VYPR

CVEs

390,318 total · page 6558 of 7,807

AllCriticalHighKEV
  • CVE-2014-0867Jul 7, 2014
    IBM
    Algo Credit Limits
    risk 0.03cvss —epss 0.05

    rcore6/main/addcookie.jsp in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows remote attackers to create or modify cookies via the query string.

  • CVE-2014-0866Jul 7, 2014
    IBM
    Algo Credit Limits
    risk 0.03cvss —epss 0.05

    RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics sends cleartext credentials over HTTP, which allows remote attackers to obtain sensitive information by sniffing the network.

  • CVE-2014-0865Jul 7, 2014
    IBM
    Algo Credit Limits
    risk 0.03cvss —epss 0.05

    RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validation, which allows remote authenticated users to bypass intended dual-control restrictions and modify data via crafted serialized objects, as…

  • CVE-2014-0864Jul 7, 2014
    IBM
    Algo Credit Limits
    risk 0.03cvss —epss 0.03

    Multiple cross-site request forgery (CSRF) vulnerabilities in Executer in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allow remote attackers to hijack the authentication of arbitrary users for requests that change (1) a…

  • CVE-2014-0860Jul 7, 2014
    IBM
    Advanced Management Module
    risk 0.00cvss —epss 0.01

    The firmware before 3.66E in IBM BladeCenter Advanced Management Module (AMM), the firmware before 1.43 in IBM Integrated Management Module (IMM), and the firmware before 4.15 in IBM Integrated Management Module II (IMM2) contains cleartext IPMI credentials, which allows…

  • CVE-2014-0602Jul 7, 2014
    Microfocus
    Security Manager
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in NetIQ Security Manager through 6.5.4 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-3460.

  • CVE-2013-5423Jul 7, 2014
    IBM
    Flex System Manager
    risk 0.00cvss —epss 0.01

    IBM Flex System Manager (FSM) 1.1 through 1.3 before 1.3.2.0 allows remote attackers to enumerate user accounts via unspecified vectors.

  • CVE-2013-3993MedKEVJul 7, 2014
    IBM
    Infosphere Biginsights
    risk 0.61cvss 6.5epss 0.05

    IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted data or code, via crafted parameters in unspecified API calls.

  • CVE-2014-4721Jul 6, 2014
    PHP
    PHP
    risk 0.00cvss —epss 0.06

    The phpinfo implementation in ext/standard/info.c in PHP before 5.4.30 and 5.5.x before 5.5.14 does not ensure use of the string data type for the PHP_AUTH_PW, PHP_AUTH_TYPE, PHP_AUTH_USER, and PHP_SELF variables, which might allow context-dependent attackers to obtain sensitive…

  • CVE-2014-4720Jul 6, 2014
    Email\
    \
    risk 0.00cvss —epss 0.02

    Email::Address module before 1.904 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via vectors related to "backtracking into the phrase," a different vulnerability than CVE-2014-0477.

  • CVE-2014-4672Jul 3, 2014
    Yiiframework
    Yiiframework
    risk 0.00cvss —epss 0.02

    The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.

  • CVE-2014-4168Jul 3, 2014
    Kryo
    Iodine
    risk 0.00cvss —epss 0.04

    (1) iodined.c and (2) user.c in iodine before 0.7.0 allows remote attackers to bypass authentication by continuing execution after an error has been triggering.

  • CVE-2014-3497Jul 3, 2014
    OpenStack
    Swift
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or HTML via the WWW-Authenticate header.

  • CVE-2014-0477Jul 3, 2014
    Fedoraproject
    Fedora
    risk 0.00cvss —epss 0.04

    The parse function in Email::Address module before 1.905 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via an empty quoted string in an RFC 2822 address.

  • CVE-2014-0247Jul 3, 2014
    Libreoffice
    Libreoffice
    risk 0.00cvss —epss 0.04

    LibreOffice 4.2.4 executes unspecified VBA macros automatically, which has unspecified impact and attack vectors, possibly related to doc/docmacromode.cxx.

