CVE-2016-0867: Exposure of Sensitive Information to an Unauthorized Actor

CAREL PlantVisorEnhanced allows remote attackers to bypass intended access restrictions via a direct file request...

CVE-2015-6414: Exposure of Sensitive Information to an Unauthorized Actor

Cisco TelePresence Video Communication Server VCS X8.6 uses the same encryption key across different customers' installations, which makes it easier for local users to defeat cryptographic protection mechanisms by leveraging knowledge of a key from another installation, aka Bug ID CSCuw64516...

CVE-2015-4334: Exposure of Sensitive Information to an Unauthorized Actor

The default configuration of SGOS in Blue Coat ProxySG before 6.2.16.5, 6.5 before 6.5.7.1, and 6.6 before 6.6.2.1 forwards authentication challenges from upstream origin content servers OCS when used in an explicit proxy deployment, which makes it easier for remote attackers to obtain sensitive...

CVE-2015-5256: Undefined Security Weakness

Apache Cordova-Android before 4.1.0, when an application relies on a remote server, improperly implements a JavaScript whitelist protection mechanism, which allows attackers to bypass intended access restrictions via a crafted URI...

CVE-2015-5859: Exposure of Sensitive Information to an Unauthorized Actor

The CFNetwork HTTPProtocol component in Apple iOS before 9 and OS X before 10.11 does not properly recognize the HSTS preload list during a Safari private-browsing session, which makes it easier for remote attackers to obtain sensitive information by sniffing the network...

CVE-2015-6476: Undefined Security Weakness

Advantech EKI-122x-BE devices with firmware before 1.65, EKI-132x devices with firmware before 1.98, and EKI-136x devices with firmware before 1.27 have hardcoded SSH keys, which makes it easier for remote attackers to obtain access via an SSH session...

CVE-2015-6614: Undefined Security Weakness

Telephony in Android 5.x before 5.1.1 LMY48X allows attackers to gain privileges, and consequently bypass intended network-interface restrictions, perform expensive data transfers, or cause a denial of service call-reception outage or mute manipulation, via a crafted application, aka internal bug...

CVE-2015-7904: Undefined Security Weakness

Unrestricted file upload vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary JSP code via vectors involving an upload of an image file...

CVE-2015-6315: Undefined Security Weakness

Cisco Aironet 1850 access points with software 8.1112.4 allow local users to gain privileges via crafted CLI commands, aka Bug ID CSCuv79694...

CVE-2015-2030: Undefined Security Weakness

IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 has an improper account-lockout setting, which makes it easier for remote attackers to obtain access via a brute-force attack...

CVE-2015-7239: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the BPFINDJOBSWITHPROGRAM function module in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-6466: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Diagnosis Ping feature in the administrative web interface on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote attackers to inject arbitrary web script or HTML via an unspecified field...

CVE-2015-4328: Improper Input Validation

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, as demonstrated by read or write operations on the Unified...

CVE-2015-5080: Improper Neutralization of Special Elements used in a Command

The Management Interface in Citrix NetScaler Application Delivery Controller ADC and NetScaler Gateway 10.1 before 10.1.132.8, 10.5 before Build 56.15, and 10.5.e before Build 56.1505.e allows remote authenticated users to execute arbitrary shell commands via shell metacharacters in the filter...

CVE-2015-3244: Undefined Security Weakness

The Portlet Bridge for JavaServer Faces in Red Hat JBoss Portal 6.2.0, when used in portlets with the default resource serving for GenericPortlet, does not properly restrict access to restricted resources, which allows remote attackers to obtain sensitive information via a URL with a modified...

CVE-2015-1901: Exposure of Sensitive Information to an Unauthorized Actor

The installer in IBM InfoSphere Information Server 8.5 through 11.3 before 11.3.1.2 allows local users to obtain sensitive information via unspecified commands...

CVE-2015-1768: Improper Restriction of Operations within the Bounds of a Memory Buffer

win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2 allows local users to gain privileges or cause a denial of service memory corruption via a crafted application, aka "Win32k Memory Corruption Elevation of Privilege Vulnerability."...

CVE-2014-9201: Improper Input Validation

Beckwith Electric M-6200 Digital Voltage Regulator Control with firmware before D-0198V04.07.00, M-6200A Digital Voltage Regulator Control with firmware before D-0228V02.01.07, M-2001D Digital Tapchanger Control with firmware before D-0214V01.10.04, M-6283A Three Phase Digital Capacitor Bank...

CVE-2015-0752: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Cisco TelePresence Video Communication Server VCS X8.5.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut27635...

CVE-2015-1392: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Aruba Networks ClearPass Policy Manager CPPM before 6.4.5 allow remote administrators to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-4016: Improper Input Validation

The client detection protocol in Valve Steam allows remote attackers to cause a denial of service process crash via a crafted response to a broadcast packet...

CVE-2015-1716: Exposure of Sensitive Information to an Unauthorized Actor

Schannel in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly restrict Diffie-Hellman Ephemeral DHE key lengths, which makes it easier for...

CVE-2015-3393: Undefined Security Weakness

Open redirect vulnerability in the Commerce WeDeal module before 7.x-1.3 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter...

CVE-2014-3586: Undefined Security Weakness

The default configuration for the Command Line Interface in Red Hat Enterprise Application Platform before 6.4.0 and WildFly formerly JBoss Application Server uses weak permissions for .jboss-cli-history, which allows local users to obtain sensitive information via unspecified vectors...

CVE-2014-3365: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Cisco Prime Security Manager PRSM 9.2.1-2 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted input to the 1 Dashboard or 2 Configure Realm page, aka Bug ID CSCuo94808...

