| c-icap_project — c-icap |
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a ” ” or “?” character in an ICAP request, as demonstrated by use of the OPTIONS method. |
2014-12-19 |
5.0 |
CVE-2013-7401 OSVDB CONFIRM GENTOO MISC MLIST |
| cisco — adaptive_security_appliance_software |
The syslog-management subsystem in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to obtain an administrator password by waiting for an administrator to copy a file, and then (1) sniffing the network for a syslog message or (2) reading a syslog message in a file on a syslog server, aka Bug IDs CSCuq22357 and CSCur41860. |
2014-12-19 |
4.3 |
CVE-2014-3410 |
| cisco — meraki_mr_firmware |
Cisco-Meraki MS, MR, and MX devices with firmware before 2014-09-24 allow remote attackers to execute arbitrary commands by leveraging knowledge of a cross-device secret and a per-device secret, and sending a request to an unspecified HTTP handler on the local network, aka Cisco-Meraki defect ID 00301991. |
2014-12-23 |
5.4 |
CVE-2014-7994 CONFIRM |
| cisco — prime_infrastructure |
Cisco Prime Infrastructure allows remote authenticated users to read device-discovery passwords by examining the HTML source code of the Quick Discovery options page, aka Bug ID CSCum00019. |
2014-12-19 |
4.0 |
CVE-2014-8007 |
| cisco — identity_services_engine_software |
The Sponsor Portal in Cisco Identity Services Engine (ISE) allows remote authenticated users to obtain access to an arbitrary sponsor’s guest account via a modified HTTP request, aka Bug ID CSCur64400. |
2014-12-22 |
4.0 |
CVE-2014-8015 |
| cisco — identity_services_engine_software |
The periodic-backup feature in Cisco Identity Services Engine (ISE) allows remote attackers to discover backup-encryption passwords via a crafted request that triggers inclusion of a password in a reply, aka Bug ID CSCur41673. |
2014-12-22 |
5.0 |
CVE-2014-8017 |
| cisco — unified_communications_domain_manager |
Multiple cross-site scripting (XSS) vulnerabilities in Business Voice Services Manager (BVSM) pages in the Application Software in Cisco Unified Communications Domain Manager 8 allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCur19651, CSCur18555, CSCur19630, and CSCur19661. |
2014-12-22 |
4.3 |
CVE-2014-8018 |
| cisco — enterprise_content_delivery_system |
Directory traversal vulnerability in Cisco Enterprise Content Delivery System (ECDS) allows remote attackers to read arbitrary files via a crafted URL, aka Bug ID CSCuo90148. |
2014-12-19 |
5.0 |
CVE-2014-8019 |
| cisco — jabber_guest |
The API in the Guest Server in Cisco Jabber, when the HTML5 CORS feature is used, allows remote attackers to obtain sensitive information by sniffing the network during an HTTP (1) GET or (2) POST request, aka Bug ID CSCus19789. |
2014-12-22 |
4.3 |
CVE-2014-8024 |
| cisco — jabber_guest |
The API in the Guest Server in Cisco Jabber, when HTML5 is used, allows remote attackers to obtain sensitive information by sniffing the network during an HTTP (1) GET or (2) POST response, aka Bug ID CSCus19801. |
2014-12-22 |
4.3 |
CVE-2014-8025 |
| cisco — jabber_guest |
Cross-site scripting (XSS) vulnerability in the Guest Server in Cisco Jabber allows remote attackers to inject arbitrary web script or HTML via a (1) GET or (2) POST parameter, aka Bug ID CSCus08074. |
2014-12-22 |
4.3 |
CVE-2014-8026 |
| dandyid_services_project — dandyid_services |
Multiple cross-site request forgery (CSRF) vulnerabilities in the DandyID Services plugin 1.5.9 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) email_address or (2) sidebarTitle parameter in the dandyid-services.php page to wp-admin/options-general.php. |
2014-12-19 |
6.8 |
CVE-2014-9335 MISC |
| huawei — p7-l10_firmware |
The PackageInstaller module in Huawei P7-L10 smartphones before V100R001C00B136 allows remote attackers to spoof the origin website and bypass the website whitelist protection mechanism via a crafted package. |
2014-12-19 |
4.3 |
CVE-2014-9135 XF |
| ibm — security_appscan |
IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8.8 iFix 003, 9.0 before 9.0.0.1 iFix 003, and 9.0.1 before 9.0.1 iFix 001 allows remote authenticated users to write to arbitrary folders, and consequently execute arbitrary commands, via a modified argument. |
2014-12-22 |
5.5 |
CVE-2014-6122 XF |
| ibm — security_appscan |
IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8.8 iFix 003, 9.0 before 9.0.0.1 iFix 003, and 9.0.1 before 9.0.1 iFix 001 allows remote attackers to conduct clickjacking attacks via unspecified vectors. |
2014-12-22 |
4.3 |
CVE-2014-6135 XF |
| ibm — websphere_service_registry_and_repository |
The Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3.x through 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. |
2014-12-24 |
4.3 |
CVE-2014-6153 XF AIXAPAR |
| ibm — websphere_service_registry_and_repository |
Multiple directory traversal vulnerabilities in the ServiceRegistry UI in IBM WebSphere Service Registry and Repository (WSRR) 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 allow remote authenticated users to read arbitrary files via unspecified vectors. |
2014-12-24 |
4.0 |
CVE-2014-6155 XF AIXAPAR |
| ibm — websphere_service_registry_and_repository |
IBM WebSphere Service Registry and Repository (WSRR) 7.0.x before 7.0.0.5 and 7.5.x before 7.5.0.3 does not perform access-control checks for depth-0 retrieve operations, which allows remote authenticated users to obtain sensitive information via unspecified vectors. |
2014-12-24 |
4.0 |
CVE-2014-6177 XF AIXAPAR |
| ibm — websphere_service_registry_and_repository |
Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Service Registry and Repository (WSRR) 7.5.x before 7.5.0.4 and 8.0.x before 8.0.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
2014-12-24 |
4.3 |
CVE-2014-6179 XF AIXAPAR |
| ibm — websphere_service_registry_and_repository |
IBM WebSphere Service Registry and Repository (WSRR) 7.0.x before 7.0.0.5 does not perform access-control checks for contained objects, which allows remote authenticated users to obtain sensitive information via unspecified vectors. |
2014-12-24 |
4.0 |
CVE-2014-6181 XF AIXAPAR |
| ibm — websphere_service_registry_and_repository |
IBM WebSphere Service Registry and Repository (WSRR) 6.3.x before 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x before 7.5.0.3, and 8.0.x before 8.0.0.1 allows remote authenticated users to bypass intended object-access restrictions via the datagraph. |
2014-12-24 |
4.0 |
CVE-2014-6186 XF AIXAPAR |
| ibm — websphere_service_registry_and_repository |
Multiple cross-site request forgery (CSRF) vulnerabilities in IBM WebSphere Service Registry and Repository (WSRR) 6.3.x before 6.3.0.5, 7.0.x before 7.0.0.5, 7.5.x before 7.5.0.3, and 8.0.x before 8.0.0.2 allow remote authenticated users to hijack the authentication of unspecified victims via unknown vectors. |
2014-12-24 |
6.0 |
CVE-2014-6187 XF AIXAPAR |
| ibm — infosphere_master_data_management_collaborative_server |
The Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management – Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1 allows remote authenticated users to modify the administrator’s credentials and consequently gain privileges via unspecified vectors. |
2014-12-22 |
4.0 |
CVE-2014-8896 XF |
| itwitter_project — itwitter |
Multiple cross-site request forgery (CSRF) vulnerabilities in the iTwitter plugin 0.04 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) itex_t_twitter_username or (2) itex_t_twitter_userpass parameter in the iTwitter.php page to wp-admin/options-general.php. |
2014-12-19 |
6.8 |
CVE-2014-9336 FULLDISC MISC |
| jayde_online — spnbabble |
Multiple cross-site request forgery (CSRF) vulnerabilities in the SPNbabble plugin 1.4.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) username or (2) password parameter in the spnbabble.php page to wp-admin/options-general.php. |
2014-12-19 |
6.8 |
CVE-2014-9339 MISC |
| mikiurl_wordpress_eklentisi_project — mikiurl_wordpress_eklentisi |
Multiple cross-site request forgery (CSRF) vulnerabilities in the Mikiurl WordPress Eklentisi plugin 2.0 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) twitter_kullanici or (2) twitter_sifre parameter in a kaydet action in the mikiurl.php page to wp-admin/options-general.php. |
2014-12-19 |
6.8 |
CVE-2014-9337 MISC |
| modx — modx_revolution |
Cross-site scripting (XSS) vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbitrary web script or HTML via the callback parameter. |
2014-12-22 |
4.3 |
CVE-2014-8992 MISC |
| morfy_cms_project — morfy_cms |
Static code injection vulnerability in install.php in Morfy CMS 1.05 allows remote authenticated users to inject arbitrary PHP code into config.php via the site_url parameter. |
2014-12-19 |
6.5 |
CVE-2014-9185 MISC MISC BUGTRAQ FULLDISC MISC |
| netiq — access_manager |
nps/servlet/webacc in iManager in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allows remote authenticated novlwww users to read arbitrary files via a query parameter containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. |
2014-12-23 |
4.0 |
CVE-2014-5214 MISC FULLDISC MISC |
| netiq — access_manager |
NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allows remote authenticated administrators to discover service-account passwords via a request to (1) roma/jsp/volsc/monitoring/dev_services.jsp or (2) roma/jsp/debug/debug.jsp. |
