CVEs

390,197 total · page 6568 of 7,804

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2014-3925	Red Hat Sos	0.00	—	0.02	Jun 1, 2014	sosreport in Red Hat sos 1.7 and earlier on Red Hat Enterprise Linux (RHEL) 5 produces an archive with an fstab file potentially containing cleartext passwords, and lacks a warning about reviewing this archive to detect included passwords, which might allow remote attackers to…
CVE-2014-3790	VMware Vcenter Server Appliance	0.00	—	0.02	Jun 1, 2014	Ruby vSphere Console (RVC) in VMware vCenter Server Appliance allows remote authenticated users to execute arbitrary commands as root by escaping from a chroot jail.
CVE-2014-0238	PHP PHP	0.00	—	0.21	Jun 1, 2014	The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long.
CVE-2014-0237	PHP PHP	0.00	—	0.20	Jun 1, 2014	The cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (performance degradation) by triggering many file_printf calls.
CVE-2014-3793	VMware Workstation	0.00	—	0.01	May 31, 2014	VMware Tools in VMware Workstation 10.x before 10.0.2, VMware Player 6.x before 6.0.2, VMware Fusion 6.x before 6.0.3, and VMware ESXi 5.0 through 5.5, when a Windows 8.1 guest OS is used, allows guest OS users to gain guest OS privileges or cause a denial of service (kernel…
CVE-2014-0119	Apache Tomcat	0.00	—	0.08	May 31, 2014	Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an…
CVE-2014-0099	Apache Tomcat	0.00	—	0.09	May 31, 2014	Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP…
CVE-2014-0096	Apache Tomcat	0.00	—	0.07	May 31, 2014	java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read…
CVE-2014-0095	Apache Tomcat	0.00	—	0.08	May 31, 2014	java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of service (thread consumption) by using a "Content-Length: 0" AJP request to trigger a hang in request processing.
CVE-2014-0075	Apache Tomcat	0.00	—	0.20	May 31, 2014	Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed…
CVE-2014-2354	Cogentdatahub DataHub	0.00	—	0.01	May 30, 2014	Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack.
CVE-2014-2353	Cogentdatahub DataHub	0.00	—	0.02	May 30, 2014	Cross-site scripting (XSS) vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-2352	Cogentdatahub DataHub	0.00	—	0.02	May 30, 2014	The directory specifier can include designators that can be used to traverse the directory path. Exploiting this vulnerability may enable an attacker to access a limited number of hardcoded file types. Further exploitation of this vulnerability may allow an attacker to cause…
CVE-2014-2343	Trianglemicroworks SCADA Data Gateway	0.00	—	0.00	May 30, 2014	Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows physically proximate attackers to cause a denial of service (excessive data processing) via a crafted DNP request over a serial line.
CVE-2014-2342	Trianglemicroworks SCADA Data Gateway	0.00	—	0.02	May 30, 2014	Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows remote attackers to cause a denial of service (excessive data processing) via a crafted DNP3 packet.
CVE-2014-0907	IBM Db2	0.00	—	0.01	May 30, 2014	Multiple untrusted search path vulnerabilities in unspecified (1) setuid and (2) setgid programs in IBM DB2 9.5, 9.7 before FP9a, 9.8, 10.1 before FP3a, and 10.5 before FP3a on Linux and UNIX allow local users to gain root privileges via a Trojan horse library.
CVE-2013-6744	IBM Db2	0.00	—	0.03	May 30, 2014	The Stored Procedure infrastructure in IBM DB2 9.5, 9.7 before FP9a, 10.1 before FP3a, and 10.5 before FP3a on Windows allows remote authenticated users to gain privileges by leveraging the CONNECT privilege and the CREATE_EXTERNAL_ROUTINE authority.
CVE-2014-0925	IBM Sterling Control Center	0.00	—	0.01	May 30, 2014	Open redirect vulnerability in IBM Sterling Control Center 5.4.0 before 5.4.0.1 iFix 3 and 5.4.1 before 5.4.1.0 iFix 2 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
CVE-2014-3865	Debian Dpkg Dev	0.04	—	0.07	May 30, 2014	Multiple directory traversal vulnerabilities in dpkg-source in dpkg-dev 1.3.0 allow remote attackers to modify files outside of the intended directories via a source package with a crafted Index: pseudo-header in conjunction with (1) missing --- and +++ header lines or (2) a +++…
CVE-2014-3864	Debian Dpkg Dev	0.00	—	0.03	May 30, 2014	Directory traversal vulnerability in dpkg-source in dpkg-dev 1.3.0 allows remote attackers to modify files outside of the intended directories via a crafted source package that lacks a --- header line.