  • CVE-2014-4719Jul 3, 2014
    User Friendly SVN
    User-Friendly SVN
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the login panel (svn/login/) in User-Friendly SVN (aka USVN) before 1.0.7 allows remote attackers to inject arbitrary web script or HTML via the username field.

  • CVE-2014-4718Jul 3, 2014
    Lunarcms
    Lunar CMS
    risk 0.03cvss —epss 0.02

    Multiple cross-site request forgery (CSRF) vulnerabilities in Lunar CMS before 3.3-3 allow remote attackers to hijack the authentication of administrators for requests that (1) add Super users via a request to admin/user_create.php or conduct cross-site scripting (XSS) attacks…

  • CVE-2014-4717Jul 3, 2014
    WordPress
    Simple Share Buttons Adder
    risk 0.03cvss —epss 0.03

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Simple Share Buttons Adder plugin before 4.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1)…

  • CVE-2014-4716Jul 3, 2014
    Thomson
    Twg87ouir
    risk 0.03cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in Thomson TWG87OUIR allows remote attackers to hijack the authentication of unspecified victims for requests that change passwords via the Password and PasswordReEnter parameters to goform/RgSecurity.

  • CVE-2014-4195Jul 3, 2014
    Zero CMS
    Zerocms
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in zero_view_article.php in ZeroCMS 1.0 allows remote attackers to inject arbitrary web script or HTML via the article_id parameter.

  • CVE-2014-4002Jul 3, 2014
    Cacti (software)
    Cacti
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the (1) drp_action parameter to cdef.php, (2) data_input.php, (3) data_queries.php, (4) data_sources.php, (5) data_templates.php, (6)…

  • CVE-2014-3920Jul 3, 2014
    Kanboard
    Kanboard
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Kanboard before 1.0.6 allows remote attackers to hijack the authentication of administrators for requests that add an administrative user via a save action to the default URI.

  • CVE-2014-3857Jul 3, 2014
    Kerio Technologies
    Control
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Kerio Control Statistics in Kerio Control (formerly WinRoute Firewall) before 8.3.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) x_16 or (2) x_17 parameter to print.php.

  • CVE-2014-3538Jul 3, 2014
    File Project
    File
    risk 0.00cvss —epss 0.12

    file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability…

  • CVE-2014-3149Jul 3, 2014
    Invision Power Services
    Ip.nexus
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.3.x and 3.4.x through 3.4.6, as downloaded before 20140424, or IP.Nexus 1.5.x through 1.5.9, as downloaded before 20140424, allows remote attackers to inject arbitrary web script or…

  • CVE-2014-2965Jul 3, 2014
    Spamtitan
    Spamtitan
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in auth-settings-x.php in SpamTitan before 6.04 allows remote attackers to inject arbitrary web script or HTML via the sortdir parameter.

  • CVE-2014-0325Jul 3, 2014
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.16

    Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site that triggers improper processing of CElement objects, aka "Internet Explorer Memory Corruption…

  • CVE-2014-4715Jul 3, 2014
    Yann Collet
    LZ4
    risk 0.00cvss —epss 0.03

    Yann Collet LZ4 before r119, when used on certain 32-bit platforms that allocate memory beyond 0x80000000, does not properly detect integer overflows, which allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other…

  • CVE-2014-4667Jul 3, 2014
    Linux
    Kernel
    risk 0.00cvss —epss 0.06

    The sctp_association_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog value, which allows remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet.

