Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (91295 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2014-3809 1 Nokia 6 1830 Photonic Service Switch-16, 1830 Photonic Service Switch-16 Firmware, 1830 Photonic Service Switch-32 and 3 more 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in the management interface in Alcatel-Lucent 1830 Photonic Service Switch (PSS) 6.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the myurl parameter to menu/pop.html.
CVE-2014-3743 1 Marked Project 1 Marked 2024-11-21 6.1 Medium
Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2) javascript url's.
CVE-2014-3718 1 Exlibrisgroup 1 Aleph 500 2024-11-21 6.1 Medium
Multiple cross-site scripting (XSS) vulnerabilities in cgi-bin/tag_m.cgi in Ex Libris ALEPH 500 (Integrated library management system) 18.1 and 20 allow remote attackers to inject arbitrary web script or HTML via the (1) find, (2) lib, or (3) sid parameter.
CVE-2014-3700 1 Redhat 2 Edeploy, Jboss Enterprise Web Server 2024-11-21 9.8 Critical
eDeploy through at least 2014-10-14 has remote code execution due to eval() of untrusted data
CVE-2014-3656 1 Redhat 1 Jboss Keycloak 2024-11-21 6.1 Medium
JBoss KeyCloak: XSS in login-status-iframe.html
CVE-2014-3650 1 Redhat 1 Jboss Aerogear 2024-11-21 5.4 Medium
Multiple persistent cross-site scripting (XSS) flaws were found in the way Aerogear handled certain user-supplied content. A remote attacker could use these flaws to compromise the application with specially crafted input.
CVE-2014-3649 1 Redhat 1 Jboss Aerogear 2024-11-21 6.1 Medium
JBoss AeroGear has reflected XSS via the password field
CVE-2014-3592 1 Redhat 1 Openshift Origin 2024-11-21 6.1 Medium
OpenShift Origin: Improperly validated team names could allow stored XSS attacks
CVE-2014-3484 1 Musl-libc 1 Musl 2024-11-21 9.8 Critical
Multiple stack-based buffer overflows in the __dn_expand function in network/dn_expand.c in musl libc 1.1x before 1.1.2 and 0.9.13 through 1.0.3 allow remote attackers to (1) have unspecified impact via an invalid name length in a DNS response or (2) cause a denial of service (crash) via an invalid name length in a DNS response, related to an infinite loop with no output.
CVE-2014-3413 1 Juniper 1 Junos Space 2024-11-21 N/A
The MySQL server in Juniper Networks Junos Space before 13.3R1.8 has an unspecified account with a hardcoded password, which allows remote attackers to obtain sensitive information and consequently obtain administrative control by leveraging database access.
CVE-2014-3205 1 Seagate 4 Blackarmor Nas 110, Blackarmor Nas 110 Firmware, Blackarmor Nas 220 and 1 more 2024-11-21 N/A
backupmgt/pre_connect_check.php in Seagate BlackArmor NAS contains a hard-coded password of '!~@##$$%FREDESWWSED' for a backdoor user.
CVE-2014-3114 1 Ezpz-one-click-backup Project 1 Ezpz-one-click-backup 2024-11-21 N/A
The EZPZ One Click Backup (ezpz-one-click-backup) plugin 12.03.10 and earlier for WordPress allows remote attackers to execute arbitrary commands via the cmd parameter to functions/ezpz-archive-cmd.php.
CVE-2014-2843 1 Infoware 1 Mapsuite 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in infoware MapSuite MapAPI 1.0.x before 1.0.36 and 1.1.x before 1.1.49 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-2727 1 Trustwave 1 Mailmarshal 2024-11-21 9.8 Critical
The STARTTLS implementation in MailMarshal before 7.2 allows plaintext command injection.
CVE-2014-2650 1 Atos 30 Openscape Desk Phone Ip 35g, Openscape Desk Phone Ip 35g Eco, Openscape Desk Phone Ip 35g Eco Firmware and 27 more 2024-11-21 9.8 Critical
Unify OpenStage / OpenScape Desk Phone IP before V3 R3.11.0 SIP has an OS command injection vulnerability in the web based management interface
CVE-2014-2297 1 Videowhisper 1 Videowhisper Live Streaming Integration 2024-11-21 N/A
Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) n parameter to ls/htmlchat.php or (2) bgcolor parameter to ls/index.php. NOTE: vector 1 may overlap CVE-2014-1906.4.
CVE-2014-2294 1 Openwebanalytics 1 Open Web Analytics 2024-11-21 N/A
Open Web Analytics (OWA) before 1.5.7 allows remote attackers to conduct PHP object injection attacks via a crafted serialized object in the owa_event parameter to queue.php.
CVE-2014-2228 1 Talend 1 Restlet 2024-11-21 9.8 Critical
The XStream extension in HP Fortify SCA before 2.2 RC3 allows remote attackers to execute arbitrary code via unsafe deserialization of XML messages.
CVE-2014-2214 1 Posh Project 1 Posh 2024-11-21 6.1 Medium
Multiple cross-site scripting (XSS) vulnerabilities in POSH (aka Posh portal or Portaneo) 3.0 through 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) error parameter to /includes/plugins/mobile/scripts/login.php or (2) id parameter to portal/openrssarticle.php
CVE-2014-2073 1 3ds 1 Catia 2024-11-21 9.8 Critical
Stack-based buffer overflow in Dassault Systemes CATIA V5-6R2013 allows remote attackers to execute arbitrary code via a crafted packet, related to "CATV5_Backbone_Bus."