Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (322833 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2014-5000 1 Lawn-login Project 1 Lawn-login 2024-11-21 N/A
The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process.
CVE-2014-4999 1 Kajam Project 1 Kajam 2024-11-21 N/A
vendor/plugins/dataset/lib/dataset/database/mysql.rb in the kajam gem 1.0.3.rc2 for Ruby places the mysql user password on the (1) mysqldump command line in the capture function and (2) mysql command line in the restore function, which allows local users to obtain sensitive information by listing the process.
CVE-2014-4998 1 Lean-ruport Project 1 Lean-ruport 2024-11-21 N/A
test/tc_database.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.
CVE-2014-4997 1 Point-cli Project 1 Point-cli 2024-11-21 N/A
lib/commands/setup.rb in the point-cli gem 0.0.1 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process.
CVE-2014-4996 1 Vladtheenterprising Project 1 Vladtheenterprising 2024-11-21 N/A
lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to write to arbitrary files via a symlink attack on /tmp/my.cnf.#{target_host}.
CVE-2014-4995 1 Vladtheenterprising Project 1 Vladtheenterprising 2024-11-21 N/A
Race condition in lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to obtain sensitive information by reading the MySQL root password from a temporary file before it is removed.
CVE-2014-4994 1 Gyazo Project 1 Gyazo 2024-11-21 N/A
lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file, related to time-based filenames.
CVE-2014-4993 2 Backup-agoddard Project, Backup Checksum Project 2 Backup-agoddard, Backup Checksum 2024-11-21 N/A
(1) lib/backup/cli/utility.rb in the backup-agoddard gem 3.0.28 and (2) lib/backup/cli/utility.rb in the backup_checksum gem 3.0.23 for Ruby place credentials on the openssl command line, which allows local users to obtain sensitive information by listing the process.
CVE-2014-4992 1 Cap-strap Project 1 Cap-strap 2024-11-21 N/A
lib/cap-strap/helpers.rb in the cap-strap gem 0.1.5 for Ruby places credentials on the useradd command line, which allows local users to obtain sensitive information by listing the process.
CVE-2014-4991 1 Codders-dataset Project 1 Codders-dataset 2024-11-21 N/A
(1) lib/dataset/database/mysql.rb and (2) lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3.2.1 for Ruby place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.
CVE-2014-4984 1 Dejavuprotech 1 Crescendo - Sales Crm 2024-11-21 9.8 Critical
Déjà Vu Crescendo Sales CRM has remote SQL Injection
CVE-2014-4982 1 Xorux 1 Lpar2rrd 2024-11-21 9.8 Critical
LPAR2RRD ≤ 4.53 and ≤ 3.5 has arbitrary command injection on the application server.
CVE-2014-4981 1 Xorux 1 Lpar2rrd 2024-11-21 9.8 Critical
LPAR2RRD in 3.5 and earlier allows remote attackers to execute arbitrary commands due to insufficient input sanitization of the web GUI parameters.
CVE-2014-4972 1 Ajax Upload For Gravity Forms Project 1 Ajax Upload For Gravity Forms 2024-11-21 N/A
Unrestricted file upload vulnerability in the Gravity Upload Ajax plugin 1.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under wp-content/uploads/gravity_forms.
CVE-2014-4968 1 Boatmob 1 Boat Browser 2024-11-21 8.8 High
The WebView class and use of the WebView.addJavascriptInterface method in the Boat Browser application 8.0 and 8.0.1 for Android allow remote attackers to execute arbitrary code via a crafted web site, a related issue to CVE-2012-6636.
CVE-2014-4967 1 Redhat 1 Ansible 2024-11-21 9.8 Critical
Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as demonstrated by a fact with (1) a trailing " src=" clause, (2) a trailing " temp=" clause, or (3) a trailing " validate=" clause accompanied by a shell command.
CVE-2014-4966 1 Redhat 1 Ansible 2024-11-21 9.8 Critical
Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.
CVE-2014-4959 1 Google 1 Android 2024-11-21 N/A
**DISPUTED** SQL injection vulnerability in SQLiteDatabase.java in the SQLi Api in Android allows remote attackers to execute arbitrary SQL commands via the delete method.
CVE-2014-4932 1 Wordfence 1 Wordfence Security 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php.
CVE-2014-4928 1 Invisioncommunity 1 Invision Power Board 2024-11-21 N/A
SQL injection vulnerability in Invision Power Board (aka IPB or IP.Board) before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the cId parameter.