Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (325342 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2014-9382 1 Free 1 Freebox Os 2024-11-21 6.5 Medium
Freebox OS Web interface 3.0.2 has CSRF which can allow VPN user account creation
CVE-2014-9356 2 Docker, Redhat 2 Docker, Rhel Extras Other 2024-11-21 8.6 High
Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile.
CVE-2014-9320 1 Sap 1 Businessobjects Edge 2024-11-21 9.8 Critical
SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SI_PLATFORM_SEARCH_SERVER_LOGON_TOKEN token and consequently gain SYSTEM privileges via vectors involving CORBA calls, aka SAP Note 2039905.
CVE-2014-9211 1 Clickdesk 1 Clickdesk 2024-11-21 6.1 Medium
ClickDesk version 4.3 and below has persistent cross site scripting
CVE-2014-9189 1 Honeywell 1 Experion Process Knowledge System 2024-11-21 N/A
Multiple stack-based buffer overflow vulnerabilities were found in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2 modules that could lead to possible remote code execution, dynamic memory corruption, or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
CVE-2014-9187 1 Honeywell 1 Experion Process Knowledge System 2024-11-21 N/A
Multiple heap-based buffer overflow vulnerabilities exist in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2 modules, which could lead to possible remote code execution or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
CVE-2014-9186 1 Honeywell 1 Experion Process Knowledge System 2024-11-21 N/A
A file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which could lead to accepting an arbitrary file into the function, and potential information disclosure or remote code execution. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
CVE-2014-9127 1 Open-school 1 Open-school 2024-11-21 6.5 Medium
Open-School Community Edition 2.2 does not properly restrict access to the export functionality, which allows remote authenticated users to obtain sensitive information via the r parameter with the value export to index.php.
CVE-2014-9126 1 Open-school 1 Open-school 2024-11-21 6.1 Medium
Multiple cross-site scripting (XSS) vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to inject arbitrary web script or HTML via the YII_CSRF_TOKEN HTTP cookie or the StudentDocument, StudentCategories, StudentPreviousDatas parameters to index.php.
CVE-2014-9014 1 Wpmarketplace Project 1 Wpmarketplace 2024-11-21 4.3 Medium
Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin before 2.4.1 for WordPress allows remote authenticated users to download arbitrary files via a .. (dot dot) in the file parameter.
CVE-2014-9013 1 Wpmarketplace Project 1 Wpmarketplace 2024-11-21 8.8 High
The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to create arbitrary users and gain admin privileges via a request to wpmp_pp_ajax_call with an execution target of wp_insert_user.
CVE-2014-8985 1 Microsoft 1 Internet Explorer 2024-11-21 N/A
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2810, CVE-2014-2811, CVE-2014-2822, CVE-2014-2823, CVE-2014-4057, and CVE-2014-4145.
CVE-2014-8945 1 Piwigo 1 Lexiglot 2024-11-21 9.8 Critical
admin.php?page=projects in Lexiglot through 2014-11-20 allows command injection via username and password fields.
CVE-2014-8944 1 Piwigo 1 Lexiglot 2024-11-21 5.4 Medium
Lexiglot through 2014-11-20 allows XSS (Reflected) via the username, or XSS (Stored) via the admin.php?page=config install_name, intro_message, or new_file_content parameter.
CVE-2014-8943 1 Piwigo 1 Lexiglot 2024-11-21 8.8 High
Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svn_url parameter.
CVE-2014-8942 1 Piwigo 1 Lexiglot 2024-11-21 8.8 High
Lexiglot through 2014-11-20 allows CSRF.
CVE-2014-8941 1 Piwigo 1 Lexiglot 2024-11-21 9.8 Critical
Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&from_id= or admin.php?page=history&limit= URI.
CVE-2014-8940 1 Piwigo 1 Lexiglot 2024-11-21 5.3 Medium
Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (names and details of projects) by visiting the /update.log URI.
CVE-2014-8939 1 Piwigo 1 Lexiglot 2024-11-21 5.3 Medium
Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (full path) via an include/smarty/plugins/modifier.date_format.php request if PHP has a non-recommended configuration that produces warning messages.
CVE-2014-8938 1 Piwigo 1 Lexiglot 2024-11-21 7.8 High
Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username and password are on the command line.