Directory traversal

Directory traversal vulnerability in dna/viewfilecontents.do in the Dialed Number Analyzer DNA component in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via a crafted URL, aka Bug ID CSCup76318...

CVE-2014-3318

Directory traversal vulnerability in dna/viewfilecontents.do in the Dialed Number Analyzer DNA component in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via a crafted URL, aka Bug ID CSCup76318...

CVE-2014-3316

The Multiple Analyzer in the Dialed Number Analyzer DNA component in Cisco Unified Communications Manager allows remote authenticated users to bypass intended upload restrictions via a crafted parameter, aka Bug ID CSCup76297...

UBUNTU-CVE-2014-3474

Cross-site scripting XSS vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a networ...

CVE-2014-2814

CVE-2014-2814 affects Microsoft Service Bus 1.1 on Windows Server 2008 R2 SP1 and Server 2012 (Gold/R2). The vulnerability allows remote authenticated attackers to cause a denial-of-service (AMQP messaging outage) by sending specially crafted AMQP messages. CVSS v2 base score 4.0 (NETWORK, LOW co...

CVE-2014-2514

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P15, 7.0 before P15, and 7.1 before P06 does not properly check authorization and does not properly restrict object types, which allows remote authenticated users to run save RPC commands with super-user privileges, and consequently...

CVE-2014-2514

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P15, 7.0 before P15, and 7.1 before P06 does not properly check authorization and does not properly restrict object types, which allows remote authenticated users to run save RPC commands with super-user privileges, and consequently...

CVE-2014-2197

The Administration GUI in the web framework in Cisco Unified Communications Domain Manager CDM in Unified CDM Application Software before 8.1.4 does not properly implement access control, which allows remote authenticated users to modify administrative credentials via a crafted URL, aka Bug ID...

CVE-2014-0868

RICOS in IBM Algo Credit Limits aka ACLM 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validation, which allows remote authenticated users to bypass intended dual-control restrictions and modify data via a crafted XML document, as demonstrated by...

Improper access control

The Administration GUI in the web framework in Cisco Unified Communications Domain Manager CDM in Unified CDM Application Software before 8.1.4 does not properly implement access control, which allows remote authenticated users to modify administrative credentials via a crafted URL, aka Bug ID...

Input validation

RICOS in IBM Algo Credit Limits aka ACLM 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validation, which allows remote authenticated users to bypass intended dual-control restrictions and modify data via a crafted XML document, as demonstrated by...

CVE-2014-2197

The Administration GUI in the web framework in Cisco Unified Communications Domain Manager CDM in Unified CDM Application Software before 8.1.4 does not properly implement access control, which allows remote authenticated users to modify administrative credentials via a crafted URL, aka Bug ID...

Oracle Event Processing FileUploadServlet Arbitrary File Upload Exploit

Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7.0 allows remote authenticated users to affect integrity via vectors related to CEP system. This Metasploit module exploits an Arbitrary File Upload vulnerability in Oracle Event Processing...

CVE-2014-3857

Multiple SQL injection vulnerabilities in Kerio Control Statistics in Kerio Control formerly WinRoute Firewall before 8.3.2 allow remote authenticated users to execute arbitrary SQL commands via the 1 x16 or 2 x17 parameter to print.php...

CVE-2014-3857

Kerio Control (formerly WinRoute Firewall) prior to 8.3.2 contains a boolean‑based blind SQL injection in the print.php handler used by Kerio Control Statistics. The vulnerability is exploitable via the x_16 and x_17 parameters, and requires a valid client session (remote, authenticated access is...

CVE-2014-3857

Multiple SQL injection vulnerabilities in Kerio Control Statistics in Kerio Control formerly WinRoute Firewall before 8.3.2 allow remote authenticated users to execute arbitrary SQL commands via the 1 x16 or 2 x17 parameter to print.php...

CVE-2014-3298

Form Data Viewer in Cisco Intelligent Automation for Cloud in Cisco Cloud Portal places passwords in form data, which allows remote authenticated users to obtain sensitive information by reading HTML source code, aka Bug ID CSCui36976...

CVE-2014-3297

Cisco Intelligent Automation for Cloud in Cisco Cloud Portal does not properly restrict the content of MyServices action URLs, which allows remote authenticated users to obtain sensitive information by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history, aka Bug...

CVE-2014-3088

stconf.nsf in IBM Sametime Meeting Server 8.5.1 relies on the client to validate the file format used in wAttach?OpenForm multipart/form-data POST requests, which allows remote authenticated users to bypass intended upload restrictions by modifying the Content-Type header and file extension, as...

CVE-2014-3088

stconf.nsf in IBM Sametime Meeting Server 8.5.1 relies on the client to validate the file format used in wAttach?OpenForm multipart/form-data POST requests, which allows remote authenticated users to bypass intended upload restrictions by modifying the Content-Type header and file extension, as...