33565 matches found
CVE-2014-5380
Grand MA 300 allows retrieval of the access PIN from sniffed data...
CVE-2014-3963
ownCloud Server before 6.0.1 does not properly check permissions, which allows remote authenticated users to access arbitrary preview pictures via unspecified vectors...
CVE-2014-3787
SAP NetWeaver 7.20 and earlier allows remote attackers to read arbitrary SAP Central User Administration SAP CUA tables via unspecified vectors...
CVE-2014-10384
The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion...
CVE-2014-10075
The karo gem 2.3.8 for Ruby allows Remote command injection via the host field...
CVE-2014-5093
Status2k does not remove the install directory allowing credential reset...
CVE-2014-10376
The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection...
CVE-2014-1860
Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities...
CVE-2014-10389
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication...
CVE-2014-2850
The network interface configuration page netinterface in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter...
CVE-2014-10383
The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion...
CVE-2014-2871
PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 relies on an HTTP session for entering credentials on login pages, which allows remote attackers to obtain sensitive information by sniffing the network...
CVE-2014-9442
SQL injection vulnerability in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the q parameter in a promotionProductSearch action to wp-admin/admin-ajax.php...
CVE-2014-9577
VDG Security SENSE formerly DIVA 2.3.13 sends the user database when a user logs in, which allows remote authenticated users to obtain usernames and password hashes by logging in to TCP port 51410 and reading the response...
CVE-2014-10393
The cforms2 plugin before 10.5 for WordPress has XSS...
CVE-2014-9099
Cross-site request forgery CSRF vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via a request to the whydoworkadsense page in wp-admin/options-general.php...
CVE-2014-8667
Cross-site scripting XSS vulnerability in SAP HANA Web-based Development Workbench allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2014-125078
A vulnerability was found in yanheven console and classified as problematic. Affected by this issue is some unknown functionality of the file horizon/static/horizon/js/horizon.instances.js. The manipulation leads to cross site scripting. The attack may be launched remotely. The patch is identifie...