VYPR

CVEs

390,209 total · page 6565 of 7,805

AllCriticalHighKEV
  • CVE-2009-5023Jun 10, 2014
    Fail2ban
    Fail2ban
    risk 0.00cvss —epss 0.00

    The (1) dshield.conf, (2) mail-buffered.conf, (3) mynetwatchman.conf, and (4) mynetwatchman.conf actions in action.d/ in Fail2ban before 0.8.5 allows local users to write to arbitrary files via a symlink attack on temporary files with predictable names, as demonstrated by…

  • CVE-2014-3294Jun 10, 2014
    Cisco Systems, Inc.
    Webex Meetings Server
    risk 0.00cvss —epss 0.01

    Cisco WebEx Meeting Server does not properly restrict the content of URLs, which allows remote authenticated users to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history, aka Bug ID CSCuj81691.

  • CVE-2014-3292Jun 10, 2014
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.02

    The Real Time Monitoring Tool (RTMT) implementation in Cisco Unified Communications Manager (Unified CM) allows remote authenticated users to (1) read or (2) delete arbitrary files via a crafted URL, aka Bug IDs CSCuo17302 and CSCuo17199.

  • CVE-2014-3289Jun 10, 2014
    Cisco Systems, Inc.
    Content Security Management Appliance
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance (ESA) 8.0, Web Security Appliance (WSA) 8.0 (.5 Hot Patch 1) and earlier, and Content Security Management Appliance (SMA) 8.3 and earlier allows remote…

  • CVE-2014-3287Jun 10, 2014
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in BulkViewFileContentsAction.java in the Java interface in Cisco Unified Communications Manager (Unified CM) allows remote authenticated users to execute arbitrary SQL commands via crafted filename parameters in a URL, aka Bug ID CSCuo17337.

  • CVE-2014-3042Jun 10, 2014
    IBM
    Cics Transaction Server
    risk 0.00cvss —epss 0.01

    IBM CICS Transaction Server 3.1, 3.2, 4.1, 4.2, and 5.1 on z/OS does not properly implement CEMT transactions, which allows remote authenticated users to cause a denial of service (storage overlay) by using a 3270 emulator to send an invalid 3270 data stream.

  • CVE-2014-4012Jun 9, 2014
    SAP
    Open Hub Service
    risk 0.00cvss —epss 0.01

    SAP Open Hub Service has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.

  • CVE-2014-4011Jun 9, 2014
    SAP
    Capacity Leveling
    risk 0.00cvss —epss 0.01

    SAP Capacity Leveling has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.

  • CVE-2014-4010Jun 9, 2014
    SAP
    Transaction Data Pool
    risk 0.00cvss —epss 0.01

    SAP Transaction Data Pool has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.

  • CVE-2014-4009Jun 9, 2014
    SAP
    CCMS Monitoring
    risk 0.00cvss —epss 0.01

    SAP CCMS Monitoring (BC-CCM-MON) has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.

  • CVE-2014-4008Jun 9, 2014
    SAP
    Web Services Tool
    risk 0.00cvss —epss 0.01

    SAP Web Services Tool (CA-WUI-WST) has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.

  • CVE-2014-4007Jun 9, 2014
    SAP
    Upgrade tools for ABAP
    risk 0.00cvss —epss 0.01

    The SAP Upgrade tools for ABAP has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.

  • CVE-2014-4006Jun 9, 2014
    SAP
    Trader's and Scheduler's Workbench
    risk 0.00cvss —epss 0.01

    The SAP Trader's and Scheduler's Workbench (TSW) for SAP Oil & Gas has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.

  • CVE-2014-4005Jun 9, 2014
    SAP
    Brazil
    risk 0.00cvss —epss 0.01

    SAP Brazil add-on has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.

  • CVE-2014-4004Jun 9, 2014
    SAP
    Project System (PS-IS) module
    risk 0.00cvss —epss 0.01

    The (1) Structures and (2) Project-Oriented Procurement components in SAP Project System has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.

  • CVE-2014-4003Jun 9, 2014
    SAP
    Netweaver
    risk 0.00cvss —epss 0.03

    The System Landscape Directory (SLD) in SAP NetWeaver allows remote attackers to modify information via vectors related to adding a system.

  • CVE-2013-7323Jun 9, 2014
    Vinay Sajip
    Python Gnupg
    risk 0.00cvss —epss 0.03

    python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.

  • CVE-2013-6223Jun 9, 2014
    Livezilla
    Livezilla
    risk 0.00cvss —epss 0.00

    LiveZilla before 5.1.1.0 stores the admin Base64 encoded username and password in a 1click file, which allows local users to obtain access by reading the file.

