Archive
April 2015
Vulnerabilities first published in this month (UTC), newest first.
538 results · Feed
-
Unscored —
The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for roo…
-
Unscored —
SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Communi…
-
Unscored —
PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento…
-
Unscored —CVE-2015-1398 EPSS 14%
Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14…
-
Unscored —
The fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterpr…
-
Unscored —CVE-2015-3457 EPSS 25%
Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentica…
-
Unscored —
Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu (vivid) before 0.9.10.0-4ubuntu15.1,…
-
Unscored —
Use-after-free vulnerability in the file picker implementation in Oxide before 1.6.5 allows remote attackers to cause a…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in macIpSpoofView.html in Dell SonicWall SonicOS 7.5.0.12 and 6.x a…
-
Unscored —
Icecast before 2.4.2, when a stream_auth handler is defined for URL authentication, allows remote attackers to cause a …
-
Low —
rest-client allows local users to obtain sensitive information by reading the log
REST client for Ruby (aka rest-client) before 1.7.3 logs usernames and passwords, which allows local users to obtain sensitive information by reading the log.
-
Unscored —
The hamgr service in the IPv6 Proxy Mobile (PM) implementation in Cisco StarOS 18.1.0.59776 on ASR 5000 devices allows …
-
Unscored —
Cisco IOS 15.5S and IOS XE allow remote authenticated users to cause a denial of service (device crash) by leveraging k…
-
Unscored —
The Overlay Transport Virtualization (OTV) implementation in Cisco IOS XE 3.10S allows remote attackers to cause a deni…
-
Unscored —
Cisco IOS 15.4S, 15.4SN, and 15.5S and IOS XE 3.13S and 3.14S allow remote attackers to cause a denial of service (devi…
-
Unscored —
Wiki Server in Apple OS X Server before 4.1 allows remote attackers to bypass intended restrictions on Activity and Peo…
-
Unscored —
The Firewall component in Apple OS X Server before 4.1 uses an incorrect pathname in configuration files, which allows …
-
Unscored —
The HWP filter in LibreOffice before 4.3.7 and 4.4.x before 4.4.2 and Apache OpenOffice before 4.1.2 allows remote atta…
-
Unscored —
Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (cras…
-
Unscored —
Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensi…
-
Unscored —
Unspecified vulnerability in HP Capture and Route Software (HPCR) 1.3 before Patch 7, 1.3 FP1 before Patch 1, and 1.4 b…
-
Unscored —
Cross-site scripting (XSS) vulnerability in MQ XR WebSockets Listener in WMQ Telemetry in IBM WebSphere MQ 8.0 before 8…
-
Unscored —
The Jazz help system in IBM Rational Collaborative Lifecycle Management 4.0 through 5.0.2, Rational Quality Manager 4.0…
-
Unscored —
IBM Curam Social Program Management (SPM) 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 befo…
-
Unscored —
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) DataMappingEditorCommands, (2) DatastoreEditorCom…
-
Unscored —
IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 does not properly implement authData elements…
-
Unscored —
The SNMP implementation in IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.5 does not properly handle configura…
-
Unscored —
Multiple race conditions in IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 allow remote auth…
-
Unscored —
WebSphereOauth20SP.ear in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, 8.5 Liberty …
-
Unscored —
HP TippingPoint Security Management System (SMS) and TippingPoint Virtual Security Management System (vSMS) before 4.1 …
-
Unscored —
Unspecified vulnerability in HP Storage Data Protector 7.x before 7.03 build 107 allows remote authenticated users to e…
-
Unscored —
The Remote Document Conversion Service (DCS) in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 …
-
Unscored —
Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27…
-
Unscored —
Race condition in the AsyncPaintWaitEvent::AsyncPaintWaitEvent function in Mozilla Firefox before 37.0.2 allows remote …
-
Unscored —
The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values dur…
-
Unscored —
SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-depende…
-
Unscored —
Use-after-free vulnerability in the ff_h264_free_tables function in libavcodec/h264.c in FFmpeg before 2.3.6 allows rem…
-
Unscored —
The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which a…
-
Unscored —
Red Hat JBoss Operations Network 3.3.1 does not properly restrict access to certain APIs, which allows remote attackers…
-
High 7.5
django-markupfield Arbitrary File Read
django-markupfield before 1.3.2 uses the default docutils RESTRUCTUREDTEXT_FILTER_SETTINGS settings, which allows remote attackers to include and read arbitrary files via unspecified vectors.