CVE-2013-2559

SQL injection vulnerability in Symphony CMS before 2.3.2 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter to system/authors/. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands...

CVE-2013-2559

Symphony CMS (before 2.3.2) is affected by a SQL injection in the sort parameter to system/authors/ that can be triggered by remote authenticated users; note that CSRF can enable remote unauthenticated attackers to execute arbitrary SQL commands. The issue is linked to CVE-2013-2559 and is also d...

CVE-2014-0886

CVE-2014-0886 affects IBM Lotus Protector for Mail Security 2.8.x prior to 2.8.1-22905, where the Admin Web UI allows remote authenticated users to bypass access restrictions and execute arbitrary commands via unspecified vectors. Affected product: IBM Lotus Protector for Mail Security (Admin Web...

CVE-2014-0887

The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors...

PYSEC-2014-113

The VMWare driver in OpenStack Compute Nova 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service resource consumption by requesting the VM be put into rescue and then deleting the imag...

CVE-2014-2585

ownCloud before 5.0.15 and 6.x before 6.0.2, when the fileexternal app is enabled, allows remote authenticated users to mount the local filesystem in the user's ownCloud via the mount configuration...

CVE-2013-0303

Unspecified vulnerability in core/ajax/translations.php in ownCloud before 4.0.12 and 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via unknown vectors. NOTE: this entry has been SPLIT due to different affected versions. The core/settings.php issue is covered ...

CVE-2013-7344

Unspecified vulnerability in core/settings.php in ownCloud before 4.0.12 and 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via unknown vectors. NOTE: this issue was SPLIT from CVE-2013-0303 due to different affected versions...

CVE-2011-3197

SQL injection vulnerability in Domain Technologie Control DTC before 0.34.1 allows remote authenticated users to execute arbitrary SQL commands via the addrlink parameter to shared/inc/forms/domaininfo.php. NOTE: CVE-2011-3197 has been SPLIT due to findings by different researchers. CVE-2011-5272...

CVE-2014-0132

The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind...

CVE-2014-0132

CVE-2014-0132 affects 389 Directory Server: SASL authentication can be abused via the authzid parameter in a SASL/GSSAPI bind to connect as an arbitrary user and gain privileges. Mageia advisory MGASA-2014-0145 indicates updated 389-ds-base packages fix this vulnerability; apply the vendor-provid...

CVE-2014-2536

Directory traversal vulnerability in McAfee Cloud Identity Manager 3.0, 3.1, and 3.5.1, McAfee Cloud Single Sign On MCSSO before 4.0.1, and Intel Expressway Cloud Access 360-SSO 2.1 and 2.5 allows remote authenticated users to read an unspecified file containing a hash of the administrator passwo...

UBUNTU-CVE-2013-2085

Directory traversal vulnerability in apps/filestrashbin/index.php in ownCloud Server before 5.0.6 allows remote authenticated users to access arbitrary files via a .. dot dot in the dir parameter...

Directory traversal

Directory traversal vulnerability in apps/filestrashbin/index.php in ownCloud Server before 5.0.6 allows remote authenticated users to access arbitrary files via a .. dot dot in the dir parameter...

CVE-2013-1963

The CVE-2013-1963 entry describes a vulnerability in the ownCloud Contacts app where ownership of contacts is not properly enforced, allowing remote authenticated users to download arbitrary contacts via unspecified vectors. Affected versions are ownCloud before 4.5.10 and 5.x before 5.0.5. The u...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote authenticated administrators to inject arbitrary web script or HTML via the 1 sitename or 2 siteurl parameter to apps/external/ajax/setsites.php...

389-ds: flaw in parsing authzid can lead to privilege escalation

The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind...

PYSEC-2014-56

sendto.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to spoof emails via unspecified vectors...

PYSEC-2014-61

memberportrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or delete portraits of other users via unspecified vectors...

CVE-2013-4197

Plone CVE-2013-4197 affects member_portrait.py in Plone 2.1–4.1, 4.2.x–4.2.5, and 4.3.x–4.3.1. The issue allows remote authenticated users to modify or delete portraits of other users via unspecified vectors due to an access-control weakness. No exploitation details or direct fix are provided in ...