CVE-2013-7439: Undefined Security Weakness

Multiple off-by-one errors in the 1 MakeBigReq and 2 SetReqLen macros in include/X11/Xlibint.h in X11R6.x and libX11 before 1.6.0 allow remote attackers to have unspecified impact via a crafted request, which triggers a buffer overflow...

CVE-2014-5427: Exposure of Sensitive Information to an Unauthorized Actor

Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server ADS, Extended Application and Data Server aka ADX, LonWorks Control Server 85 LCS8520, Network Automation Engine NAE 55xx-x, Network Integration Engine NIE 5xxx-x, and NxE8500, allows remote attackers to read passwor...

CVE-2015-2682: Undefined Security Weakness

Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 allows remote attackers to obtain credentials via a direct request to conf/securitydbData.xml...

CVE-2014-8757: Improper Access Control

LG On-Screen Phone OSP before 4.3.010 allows remote attackers to bypass authorization via a crafted request...

CVE-2014-9197: Missing Authentication for Critical Function

The Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware before 1.60 IR 04 stores rde.jar under the web root with insufficient access control, which allows remote attackers to obtain sensitive setup and configuration information via a direct request...

CVE-2015-0554: Undefined Security Weakness

The ADB formerly Pirelli Broadband Solutions P.DGA4001N router with firmware PDGTEFSP4.06L.6 does not properly restrict access to the web interface, which allows remote attackers to obtain sensitive information or cause a denial of service device restart as demonstrated by a direct request to 1...

CVE-2014-1908: Exposure of Sensitive Information to an Unauthorized Actor

The error-handling feature in 1 bp.php, 2 videowhisperstreaming.php, and 3 ls/rtmp.inc.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error messag...

CVE-2014-9360: Undefined Security Weakness

XML external entity XXE vulnerability in Scalix Web Access 11.4.6.12377 and 12.2.0.14697 allows remote attackers to read arbitrary files and trigger requests to intranet servers via a crafted request...

CVE-2014-9292: Undefined Security Weakness

Server-side request forgery SSRF vulnerability in proxy.php in the jRSS Widget plugin 1.2 and earlier for WordPress allows remote attackers to trigger outbound requests and enumerate open ports via the url parameter...

CVE-2014-9177: Exposure of Sensitive Information to an Unauthorized Actor

The HTML5 MP3 Player with Playlist Free plugin before 2.7 for WordPress allows remote attackers to obtain the installation path via a request to html5plus/playlist.php...

CVE-2014-8874: Exposure of Sensitive Information to an Unauthorized Actor

The kequestionnaire extension 2.5.2 and earlier for TYPO3 uses predictable names for the questionnaire answer forms, which makes it easier for remote attackers to obtain sensitive information via a direct request...

CVE-2014-6098: Undefined Security Weakness

IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to discover cleartext passwords via a crafted request...

CVE-2014-8592: Undefined Security Weakness

Unspecified vulnerability in SAP Host Agent, as used in SAP NetWeaver 7.02 and 7.3, allows remote attackers to cause a denial of service process termination via a crafted request...

CVE-2014-1830: Exposure of Sensitive Information to an Unauthorized Actor

Requests aka python-requests before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redirected request...

CVE-2012-5498

queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of service via a crafted request to a collection...

CVE-2014-5107: Exposure of Sensitive Information to an Unauthorized Actor

concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a direct request to 1 system/basics/editor.php, 2 system/view.php, 3 system/environment/filestoragelocations.php, 4 system/mail/importers.php, 5 system/mail/method.php, 6 system/permissions/filetypes.php, 7...

PT-2014-6221

Name of the Vulnerable Software and Affected Versions EasyCart wp-easycart versions prior to 2.0.6 Description The issue allows remote attackers to obtain configuration information by making a direct request to "inc/admin/phpinfo.php", which calls the phpinfo function. Recommendations For version...

CVE-2013-6766: Improper Authentication

OpenVAS Administrator 1.2 before 1.2.2 and 1.3 before 1.3.2 allows remote attackers to bypass the OAP authentication restrictions and execute OAP commands via a crafted OAP request for version information, which causes the state to be set to CLIENTAUTHENTIC...

CVE-2013-6765: Improper Authentication

OpenVAS Manager 3.0 before 3.0.7 and 4.0 before 4.0.4 allows remote attackers to bypass the OMP authentication restrictions and execute OMP commands via a crafted OMP request for version information, which causes the state to be set to CLIENTAUTHENTIC, as demonstrated by the ompxmlhandleendelemen...

CVE-2014-1418: Undefined Security Weakness

Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the 1 Vary: Cookie or 2 Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers...