4496 matches found
CVE-2014-0162
The Sheepdog backend in OpenStack Image Registry and Delivery Service Glance 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote authenticated users with permission to insert or modify an image to execute arbitrary commands via a crafted location...
CVE-2012-5017
CVE-2012-5017 affects Cisco IOS before 15.1(1)SY1. The issue arises in the VPN/IKEv2 processing where remote authenticated users can trigger a denial of service (device reload) by establishing a VPN session and sending malformed IKEv2 packets. Connected documents confirm the vulnerable condition,...
CVE-2014-2719
AdvancedSystemContent.asp in the ASUS RT series routers with firmware before 3.0.0.4.374.5517, when an administrator session is active, allows remote authenticated users to obtain the administrator user name and password by reading the source code...
CVE-2013-6469
JBoss Overlord Run Time Governance RTGov 1.0 for JBossAS allows remote authenticated users to execute arbitrary Java code via an MVFLEX Expression Language MVEL expression. NOTE: some of these details are obtained from third party information...
Code injection
The Network Analysis tab MainAnalysisContent.asp in the ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the Target field destIP parameter...
CVE-2013-5459
Unspecified vulnerability in IBM Rational Software Architect RSA Design Manager and Rational Rhapsody Design Manager 3.x through 3.0.1 and 4.x before 4.0.6 allows remote authenticated users to modify data by leveraging improper parameter checking...
CVE-2013-5948
CVE-2013-5948 documents concrete details: Affected devices are ASUS RT-AC68U and other RT-series routers with firmware before 3.0.0.4.374.5047. The issue resides in the Network Analysis tab (Main_Analysis_Content.asp), where remote authenticated users can cause arbitrary commands to run via shell...
Advantech WebAccess Vulnerabilities
OVERVIEW NCCIC/ICS-CERT received a report from the Zero Day Initiative ZDI concerning vulnerabilities affecting the Advantech WebAccess application. These vulnerabilities were reported to ZDI by security researchers Dave Weinstein, Tom Gallagher, John Leitch, and others. Advantech has produced an...
CVE-2014-2287
channels/chansip.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.15 before 1.8.15-cert5 and 11.6 before 11.6-cert2, when chansip has a certain configuration, allows remote authenticated users to cause a denial of service...
CVE-2013-7196
PHPFox 3.7.3–3.7.5 contains a flaw in static/ajax.php that allows remote authenticated users to bypass the "Only Me" privacy setting and post a comment on private publications by manipulating the val[item_id] parameter. The root cause is insufficient access control in AJAX comment/like handling, ...
CVE-2013-2143
Summary: CVE-2013-2143 records a privilege-escalation flaw in Katello 1.5.0-14 and earlier (and Red Hat Satellite) where the users controller’s update_roles action does not enforce authorization. This allows remote authenticated users to elevate a normal account to administrator by manipulating t...
CVE-2014-2879
Dell SonicWall Email Security 7.4.5 and earlier suffer multiple cross-site scripting (XSS) vulnerabilities in the web interface. Remote authenticated administrators can inject arbitrary web script or HTML via the uploadPatch parameter on System/Advanced (settings_advanced.html) or the uploadLicen...
CVE-2014-2467
Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote authenticated users to affect integrity via unknown vectors related to Security, a different vulnerability than CVE-2014-2445...
CVE-2014-2434
Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect availability via vectors related to DML...
CVE-2014-2445
Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote authenticated users to affect integrity via unknown vectors related to Security, a different vulnerability than CVE-2014-2467...
CVE-2014-2451
Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Privileges...
Design/Logic Flaw
Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer...
UBUNTU-CVE-2014-2444
Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to InnoDB...
CVE-2014-2424
CVE-2014-2424 affects the Oracle Event Processing component of Oracle Fusion Middleware 11.1.1.7.0. The vulnerability resides in the FileUploadServlet, described as a directory traversal flaw that allows an arbitrary file upload, enabling a remote attacker to place files on the server. The CVE no...