6 is enabled, allows remote attackers to cause a denial of…

  • CVE-2014-3816Jul 11, 2014
    Juniper Networks
    Junos
    risk 0.00cvss —epss 0.02

    Juniper Junos 11.4 before 11.4R12, 12.1 before 12.1R11, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D30, 12.1X46 before 12.1X46-D20, 12.1X47 before 12.1X47-D10, 12.2 before 12.2R8-S2, 12.3 before 12.3R7, 13.1 before 13.1R4-S2, 13.2 before 13.2R5, 13.3 before 13.3R2-S2,…

  • CVE-2014-3815Jul 11, 2014
    Juniper Networks
    Junos
    risk 0.00cvss —epss 0.02

    Juniper Junos 12.1X46 before 12.1X46-D20 and 12.1X47 before 12.1X47-D10 on SRX Series devices allows remote attackers to cause a denial of service (flowd crash) via a crafted SIP packet.

  • CVE-2013-6117Jul 11, 2014
    Dahua
    DVR
    risk 0.09cvss —epss 0.70

    Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.

  • CVE-2014-4700Jul 11, 2014
    Citrix Systems
    Xendesktop
    risk 0.00cvss —epss 0.01

    Citrix XenDesktop 7.x, 5.x, and 4.x, when pooled random desktop groups is enabled and ShutdownDesktopsAfterUse is disabled, allows local guest users to gain access to another user's desktop via unspecified vectors.

  • CVE-2014-4167Jul 11, 2014
    OpenStack
    Neutron
    risk 0.00cvss —epss 0.02

    The L3-agent in OpenStack Neutron before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to cause a denial of service (IPv4 address attachment outage) by attaching an IPv6 private subnet to a L3 router.

  • CVE-2014-3992Jul 11, 2014
    Dolibarr
    Dolibarr
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote authenticated users to execute arbitrary SQL commands via the (1) entity parameter in an update action to user/fiche.php or (2) sortorder parameter to user/group/index.php.

  • CVE-2014-3991Jul 11, 2014
    Dolibarr
    Dolibarr
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary web script or HTML via the (1) dol_use_jmobile, (2) dol_optimize_smallscreen, (3) dol_no_mouse_hover, (4) dol_hide_topmenu, (5) dol_hide_leftmenu, (6)…

  • CVE-2014-3503Jul 11, 2014
    Apache
    Syncope
    risk 0.00cvss —epss 0.06

    Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

  • CVE-2014-3499Jul 11, 2014
    Docker
    Docker
    risk 0.00cvss —epss 0.00

    Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

  • CVE-2014-3485Jul 11, 2014
    Red Hat
    Enterprise Virtualization
    risk 0.00cvss —epss 0.01

    The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.

  • CVE-2014-0174Jul 11, 2014
    Red Hat
    Enterprise Mrg
    risk 0.00cvss —epss 0.02

    Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

  • CVE-2014-4908Jul 11, 2014
    Lingej
    Pnp4nagios
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in PNP4Nagios through 0.6.22 allow remote attackers to inject arbitrary web script or HTML via the URI used for reaching (1) share/pnp/application/views/kohana_error_page.php or (2) share/pnp/application/views/template.php,…

  • CVE-2014-4907Jul 11, 2014
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in share/pnp/application/views/kohana_error_page.php in PNP4Nagios before 0.6.22 allows remote attackers to inject arbitrary web script or HTML via a parameter that is not properly handled in an error message.

  • CVE-2014-4856Jul 10, 2014
    WordPress
    Polldaddy
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Polldaddy Polls & Ratings plugin before 2.0.25 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to a ratings shortcode and a unique ID. NOTE: some of these details are obtained from…

  • CVE-2014-4855Jul 10, 2014
    WordPress
    Polylang
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Polylang plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to a user description. NOTE: some of these details are obtained from third party information.

  • CVE-2014-4854Jul 10, 2014
    WordPress
    WP Construction Mode
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the WP Construction Mode plugin 1.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wuc_logo parameter in a save action to wp-admin/admin.php.

  • CVE-2014-4853Jul 10, 2014
    Opendocman
    Opendocman
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in odm-init.php in OpenDocMan before 1.2.7.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name of an uploaded file.

  • CVE-2014-4852Jul 10, 2014
    Thedigitalcraft
    Atomcms
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in admin/uploads.php in The Digital Craft AtomCMS, possibly 2.0, allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2014-4851Jul 10, 2014
    Foecms
    Foecms
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in msg.php in FoeCMS allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the r parameter.

  • CVE-2014-4850Jul 10, 2014
    Foecms
    Foecms
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in FoeCMS allows remote attackers to execute arbitrary SQL commands via the i parameter.

  • CVE-2014-4849Jul 10, 2014
    Foecms
    Foecms
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in msg.php in FoeCMS allow remote attackers to inject arbitrary web script or HTML via the (1) e or (2) r parameter.

  • CVE-2014-4848Jul 10, 2014
    WordPress
    Blogstand Banner
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Blogstand Banner (blogstand-smart-banner) plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the bs_blog_id parameter to wp-admin/options-general.php.

  • CVE-2014-4847Jul 10, 2014
    Buffercode
    Random Banner
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Random Banner plugin 1.1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the buffercode_RBanner_url_banner1 parameter in an update action to wp-admin/options.php.

  • CVE-2014-4846Jul 10, 2014
    WordPress
    Metaslider
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Meta Slider (ml-slider) plugin 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter to wp-admin/admin.php.

