Archive
June 2014
Vulnerabilities first published in this month (UTC), newest first.
445 results · Feed
-
Unscored —
Cisco WebEx Meeting Server does not properly restrict the content of URLs, which allows remote authenticated users to o…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the web management interface in Cisco AsyncOS on the Email Security Applian…
-
Unscored —
IBM CICS Transaction Server 3.1, 3.2, 4.1, 4.2, and 5.1 on z/OS does not properly implement CEMT transactions, which al…
-
Unscored —
The Real Time Monitoring Tool (RTMT) implementation in Cisco Unified Communications Manager (Unified CM) allows remote …
-
Unscored —
SQL injection vulnerability in BulkViewFileContentsAction.java in the Java interface in Cisco Unified Communications Ma…
-
Unscored —
The (1) Structures and (2) Project-Oriented Procurement components in SAP Project System has hardcoded credentials, whi…
-
Unscored —
The SAP Trader's and Scheduler's Workbench (TSW) for SAP Oil & Gas has hardcoded credentials, which makes it easier for…
-
Unscored —
SAP Transaction Data Pool has hardcoded credentials, which makes it easier for remote attackers to obtain access via un…
-
Unscored —
The SAP Upgrade tools for ABAP has hardcoded credentials, which makes it easier for remote attackers to obtain access v…
-
Unscored —
SAP CCMS Monitoring (BC-CCM-MON) has hardcoded credentials, which makes it easier for remote attackers to obtain access…
-
Unscored —
SAP Web Services Tool (CA-WUI-WST) has hardcoded credentials, which makes it easier for remote attackers to obtain acce…
-
Unscored —
SAP Brazil add-on has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecifie…
-
Unscored —
SAP Capacity Leveling has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspec…
-
Unscored —
SAP Open Hub Service has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspeci…
-
Unscored —
The System Landscape Directory (SLD) in SAP NetWeaver allows remote attackers to modify information via vectors related…
-
Critical 9.8
python-gnupg allows context-dependent attackers to execute arbitrary commands via shell metacharacters
python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
-
Unscored —
The autocomplete callback in Autocomplete Widgets for Text and Number Fields (autocomplete_widgets) module 6.x-1.x befo…
-
High —
Dragonfly Code Injection vulnerability
The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
-
Unscored —
The Misery module 6.x-2.x before 6.x-2.5 and 7.x-2.x before 7.x-2.2 for Drupal, when the "delay misery" configuration i…
-
Unscored —
The Secure Pages module 6.x-2.x before 6.x-2.0 for Drupal does not properly match URLs, which causes HTTP to be used in…
-
Unscored —
The Revisioning module 7.x-1.x before 7.x-1.6 for Drupal does not properly check node access permissions for content ma…
-
Unscored —
LiveZilla before 5.1.1.0 stores the admin Base64 encoded username and password in a 1click file, which allows local use…
-
Unscored —CVE-2013-3081 Public exploit
SQL injection vulnerability in the checkEmailFormat function in plugins/jojo_core/classes/Jojo.php in Jojo before 1.2.2…
-
Unscored —CVE-2013-3082 Public exploit
Cross-site scripting (XSS) vulnerability in plugins/jojo_core/forgot_password.php in Jojo before 1.2.2 allows remote at…
-
Unscored —
Mambo CMS 4.6.5 stores the MySQL database password in cleartext in the document root, which allows local users to obtai…
-
Unscored —
Mambo CMS 4.6.5 uses world-readable permissions on configuration.php, which allows local users to obtain the admin pass…
-
Unscored —
Mambo CMS 4.6.5 allows remote attackers to cause a denial of service (memory and bandwidth consumption) by uploading a …
-
Unscored —
QNAP Photo Station before firmware 4.0.3 build0912 allows remote attackers to list OS user accounts via a request to ph…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in the Profiles component in IBM Connections through 3.0.1.1 CR3 allows…
-
Unscored —
IBM Security AppScan Source 8.0 through 9.0, when the publish-assessment permission is not properly restricted for the …
-
Unscored —
Unspecified vulnerability on the IBM System Storage Virtualization Engine TS7700 allows local users to gain privileges …
-
Unscored —CVE-2014-3977 Public exploit
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack o…
-
Unscored —
Unspecified vulnerability in IBM API Management 3.0.0.0, when basic authentication is used for APIs, allows remote atta…
-
Unscored —
IBM SPSS Modeler 16.0 before 16.0.0.1 on UNIX does not properly drop group privileges, which allows local users to bypa…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in IBM Tivoli Identity Manager (ITIM) 5.0 before 5.0.0.15 and 5.1 befor…
-
Unscored —
include/tests_webservers in Lynis before 1.5.5 allows local users to overwrite arbitrary files via a symlink attack on …
-
Unscored —
include/tests_webservers in Lynis before 1.5.5 on AIX allows local users to overwrite arbitrary files via a symlink att…
-
Unscored —
acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary file…
-
Unscored —
Cisco Wireless LAN Controller (WLC) devices allow remote attackers to cause a denial of service (NULL pointer dereferen…
-
Unscored —
The web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) does not properly implement access contr…