  • CVE-2013-5760Jun 9, 2014
    Qnap
    Photo Station
    risk 0.00cvss —epss 0.01

    QNAP Photo Station before firmware 4.0.3 build0912 allows remote attackers to list OS user accounts via a request to photo/p/api/list.php.

  • CVE-2013-4599Jun 9, 2014
    Drupal
    Misery
    risk 0.00cvss —epss 0.01

    The Misery module 6.x-2.x before 6.x-2.5 and 7.x-2.x before 7.x-2.2 for Drupal, when the "delay misery" configuration is set to a high value, allows remote attackers to cause a denial of service (process consumption) via multiple requests.

  • CVE-2013-4597Jun 9, 2014
    Rik De Boer
    Revisioning
    risk 0.00cvss —epss 0.01

    The Revisioning module 7.x-1.x before 7.x-1.6 for Drupal does not properly check node access permissions for content marked unpublished by the Scheduled module, which allows remote authenticated users to obtain sensitive information via unspecified vectors.

  • CVE-2013-4595Jun 9, 2014
    Gordon Heydon
    Secure Pages
    risk 0.00cvss —epss 0.01

    The Secure Pages module 6.x-2.x before 6.x-2.0 for Drupal does not properly match URLs, which causes HTTP to be used instead of HTTPS and makes it easier for remote attackers to obtain sensitive information via a crafted web page.

  • CVE-2013-3082Jun 9, 2014
    Jojocms
    Jojo CMS
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in plugins/jojo_core/forgot_password.php in Jojo before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the search parameter to forgot-password/.

  • CVE-2013-3081Jun 9, 2014
    Jojocms
    Jojo CMS
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the checkEmailFormat function in plugins/jojo_core/classes/Jojo.php in Jojo before 1.2.2 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header to /articles/test/.

  • CVE-2013-2564Jun 9, 2014
    Mambo (software)
    CMS
    risk 0.00cvss —epss 0.02

    Mambo CMS 4.6.5 allows remote attackers to cause a denial of service (memory and bandwidth consumption) by uploading a crafted file.

  • CVE-2013-2563Jun 9, 2014
    Mambo (software)
    CMS
    risk 0.00cvss —epss 0.00

    Mambo CMS 4.6.5 uses world-readable permissions on configuration.php, which allows local users to obtain the admin password hash by reading the file.

  • CVE-2013-2562Jun 9, 2014
    Mambo (software)
    CMS
    risk 0.00cvss —epss 0.00

    Mambo CMS 4.6.5 stores the MySQL database password in cleartext in the document root, which allows local users to obtain sensitive information via unspecified vectors.

  • CVE-2013-1973Jun 9, 2014
    Autocomplete Widgets Project
    Autocomplete Widgets
    risk 0.00cvss —epss 0.01

    The autocomplete callback in Autocomplete Widgets for Text and Number Fields (autocomplete_widgets) module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.0-rc1 does not properly handle node permissions, which allows remote authenticated users to obtain sensitive field values…

  • CVE-2013-1756Jun 9, 2014
    Mark Evans
    Dragonfly Gem
    risk 0.00cvss —epss 0.04

    The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.

  • CVE-2014-3977Jun 8, 2014
    IBM
    Aix
    risk 0.03cvss —epss 0.01

    libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on a temporary file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-2179.

  • CVE-2014-3048Jun 8, 2014
    IBM
    System Storage Virtualization Engine Ts7700
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability on the IBM System Storage Virtualization Engine TS7700 allows local users to gain privileges by leveraging the TSSC service-user role to enter a crafted SSH command.

  • CVE-2014-3038Jun 8, 2014
    IBM
    Spss Modeler
    risk 0.00cvss —epss 0.00

    IBM SPSS Modeler 16.0 before 16.0.0.1 on UNIX does not properly drop group privileges, which allows local users to bypass intended file-access restrictions by leveraging (1) gid 0 or (2) root's group memberships.

  • CVE-2014-3036Jun 8, 2014
    IBM
    API Management
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in IBM API Management 3.0.0.0, when basic authentication is used for APIs, allows remote attackers to bypass intended restrictions on topology access, and obtain sensitive information, via unknown vectors.

  • CVE-2014-0936Jun 8, 2014
    IBM
    Security Appscan Source
    risk 0.00cvss —epss 0.01

    IBM Security AppScan Source 8.0 through 9.0, when the publish-assessment permission is not properly restricted for the configured database server, transmits cleartext assessment data, which allows remote attackers to obtain sensitive information by sniffing the network.