CVE-2014-3227	Debian Dpkg	0.00	—	0.02	May 30, 2014	dpkg 1.15.9, 1.16.x before 1.16.14, and 1.17.x before 1.17.9 expect the patch program to be compliant with a need for the "C-style encoded filenames" feature, but is supported in environments with noncompliant patch programs, which triggers an interaction error that allows…
CVE-2014-3010	IBM Websphere Service Registry And Repository	0.00	—	0.01	May 30, 2014	Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.2, 6.3 before 6.3.0.6, 7.0 before 7.0.0.6, 7.5 before 7.5.0.5, and 8.0 before 8.0.0.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVE-2014-3924	Webmin Webmin	0.00	—	0.01	May 30, 2014	Multiple cross-site scripting (XSS) vulnerabilities in Webmin before 1.690 and Usermin before 1.600 allow remote attackers to inject arbitrary web script or HTML via vectors related to popup windows.
CVE-2014-3923	Digitalzoomstudio Video Gallery	0.00	—	0.02	May 30, 2014	Multiple cross-site scripting (XSS) vulnerabilities in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the logoLink parameter to (1) preview.swf, (2) preview_skin_rouge.swf, (3)…
CVE-2014-3922	Trend Micro Interscan Messaging Security Virtual Appliance	0.00	—	0.02	May 30, 2014	Cross-site scripting (XSS) vulnerability in Trend Micro InterScan Messaging Security Virtual Appliance 8.5.1.1516 allows remote authenticated users to inject arbitrary web script or HTML via the addWhiteListDomainStr parameter to addWhiteListDomain.imss.
CVE-2014-3921	Simple Popup Project Simple Popup	0.00	—	0.02	May 30, 2014	Cross-site scripting (XSS) vulnerability in popup.php in the Simple Popup Images plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the z parameter.
CVE-2014-3780	Citrix Systems Vdi In A Box	0.00	—	0.03	May 30, 2014	Unspecified vulnerability in Citrix VDI-In-A-Box 5.3.x before 5.3.8 and 5.4.x before 5.4.4 allows remote attackers to bypass authentication via unspecified vectors, related to a Java servlet.
CVE-2014-0202	Red Hat Rhevm Dwh	0.00	—	0.00	May 30, 2014	The setup script in ovirt-engine-dwh, as used in the Red Hat Enterprise Virtualization Manager data warehouse (rhevm-dwh) package before 3.3.3, stores the history database password in cleartext, which allows local users to obtain sensitive information by reading an unspecified…
CVE-2013-6788	Bitrix Bitrix E Store Module	0.00	—	0.02	May 30, 2014	The Bitrix e-Store module before 14.0.1 for Bitrix Site Manager uses sequential values for the BITRIX_SM_SALE_UID cookie, which makes it easier for remote attackers to guess the cookie value and bypass authentication via a brute force attack.
CVE-2013-5919	Suricata Suricata	0.00	—	0.02	May 30, 2014	Suricata before 1.4.6 allows remote attackers to cause a denial of service (crash) via a malformed SSL record.
CVE-2013-4143	xlockmore xlockmore	0.00	—	0.00	May 30, 2014	The (1) checkPasswd and (2) checkGroupXlockPasswds functions in xlockmore before 5.43 do not properly handle when a NULL value is returned upon an error by the crypt or dispcrypt function as implemented in glibc 2.17 and later, which allows attackers to bypass the screen lock…
CVE-2012-5877	Nero Mediahome	0.04	—	0.07	May 30, 2014	Nero MediaHome 4.5.8.0 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an HTTP header without a name.
CVE-2012-5876	Nero Mediahome	0.03	—	0.04	May 30, 2014	Multiple off-by-one errors in NMMediaServerService.dll in Nero MediaHome 4.5.8.0 and earlier allow remote attackers to cause a denial of service (crash) via a long string in the (1) request line or (2) HTTP Referer header to TCP port 54444, which triggers a heap-based buffer…
CVE-2012-5572	Dancer\ Dancer	0.00	—	0.01	May 30, 2014	CRLF injection vulnerability in the cookie method (lib/Dancer/Cookie.pm) in Dancer before 1.3114 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a cookie name, a different vulnerability than CVE-2012-5526.
