14000 matches found
Cross site scripting
Cross-site scripting XSS vulnerability in webtop/eventviewer/eventViewer.jsp in the Web GUI in IBM Netcool/OMNIbus 7.4.0 before FP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-0942...
Cross site scripting
Cross-site scripting XSS vulnerability in webtop/eventviewer/eventViewer.jsp in the Web GUI in IBM Netcool/OMNIbus 7.4.0 before FP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-0941...
CVE-2014-0942
CVE-2014-0942 is an XSS vulnerability in the IBM Netcool/OMNIbus Web GUI (webtop/eventviewer/eventViewer.jsp) affecting version 7.4.0 before FP2. The flaw lets remote authenticated users inject arbitrary web script or HTML via a crafted URL. The connected records confirm the same issue as CVE-201...
CVE-2013-6323
Cross-site scripting XSS vulnerability in the Administration Console in IBM WebSphere Application Server WAS 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, and WebSphere Virtual Enterprise 7.x before 7.0.0.5, allows remote authenticated users to inject arbitrary web script or...
CVE-2013-1806
Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a .. dot dot in the 1 usertheme parameter to maincore.php; or remote authenticated administrators to delete arbitrary files via the 2 enable...
PYSEC-2014-98
Cross-site scripting XSS vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via the command field in the Cron functionality...
CVE-2014-3132
SAP Background Processing does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an unspecified RFC function, related to SAP Solution Manager 7.1...
CVE-2014-1957
FortiGuard FortiWeb before 5.0.3 allows remote authenticated users to gain privileges via unspecified vectors...
Code injection
SAP Profile Maintenance does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an unspecified RFC function, related to SAP Solution Manager 7.1...
CVE-2014-1957
Fortinet FortiWeb is affected by CVE-2014-1957 (FortiWeb prior to 5.0.3). The vulnerability allows remote authenticated users to gain privileges via unspecified vectors. Affected product: FortiWeb; vulnerable component/issue: privilege escalation in versions before 5.0.3. The issue is confirmed a...
CVE-2014-1957
FortiGuard FortiWeb before 5.0.3 allows remote authenticated users to gain privileges via unspecified vectors...
Input validation
The Organic Groups OG module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users to bypass group restrictions on nodes with all groups set to optional input via an empty group field...
CVE-2013-7068
The Organic Groups OG module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users to bypass group restrictions on nodes with all groups set to optional input via an empty group field...
Command injection
The Document Management component in Cisco Unified Contact Center Express does not properly validate a parameter, which allows remote authenticated users to upload files to arbitrary pathnames via a crafted HTTP request, aka Bug ID CSCun74133...
Code injection
The L2TP module in Cisco IOS XE 3.10S.2 and earlier on ASR 1000 routers allows remote authenticated users to cause a denial of service ESP card reload via a malformed L2TP packet, aka Bug ID CSCun09973...
CVE-2014-2185
The Call Detail Records CDR Management component in Cisco Unified Communications Manager Unified CM allows remote authenticated users to obtain sensitive information by reading extraneous fields in an HTML document, aka Bug ID CSCun74374...
CVE-2014-0187
The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1 before 2014.1.1 allows remote authenticated users to bypass security group restrictions via an invalid CIDR in a security group rule, which prevents further rules from being applied...
CVE-2014-2042
Unrestricted file upload vulnerability in the Manage Project functionality in Livetecs Timelive before 6.5.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in a predictable directory ...
CVE-2014-2042
CVE-2014-2042 affects Livetecs Timelive; unrestricted file upload in the Manage Project functionality (Uploads/) enables remote code execution. Affected: Timelive up to version 6.2.71. Root cause: lack of file-type restrictions and permissive Read/Execute on uploaded files. Impact: potential arbi...