VYPR

CVEs

390,205 total · page 6567 of 7,805

AllCriticalHighKEV
  • CVE-2014-3835Jun 4, 2014
    OwnCloud
    Owncloud
    risk 0.00cvss —epss 0.01

    ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not check permissions to the files_external application, which allows remote authenticated users to add external storage via unspecified vectors.

  • CVE-2014-3834Jun 4, 2014
    OwnCloud
    Owncloud
    risk 0.00cvss —epss 0.01

    ownCloud Server before 6.0.3 does not properly check permissions, which allows remote authenticated users to (1) access the contacts of other users via the address book or (2) rename files via unspecified vectors.

  • CVE-2014-3833Jun 4, 2014
    OwnCloud
    Owncloud
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the (1) Gallery and (2) core components in ownCloud Server before 5.016 and 6.0.x before 6.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the print_unescaped…

  • CVE-2014-3832Jun 4, 2014
    OwnCloud
    Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Documents component in ownCloud Server 6.0.x before 6.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the print_unescaped function.

  • CVE-2014-3786Jun 4, 2014
    Pixie CMS
    Pixie CMS
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the contact module (admin/modules/contact.php) in Pixie CMS 1.04 allow remote attackers to inject arbitrary web script or HTML via the (1) uemail or (2) subject parameter in the Contact form to contact/.

  • CVE-2014-2056Jun 4, 2014
    Phpdocx
    Phpdocx
    risk 0.00cvss —epss 0.02

    PHPDocX, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.

  • CVE-2014-2055Jun 4, 2014
    OwnCloud
    Server
    risk 0.00cvss —epss 0.02

    SabreDAV before 1.7.11, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.

  • CVE-2014-2054Jun 4, 2014
    OwnCloud
    Server
    risk 0.00cvss —epss 0.02

    PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity…

  • CVE-2014-2053Jun 4, 2014
    Getid3
    Getid3
    risk 0.00cvss —epss 0.05

    getID3() before 1.9.8, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.

  • CVE-2013-1941Jun 4, 2014
    OwnCloud
    Owncloud
    risk 0.00cvss —epss 0.01

    The installation routine in ownCloud Server before 4.0.14, 4.5.x before 4.5.9, and 5.0.x before 5.0.4 uses the time function to seed the generation of the PostgreSQL database user password, which makes it easier for remote attackers to guess the password via a brute force attack.

  • CVE-2013-0204Jun 4, 2014
    OwnCloud
    Owncloud
    risk 0.00cvss —epss 0.01

    settings/personal.php in ownCloud 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via crafted mount point settings.

  • CVE-2012-5336Jun 4, 2014
    OwnCloud
    Owncloud
    risk 0.00cvss —epss 0.01

    lib/base.php in ownCloud before 4.0.8 does not properly validate the user_id session variable, which allows remote authenticated users to read arbitrary files via vectors related to WebDAV.

  • CVE-2012-5057Jun 4, 2014
    OwnCloud
    Owncloud
    risk 0.00cvss —epss 0.01

    CRLF injection vulnerability in ownCloud Server before 4.0.8 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the url path parameter.

  • CVE-2012-5056Jun 4, 2014
    OwnCloud
    Owncloud
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ownCloud Server before 4.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) readyCallback parameter to apps/files_odfviewer/src/webodf/webodf/flashput/PUT.swf, the (2) root parameter to…

  • CVE-2014-3956Jun 4, 2014
    Sendmail, Inc.
    Sendmail
    risk 0.00cvss —epss 0.01

    The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FD_CLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program.

  • CVE-2014-0935Jun 4, 2014
    IBM
    Smart Analytics System 7700
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in IBM Smart Analytics System 7700 before FP 2.1.3.0 and 7710 before FP 2.1.3.0 allows local users to gain privileges via vectors related to events.

  • CVE-2014-2502Jun 4, 2014
    EMC Corporation
    Rsa Adaptive Authentication Hosted
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in rsa_fso.swf in EMC RSA Adaptive Authentication (Hosted) 11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-3959Jun 3, 2014
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in list.jsp in the Configuration utility in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, GTM, and Link Controller 11.2.1 through 11.5.1, AAM 11.4.0 through 11.5.1 PEM 11.3.0 through 11.5.1, PSM 11.2.1 through 11.4.1, WebAccelerator and WOM…

  • CVE-2014-3946Jun 3, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors.

