CVE-2015-1029

The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8.8 and earlier allows remote authenticated users to gain privileges or obtain sensitive information by prepopulating the fact cache...

CVE-2014-7814

SQL injection vulnerability in Red Hat CloudForms 3.1 Management Engine CFME 5.3 allows remote authenticated users to execute arbitrary SQL commands via a crafted REST API request to an SQL filter...

CVE-2015-1029

The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8.8 and earlier allows remote authenticated users to gain privileges or obtain sensitive information by prepopulating the fact cache...

PT-2015-3930 · Red Hat · Red Hat Cloudforms

Name of the Vulnerable Software and Affected Versions: Red Hat CloudForms 3.1 Management Engine CFME version 5.3 Description: The issue allows remote authenticated users to execute arbitrary SQL commands via a crafted REST API request to an SQL filter. This can be achieved by sending a malicious...

CVE-2014-8143

Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller AD DC is configured, allows remote authenticated users to set the LDB userAccountControl UFSERVERTRUSTACCOUNT bit, and consequently gain privileges, by leveraging delegation of...

CVE-2014-8153

The L3 agent in OpenStack Neutron 2014.2.x before 2014.2.2, when using radvd 2.0+, allows remote authenticated users to cause a denial of service blocked router update processing by creating eight routers and assigning an ipv6 non-provider subnet to each...

PT-2015-3671 · D Link · D-Link Dap-1360

Name of the Vulnerable Software and Affected Versions: D-Link DAP-1360 router versions 2.5.4 and earlier Description: The issue allows remote attackers to hijack the authentication of unspecified users for requests, including changing the MAC filter restrict mode, adding a MAC address to the...

MS15-007: Vulnerability in Network Policy Server RADIUS implementation could cause denial of service: January 13, 2015

None None...

PT-2015-3669 · D Link · D-Link Dap-1360

Name of the Vulnerable Software and Affected Versions: D-Link DAP-1360 versions 2.5.4 and earlier Description: The issue allows remote attackers to hijack the authentication of unspecified users for requests that change various settings, including Enable Wireless, MBSSID, BSSID, Hide Access Point...

Default credentials

VDG Security SENSE formerly DIVA 2.3.13 sends the user database when a user logs in, which allows remote authenticated users to obtain usernames and password hashes by logging in to TCP port 51410 and reading the response...

CVE-2014-9577

Affected product/variant: VDG Security SENSE (formerly DIVA) version 2.3.13. Vulnerability type: information disclosure via the login process. Root cause / mechanism: the system sends the user database during login, enabling an authenticated remote user to read the response over TCP port 51410. I...

Design/Logic Flaw

The V2 API in OpenStack Image Registry and Delivery Service Glance before 2014.2.2 and 2014.1.4 allows remote authenticated users to read or delete arbitrary files via a full pathname in a file: URL in the image location property...

DEBIAN-CVE-2014-8131

The qemu implementation of virConnectGetAllDomainStats in libvirt before 1.2.11 does not properly handle locks when a domain is skipped due to ACL restrictions, which allows a remote authenticated users to cause a denial of service deadlock or segmentation fault and crash via a request to access...

WordPress Plugin Cart66 Lite 'models/Cart66.php' Directory Traversal Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A directory traversal vulnerability exists in WordPress plugin Cart66 Lite 'models/Cart66.php' versions prior to 1.5.4, which...

NetIQ Access Manager Directory Traversal Vulnerability

NetIQ Access Manager is a solution for controlling access to resources from American NetIQ. A directory traversal vulnerability in HF3, version 4.x prior to NetIQ Access Manager 4.0.1, allows remotely authenticated novlwww users to read arbitrary files via external entity declarations containing...

CVE-2014-5215

NetIQ Access Manager (NAM) 4.x prior to 4.0.1 HF3 is affected by CVE-2014-5215. An authenticated administrator can disclose service-account passwords via requests to roma/jsp/volsc/monitoring/dev_services.jsp or roma/jsp/debug/debug.jsp, constituting an information-disclosure vulnerability (impac...

CVE-2014-8007

Cisco Prime Infrastructure allows remote authenticated users to read device-discovery passwords by examining the HTML source code of the Quick Discovery options page, aka Bug ID CSCum00019...

Server side request forgery (ssrf)

nds/files/opt/novell/eDirectory/lib64/ndsimon/public/images in iMonitor in Novell eDirectory before 8.8 SP8 Patch 4 allows remote authenticated users to obtain sensitive information from process memory via a direct request...

CVE-2014-9355

Puppet Enterprise before 3.7.1 allows remote authenticated users to obtain licensing and certificate signing request information by leveraging access to an unspecified API endpoint...

DEBIAN-CVE-2014-9324

The GenericInterface in OTRS Help Desk 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before 4.0.3 allows remote authenticated users to access and modify arbitrary tickets via unspecified vectors...