33562 matches found
CVE-2014-8324
network.c in Aircrack-ng before 1.2 Beta 3 allows remote attackers to cause a denial of service segmentation fault via a response with a crafted length parameter...
CVE-2014-9487
CVE-2014-9487 involves the getID3 library used by MediaWiki. The flaw enables an XML External Entity (XXE) attack that can cause the system to read arbitrary files, with potential denial of service or other impact. Affected MediaWiki versions are 1.19.23, 1.22.15, 1.23.8, and 1.24.0 prior to 1.24...
CVE-2014-9697
Huawei USG9560/9520/9580 devices (before V300R001C01SPC300) are affected by CVE-2014-9697, where remote attackers can trigger a memory leak leading to memory exhaustion, DoS, reboot, and MPU switchover via a crafted web page. The issue is due to memory leakage in the MPU when servicing crafted re...
CVE-2014-8323
Aircrack-ng buddy-ng component has a vulnerability where a crafted length parameter can cause a segmentation fault, leading to denial of service. Affected are Aircrack-ng versions before 1.2-rc1 (and related advisories reference pre-1.2.0‑rc1 fixes; 1.2 Beta/RC1 fixes exist). Remediation is to up...
CVE-2014-0208
CVE-2014-0208 is a Foreman XSS vulnerability in the search auto-completion, exploitable by remote authenticated users via a crafted key name in Foreman versions prior to 1.4.4. Root cause: reflected/stored XSS in the auto-complete input path (exact implementation details not provided in the docum...
CVE-2014-0208
Cross-site scripting XSS vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted key name...
CVE-2014-8087
Cross-site scripting XSS vulnerability in the post highlights plugin before 2.6.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the txt parameter in a headline action to ajax/phsave.php...
CVE-2014-3702
Directory traversal vulnerability in eNovance eDeploy allows remote attackers to create arbitrary directories and files and consequently cause a denial of service resource consumption via a .. dot dot the session parameter...
CVE-2014-9147
CVE-2014-9147 affects Fiyo CMS 2.0.1.8. The vulnerability allows remote attackers to obtain sensitive information by directly requesting the database backup file in the ".backup/" path. The NVD entry records a high-severity vector (CVSSv3: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base score 7.5) with...
CVE-2014-9148
CVE-2014-9148 concerns Fiyo CMS 2.0.1.8, where an attacker can bypass access restrictions by manipulating the view parameter in a direct request to fiyo/dapur, enabling remote execution of the Install and Update or Backup super administrator functions. The description specifies a direct parameter...
CVE-2014-3702
CVE-2014-3702 describes a directory-traversal vulnerability in Red Hat eNovance eDeploy. A remote attacker can exploit the vulnerability by manipulating the session parameter with dots (..) to create arbitrary directories and files, causing a denial of service through resource consumption. The co...
CVE-2014-8621
The CVE-2014-8621 issue affects the WordPress Store Locator plugin versions 2.3–3.11, where an SQL injection vulnerability exists in the sl-xml.php endpoint via the sl_custom_field parameter. The underlying flaw allows remote attackers to execute arbitrary SQL commands, as indicated by multiple s...
CVE-2014-8087
CVE-2014-8087 corresponds to a stored XSS in the WordPress Post Highlights plugin (versions before 2.6.1). The vulnerability allows an attacker to inject arbitrary script/HTML via the txt parameter used in a headline action to ajax/ph_save.php. Public records consistently cite the affected compon...
CVE-2014-8087
Cross-site scripting XSS vulnerability in the post highlights plugin before 2.6.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the txt parameter in a headline action to ajax/phsave.php...
CVE-2014-7851
Vulnerability CVE-2014-7851 affects oVirt 3.2.2–3.5.0 where restapi sessions are not invalidated after logout from webadmin, enabling remote authenticated users who know another user’s session data to assume that user’s privileges by swapping session tokens. Root cause: restapi session not invali...
CVE-2014-0029
CVE-2014-0029 affects the SAM web application in Red Hat katello-headpin (the systems management engine). The connected documents describe multiple cross-site scripting (XSS) vulnerabilities in the SAM web app, allowing remote attackers to inject arbitrary web script or HTML via unspecified param...
Hancom Hangul HCell CSSValFormat::CheckUnderbar Code Execution Vulnerability(CVE-2016-4296)
Description This vulnerability was discovered within the Hangul Hcell application which is part of the Hangul Office Suite. Hangul Office is published by Hancom, Inc. and is considered one of the more popular Office suites used within South Korea. When opening a Hangul Hcell Document .cell and...
CVE-2014-9092
libjpeg-turbo before 1.3.1 allows remote attackers to cause a denial of service crash via a crafted JPEG file, related to the Exif marker...
CVE-2014-9092
CVE-2014-9092 affects libjpeg-turbo before 1.3.1, allowing remote attackers to cause a denial of service (crash) via a crafted JPEG file, related to the Exif marker. Affected versions include libjpeg-turbo prior to 1.3.1; multiple vendor advisories reference this issue in various operating enviro...