CVE-2014-3793VMware Tools in VMware Workstation 10.x before 10.0.2, VMware Player 6.x before 6.0.2, VMware Fusion 6.x before 6.0.3, and VMware ESXi 5.0 through 5.5, when a Windows 8.1 guest OS …
5.8 MOYENNE
CVE-2014-0119Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which a…
4.3 MOYENNE
CVE-2014-0099Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows…
4.3 MOYENNE
CVE-2014-0096java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT…
4.3 MOYENNE
CVE-2014-0095java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of service (thread consumption) by using a "Content…
5.0 MOYENNE
CVE-2014-0075Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before…
5.0 MOYENNE
CVE-2014-2354Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attac…
6.0 MOYENNE
CVE-2014-2353Les versions de Cogent DataHub antérieures à la 7.3.5 sont vulnérables aux scripts intersites (cross-site scripting), ce qui permet à un attaquant distant d'injecter des scripts ma…
7.1 ÉLEVÉE
CVE-2014-2352Certains composants de serveurs web sont sensibles à une faille de traversée de répertoire qui permet à des attaquants distants et non authentifiés de lire un ensemble limité de fi…
7.8 ÉLEVÉE
CVE-2014-2343Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows physically proximate attackers to cause a denial of service (excessive data processing) via a crafted DNP request ove…
1.2 FAIBLE
CVE-2014-2342Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows remote attackers to cause a denial of service (excessive data processing) via a crafted DNP3 packet.
4.3 MOYENNE
CVE-2014-0907Les versions 9.5 à 10.5 d'IBM DB2 sur Linux et UNIX sont affectées par une faille dans la manière dont certains programmes privilégiés recherchent les bibliothèques. Un utilisateur…
7.2 ÉLEVÉE
CVE-2013-6744Les bases de données IBM DB2 s'exécutant sous Windows sont concernées si elles ne sont pas mises à jour avec les correctifs (fix packs) spécifiés. Un attaquant disposant d'identifi…
8.5 ÉLEVÉE
CVE-2014-0925Open redirect vulnerability in IBM Sterling Control Center 5.4.0 before 5.4.0.1 iFix 3 and 5.4.1 before 5.4.1.0 iFix 2 allows remote authenticated users to redirect users to arbitr…
3.5 FAIBLE
CVE-2014-3865Multiple directory traversal vulnerabilities in dpkg-source in dpkg-dev 1.3.0 allow remote attackers to modify files outside of the intended directories via a source package with a…
6.4 MOYENNE
CVE-2014-3864Directory traversal vulnerability in dpkg-source in dpkg-dev 1.3.0 allows remote attackers to modify files outside of the intended directories via a crafted source package that lac…
6.4 MOYENNE
CVE-2014-3227dpkg 1.15.9, 1.16.x before 1.16.14, and 1.17.x before 1.17.9 expect the patch program to be compliant with a need for the "C-style encoded filenames" feature, but is supported in e…
6.4 MOYENNE
CVE-2014-3010Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.2, 6.3 before 6.3.0.6, 7.0 before 7.0.0.6, 7.5 before 7.5.0.5, and …
4.3 MOYENNE
CVE-2014-3924Multiple cross-site scripting (XSS) vulnerabilities in Webmin before 1.690 and Usermin before 1.600 allow remote attackers to inject arbitrary web script or HTML via vectors relate…
4.3 MOYENNE
CVE-2014-3923Multiple cross-site scripting (XSS) vulnerabilities in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTM…
4.3 MOYENNE
CVE-2014-3922Cross-site scripting (XSS) vulnerability in Trend Micro InterScan Messaging Security Virtual Appliance 8.5.1.1516 allows remote authenticated users to inject arbitrary web script o…
4.3 MOYENNE
CVE-2014-3921Cross-site scripting (XSS) vulnerability in popup.php in the Simple Popup Images plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the z param…
4.3 MOYENNE
CVE-2014-3780Les versions 5.3 (avant 5.3.8) et 5.4 (avant 5.4.4) de Citrix VDI-In-A-Box contiennent une faille dans un servlet Java qui permet à un attaquant de contourner l'authentification. E…
7.5 ÉLEVÉE
CVE-2014-0202The setup script in ovirt-engine-dwh, as used in the Red Hat Enterprise Virtualization Manager data warehouse (rhevm-dwh) package before 3.3.3, stores the history database password…
2.1 FAIBLE
CVE-2013-6788Les installations de Bitrix Site Manager utilisant le module e-Store avant la version 14.0.1 sont concernées. Un attaquant peut contourner l'authentification et obtenir un accès no…
7.5 ÉLEVÉE
CVE-2013-5919Suricata before 1.4.6 allows remote attackers to cause a denial of service (crash) via a malformed SSL record.
