CVE-2014-6048

The CVE-2014-6048 flaw affects phpMyFAQ before version 2.8.13, where an attacker can read arbitrary attachments via a direct request due to a missing check on whether an attachment is being requested. Public references describe unauthenticated read access and verify the core issue as improper acc...

CVE-2014-6045

CVE-2014-6045 pertains to the PHPMyFAQ package, where versions before 2.8.13 are affected by an SQL injection vulnerability. The issue enables remote authenticated users with certain permissions to execute arbitrary SQL commands via vectors involving the restore function. The root cause is improp...

CVE-2014-6050

CVE-2014-6050 affects phpMyFAQ prior to 2.8.13 and allows remote attackers to bypass CAPTCHA protection by replaying the request. NVD describes CAPTCHA bypass; Veracode notes bypass of form protections via replay. Documented impact is bypass of CAPTCHA on forms; no remediation details are provide...

CVE-2014-4932

CVE-2014-4932 is a documented XSS in the Wordfence Security plugin for WordPress, before version 5.1.5. The issue allows a remote attacker to inject arbitrary web script or HTML by manipulating the val parameter to whois.php. Several connected sources corroborate the affected product and vulnerab...

CVE-2014-6049

CVE-2014-6049 affects phpMyFAQ prior to version 2.8.13, where remote authenticated users with admin privileges can bypass authorization by manipulating a crafted instance ID parameter. The root cause involves improper handling of the instance ID, enabling privilege escalation: an admin user could...

CVE-2014-10074

Summary: CVE-2014-10074 affects Umbraco prior to 7.2.0. The vulnerability stems from not blocking uploads of PHP files in Umbraco.Web.UI/config/umbracoSettings.Release.config, enabling an attacker to upload a PHP file and trigger remote code execution when that file is accessed. This is documente...

fledrCMS Cross-Site Request Forgery Vulnerability

fledrCMS is a lightweight, responsive PHP-based content management system CMS. A cross-site request forgery vulnerability exists in fledrCMS 2014-02-03 and earlier versions. A remote attacker can exploit this vulnerability to change the administrator password with the help of the...

daveismyname simple-cms authentication flaw vulnerability

daveismyname simple-cms is a content management system CMS. A security vulnerability exists in daveismyname simple-cms on 2014-03-11 and earlier versions, which stems from adding pages without authentication. An attacker can exploit the vulnerability to add pages...

CVE-2018-1000220

CVE-2018-1000220 is rejected/not used; a reservation duplicate of CVE-2014-5462.

OracleVM 3.4 : xen (OVMSA-2018-0248) (Bunker Buster) (Foreshadow) (Meltdown) (POODLE) (Spectre)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0248 for details. C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory OVMSA-2018-0248...

Photon OS 1.0: Binutils / Libarchive / Ntp PHSA-2017-0010 (deprecated)

An update of binutils,ntp,libarchive packages for PhotonOS has been released. C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2/7/2019 The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2017-0010. The text itself is copyright C VMwar...

Vulnerabilities in NTPv3 affect AIX,Vulnerabilities in NTPv3 affect VIOS,Vulnerabilities in NTPv4 affect AIX,Vulnerabilities in NTPv4 affect VIOS

IBM SECURITY ADVISORY First Issued: Tue Aug 14 14:48:57 CDT 2018 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/ntpadvisory10.asc https://aix.software.ibm.com/aix/efixes/security/ntpadvisory10.asc...

Security Bulletin: Multiple Vulnerabilities in Current Release of IBM® SDK for Node.js™

Summary Multiple vulnerabilities in OpenSSL disclosed on August 6, 2014 by the OpenSSL Project, plus a vulnerability in the V8 JavaScript engine Vulnerability Details CVE-ID: CVE-2014-3512 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an internal buffer overrun. A remote...

Security Bulletin: Current Release of IBM® SDK for Node.js™ is affected by CVE-2014-7191

Summary Node.js qs denial-of-service vulnerability. Vulnerability Details CVE-ID: CVE-2014-7191 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by an error in the qs module when parsing a string representing a deeply nested object. An attacker could exploit this vulnerability to...

Security Bulletin: Vulnerabilities in IBM Tivoli System Automation for Integrated Operations Management (Several CVE's)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 that is used by IBM Tivoli System Automation for Integrated Operations Management. These issues were disclosed as part of the IBM Java SDK updates in July 2014. CVE-2014-3086, CVE-2014-4227, CVE-2014-4262,...

Security Bulletin: Vulnerabilities in OpenSSL including Logjam affect IBM® SDK for Node.js™ in IBM Bluemix

Summary OpenSSL vulnerabilities were disclosed on June 11, 2015 by the OpenSSL Project. This includes the Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol CVE-2015-4000 which affects IBM SDK for Node.js in IBM Bluemix. Vulnerability Details CVEID: CVE-2015-4000...

Security Bulletin: IBM® SDK for Node.js™ is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470

Summary Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. Vulnerability Details CVE-ID: CVE-2014-0224 DESCRIPTION: OpenSSL is vulnerable to a man-in-the-middle attack, caused by the use of weak keying material in SSL/TLS clients an...

Security Bulletin: IBM® SDK for Node.js™ may be affected by CVE-2014-9748

Summary Unsafe use of read/write locks on Windows 2003 and Windows XP in libuv Vulnerability Details CVEID: CVE-2014-9748 DESCRIPTION: libuv, as used in Node.js is vulnerable to a denial of service, caused by an error in the read/write locks implementation. A local attacker could exploit this...

Security Bulletin: Vulnerability in SSLv3 affects IBM Cloud Manager with OpenStack (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM SmartCloud Entry. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain sensitive...

Security Bulletin: IBM Cloud Manager with Openstack XSS in Swift vulnerability (CVE-2014-3497)

Summary The OpenStack Swift server included in IBM Cloud Manager with Openstack is vulnerable to a XSS attack. Vulnerability Details CVE ID: CVE-2014-3497 Description: OpenStack Swift is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker...