CVE-2014-4802

The Saved Search Admin component in the Process Admin Console in IBM Business Process Manager BPM 8.0 through 8.5.5 does not properly restrict task and instance listings in result sets, which allows remote authenticated users to bypass authorization checks and obtain sensitive information by...

CVE-2014-4868

The management console on the Brocade Vyatta 5400 vRouter 6.4Rx, 6.6Rx, and 6.7R1 allows remote authenticated users to execute arbitrary Linux commands via shell metacharacters in a console command...

CVE-2014-2044

Incomplete blacklist vulnerability in ajax/upload.php in ownCloud before 5.0, when running on Windows, allows remote authenticated users to bypass intended access restrictions, upload files with arbitrary names, and execute arbitrary code via an Alternate Data Stream ADS syntax in the filename...

CVE-2014-3521

CVE-2014-3521 affects Red Hat Conga 0.12.2 in the luci/homebase and luci/cluster menu. The issue allows remote authenticated users to bypass access restrictions by sending a crafted URL, enabling partial disclosure/ modification concerns (per CVSS 2.0: AV:N/AC:L/Au:S/C:P/I:P/A:N). Exploitation st...

CVE-2014-3608

CVE-2014-3608 affects the OpenStack Nova VMware driver. The vulnerability arises when a VM is put into RESCUE, causing quota bypass and DoS via image deletion; it stems from an incomplete fix for CVE-2014-2573. Affected: OpenStack Nova VMware driver (2013.2 to 2013.2.2 and before 2014.1.3). Impac...

CVE-2014-3608

The VMWare driver in OpenStack Compute Nova before 2014.1.3 allows remote authenticated users to bypass the quota limit and cause a denial of service resource consumption by putting the VM into the rescue state, suspending it, which puts into an ERROR state, and then deleting the image. NOTE: thi...

PT-2014-5433 · Red Hat · Red Hat Cloudforms

Name of the Vulnerable Software and Affected Versions: Red Hat CloudForms versions prior to 5.3 Description: The issue allows remote authenticated users to gain privileges via unspecified vectors, related to an "insecure send method" in the vmdb/app/controllers/application controller/performance....

Code injection

The catalog url replacement in OpenStack Identity Keystone before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$admintoken" in the publicurl endpoint field...

CVE-2014-6242

Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 orderby or 2 order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using...

CVE-2014-3621

The catalog url replacement in OpenStack Identity Keystone before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$admintoken" in the publicurl endpoint field...

PYSEC-2014-29

The sandbox whitelisting function allowmodule.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing...

CVE-2014-5324

Unrestricted file upload vulnerability in the N-Media file uploader plugin before 3.4 for WordPress allows remote authenticated users to execute arbitrary PHP code by leveraging Author privileges to store a file...

CVE-2014-4816

Cross-site request forgery CSRF vulnerability in the Administrative Console in IBM WebSphere Application Server WAS 6.x through 6.1.0.47, 7.0 before 7.0.0.35, 8.0 before 8.0.0.10, and 8.5 before 8.5.5.4 allows remote authenticated users to hijack the authentication of arbitrary users for requests...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM WebSphere Application Server WAS 6.x through 6.1.0.47, 7.0 before 7.0.0.35, 8.0 before 8.0.0.10, and 8.5 before 8.5.5.4 allows remote authenticated administrators to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-5411

Schneider Electric SCADA Expert ClearSCADA (ClearSCADA 2010 R3 through 2014 R1; SCADA Expert ClearSCADA 2013/2014 R1 variants) is affected by CVE-2014-5411, a cross-site scripting (XSS) vulnerability combined with an authentication bypass and a weak MD5-based self-signed certificate issue. The IC...

CVE-2014-4622

EMC Documentum Content Server is affected by multiple privilege-escalation vulnerabilities (CVE-2014-4622, CVE-2015-4531/4532/4533/4534/4535/4536) across versions prior to 6.7SP1 P32, 6.7SP2 P25, 7.0 P19, 7.1 P16, and 7.2 P02. The root cause involves improper authorization checks for subgroups wi...

Design/Logic Flaw

ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 does not properly restrict access to the database browser, which allows remote authenticated users to obtain access to the database via a direct request to event/runQuery.do. Fixed in Build 10000...

CVE-2014-6232

Unspecified vulnerability in the LDAP euldap extension before 2.8.18 for TYPO3 allows remote authenticated users to obtain sensitive information via unknown vectors...

Katello: CLI - user without access can call "system remove_deletion" command

Katello allows remote authenticated users to call the "system removedeletion" CLI command via vectors related to "remove system" permissions...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in IBM Configuration Management Application aka VVC in IBM Rational Engineering Lifecycle Manager before 4.0.7 and 5.x before 5.0.1, Rational Software Architect Design Manager before 4.0.7 and 5.x before 5.0.1, and Rational Rhapsody Design Manager...