CVE-2014-9101

Multiple cross-site request forgery CSRF vulnerabilities in Oxwall 1.7.0 build 7907 and 7906 and SkaDate Lite 2.0 build 7651 allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks or possibly have other unspecified impact v...

CVE-2012-5654

The Nodewords: D6 Meta Tags module before 6.x-1.14 for Drupal, when configured to automatically generate description meta tags from node text, does not properly filter node content when creating tags, which might allow remote attackers to obtain sensitive information by reading the 1 description,...

CVE-2012-1643

The Faster Permissions module 7.x-2.x before 7.x-1.2 for Drupal does not check the "administer permissions" permission, which allows remote attackers to modify access permissions via unspecified vectors...

CVE-2011-3790

Piwigo 2.1.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tools/metadata.php and certain other files...

CVE-2019-13557

In Tasy EMR, Tasy WebPortal Versions 3.02.1757 and prior, there is an information exposure vulnerability which may allow a remote attacker to access system and configuration information...

CVE-2019-12394

Anviz access control devices allow unverified password change which allows remote attackers to change the administrator password without prior authentication...

CVE-2018-16158

Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins to uid 0 via the PubkeyAuthentication...

CVE-2019-6036

Cross-site scripting vulnerability in F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 version 6 series allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2010-2984

Cisco Unified Wireless Network UWN Solution 7.x before 7.0.98.0 on 4404 series controllers does not properly implement the WEBAUTHREQD state, which allows remote attackers to bypass intended access restrictions via WLAN traffic, aka Bug ID CSCtb75305...

CVE-2015-9491

The ThemeMakers Blessing Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information such as userlogin, userpass, and useremail values via a direct request for the wp-content/uploads/tmmdbmigrate/wpusers.dat URI...

CVE-2012-4070

SQL injection vulnerability in system/src/dispatcher.php in Dir2web 3.0 allows remote attackers to execute arbitrary SQL commands via the oid parameter in a homepage action to index.php...

CVE-2010-4733

WebSCADA WS100 and WS200, Easy Connect EC150, Modbus RTU - TCP Gateway MB100, and Serial Ethernet Server SS100 on the IntelliCom NetBiter NB100 and NB200 platforms have a default username and password, which makes it easier for remote attackers to obtain superadmin access via the web interface, a...

CVE-2011-3787

phpScheduleIt 1.2.12 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by templates/schedule.template.php and certain other files...

CVE-2014-10076

The wp-db-backup plugin 2.2.4 for WordPress relies on a five-character string for access control, which makes it easier for remote attackers to read backup archives via a brute-force attack...

CVE-2012-6642

Cross-site scripting XSS vulnerability in ClipBucket 2.6 allows remote attackers to inject arbitrary web script or HTML via the type parameter to viewchannel.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2002-2346

phpBB 2.0 through 2.0.3 generates names for uploaded avatar files with the hex-encoded IP address of the client system, which allows remote attackers to obtain client IP addresses...

The vulnerability of Xen hypervisors relates to the incorrect sequence of processor instructions, allowing attackers to gain unauthorized access to protected information.

The vulnerability of Xen hypervisors is related to an incorrect sequence of processor instructions, due to the absence of the ENDBR instruction and a prologue/eepilog for CFI schemes based on hash. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access ...

The vulnerability of the Jenkins automation server, related to insufficient protection of service data, allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Jenkins automation server is related to insufficient protection for service data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2025-32825

A vulnerability has been identified in TeleControl Server Basic All versions V3.1.2.2. The affected application is vulnerable to SQL injection through the internally used 'GetProjects' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and wri...

CVE-2025-31343

A vulnerability has been identified in TeleControl Server Basic All versions V3.1.2.2. The affected application is vulnerable to SQL injection through the internally used 'UpdateTcmSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from a...