CVE-2012-5560	MATE Mate Settings Daemon	0.00	—	0.00	May 30, 2014	The default configuration in mate-settings-daemon 1.5.3 allows local users to change the timezone for the system via a crafted D-Bus call.
CVE-2014-3285	Cisco Systems, Inc. Wide Area Application Services	0.00	—	0.03	May 29, 2014	Cisco Wide Area Application Services (WAAS) 5.3(.5a) and earlier, when SharePoint acceleration is enabled, does not properly parse SharePoint responses, which allows remote attackers to cause a denial of service (application-optimization handler reload) via a crafted SharePoint…
CVE-2014-3283	Cisco Systems, Inc. Unified Communications Domain Manager	0.00	—	0.02	May 29, 2014	Open redirect vulnerability in Self-Care Client Portal applications in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted…
CVE-2014-3282	Cisco Systems, Inc. Unified Communications Domain Manager	0.00	—	0.02	May 29, 2014	The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allows remote authenticated users to obtain sensitive number-translation information by leveraging…
CVE-2014-3279	Cisco Systems, Inc. Unified Communications Domain Manager	0.00	—	0.02	May 29, 2014	The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allows remote attackers to enumerate account names via a crafted URL, aka Bug IDs CSCun39631 and…
CVE-2014-3277	Cisco Systems, Inc. Unified Communications Domain Manager	0.00	—	0.02	May 29, 2014	The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allows remote authenticated users to obtain sensitive user and group information by leveraging Location…
CVE-2014-3417	Jasig Uportal	0.00	—	0.01	May 29, 2014	uPortal before 4.0.13.1 does not properly check the CONFIG permission, which allows remote authenticated users to configure portlets by leveraging the SUBSCRIBE permission for a portlet.
CVE-2014-3416	Jasig Uportal	0.00	—	0.01	May 29, 2014	uPortal before 4.0.13.1 does not properly check the MANAGE permissions, which allows remote authenticated users to manage arbitrary portlets by leveraging the SUBSCRIBE permission for the portlet-admin portlet.
CVE-2014-3415	Sharetronix Sharetronix	0.03	—	0.02	May 29, 2014	SQL injection vulnerability in Sharetronix before 3.4 allows remote authenticated users to execute arbitrary SQL commands via the invite_users[] parameter to the /invite page for a group.
CVE-2014-3414	Sharetronix Sharetronix	0.03	—	0.02	May 29, 2014	Cross-site request forgery (CSRF) vulnerability in Sharetronix before 3.4 allows remote attackers to hijack the authentication of administrators for requests that add administrative privileges to a user via the admin parameter to admin/administrators.
CVE-2014-0246	Sos Project Sosreport	0.00	—	0.01	May 29, 2014	SOSreport stores the md5 hash of the GRUB bootloader password in an archive, which allows local users to obtain sensitive information by reading the archive.
CVE-2014-0201	Red Hat ovirt-engine-reports	0.00	—	0.00	May 29, 2014	ovirt-engine-reports, as used in the Red Hat Enterprise Virtualization reports package (rhevm-reports) before 3.3.3, uses world-readable permissions on configuration files, which allows local users to obtain sensitive information by reading the files.
CVE-2014-0200	Red Hat Rhevm Reports	0.00	—	0.00	May 29, 2014	The Red Hat Enterprise Virtualization Manager reports (rhevm-reports) package before 3.3.3-1 uses world-readable permissions on the datasource configuration file (js-jboss7-ds.xml), which allows local users to obtain sensitive information by reading the file.
CVE-2014-0199	Red Hat Rhevm Reports	0.00	—	0.00	May 29, 2014	The setup script in ovirt-engine-reports, as used in the Red Hat Enterprise Virtualization reports (rhevm-reports) package before 3.3.3, stores the reports database password in cleartext, which allows local users to obtain sensitive information by reading an unspecified file.
CVE-2013-4178	Drupal Google Authenticator	0.00	—	0.01	May 29, 2014	The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to obtain access by replaying the username, password, and one-time password (OTP).
CVE-2013-4177	Drupal Google Authenticator	0.00	—	0.01	May 29, 2014	The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal does not properly identify user account names, which might allow remote attackers to bypass the two-factor authentication requirement via unspecified vectors.