  • CVE-2014-3945Jun 3, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the password hash is known, which allows remote attackers to bypass authentication and gain access to the backend by…

  • CVE-2014-3944Jun 3, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote attackers to bypass authentication via unspecified vectors.

  • CVE-2014-3943Jun 3, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allow remote authenticated editors to inject arbitrary web script or HTML via…

  • CVE-2014-3942Jun 3, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object.

  • CVE-2014-3941Jun 3, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.03

    TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allows remote attackers to have unspecified impact via a crafted HTTP Host header, related to "Host Spoofing."

  • CVE-2014-3466Jun 3, 2014
    GNU
    Gnutls
    risk 0.01cvss —epss 0.11

    Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a long session id in a…

  • CVE-2013-0191Jun 3, 2014
    Libpam Pgsql
    Libpam Pgsql
    risk 0.00cvss —epss 0.02

    libpam-pgsql (aka pam_pgsql) 0.7 does not properly handle a NULL value returned by the password search query, which allows remote attackers to bypass authentication via a crafted password.

  • CVE-2014-3280Jun 3, 2014
    Cisco Systems, Inc.
    Unified Communications Domain Manager
    risk 0.00cvss —epss 0.02

    The web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allows remote authenticated users to obtain potentially sensitive user information by visiting an unspecified Administration GUI…

  • CVE-2014-2959Jun 2, 2014
    Quantum
    Scalar I500
    risk 0.00cvss —epss 0.03

    logViewer.htm on the Dell ML6000 tape backup system with firmware before i8.2.0.2 (641G.GS103) and the Quantum Scalar i500 tape backup system with firmware before i8.2.2.1 (646G.GS002) allows remote attackers to execute arbitrary commands via shell metacharacters in a pathname…

  • CVE-2014-2946Jun 2, 2014
    Huawei
    E303 Modem
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in api/sms/send-sms in the Web UI 11.010.06.01.858 on Huawei E303 modems with software 22.157.18.00.858 allows remote attackers to hijack the authentication of administrators for requests that perform API operations and send SMS…

  • CVE-2014-2939Jun 2, 2014
    Alfresco
    Alfresco
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Alfresco Enterprise before 4.1.6.13 allow remote attackers to inject arbitrary web script or HTML via (1) an XHTML document, (2) a <% tag, or (3) the taskId parameter to share/page/task-edit.

  • CVE-2014-3937Jun 2, 2014
    WordPress
    Contextual Related Posts
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the Contextual Related Posts plugin before 1.8.10.2 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2014-0042Jun 2, 2014
    OpenStack
    Tripleo Heat Templates
    risk 0.00cvss —epss 0.01

    OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets gpgcheck to 0 for certain templates, which disables GPG signature checking on downloaded packages and allows man-in-the-middle attackers to install arbitrary packages via…

  • CVE-2014-0041Jun 2, 2014
    OpenStack
    Tripleo Heat Templates
    risk 0.00cvss —epss 0.01

    OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets sslverify to false for certain Yum repositories, which disables SSL protection and allows man-in-the-middle attackers to prevent updates via unspecified vectors.

  • CVE-2014-0040Jun 2, 2014
    OpenStack
    Tripleo Heat Templates
    risk 0.00cvss —epss 0.01

    OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, uses an HTTP connection to download (1) packages and (2) signing keys from Yum repositories, which allows man-in-the-middle attackers to prevent updates via unspecified vectors.

  • CVE-2013-7387Jun 2, 2014
    DataLife Engine
    DataLife Engine
    risk 0.03cvss —epss 0.05

    Session fixation vulnerability in DataLife Engine (DLE) 9.7 and earlier allows remote attackers to hijack web sessions via the PHPSESSID cookie.

  • CVE-2013-7386Jun 2, 2014
    Boinc
    Boinc
    risk 0.00cvss —epss 0.04

    Format string vulnerability in the PROJECT::write_account_file function in client/cs_account.cpp in BOINC, possibly 7.2.33, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via format string specifiers in the gui_urls item in an…

  • CVE-2013-6470Jun 2, 2014
    Red Hat
    Openstack
    risk 0.00cvss —epss 0.02

    The default configuration in the standalone controller quickstack manifest in openstack-foreman-installer, as used in Red Hat Enterprise Linux OpenStack Platform 4.0, disables authentication for Qpid, which allows remote attackers to gain access by connecting to Qpid.

  • CVE-2013-6433Jun 2, 2014
    OpenStack
    Neutron
    risk 0.00cvss —epss 0.03

    The default configuration in the Red Hat openstack-neutron package before 2013.2.3-7 does not properly set a configuration file for rootwrap, which allows remote attackers to gain privileges via a crafted configuration file.

  • CVE-2013-4596Jun 2, 2014
    Drupal
    Node Access Keys
    risk 0.00cvss —epss 0.01

    The Node Access Keys module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permissions, which allows remote attackers to bypass access restrictions via a node listing.

  • CVE-2013-3476Jun 2, 2014
    WordPress
    Related Posts
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the WordPress Related Posts plugin before 2.6.2 for WordPress allows remote attackers to hijack the authentication of users for requests that change settings via unspecified vectors.

  • CVE-2013-3258Jun 2, 2014
    WordPress
    Digg Digg
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in he Digg Digg plugin before 5.3.5 for WordPress allows remote attackers to hijack the authentication of users for requests that modify settings via unspecified vectors.

  • CVE-2013-3257Jun 2, 2014
    Zemanta
    Related Posts
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Related Posts plugin before 2.7.2 for WordPress allows remote attackers to hijack the authentication of users for requests that modify settings via unspecified vectors.

  • CVE-2013-2710Jun 2, 2014
    WordPress
    Contextual Related Posts
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Contextual Related Posts plugin before 1.8.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via unspecified vectors.

  • CVE-2013-2298Jun 2, 2014
    Boinc
    Boinc
    risk 0.00cvss —epss 0.03

    Multiple stack-based buffer overflows in the XML parser in BOINC 7.x allow attackers to have unspecified impact via a crafted XML file, related to the scheduler.

  • CVE-2013-2019Jun 2, 2014
    Boinc
    Boinc
    risk 0.00cvss —epss 0.02

    Stack-based buffer overflow in BOINC 6.10.58 and 6.12.34 allows remote attackers to have unspecified impact via multiple file_signature elements.

  • CVE-2013-2014Jun 2, 2014
    OpenStack
    Keystone
    risk 0.00cvss —epss 0.03

    OpenStack Identity (Keystone) before 2013.1 allows remote attackers to cause a denial of service (memory consumption and crash) via multiple long requests.

  • CVE-2013-1818Jun 2, 2014
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    maintenance/mwdoc-filter.php in MediaWiki before 1.20.3 allows remote attackers to read arbitrary files via unspecified vectors.

  • CVE-2013-1412Jun 2, 2014
    DataLife Engine
    DataLife Engine
    risk 0.06cvss —epss 0.40

    DataLife Engine (DLE) 9.7 allows remote attackers to execute arbitrary PHP code via the catlist[] parameter to engine/preview.php, which is used in a preg_replace function call with an e modifier.

  • CVE-2013-1397Jun 2, 2014
    Sensiolabs
    Symfony
    risk 0.00cvss —epss 0.02

    Symfony 2.0.x before 2.0.22, 2.1.x before 2.1.7, and 2.2.x remote attackers to execute arbitrary PHP code via a serialized PHP object to the (1) Yaml::parse or (2) Yaml\Parser::parse function, a different vulnerability than CVE-2013-1348.

  • CVE-2013-1348Jun 2, 2014
    Sensiolabs
    Symfony
    risk 0.00cvss —epss 0.02

    The Yaml::parse function in Symfony 2.0.x before 2.0.22 remote attackers to execute arbitrary PHP code via a PHP file, a different vulnerability than CVE-2013-1397.