33562 matches found
CVE-2014-8335
The CVE-2014-8335 entry relates to the WP-DBManager (aka Database Manager) WordPress plugin, affected in versions prior to 2.7.2. The vulnerability affects the files wp-dbmanager.php and database-manage.php, where credentials are placed on the mysqldump command line, enabling local users to obtai...
CVE-2014-8540
The CVE covers GitLab’s groups API in versions 6.x and 7.x up to 7.4.3, where remote authenticated guest users could modify ownership of arbitrary groups due to improper permission checks. Impact is ownership modification without authorization; CVSS vectors indicate low attack complexity with par...
CVE-2017-2014
This CVE entry is rejected/not used and does not represent an active vulnerability.
SUSE-RU-2018:0028-1 Recommended update for icu
This update for icu fixes the following issue: - Fix international date/time format output a regression caused by the fix for CVE-2014-9911 bsc1037416...
CVE-2014-7862
The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action...
CVE-2014-7862
CVE-2014-7862 affects ManageEngine Desktop Central/Desktop Central MSP via the DCPluginServelet; unauthenticated remote attackers can create administrator accounts using addPlugInUser, with pre-90109 builds vulnerable. Public PoC/exploit references exist (Exploit-DB 43892; Rapid7 Metasploit modul...
CVE-2014-7862
The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action...
Debian: Security Advisory (DLA-693-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Description of the security update for SQL Server 2014 SP2 CU10: January 16, 2018
None None...
Description of the security update for SQL Server 2014 SP2 GDR: January 16, 2018
None None...
CVE-2014-8119
The findifcfgpath function in netcf before 0.2.7 might allow attackers to cause a denial of service application crash via vectors involving augeas path expressions...
CVE-2014-4978
CVE-2014-4978 concerns the rs_filter_graph function in librawstudio/rs-filter.c of rawstudio, where a symlink attack on /tmp/rs-filter-graph.png or /tmp/rs-filter-graph could let a local attacker truncate arbitrary files. The vulnerability is local and depends on symlink handling in rs-filter_gra...
CVE-2014-9515
Dozer improperly uses a reflection-based approach to type conversion, which might allow remote attackers to execute arbitrary code via a crafted serialized object...
CVE-2014-0121
CVE-2014-0121 affects Hawt.io: the admin terminal does not require authentication, allowing remote attackers to execute arbitrary commands via the k parameter. Documents consistently describe an authentication bypass in Hawt.io’s admin terminal, enabling command execution with potential high impa...
CVE-2014-8119
CVE-2014-8119 affects the netcf library, where the function find_ifcfg_path in netcf before 0.2.7 may allow a remote attacker to trigger a denial of service (application crash) via vectors involving augeas path expressions. This vulnerability has been acknowledged in multiple advisories across ve...
CVE-2014-3630
Play framework’s Java XML processing (before 2.2.6 and 2.3.x before 2.3.5) is affected by CVE-2014-3630 via an XML External Entity (XXE) vulnerability. Crafted XML data can read arbitrary files, cause denial of service, or have unspecified impacts. The connected records confirm affected versions ...
CVE-2014-3630
XML external entity XXE vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial of service, or have unspecified other impact via crafted XML data...
CVE-2014-9515
CVE-2014-9515 affects Dozer: the vulnerability stems from reflection-based type conversion during object mapping, enabling remote code execution via specially crafted serialized objects. The NVD entry lists a high/critical impact (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; base scores up to 9.8) with n...