CVE-2014-3925Jun 1, 2014
Red Hat
Sos
risk 0.00cvss —epss 0.02
sosreport in Red Hat sos 1.7 and earlier on Red Hat Enterprise Linux (RHEL) 5 produces an archive with an fstab file potentially containing cleartext passwords, and lacks a warning about reviewing this archive to detect included passwords, which might allow remote attackers to…
CVE-2014-3790Jun 1, 2014
VMware
Vcenter Server Appliance
risk 0.00cvss —epss 0.02
Ruby vSphere Console (RVC) in VMware vCenter Server Appliance allows remote authenticated users to execute arbitrary commands as root by escaping from a chroot jail.
CVE-2014-0238Jun 1, 2014
PHP
PHP
risk 0.00cvss —epss 0.21
The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long.
CVE-2014-0237Jun 1, 2014
PHP
PHP
risk 0.00cvss —epss 0.20
The cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (performance degradation) by triggering many file_printf calls.
CVE-2014-3793May 31, 2014
VMware
Workstation
risk 0.00cvss —epss 0.01
VMware Tools in VMware Workstation 10.x before 10.0.2, VMware Player 6.x before 6.0.2, VMware Fusion 6.x before 6.0.3, and VMware ESXi 5.0 through 5.5, when a Windows 8.1 guest OS is used, allows guest OS users to gain guest OS privileges or cause a denial of service (kernel…
CVE-2014-0119May 31, 2014
Apache
Tomcat
risk 0.00cvss —epss 0.08
Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an…
CVE-2014-0099May 31, 2014
Apache
Tomcat
risk 0.00cvss —epss 0.09
Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP…
CVE-2014-0096May 31, 2014
Apache
Tomcat
risk 0.00cvss —epss 0.07
java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read…
CVE-2014-0095May 31, 2014
Apache
Tomcat
risk 0.00cvss —epss 0.08
java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of service (thread consumption) by using a "Content-Length: 0" AJP request to trigger a hang in request processing.
CVE-2014-0075May 31, 2014
Apache
Tomcat
risk 0.00cvss —epss 0.20
Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed…
CVE-2014-2354May 30, 2014
Cogentdatahub
DataHub
risk 0.00cvss —epss 0.01
Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack.
CVE-2014-2353May 30, 2014
Cogentdatahub
DataHub
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-2352May 30, 2014
Cogentdatahub
DataHub
risk 0.00cvss —epss 0.02
The directory specifier can include designators that can be used to traverse the directory path. Exploiting this vulnerability may enable an attacker to access a limited number of hardcoded file types. Further exploitation of this vulnerability may allow an attacker to cause…
CVE-2014-2343May 30, 2014
Trianglemicroworks
SCADA Data Gateway
risk 0.00cvss —epss 0.00
Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows physically proximate attackers to cause a denial of service (excessive data processing) via a crafted DNP request over a serial line.
CVE-2014-2342May 30, 2014
Trianglemicroworks
SCADA Data Gateway
risk 0.00cvss —epss 0.02
Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows remote attackers to cause a denial of service (excessive data processing) via a crafted DNP3 packet.
CVE-2014-0907May 30, 2014
IBM
Db2
risk 0.00cvss —epss 0.01
Multiple untrusted search path vulnerabilities in unspecified (1) setuid and (2) setgid programs in IBM DB2 9.5, 9.7 before FP9a, 9.8, 10.1 before FP3a, and 10.5 before FP3a on Linux and UNIX allow local users to gain root privileges via a Trojan horse library.
CVE-2013-6744May 30, 2014
IBM
Db2
risk 0.00cvss —epss 0.03
The Stored Procedure infrastructure in IBM DB2 9.5, 9.7 before FP9a, 10.1 before FP3a, and 10.5 before FP3a on Windows allows remote authenticated users to gain privileges by leveraging the CONNECT privilege and the CREATE_EXTERNAL_ROUTINE authority.
CVE-2014-0925May 30, 2014
IBM
Sterling Control Center
risk 0.00cvss —epss 0.01
Open redirect vulnerability in IBM Sterling Control Center 5.4.0 before 5.4.0.1 iFix 3 and 5.4.1 before 5.4.1.0 iFix 2 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
CVE-2014-3865May 30, 2014
Debian
Dpkg Dev
risk 0.04cvss —epss 0.07
Multiple directory traversal vulnerabilities in dpkg-source in dpkg-dev 1.3.0 allow remote attackers to modify files outside of the intended directories via a source package with a crafted Index: pseudo-header in conjunction with (1) missing --- and +++ header lines or (2) a +++…
CVE-2014-3864May 30, 2014
Debian
Dpkg Dev
risk 0.00cvss —epss 0.03
Directory traversal vulnerability in dpkg-source in dpkg-dev 1.3.0 allows remote attackers to modify files outside of the intended directories via a crafted source package that lacks a --- header line.
