CVE-2014-9558

Multiple SQL injection vulnerabilities in SmartCMS v.2...

CVE-2014-9557

CVE-2014-9557 describes multiple cross-site scripting (XSS) vulnerabilities in SmartCMS v2 (Smartwebsites). Affected product: SmartCMS v.2; vulnerability type: XSS. The root cause/technical details are not fully disclosed in the provided documents, and no explicit exploit scenario is described he...

CVE-2014-8900

IBM UrbanCode Release is vulnerable to cross-site request forgery (CSRF) due to improper validation of user-supplied input. A remote attacker could entice an authenticated user to visit a malicious site to send crafted requests, potentially enabling cross-site scripting, web cache poisoning, and ...

CVE-2014-8168

Red Hat Satellite 6 is affected. The vulnerability allows local users to access the mongod database and delete the pulp_database. The provided documents do not specify the root cause, exact vulnerable component version, or a mitigation/patch. No exploitation details or in‑the‑wild usage are descr...

CVE-2014-4925

Cross-site scripting XSS vulnerability in Good for Enterprise for Android 2.8.0.398 and 1.9.0.40...

CVE-2014-0141

Red Hat Satellite 6.0.3 contains a cross-site scripting (XSS) vulnerability in its web interface. The CNVD entry specifies a remote attacker could exploit this to inject arbitrary web script or HTML, implying browser-level impact on users authenticated to the Satellite console. The available conn...

CVE-2014-4925

The CVE-2014-4925 entry concerns Good for Enterprise for Android (versions 2.8.0.398 and 1.9.0.40) with a cross-site scripting/HTML-injection flaw in emails. Public disclosures describe a crafted HTML payload (notably a meta refresh) that can redirect users to a malicious URL when opening a messa...

CVE-2014-9558

CVE-2014-9558 affects SmartCMS v.2 (Smartwebsites). Multiple SQL injection vulnerabilities arise from improper handling of user input before SQL query construction, allowing an attacker to abuse query logic and potentially access/modify database data. Public sources describe the vendor/product as...

CVE-2014-8753

CVE-2014-8753 corresponds to multiple cross-site scripting (XSS) vulnerabilities in Cit-e-Net Cit-e-Access 6. Affected component: Cit-e-Access 6 (Cit-e-Net). Root cause: reflected/stored XSS vulnerabilities allowing malicious URIs to be parsed by clients. Practical impact (as described): attacker...

CVE-2014-9312

Unrestricted File Upload vulnerability in Photo Gallery 1.2.5...

CVE-2014-9312

CVE-2014-9312 : WordPress Photo Gallery plugin (version 1.2.5) contains an Unrestricted File Upload vulnerability. The root cause is UploadHandler.php allowing access to file uploads without proper verification/sanitization, enabling an attacker with a registered user account to upload arbitrary ...

CVE-2014-9557

Multiple cross-site scripting XSS vulnerabilities in SmartCMS v.2...

CVE-2014-9513

CVE-2014-9513 concerns insecure use of temporary files in xbindkeys-config 0.1.3-2, enabling remote code execution. The primary affected component is xbindkeys-config (version 0.1.3-2). The description across connected sources consistently states that insecure handling of temporary files allows r...

CVE-2014-9469

CVE-2014-9469: A cross-site scripting (XSS) vulnerability affects vBulletin Forum versions 3.5.4, 3.6.0, 3.6.7, 3.8.7, 4.2.2, 5.0.5 and 5.1.3. Connected sources identify a vBulletin Forum XSS vulnerability on the orum/helpulpage, with the OpenVAS entry calling it a vBulletin Forum 'forum/help' ...

CVE-2014-5302

CVE-2014-5302 affects ManageEngine ServiceDesk Plus/Plus MSP (v5–v9.0 v9030), AssetExplorer (v4–v6.1), SupportCenter (v5–v7.9), and IT360 (v8–v10.4). The issue is a directory traversal/file-upload vulnerability in WsDiscoveryServlet/attachment endpoints that enables remote code execution. Exploit...

CVE-2014-8428

CVE-2014-8428 affects Barracuda Load Balancer 5.0.0.015, causing privilege escalation via an improperly protected SSH key. Multiple sources (NVD entry and CNVD/PRION records) corroborate a vulnerability in Barracuda Load Balancer with this issue, noting the SSH key protection flaw as the root cau...

CVE-2014-9483

Removed by vendor...

CVE-2014-9637

GNU patch 2.7.2 and earlier allows remote attackers to cause a denial of service memory consumption and segmentation fault via a crafted diff file...

CVE-2014-7859

Stack-based buffer overflow in loginmgr.cgi in D-Link firmware DNR-320L and DNS-320LW before 1.04b08, DNR-322L before 2.10 build 03, DNR-326 before 2.10 build 03, and DNS-327L before 1.04b01 allows remote attackers to execute arbitrary code by crafting malformed "Host" and "Referer" header values...

CVE-2014-9637

GNU patch 2.7.2 and earlier allows remote attackers to cause a denial of service memory consumption and segmentation fault via a crafted diff file...