CVE-2014-7863

The FailOverHelperServlet aka FailServlet servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to 1 read arbitrary...

CVE-2014-7863

The CVE-2014-7863 issue affects the FailOverHelperServlet (FailServlet) in ZOHO ManageEngine OpManager, Applications Manager, and IT360, allowing (1) arbitrary file read via the fileName parameter in a copyfile operation and (2) directory-listing disclosure via listdirectory. Technical details ar...

CVE-2014-9127

Open-School Community Edition 2.2 is affected by CVE-2014-9127: an access control bypass in the export feature allows remote authenticated users to view sensitive data via the r parameter set to export on index.php. The issue enables partial confidentiality impact as described in the CVE entry, w...

CVE-2014-9126

CVE-2014-9126 affects Open-School Community Edition 2.2. The vulnerability is described as multiple cross-site scripting (XSS) issues that allow remote attackers to inject arbitrary script/HTML via the YII_CSRF_TOKEN HTTP cookie or through the StudentDocument, StudentCategories, and StudentPrevio...

CVE-2014-9470

Cross-site scripting XSS vulnerability in the loadForm function in Frontend/Modules/Search/Actions/Index.php in Fork CMS before 3.8.4 allows remote attackers to inject arbitrary web script or HTML via the qwidget parameter to en/search...

CVE-2014-9470

Fork CMS prior to 3.8.4 is affected by a cross-site scripting (XSS) vulnerability in the loadForm() function (Frontend/Modules/Search/Actions/Index.php) where the q_widget parameter to /en/search can inject arbitrary script/HTML. The issue arises from insufficient input filtering and is exploitab...

CVE-2014-2225

CVE-2014-2225 is a CSRF vulnerability in Ubiquiti Networks UniFi Controller prior to 3.2.1. The flaw enables remote attackers to hijack administrator sessions by issuing forged requests to multiple API endpoints (e.g., api/add/admin, api/set/setting/guest_access, api/cmd/stamgr, api/cmd/cfgmgr, e...

renego.cl Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1087113 Security Researcher geeknik Helped patch 8826 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting renego.cl website and its...

CVE-2014-5091

A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, which could let a malicious user execute arbitrary PHP code...

BELL-CVE-2014-5278 CVE-2014-5278 does not affect BellSoft software

Bulletin has no description...

CVE-2014-5087

Sphider Search Engine prior to version 1.3.6 is vulnerable to remote code execution due to exec() calls in admin/spiderfuncs.php. This CVE (CVE-2014-5087) affects Sphider implementations before 1.3.6 and could let an unauthenticated remote attacker execute arbitrary code, with impact on confident...

CVE-2014-5091

A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, which could let a malicious user execute arbitrary PHP code...

CVE-2014-5091

Status2K 2.5 Server Monitoring Software is affected by CVE-2014-5091 via the multies parameter to includes/functions.php, which could allow an attacker to execute arbitrary PHP code. Affected component: the server monitoring software’s PHP code path, specifically includes/functions.php, with the ...

CVE-2014-5288

A CSRF Vulnerability exists in Kemp Load Master before 7.0-18a via unspecified vectors in administrative pages...

CVE-2014-5278

CVE-2014-5278 describes a vulnerability in Docker prior to 1.2 where container names may collide with and override container IDs. The initial description explicitly states the issue; connected sources reiterate the same vulnerability. No exploit vectors, affected products, or remediation steps ar...

CVE-2014-5288

Kemp Load Master is affected by a CSRF vulnerability (CVE-2014-5288) in the web administrative interface prior to version 7.0-18a. Public writeups and exploit listings (e.g., 7.1.16 era) describe additional issues (RCE, XSS, DoS) in Kemp Load Master, indicating multiple vulnerabilities around the...

CVE-2014-5468

CVE-2014-5468 is a Railo Remote File Include vulnerability affecting Railo 4.2.1 and earlier. A specially crafted request to thumbnail.cfm can cause the server to include a malicious PNG, enabling an attacker to download arbitrary PNGs and, via directory traversal, append ColdFusion markup to the...

CVE-2014-6413

A Cross-site Scripting XSS vulnerability exists in WatchGuard XTM 11.8.3 via the pollname parameter in the firewall/policy script...

CVE-2014-6413

WatchGuard XTM 11.8.3 is affected by CVE-2014-6413, a Cross-site Scripting (XSS) flaw exploitable via the poll_name parameter in the firewall/policy script. Affects the product as described in NVD entries; CVSS base scores: 4.3 (NVD CVSS2) and 6.1 (CVSS3.1) with network attack vector, low attack ...

CVE-2014-7224

CVE-2014-7224 is an Android code‑execution vulnerability affecting versions prior to 4.4.0, tied to the addJavascriptInterface method and the accessibility/accessibilityTraversal objects. A remote attacker could potentially execute arbitrary code; NVD assigns high severity (CVSS v3.1: 8.8, vector...