2014

The (1) dshield.conf, (2) mail-buffered.conf, (3) mynetwatchman.conf, and (4) mynetwatchman.conf actions in action.d/ in

Cisco WebEx Meeting Server does not properly restrict the content of URLs, which allows remote authenticated users to ob

The Real Time Monitoring Tool (RTMT) implementation in Cisco Unified Communications Manager (Unified CM) allows remote a

Cross-site scripting (XSS) vulnerability in the web management interface in Cisco AsyncOS on the Email Security Applianc

SQL injection vulnerability in BulkViewFileContentsAction.java in the Java interface in Cisco Unified Communications Man

IBM CICS Transaction Server 3.1, 3.2, 4.1, 4.2, and 5.1 on z/OS does not properly implement CEMT transactions, which all

SAP Open Hub Service has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecif

SAP Capacity Leveling has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspeci

SAP Transaction Data Pool has hardcoded credentials, which makes it easier for remote attackers to obtain access via uns

SAP CCMS Monitoring (BC-CCM-MON) has hardcoded credentials, which makes it easier for remote attackers to obtain access

SAP Web Services Tool (CA-WUI-WST) has hardcoded credentials, which makes it easier for remote attackers to obtain acces

The SAP Upgrade tools for ABAP has hardcoded credentials, which makes it easier for remote attackers to obtain access vi

The SAP Trader's and Scheduler's Workbench (TSW) for SAP Oil & Gas has hardcoded credentials, which makes it easier for

SAP Brazil add-on has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified

The (1) Structures and (2) Project-Oriented Procurement components in SAP Project System has hardcoded credentials, whic

QNAP Photo Station before firmware 4.0.3 build0912 allows remote attackers to list OS user accounts via a request to pho

The Misery module 6.x-2.x before 6.x-2.5 and 7.x-2.x before 7.x-2.2 for Drupal, when the "delay misery" configuration is

The Revisioning module 7.x-1.x before 7.x-1.6 for Drupal does not properly check node access permissions for content mar

The Secure Pages module 6.x-2.x before 6.x-2.0 for Drupal does not properly match URLs, which causes HTTP to be used ins

Cross-site scripting (XSS) vulnerability in plugins/jojo_core/forgot_password.php in Jojo before 1.2.2 allows remote att

Mambo CMS 4.6.5 allows remote attackers to cause a denial of service (memory and bandwidth consumption) by uploading a c

The autocomplete callback in Autocomplete Widgets for Text and Number Fields (autocomplete_widgets) module 6.x-1.x befor

libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on

Unspecified vulnerability on the IBM System Storage Virtualization Engine TS7700 allows local users to gain privileges b

Unspecified vulnerability in IBM API Management 3.0.0.0, when basic authentication is used for APIs, allows remote attac

IBM Security AppScan Source 8.0 through 9.0, when the publish-assessment permission is not properly restricted for the c

Cross-site request forgery (CSRF) vulnerability in the Profiles component in IBM Connections through 3.0.1.1 CR3 allows

Cross-site request forgery (CSRF) vulnerability in IBM Tivoli Identity Manager (ITIM) 5.0 before 5.0.0.15 and 5.1 before

Cisco Wireless LAN Controller (WLC) devices allow remote attackers to cause a denial of service (NULL pointer dereferenc

The web framework in Cisco WebEx Meeting Server does not properly restrict the content of reply messages, which allows r

The web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) does not properly implement access contro

The web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) does not properly implement access contro

Directory traversal vulnerability in the File Manager component in DevExpress ASPxFileManager Control for ASP.NET WebFor

DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, allows remote at

DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, allows remote at

DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, does not set the

DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, does not include

The init_nss_hash function in exec/totemcrypto.c in Corosync 2.0 before 2.3 does not properly initialize the HMAC key, w

phpCAS before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before

The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0

The HVMOP_inject_msi function in Xen 4.2.x, 4.3.x, and 4.4.x allows local guest HVM administrators to cause a denial of

The HVMOP_inject_msi function in Xen 4.2.x, 4.3.x, and 4.4.x does not properly check the return value from the IRQ setup

The (1) asn1_read_value_type and (2) asn1_read_value functions in GNU Libtasn1 before 3.6 allows context-dependent attac

Multiple unspecified vulnerabilities in the DER decoder in GNU Libtasn1 before 3.6, as used in GnuTLS, allow remote atta

Directory traversal vulnerability in editor.php in Network Weathermap 0.97c and earlier allows remote attackers to read

Cross-site scripting (XSS) vulnerability in editor.php in Network Weathermap before 0.97b allows remote attackers to inj

ZNC 1.0 allows remote authenticated users to cause a denial of service (NULL pointer reference and crash) via a crafted

The (1) QProGetNotebookWindowHandle and (2) Ordinal132 functions in QPW160.dll in Corel Quattro Pro X6 Standard Edition