  • CVE-2014-0929Jun 8, 2014
    IBM
    Connections
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Profiles component in IBM Connections through 3.0.1.1 CR3 allows remote authenticated users to hijack the authentication of arbitrary users for requests that trigger follow actions.

  • CVE-2014-3986Jun 8, 2014
    Cisofy
    Lynis
    risk 0.00cvss —epss 0.00

    include/tests_webservers in Lynis before 1.5.5 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/lynis.*.unsorted file with an easily determined name.

  • CVE-2014-3982Jun 8, 2014
    Cisofy
    Lynis
    risk 0.00cvss —epss 0.00

    include/tests_webservers in Lynis before 1.5.5 on AIX allows local users to overwrite arbitrary files via a symlink attack on a /tmp/lynis.##### file.

  • CVE-2014-3981Jun 8, 2014
    PHP
    PHP
    risk 0.00cvss —epss 0.01

    acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file.

  • CVE-2014-0961Jun 8, 2014
    IBM
    Security Identity Manager
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in IBM Tivoli Identity Manager (ITIM) 5.0 before 5.0.0.15 and 5.1 before 5.1.0.15 and IBM Security Identity Manager (ISIM) 6.0 before 6.0.0.2 allows remote authenticated users to hijack the authentication of arbitrary users for…

  • CVE-2014-3291Jun 8, 2014
    Cisco Systems, Inc.
    Wireless Lan Controller Software
    risk 0.00cvss —epss 0.01

    Cisco Wireless LAN Controller (WLC) devices allow remote attackers to cause a denial of service (NULL pointer dereference and device restart) via a zero value in Cisco Discovery Protocol packet data that is not properly handled during SNMP polling, aka Bug ID CSCuo12321.

  • CVE-2014-3286Jun 8, 2014
    Cisco Systems, Inc.
    Webex Meetings Server
    risk 0.00cvss —epss 0.02

    The web framework in Cisco WebEx Meeting Server does not properly restrict the content of reply messages, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug IDs CSCuj81685, CSCuj81688, CSCuj81665, CSCuj81744, and CSCuj81661.

  • CVE-2014-3281Jun 8, 2014
    Cisco Systems, Inc.
    Unified Communications Domain Manager
    risk 0.00cvss —epss 0.01

    The web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) does not properly implement access control, which allows remote attackers to obtain potentially sensitive user information by visiting an unspecified BVSMWeb web page, aka Bug IDs CSCun46071 and…

  • CVE-2014-3278Jun 8, 2014
    Cisco Systems, Inc.
    Unified Communications Domain Manager
    risk 0.00cvss —epss 0.01

    The web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) does not properly implement access control, which allows remote attackers to enumerate accounts by visiting an unspecified BVSMWeb web page, aka Bug IDs CSCun39619 and CSCun45572.

  • CVE-2014-2508Jun 8, 2014
    EMC Corporation
    Documentum Content Server
    risk 0.00cvss —epss 0.02

    EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and bypass intended restrictions on database actions via vectors involving DQL…

  • CVE-2014-2507Jun 8, 2014
    EMC Corporation
    Documentum Content Server
    risk 0.00cvss —epss 0.04

    EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to execute arbitrary commands via shell metacharacters in arguments to unspecified methods.

  • CVE-2014-2506Jun 8, 2014
    EMC Corporation
    Documentum Content Server
    risk 0.00cvss —epss 0.03

    EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to obtain super-user privileges for system-object creation, and bypass intended restrictions on data access and server actions, via…

  • CVE-2014-3153HigKEVJun 7, 2014
    Linux
    Kernel
    risk 0.62cvss 7.8epss 0.37

    The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.

  • CVE-2014-3984Jun 6, 2014
    Libav
    Libav
    risk 0.00cvss —epss 0.04

    Multiple unspecified vulnerabilities in Libav before 0.8.12 allow remote attackers to have unknown impact and vectors.

  • CVE-2014-3966Jun 6, 2014
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Special:PasswordReset in MediaWiki before 1.19.16, 1.21.x before 1.21.10, and 1.22.x before 1.22.7, when wgRawHtml is enabled, allows remote attackers to inject arbitrary web script or HTML via an invalid username.

  • CVE-2014-2575Jun 6, 2014
    Devexpress
    Aspxfilemanager
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in the File Manager component in DevExpress ASPxFileManager Control for ASP.NET WebForms and MVC before 13.1.10 and 13.2.x before 13.2.9 allows remote authenticated users to read or write arbitrary files via a .. (dot dot) in the __EVENTARGUMENT…