Directory traversal

Directory traversal vulnerability in the Real-Time Monitoring Tool RTMT in Cisco Unified Communications Manager CM 10.01 allows remote authenticated users to read arbitrary files via a crafted URL, aka Bug ID CSCup57676...

Directory traversal

Directory traversal vulnerability in the Multiple Analyzer in the Dialed Number Analyzer DNA component in Cisco Unified Communications Manager 10.01 allows remote authenticated users to delete arbitrary files via a crafted URL, aka Bug ID CSCup76314...

CVE-2014-3319

Directory traversal vulnerability in the Real-Time Monitoring Tool RTMT in Cisco Unified Communications Manager CM 10.01 allows remote authenticated users to read arbitrary files via a crafted URL, aka Bug ID CSCup57676...

CVE-2014-3319

Cisco CVE-2014-3319 affects the Real-Time Monitoring Tool (RTMT) in Cisco Unified Communications Manager (CM) 10.0(1). The vulnerability is a directory traversal that lets an authenticated, remote attacker read arbitrary files by sending a crafted URL. Root cause is insufficient input validation ...

CVE-2014-4013

SQL injection vulnerability in the Policy Manager in Aruba Networks ClearPass 5.x, 6.0.x, 6.1.x through 6.1.4.61696, 6.2.x through 6.2.6.62196, and 6.3.x before 6.3.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

Sql injection

Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 categoryid or 2 pdfid parameter to wp-admin/admin.php...

CVE-2014-4013

SQL injection vulnerability in the Policy Manager in Aruba Networks ClearPass 5.x, 6.0.x, 6.1.x through 6.1.4.61696, 6.2.x through 6.2.6.62196, and 6.3.x before 6.3.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-4944

Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 categoryid or 2 pdfid parameter to wp-admin/admin.php...

CVE-2014-4013

The CVE-2014-4013 entry describes a SQL injection vulnerability in the Policy Manager of Aruba Networks ClearPass. Affected products/versions include ClearPass 5.x, 6.0.x, 6.1.x up to 6.1.4.61696, 6.2.x up to 6.2.6.62196, and 6.3.x before 6.3.4. The issue allows remote authenticated users to exec...

CVE-2014-3816

Juniper Junos 11.4 before 11.4R12, 12.1 before 12.1R11, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D30, 12.1X46 before 12.1X46-D20, 12.1X47 before 12.1X47-D10, 12.2 before 12.2R8-S2, 12.3 before 12.3R7, 13.1 before 13.1R4-S2, 13.2 before 13.2R5, 13.3 before 13.3R2-S2, and 14.1 before 14.1...

CVE-2014-3992

Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote authenticated users to execute arbitrary SQL commands via the 1 entity parameter in an update action to user/fiche.php or 2 sortorder parameter to user/group/index.php...

Sql injection

Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote authenticated users to execute arbitrary SQL commands via the 1 entity parameter in an update action to user/fiche.php or 2 sortorder parameter to user/group/index.php...

Xxe

The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization rhevm 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity XXE issue...

CVE-2014-3992

Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote authenticated users to execute arbitrary SQL commands via the 1 entity parameter in an update action to user/fiche.php or 2 sortorder parameter to user/group/index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in odm-init.php in OpenDocMan before 1.2.7.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name of an uploaded file...

Design/Logic Flaw

The Multiple Analyzer in the Dialed Number Analyzer DNA component in Cisco Unified Communications Manager allows remote authenticated users to bypass intended upload restrictions via a crafted parameter, aka Bug ID CSCup76297...

Directory traversal

Directory traversal vulnerability in dna/viewfilecontents.do in the Dialed Number Analyzer DNA component in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via a crafted URL, aka Bug ID CSCup76318...

CVE-2014-3318

Directory traversal vulnerability in dna/viewfilecontents.do in the Dialed Number Analyzer DNA component in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via a crafted URL, aka Bug ID CSCup76318...

CVE-2014-3316

The Multiple Analyzer in the Dialed Number Analyzer DNA component in Cisco Unified Communications Manager allows remote authenticated users to bypass intended upload restrictions via a crafted parameter, aka Bug ID CSCup76297...

UBUNTU-CVE-2014-3474

Cross-site scripting XSS vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a networ...