  • CVE-2014-4656Jul 3, 2014
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allow local users to cause a denial of service by leveraging /dev/snd/controlCX access, related to (1) index values in the snd_ctl_add function and (2) numid…

  • CVE-2014-4655Jul 3, 2014
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not properly maintain the user_ctl_count value, which allows local users to cause a denial of service (integer overflow and limit bypass) by leveraging…

  • CVE-2014-4654Jul 3, 2014
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, which allows local users to remove kernel controls and cause a denial of service…

  • CVE-2014-4653Jul 3, 2014
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not ensure possession of a read/write lock, which allows local users to cause a denial of service (use-after-free) and obtain sensitive information from kernel memory by leveraging…

  • CVE-2014-4652Jul 3, 2014
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Race condition in the tlv handler functionality in the snd_ctl_elem_user_tlv function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allows local users to obtain sensitive information from kernel memory by leveraging…

  • CVE-2014-4611Jul 3, 2014
    Linux
    Kernel
    risk 0.00cvss —epss 0.08

    Integer overflow in the LZ4 algorithm implementation, as used in Yann Collet LZ4 before r118 and in the lz4_uncompress function in lib/lz4/lz4_decompress.c in the Linux kernel before 3.15.2, on 32-bit platforms might allow context-dependent attackers to cause a denial of service…

  • CVE-2014-4608HigJul 3, 2014
    Linux
    Kernel
    risk 0.41cvss 7.3epss 0.05

    Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel before 3.15.2 allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run. NOTE: the…

  • CVE-2014-4614Jul 2, 2014
    Piwigo
    Piwigo
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Piwigo before 2.6.2 allow remote attackers to hijack the authentication of administrators for requests that use the (1) pwg.groups.addUser, (2) pwg.groups.deleteUser, (3) pwg.groups.setInfo, (4) pwg.users.setInfo, (5)…

  • CVE-2014-4606Jul 2, 2014
    Zeenshare Project
    Zeenshare
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in redirect_to_zeenshare.php in the ZeenShare plugin 1.0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the zs_sid parameter.

  • CVE-2014-4597Jul 2, 2014
    Wp Social Invitations Project
    Wp Social Invitations
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in test.php in the WP Social Invitations plugin before 1.4.4.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xhrurl parameter.

  • CVE-2014-4591Jul 2, 2014
    WordPress
    WP-Picasa-Image
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in picasa_upload.php in the WP-Picasa-Image plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_id parameter.

  • CVE-2014-4581Jul 2, 2014
    WordPress
    WPCB
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in facture.php in the WPCB plugin 2.4.8 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2014-4571Jul 2, 2014
    WordPress
    VN-Calendar
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in vncal.js.php in the VN-Calendar plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) fs or (2) w parameter.

  • CVE-2014-4565Jul 2, 2014
    WordPress
    Verification Code for Comments
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in vcc.js.php in the Verification Code for Comments plugin 2.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) vp, (2) vs, (3) l, (4) vu, or (5) vm parameter.

  • CVE-2014-4563Jul 2, 2014
    WordPress
    URL Cloak & Encrypt
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in go.php in the URL Cloak & Encrypt (url-cloak-encrypt) plugin 2.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter.

  • CVE-2014-4555Jul 2, 2014
    WordPress
    Style It
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in fonts/font-form.php in the Style It plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter.

  • CVE-2014-4554Jul 2, 2014
    WordPress
    SS Downloads
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in templates/download.php in the SS Downloads plugin before 1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the title parameter.

  • CVE-2014-4549Jul 2, 2014
    Woocommerce Sagepay Direct Payment Gateway Project
    Woocommerce Sagepay Direct Payment Gateway
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in pages/3DComplete.php in the WooCommerce SagePay Direct Payment Gateway plugin before 0.1.6.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) MD or (2) PARes parameter.

  • CVE-2014-4546Jul 2, 2014
    Rezgo
    Rezgo
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in book_ajax.php in the Rezgo plugin 1.4.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the response parameter.

  • CVE-2014-4534Jul 2, 2014
    WordPress
    HTML5 Video Player with Playlist
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in videoplayer/autoplay.php in the HTML5 Video Player with Playlist plugin 2.4.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) theme or (2) playlistmod parameter.

  • CVE-2014-3737Jul 2, 2014
    Storesprite
    Storesprite
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in templates/defaultheader.php in Lamp Design Storesprite before 7 - 19-06-14, when using the currency selection dropdown, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to brand.php, related to the…