CVE-2014-8015: Undefined Security Weakness

The Sponsor Portal in Cisco Identity Services Engine ISE allows remote authenticated users to obtain access to an arbitrary sponsor's guest account via a modified HTTP request, aka Bug ID CSCur64400...

CVE-2014-4629: Undefined Security Weakness

EMC Documentum Content Server 7.0, 7.1 before 7.1 P10, and 6.7 before SP2 P19 allows remote authenticated users to read or delete arbitrary files via unspecified vectors related to an insecure direct object reference...

CVE-2014-8475: Undefined Security Weakness

FreeBSD 9.1, 9.2, and 10.0, when compiling OpenSSH with Kerberos support, uses incorrect library ordering when linking sshd, which causes symbols to be resolved incorrectly and allows remote attackers to cause a denial of service sshd deadlock and prevention of new connections by ending multiple...

CVE-2014-6107: Exposure of Sensitive Information to an Unauthorized Actor

IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to obtain sensitive cookie information by sniffing the network during an HTTP session...

CVE-2014-8339: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in midroll.php in Nuevolab Nuevoplayer for ClipShare 8.0 and earlier allows remote attackers to execute arbitrary SQL commands via the ch parameter...

CVE-2014-4427: Undefined Security Weakness

App Sandbox in Apple OS X before 10.10 allows attackers to bypass a sandbox protection mechanism via the accessibility API...

CVE-2014-4847: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Random Banner plugin 1.1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the buffercodeRBannerurlbanner1 parameter in an update action to wp-admin/options.php...

CVE-2014-0865: Improper Input Validation

RICOS in IBM Algo Credit Limits aka ACLM 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validation, which allows remote authenticated users to bypass intended dual-control restrictions and modify data via crafted serialized objects, as demonstrated by limi...

CVE-2014-2056: Undefined Security Weakness

PHPDocX, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity XXE attack...

CVE-2014-2171: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in Cisco TelePresence TC Software 4.x through 6.x before 6.0.1 and TE Software 4.x and 6.0.x before 6.0.2 allows remote attackers to execute arbitrary code via crafted SIP packets, aka Bug ID CSCud81796...

CVE-2014-2118: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in dashboard-related HTML documents in Cisco Prime Security Manager aka PRSM 9.2.1-2 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCun50687...

CVE-2014-1912: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the socket.recvfrominto function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remote attackers to execute arbitrary code via a crafted string...

CVE-2014-0834: Improper Input Validation

IBM General Parallel File System GPFS 3.4 through 3.4.0.27 and 3.5 through 3.5.0.16 allows attackers to cause a denial of service daemon crash via crafted arguments to a setuid program...

CVE-2013-6032: Improper Input Validation

cgi-bin/postpf/cgi-bin/dynamic/config/config.html on Lexmark X94x before LC.BR.P142, X85x through LC4.BE.P487, X644 and X646 before LC2.MC.P374, X642 through LC2.MB.P318, W840 through LS.HA.P252, T64x before LS.ST.P344, X64xef through LC2.TI.P325, C935dn through LC.JO.P091, C920 through LS.TA.P15...

CVE-2013-3263: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress allow remote attackers to inject arbitrary web script or HTML via the 1 siteurl parameter to campaign/campaignone.php; the 2 action, 3 campaignname, 4 campaignformat...

CVE-2013-5008: Exposure of Sensitive Information to an Unauthorized Actor

The agent and task-agent components in Symantec Management Platform 7.0 and 7.1 before 7.1 SP2 Mp1.1v7 rollup, as used in certain Altiris products, use the same registry-entry encryption key across different customers' installations, which makes it easier for local users to obtain sensitive...

CVE-2013-1224: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Resource Manager in Cisco Unified Customer Voice Portal CVP Software before 9.0.1 ES 11 allows remote attackers to overwrite arbitrary files via a crafted 1 HTTP or 2 HTTPS request that triggers incorrect parameter validation, aka Bug ID CSCub38369...

CVE-2013-1387: Undefined Security Weakness

Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 before Update 4, and 10 before Update 9 allows attackers to impersonate users via unknown vectors...

CVE-2013-0664: Undefined Security Weakness

The FactoryCast service on the Schneider Electric Quantum 140NOE77111 and 140NWM10000, M340 BMXNOE0110x, and Premium TSXETY5103 PLC modules allows remote authenticated users to send Modbus messages, and consequently execute arbitrary code, by embedding these messages in SOAP HTTP POST requests...

CVE-2013-0080: Undefined Security Weakness

Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allow remote attackers to bypass intended read restrictions for content, and hijack user accounts, via a crafted URL, aka "Callback Function Vulnerability."...

CVE-2012-4550: Improper Handling of Insufficient Permissions or Privileges

A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans EJB access, the system does not correctly call the necessary authorization modules. This prevents Java Authorization Contract for Containers JACC permissions from being...

CVE-2012-5622: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the management console openshift-console/app/controllers/applicationcontroller.rb in OpenShift 0.0.5 allows remote attackers to hijack the authentication of arbitrary users via unspecified vectors...

CVE-2012-4608: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the web interface in EMC RSA NetWitness Informer before 2.0.5.6 allows remote attackers to hijack the authentication of arbitrary users...

CVE-2012-5459: Undefined Security Weakness

Untrusted search path vulnerability in VMware Workstation 8.x before 8.0.5 and VMware Player 4.x before 4.0.5 on Windows allows host OS users to gain host OS privileges via a Trojan horse DLL in a "system folder."...

CVE-2011-5213: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in BrowserCRM 5.100.01 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 loginusername parameter to index.php, 2 parentid parameter to modules/Documents/versionlist.php, or 3 contactid parameter to modules/Documents/index.php...