2014-12-23 |
4.0 |
CVE-2014-5215 MISC FULLDISC MISC |
| netiq — access_manager |
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote attackers to inject arbitrary web script or HTML via (1) the location parameter in a dev.Empty action to nps/servlet/webacc, (2) the error parameter to nidp/jsp/x509err.jsp, (3) the lang parameter to sslvpn/applet_agent.jsp, or (4) the secureLoggingServersA parameter to roma/system/cntl, a different issue than CVE-2014-9412. |
2014-12-23 |
4.3 |
CVE-2014-5216 MISC FULLDISC MISC |
| netiq — access_manager |
Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.1 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via an fw.SetPassword action. |
2014-12-23 |
6.8 |
CVE-2014-5217 MISC FULLDISC MISC |
| netiq — access_manager |
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary parameter to roma/jsp/debug/debug.jsp or (2) an arbitrary parameter in a debug.DumpAll action to nps/servlet/webacc, a different issue than CVE-2014-5216. |
2014-12-23 |
4.3 |
CVE-2014-9412 MISC FULLDISC MISC |
| novell — edirectory |
Cross-site scripting (XSS) vulnerability in nds/search/data in iMonitor in Novell eDirectory before 8.8 SP8 Patch 4 allows remote attackers to inject arbitrary web script or HTML via the rdn parameter. |
2014-12-19 |
4.3 |
CVE-2014-5212 MISC CONFIRM BUGTRAQ |
| novell — edirectory |
nds/files/opt/novell/eDirectory/lib64/ndsimon/public/images in iMonitor in Novell eDirectory before 8.8 SP8 Patch 4 allows remote authenticated users to obtain sensitive information from process memory via a direct request. |
2014-12-19 |
4.0 |
CVE-2014-5213 MISC CONFIRM BUGTRAQ |
| ntp — ntp |
The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. |
2014-12-19 |
5.0 |
CVE-2014-9293 CONFIRM CONFIRM CONFIRM |
| ntp — ntp |
util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. |
2014-12-19 |
5.0 |
CVE-2014-9294 CONFIRM CONFIRM CONFIRM |
| ntp — ntp |
The receive function in ntp_proto.c in ntpd in NTP before 4.2.8 continues to execute after detecting a certain authentication error, which might allow remote attackers to trigger an unintended association change via crafted packets. |
2014-12-19 |
5.0 |
CVE-2014-9296 CONFIRM CONFIRM CONFIRM |
| o2tweet_project — o2tweet |
Multiple cross-site request forgery (CSRF) vulnerabilities in the O2Tweet plugin 0.0.4 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) o2t_username or (2) o2t_tags parameter to wp-admin/options-general.php. |
2014-12-19 |
6.8 |
CVE-2014-9338 MISC |
| openssl — openssl |
The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unexpected handshake, as demonstrated by an SSLv3 handshake to a no-ssl3 application with certain error handling. NOTE: this issue became relevant after the CVE-2014-3568 fix. |
2014-12-24 |
5.0 |
CVE-2014-3569 CONFIRM CONFIRM CONFIRM CONFIRM CONFIRM CONFIRM |
| otrs — otrs_help_desk |
The GenericInterface in OTRS Help Desk 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before 4.0.3 allows remote authenticated users to access and modify arbitrary tickets via unspecified vectors. |
2014-12-19 |
6.0 |
CVE-2014-9324 SECUNIA |
| puppetlabs — puppet |
Puppet Enterprise before 3.7.1 allows remote authenticated users to obtain licensing and certificate signing request information by leveraging access to an unspecified API endpoint. |
2014-12-19 |
4.0 |
CVE-2014-9355 SECUNIA |
| twitterdash_project — twitterdash |
Cross-site request forgery (CSRF) vulnerability in the twitterDash plugin 2.1 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the username_twitterDash parameter in the twitterDash.php page to wp-admin/options-general.php. |
2014-12-19 |
6.8 |
CVE-2014-9368 MISC |
| wpcommenttwit_project — wpcommenttwit |
Multiple cross-site request forgery (CSRF) vulnerabilities in the wpCommentTwit plugin 0.5 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) username or (2) password parameter in the wpCommentTwit.php page to wp-admin/options-general.php. |
2014-12-19 |
6.8 |
CVE-2014-9340 MISC |
| yurl_retwitt_project — yurl_retwitt |
Multiple cross-site request forgery (CSRF) vulnerabilities in the yURL ReTwitt plugin 1.4 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) yurl_login or (2) yurl_anchor parameter in the yurl page to wp-admin/options-general.php. |
2014-12-19 |
6.8 |
CVE-2014-9341 MISC |
| znc — znc |
The CWebAdminMod::ChanPage function in modules/webadmin.cpp in ZNC before 1.4 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) by adding a channel with the same name as an existing channel but without the leading # character, related to a “use-after-delete” error. |
2014-12-19 |
4.0 |
CVE-2014-9403 CONFIRM BID MLIST SECUNIA |