5.0 MOYENNE
CVE-2013-4143The (1) checkPasswd and (2) checkGroupXlockPasswds functions in xlockmore before 5.43 do not properly handle when a NULL value is returned upon an error by the crypt or dispcrypt f…
2.1 FAIBLE
CVE-2012-5877Nero MediaHome 4.5.8.0 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an HTTP header without a name.
5.0 MOYENNE
CVE-2012-5876Multiple off-by-one errors in NMMediaServerService.dll in Nero MediaHome 4.5.8.0 and earlier allow remote attackers to cause a denial of service (crash) via a long string in the (1…
5.0 MOYENNE
CVE-2012-5572CRLF injection vulnerability in the cookie method (lib/Dancer/Cookie.pm) in Dancer before 1.3114 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response …
5.0 MOYENNE
CVE-2012-5560The default configuration in mate-settings-daemon 1.5.3 allows local users to change the timezone for the system via a crafted D-Bus call.
2.1 FAIBLE
CVE-2014-3463Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a unique secur…
CVE-2014-3285Cisco Wide Area Application Services (WAAS) 5.3(.5a) and earlier, when SharePoint acceleration is enabled, does not properly parse SharePoint responses, which allows remote attacke…
5.0 MOYENNE
CVE-2014-3283Open redirect vulnerability in Self-Care Client Portal applications in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier allows rem…
5.8 MOYENNE
CVE-2014-3282The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allow…
4.0 MOYENNE
CVE-2014-3279The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allow…
5.0 MOYENNE
CVE-2014-3277The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allow…
4.0 MOYENNE
CVE-2014-3417uPortal before 4.0.13.1 does not properly check the CONFIG permission, which allows remote authenticated users to configure portlets by leveraging the SUBSCRIBE permission for a po…
6.5 MOYENNE
CVE-2014-3416uPortal before 4.0.13.1 does not properly check the MANAGE permissions, which allows remote authenticated users to manage arbitrary portlets by leveraging the SUBSCRIBE permission …
6.5 MOYENNE
CVE-2014-3415SQL injection vulnerability in Sharetronix before 3.4 allows remote authenticated users to execute arbitrary SQL commands via the invite_users[] parameter to the /invite page for a…
6.5 MOYENNE
CVE-2014-3414Cross-site request forgery (CSRF) vulnerability in Sharetronix before 3.4 allows remote attackers to hijack the authentication of administrators for requests that add administrativ…
6.8 MOYENNE
CVE-2014-0246SOSreport stores the md5 hash of the GRUB bootloader password in an archive, which allows local users to obtain sensitive information by reading the archive.
4.3 MOYENNE
CVE-2014-0201ovirt-engine-reports, as used in the Red Hat Enterprise Virtualization reports package (rhevm-reports) before 3.3.3, uses world-readable permissions on configuration files, which a…
2.1 FAIBLE
CVE-2014-0200The Red Hat Enterprise Virtualization Manager reports (rhevm-reports) package before 3.3.3-1 uses world-readable permissions on the datasource configuration file (js-jboss7-ds.xml)…
2.1 FAIBLE
CVE-2014-0199The setup script in ovirt-engine-reports, as used in the Red Hat Enterprise Virtualization reports (rhevm-reports) package before 3.3.3, stores the reports database password in cle…
2.1 FAIBLE
CVE-2013-4178The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to obtain access by replaying the username, password, and…
5.0 MOYENNE
CVE-2013-4177The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal does not properly identify user account names, which might allow remote attackers…
5.0 MOYENNE
CVE-2013-2193Apache HBase 0.92.x before 0.92.3 and 0.94.x before 0.94.9, when the Kerberos features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and o…
4.3 MOYENNE
CVE-2013-0199The default LDAP ACIs in FreeIPA 3.0 before 3.1.2 do not restrict access to the (1) ipaNTTrustAuthIncoming and (2) ipaNTTrustAuthOutgoing attributes, which allow remote attackers t…
5.0 MOYENNE
CVE-2012-4915Directory traversal vulnerability in the Google Doc Embedder plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parame…
5.0 MOYENNE