CVE-2014-3227May 30, 2014
Debian
Dpkg
risk 0.00cvss —epss 0.02
dpkg 1.15.9, 1.16.x before 1.16.14, and 1.17.x before 1.17.9 expect the patch program to be compliant with a need for the "C-style encoded filenames" feature, but is supported in environments with noncompliant patch programs, which triggers an interaction error that allows…
CVE-2014-3010May 30, 2014
IBM
Websphere Service Registry And Repository
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.2, 6.3 before 6.3.0.6, 7.0 before 7.0.0.6, 7.5 before 7.5.0.5, and 8.0 before 8.0.0.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVE-2014-3924May 30, 2014
Webmin
Webmin
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Webmin before 1.690 and Usermin before 1.600 allow remote attackers to inject arbitrary web script or HTML via vectors related to popup windows.
CVE-2014-3923May 30, 2014
Digitalzoomstudio
Video Gallery
risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the logoLink parameter to (1) preview.swf, (2) preview_skin_rouge.swf, (3)…
CVE-2014-3922May 30, 2014
Trend Micro
Interscan Messaging Security Virtual Appliance
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in Trend Micro InterScan Messaging Security Virtual Appliance 8.5.1.1516 allows remote authenticated users to inject arbitrary web script or HTML via the addWhiteListDomainStr parameter to addWhiteListDomain.imss.
CVE-2014-3921May 30, 2014
Simple Popup Project
Simple Popup
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in popup.php in the Simple Popup Images plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the z parameter.
CVE-2014-3780May 30, 2014
Citrix Systems
Vdi In A Box
risk 0.00cvss —epss 0.03
Unspecified vulnerability in Citrix VDI-In-A-Box 5.3.x before 5.3.8 and 5.4.x before 5.4.4 allows remote attackers to bypass authentication via unspecified vectors, related to a Java servlet.
CVE-2014-0202May 30, 2014
Red Hat
Rhevm Dwh
risk 0.00cvss —epss 0.00
The setup script in ovirt-engine-dwh, as used in the Red Hat Enterprise Virtualization Manager data warehouse (rhevm-dwh) package before 3.3.3, stores the history database password in cleartext, which allows local users to obtain sensitive information by reading an unspecified…
CVE-2013-6788May 30, 2014
Bitrix
Bitrix E Store Module
risk 0.00cvss —epss 0.02
The Bitrix e-Store module before 14.0.1 for Bitrix Site Manager uses sequential values for the BITRIX_SM_SALE_UID cookie, which makes it easier for remote attackers to guess the cookie value and bypass authentication via a brute force attack.
CVE-2013-5919May 30, 2014
Suricata
Suricata
risk 0.00cvss —epss 0.02
Suricata before 1.4.6 allows remote attackers to cause a denial of service (crash) via a malformed SSL record.
CVE-2013-4143May 30, 2014
xlockmore
xlockmore
risk 0.00cvss —epss 0.00
The (1) checkPasswd and (2) checkGroupXlockPasswds functions in xlockmore before 5.43 do not properly handle when a NULL value is returned upon an error by the crypt or dispcrypt function as implemented in glibc 2.17 and later, which allows attackers to bypass the screen lock…
CVE-2012-5877May 30, 2014
Nero
Mediahome
risk 0.04cvss —epss 0.07
Nero MediaHome 4.5.8.0 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an HTTP header without a name.
CVE-2012-5876May 30, 2014
Nero
Mediahome
risk 0.03cvss —epss 0.04
Multiple off-by-one errors in NMMediaServerService.dll in Nero MediaHome 4.5.8.0 and earlier allow remote attackers to cause a denial of service (crash) via a long string in the (1) request line or (2) HTTP Referer header to TCP port 54444, which triggers a heap-based buffer…
CVE-2012-5572May 30, 2014
Dancer\
Dancer
risk 0.00cvss —epss 0.01
CRLF injection vulnerability in the cookie method (lib/Dancer/Cookie.pm) in Dancer before 1.3114 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a cookie name, a different vulnerability than CVE-2012-5526.
