13976 matches found
CVE-2014-2610
Directory traversal vulnerability in the Content Acceleration Pack CAP web application in HP Executive Scorecard 9.40 and 9.41 allows remote authenticated users to execute arbitrary code by uploading an executable file, aka ZDI-CAN-2117...
CVE-2014-1650
SQL injection vulnerability in user.php in the management console in Symantec Web Gateway SWG before 5.2.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...
CVE-2014-1652
Multiple cross-site scripting XSS vulnerabilities in the management console in Symantec Web Gateway SWG before 5.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified report parameters...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the management console in Symantec Web Gateway SWG before 5.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified report parameters...
Sql injection
SQL injection vulnerability in user.php in the management console in Symantec Web Gateway SWG before 5.2.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...
CVE-2014-1652
Symantec Web Gateway (SWG) management console prior to 5.2 is affected by CVE-2014-1652: multiple cross-site scripting vulnerabilities allow remote authenticated users to inject script via unspecified report parameters (e.g., entSummary.php, custom_report.php, host_spy_report.php, repairedclients...
CVE-2014-3013
Multiple cross-site scripting XSS vulnerabilities in IBM Curam Social Program Management 4.5 SP10 through 6.0.5.4 allow remote authenticated users to inject arbitrary web script or HTML via crafted input to a 1 custom JSP or 2 custom renderer...
Crlf injection
Multiple CRLF injection vulnerabilities in IBM Curam Social Program Management 5.2 SP1 through 6.0.5.4 allow remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified parameters to custom JSPs...
Cross site scripting
Cross-site scripting XSS vulnerability in IBM WebSphere Portal 6.1.0.0 through 6.1.0.6 CF27, 6.1.5.0 through 6.1.5.3 CF27, and 7.0.0 through 7.0.0.2 CF28 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...
CVE-2014-2949
SQL injection vulnerability in the web service in F5 ARX Data Manager 3.0.0 through 3.1.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...
CVE-2014-3013
Multiple cross-site scripting XSS vulnerabilities in IBM Curam Social Program Management 4.5 SP10 through 6.0.5.4 allow remote authenticated users to inject arbitrary web script or HTML via crafted input to a 1 custom JSP or 2 custom renderer...
CVE-2014-0910
Cross-site scripting XSS vulnerability in IBM WebSphere Portal 6.1.0.0 through 6.1.0.6 CF27, 6.1.5.0 through 6.1.5.3 CF27, and 7.0.0 through 7.0.0.2 CF28 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...
Design/Logic Flaw
OpenStack Identity Keystone before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a 1 trust or 2 OAuth token with impersonation enabled to create a new token with...
CVE-2014-3476
OpenStack Identity Keystone before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a 1 trust or 2 OAuth token with impersonation enabled to create a new token with...
CVE-2014-3476
OpenStack Identity Keystone before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a 1 trust or 2 OAuth token with impersonation enabled to create a new token with...
CVE-2014-3782
Multiple incomplete blacklist vulnerabilities in the filemanager::isFileExclude method in the Media Manager in Dotclear before 2.6.3 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a 1 double extension or 2 .php5, 3 .phtml, or some other PHP file extension...
CVE-2014-3782
Multiple incomplete blacklist vulnerabilities in the filemanager::isFileExclude method in the Media Manager in Dotclear before 2.6.3 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a 1 double extension or 2 .php5, 3 .phtml, or some other PHP file extension...
Input validation
Multiple incomplete blacklist vulnerabilities in the filemanager::isFileExclude method in the Media Manager in Dotclear before 2.6.3 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a 1 double extension or 2 .php5, 3 .phtml, or some other PHP file extension...