33311 matches found
CVE-2014-125072
A vulnerability classified as critical has been found in CherishSin klattr. This affects an unknown part. The manipulation leads to sql injection. The patch is named f8e4ecfbb83aef577011b0b4aebe96fb6ec557f1. It is recommended to apply a patch to fix this issue. The associated identifier of this...
CVE-2014-125098
A vulnerability was found in Dart httpserver up to 0.9.5 and classified as problematic. Affected by this issue is the function VirtualDirectory of the file lib/src/virtualdirectory.dart of the component Directory Listing Handler. The manipulation of the argument request.uri.path leads to cross si...
CVE-2014-9154
The Notify module 7.x-1.x before 7.x-1.1 for Drupal does not properly restrict access to 1 new or 2 modified nodes or 3 their fields, which allows remote authenticated users to obtain node titles, teasers, and fields by reading a notification email...
CVE-2014-6275
FusionForge before 5.3.2 use scripts that run under the shared Apache user, which is also used by project homepages by default. If project webpages are hosted on the same server than FusionForge, it can allow users to incorrectly access on-disk private data in FusionForge...
CVE-2014-3447
BSS Continuity CMS 4.2.22640.0 has a Remote Denial Of Service vulnerability...
CVE-2014-9211
ClickDesk version 4.3 and below has persistent cross site scripting...
CVE-2014-10385
The memphis-documents-library plugin before 3.0 for WordPress has XSS via $REQUEST...
CVE-2014-5500
Synacor Zimbra Collaboration before 8.0.8 has XSS...
CVE-2014-9448
Buffer overflow in Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 allows remote attackers to execute arbitrary code or cause a denial of service crash via a long string in a WAX file...
CVE-2014-8942
Lexiglot through 2014-11-20 allows CSRF...
CVE-2014-8522
The MySQL database in McAfee Network Data Loss Prevention NDLP before 9.3 does not require a password, which makes it easier for remote attackers to obtain access...
CVE-2014-8943
Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svnurl parameter...
CVE-2014-5380
Grand MA 300 allows retrieval of the access PIN from sniffed data...
CVE-2014-3963
ownCloud Server before 6.0.1 does not properly check permissions, which allows remote authenticated users to access arbitrary preview pictures via unspecified vectors...
CVE-2014-3787
SAP NetWeaver 7.20 and earlier allows remote attackers to read arbitrary SAP Central User Administration SAP CUA tables via unspecified vectors...
CVE-2014-10384
The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion...
CVE-2014-10075
The karo gem 2.3.8 for Ruby allows Remote command injection via the host field...
CVE-2014-5093
Status2k does not remove the install directory allowing credential reset...