  • CVE-2014-4845Jul 10, 2014
    WordPress
    BannerMan
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the BannerMan plugin 0.2.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the bannerman_background parameter to wp-admin/options-general.php.

  • CVE-2014-4698Jul 10, 2014
    PHP
    PHP
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in ext/spl/spl_array.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted ArrayIterator usage within applications in certain web-hosting…

  • CVE-2014-4670Jul 10, 2014
    PHP
    PHP
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in ext/spl/spl_dllist.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted iterator usage within applications in certain web-hosting…

  • CVE-2014-3888Jul 10, 2014
    Yokogawa
    Exaopc
    risk 0.08cvss —epss 0.62

    Stack-based buffer overflow in BKFSim_vhfd.exe in Yokogawa CENTUM CS 1000, CENTUM CS 3000 R3.09.50 and earlier, CENTUM VP R5.03.20 and earlier, Exaopc R3.72.00 and earlier, B/M9000CS R5.05.01 and earlier, and B/M9000 VP R7.03.01 and earlier, when FCS/Test Function is enabled,…

  • CVE-2014-3318Jul 10, 2014
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in dna/viewfilecontents.do in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via a crafted URL, aka Bug ID CSCup76318.

  • CVE-2014-3316Jul 10, 2014
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.02

    The Multiple Analyzer in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote authenticated users to bypass intended upload restrictions via a crafted parameter, aka Bug ID CSCup76297.

  • CVE-2014-3315Jul 10, 2014
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in viewfilecontents.do in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCup76308.

  • CVE-2014-3311Jul 10, 2014
    Cisco Systems, Inc.
    Webex Meeting Center
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in the file-sharing feature in WebEx Meetings Client in Cisco WebEx Meetings Server and WebEx Meeting Center allows remote attackers to execute arbitrary code via crafted data, aka Bug IDs CSCup62463 and CSCup58467.

  • CVE-2014-3310Jul 10, 2014
    Cisco Systems, Inc.
    Webex Meeting Center
    risk 0.00cvss —epss 0.01

    The File Transfer feature in WebEx Meetings Client in Cisco WebEx Meetings Server and WebEx Meeting Center does not verify that a requested file was an offered file, which allows remote attackers to read arbitrary files via a modified request, aka Bug IDs CSCup62442 and…

  • CVE-2014-2963Jul 10, 2014
    Liferay
    Portal
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in group/control_panel/manage in Liferay Portal 6.1.2 CE GA3, 6.1.X EE, and 6.2.X EE allow remote attackers to inject arbitrary web script or HTML via the (1) _2_firstName, (2) _2_lastName, or (3) _2_middleName parameter.

  • CVE-2014-4744Jul 9, 2014
    Osticket
    Osticket
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in osTicket before 1.9.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone Number field to open.php or (2) Phone number field, (3) passwd1 field, (4) passwd2 field, or (5) do parameter to…

  • CVE-2014-4743Jul 9, 2014
    Kajona
    Kajona
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in (1) search_ajax.tpl and (2) search_ajax_small.tpl in templates/default/tpl/module_search/ in the Search module (module_search) in Kajona before 4.5 allow remote attackers to inject arbitrary web script or HTML via the search…

  • CVE-2014-4742Jul 9, 2014
    Kajona
    Kajona
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in system/class_link.php in the System module (module_system) in Kajona before 4.5 allows remote attackers to inject arbitrary web script or HTML via the systemid parameter in a mediaFolder action to index.php.

  • CVE-2014-4741Jul 9, 2014
    Artifectx
    Xclassified
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in demo/ads.php in Artifectx xClassified 1.2 allows remote attackers to execute arbitrary SQL commands via the catid parameter.

  • CVE-2014-4194Jul 9, 2014
    Zero CMS
    Zerocms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in zero_transact_article.php in ZeroCMS 1.0 allows remote attackers to execute arbitrary SQL commands via the article_id parameter in a Submit Comment action.

  • CVE-2014-4022Jul 9, 2014
    Xen
    Xen
    risk 0.00cvss —epss 0.01

    The alloc_domain_struct function in arch/arm/domain.c in Xen 4.4.x, when running on an ARM platform, does not properly initialize the structure containing the grant table pages for a domain, which allows local guest administrators to obtain sensitive information via the…

  • CVE-2012-4988Jul 9, 2014
    Xnview
    Xnview
    risk 0.04cvss —epss 0.10

    Heap-based buffer overflow in the xjpegls.dll (aka JLS, JPEG-LS, or JPEG lossless) format plugin in XnView 1.99 and 1.99.1 allows remote attackers to execute arbitrary code via a crafted JLS image file.

  • CVE-2014-4699Jul 9, 2014
    Linux
    Kernel
    risk 0.00cvss —epss 0.02

    The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial…

  • CVE-2014-3891Jul 9, 2014
    Rimarts Inc.
    Becky Internet Mail
    risk 0.00cvss —epss 0.02

    Buffer overflow in RimArts Becky! Internet Mail before 2.68 allows remote POP3 servers to execute arbitrary code via a crafted response.

  • CVE-2014-3515Jul 9, 2014
    PHP
    PHP
    risk 0.02cvss —epss 0.30

    The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable…

  • CVE-2014-3487Jul 9, 2014
    PHP
    PHP
    risk 0.00cvss —epss 0.15

    The cdf_read_property_info function in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate a stream offset, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF…

  • CVE-2014-3480MedJul 9, 2014
    PHP
    PHP
    risk 0.36cvss 6.5epss 0.11

    The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to cause a denial of service (application crash) via a crafted…