CVE-2012-5560May 30, 2014
MATE
Mate Settings Daemon
risk 0.00cvss —epss 0.00
The default configuration in mate-settings-daemon 1.5.3 allows local users to change the timezone for the system via a crafted D-Bus call.
CVE-2014-3285May 29, 2014
Cisco Systems, Inc.
Wide Area Application Services
risk 0.00cvss —epss 0.03
Cisco Wide Area Application Services (WAAS) 5.3(.5a) and earlier, when SharePoint acceleration is enabled, does not properly parse SharePoint responses, which allows remote attackers to cause a denial of service (application-optimization handler reload) via a crafted SharePoint…
CVE-2014-3283May 29, 2014
Cisco Systems, Inc.
Unified Communications Domain Manager
risk 0.00cvss —epss 0.02
Open redirect vulnerability in Self-Care Client Portal applications in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted…
CVE-2014-3282May 29, 2014
Cisco Systems, Inc.
Unified Communications Domain Manager
risk 0.00cvss —epss 0.02
The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allows remote authenticated users to obtain sensitive number-translation information by leveraging…
CVE-2014-3279May 29, 2014
Cisco Systems, Inc.
Unified Communications Domain Manager
risk 0.00cvss —epss 0.02
The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allows remote attackers to enumerate account names via a crafted URL, aka Bug IDs CSCun39631 and…
CVE-2014-3277May 29, 2014
Cisco Systems, Inc.
Unified Communications Domain Manager
risk 0.00cvss —epss 0.02
The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allows remote authenticated users to obtain sensitive user and group information by leveraging Location…
CVE-2014-3417May 29, 2014
Jasig
Uportal
risk 0.00cvss —epss 0.01
uPortal before 4.0.13.1 does not properly check the CONFIG permission, which allows remote authenticated users to configure portlets by leveraging the SUBSCRIBE permission for a portlet.
CVE-2014-3416May 29, 2014
Jasig
Uportal
risk 0.00cvss —epss 0.01
uPortal before 4.0.13.1 does not properly check the MANAGE permissions, which allows remote authenticated users to manage arbitrary portlets by leveraging the SUBSCRIBE permission for the portlet-admin portlet.
CVE-2014-3415May 29, 2014
Sharetronix
Sharetronix
risk 0.03cvss —epss 0.02
SQL injection vulnerability in Sharetronix before 3.4 allows remote authenticated users to execute arbitrary SQL commands via the invite_users[] parameter to the /invite page for a group.
CVE-2014-3414May 29, 2014
Sharetronix
Sharetronix
risk 0.03cvss —epss 0.02
Cross-site request forgery (CSRF) vulnerability in Sharetronix before 3.4 allows remote attackers to hijack the authentication of administrators for requests that add administrative privileges to a user via the admin parameter to admin/administrators.
CVE-2014-0246May 29, 2014
Sos Project
Sosreport
risk 0.00cvss —epss 0.01
SOSreport stores the md5 hash of the GRUB bootloader password in an archive, which allows local users to obtain sensitive information by reading the archive.
CVE-2014-0201May 29, 2014
Red Hat
ovirt-engine-reports
risk 0.00cvss —epss 0.00
ovirt-engine-reports, as used in the Red Hat Enterprise Virtualization reports package (rhevm-reports) before 3.3.3, uses world-readable permissions on configuration files, which allows local users to obtain sensitive information by reading the files.
CVE-2014-0200May 29, 2014
Red Hat
Rhevm Reports
risk 0.00cvss —epss 0.00
The Red Hat Enterprise Virtualization Manager reports (rhevm-reports) package before 3.3.3-1 uses world-readable permissions on the datasource configuration file (js-jboss7-ds.xml), which allows local users to obtain sensitive information by reading the file.
CVE-2014-0199May 29, 2014
Red Hat
Rhevm Reports
risk 0.00cvss —epss 0.00
The setup script in ovirt-engine-reports, as used in the Red Hat Enterprise Virtualization reports (rhevm-reports) package before 3.3.3, stores the reports database password in cleartext, which allows local users to obtain sensitive information by reading an unspecified file.
CVE-2013-4178May 29, 2014
Drupal
Google Authenticator
risk 0.00cvss —epss 0.01
The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to obtain access by replaying the username, password, and one-time password (OTP).
CVE-2013-4177May 29, 2014
Drupal
Google Authenticator
risk 0.00cvss —epss 0.01
The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal does not properly identify user account names, which might allow remote attackers to bypass the two-factor authentication requirement via unspecified vectors.