Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (118672 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2014-5071 1 Microsemi 2 S350i, S350i Firmware 2024-11-21 9.8 Critical
SQL injection vulnerability in the checkPassword function in Symmetricom s350i 2.70.15 allows remote attackers to execute arbitrary SQL commands via vectors involving a username.
CVE-2014-5070 1 Microsemi 2 S350i, S350i Firmware 2024-11-21 8.8 High
Symmetricom s350i 2.70.15 allows remote authenticated users to gain privileges via vectors related to pushing unauthenticated users to the login page.
CVE-2014-5069 1 Microsemi 2 S350i, S350i Firmware 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in Symmetricom s350i 2.70.15 allows remote attackers to inject arbitrary web script or HTML via vectors involving system logs.
CVE-2014-5068 1 Microsemi 2 S350i, S350i Firmware 2024-11-21 7.5 High
Directory traversal vulnerability in the web application in Symmetricom s350i 2.70.15 allows remote attackers to read arbitrary files via a (1) ../ (dot dot slash) or (2) ..\ (dot dot forward slash) before a file name.
CVE-2014-5044 1 Gnu 1 Libgfortran 2024-11-21 N/A
Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of service (Fortran application crash) via vectors related to array allocation.
CVE-2014-5039 1 Eucalyptus 1 Eucalyptus Management Console 2024-11-21 9.6 Critical
Cross-site scripting (XSS) vulnerability in Eucalyptus Management Console (EMC) 4.0.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-5034 1 Fresh-media 1 Brute Force Login Protection 2024-11-21 N/A
Cross-site request forgery (CSRF) vulnerability in the Brute Force Login Protection module 1.3 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that have unknown impact via a crafted request to the brute-force-login-protection page to wp-admin/options-general.php.
CVE-2014-5028 1 Reviewboard 1 Review Board 2024-11-21 N/A
The Original File and Patched File resources in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information from repository files by leveraging knowledge of database ids.
CVE-2014-5014 1 Tinywebgallery 1 Wordpress Flash Uploader 2024-11-21 N/A
The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters in image_magic_path.
CVE-2014-5013 1 Dompdf Project 1 Dompdf 2024-11-21 8.8 High
DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.
CVE-2014-5007 1 Zohocorp 2 Manageengine Desktop Central, Manageengine Desktop Central Managed Service Providers 2024-11-21 9.8 Critical
Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build 90055 allows remote attackers to write to and execute arbitrary files as SYSTEM via a .. (dot dot) in the filename parameter.
CVE-2014-4984 1 Dejavuprotech 1 Crescendo - Sales Crm 2024-11-21 9.8 Critical
Déjà Vu Crescendo Sales CRM has remote SQL Injection
CVE-2014-4981 1 Xorux 1 Lpar2rrd 2024-11-21 9.8 Critical
LPAR2RRD in 3.5 and earlier allows remote attackers to execute arbitrary commands due to insufficient input sanitization of the web GUI parameters.
CVE-2014-4972 1 Ajax Upload For Gravity Forms Project 1 Ajax Upload For Gravity Forms 2024-11-21 N/A
Unrestricted file upload vulnerability in the Gravity Upload Ajax plugin 1.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under wp-content/uploads/gravity_forms.
CVE-2014-4968 1 Boatmob 1 Boat Browser 2024-11-21 8.8 High
The WebView class and use of the WebView.addJavascriptInterface method in the Boat Browser application 8.0 and 8.0.1 for Android allow remote attackers to execute arbitrary code via a crafted web site, a related issue to CVE-2012-6636.
CVE-2014-4967 1 Redhat 1 Ansible 2024-11-21 9.8 Critical
Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as demonstrated by a fact with (1) a trailing " src=" clause, (2) a trailing " temp=" clause, or (3) a trailing " validate=" clause accompanied by a shell command.
CVE-2014-4966 1 Redhat 1 Ansible 2024-11-21 9.8 Critical
Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.
CVE-2014-4959 1 Google 1 Android 2024-11-21 N/A
**DISPUTED** SQL injection vulnerability in SQLiteDatabase.java in the SQLi Api in Android allows remote attackers to execute arbitrary SQL commands via the delete method.
CVE-2014-4932 1 Wordfence 1 Wordfence Security 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php.
CVE-2014-4928 1 Invisioncommunity 1 Invision Power Board 2024-11-21 N/A
SQL injection vulnerability in Invision Power Board (aka IPB or IP.Board) before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the cId parameter.