CVE-2014-8597

A reflected cross-site scripting XSS vulnerability in PHP-Fusion 7.02.07 allows remote attackers to inject arbitrary web script or HTML via the status parameter in the CMS admin panel...

CVE-2014-8584

Cross-site scripting XSS vulnerability in the Web Dorado Spider Video Player aka WordPress Video Player plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-8523

Cross-site request forgery CSRF vulnerability in McAfee Network Data Loss Prevention NDLP before 9.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2014-8521

Cross-site scripting XSS vulnerability in McAfee Network Data Loss Prevention NDLP before 9.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-3449

BSS Continuity CMS 4.2.22640.0 has an Authentication Bypass vulnerability...

CVE-2014-8376

Cross-site scripting XSS vulnerability in the context administration sub-panel in the Site Banner module before 7.x-4.1 for Drupal allows remote authenticated users with the "Administer contexts" Context UI module permission to inject arbitrary web script or HTML via vectors related to context...

CVE-2014-8303

Cross-site scripting XSS vulnerability in Splunk Web in Splunk Enterprise 6.1.x before 6.1.4 and 6.0.x before 6.0.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to event parsing...

CVE-2014-8306

SQL injection vulnerability in the sqlquery function in cart.php in C97net Cart Engine before 4.0 allows remote attackers to execute arbitrary SQL commands via the itemid variable, as demonstrated by the 1 itemid0 or 2 itemid parameter...

CVE-2014-3139

recoveryconsole/bpl/snmpd.php in Unitrends Enterprise Backup 7.3.0 allows remote attackers to bypass authentication by setting the auth parameter to a certain string...

CVE-2014-9509

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set to all or cached, allows remote attackers to have an unspecified impact possibly resource consumption via a "Cache Poisoning" attack using a...

CVE-2014-2869

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to obtain sensitive information via requests to unspecified URIs, as demonstrated by pathname, SQL server, e-mail address, and IP address information...

CVE-2014-125018

A vulnerability, which was classified as problematic, has been found in FFmpeg 2.0. Affected by this issue is the function decodesliceheader. The manipulation leads to memory corruption. The attack may be launched remotely. It is recommended to apply a patch to fix this issue...

CVE-2014-2873

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 does not require authentication for access to log files, which allows remote attackers to obtain sensitive server information by using a predictable name in a request for a file...

CVE-2014-9702

system/classes/DbPDO.php in Cmfive through 2015-03-15, when database connectivity malfunctions, allows remote attackers to obtain sensitive information username and password via any request, such as a password reset request...

CVE-2014-8330

Cross-site scripting XSS vulnerability in EspoCRM allows remote authenticated users to inject arbitrary web script or HTML via the Name field in a new account...

CVE-2014-5350

Multiple directory traversal vulnerabilities in Bitdefender GravityZone before 5.1.11.432 allow remote attackers to read arbitrary files via a 1 .. dot dot in the id parameter to webservice/CORE/downloadFullKitEpc/a/1 in the Web Console or 2 %2E%2E encoded dot dot in the default URI to port 7074 ...

CVE-2014-5345

Cross-site scripting XSS vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress allows remote attackers to inject arbitrary web script or HTML via the step parameter...

CVE-2014-4309

Multiple cross-site scripting XSS vulnerabilities in Openfiler 2.99 allow remote attackers to inject arbitrary web script or HTML via the 1 TinkerAjax parameter to uptime.html, or remote authenticated users to inject arbitrary web script or HTML via the 2 MaxInstances, 3 PassivePorts, 4 Port, 5...

CVE-2014-3807

Multiple cross-site scripting XSS vulnerabilities in BarracudaDrive 6.7.2 allow remote attackers to inject arbitrary web script or HTML via the 1 blog, 2 bloggeruser, or 3 bloggerpasswd parameter to private/manage/...

CVE-2014-3761

Cross-site scripting XSS vulnerability in D-Link DAP 1150 with firmware 1.2.94 allows remote attackers to inject arbitrary web script or HTML via the resbuf parameter to index.cgi in the Control/URL-filter section...