CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Related To CWE-20

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2015-2055 20 1 DoS 2015-02-23 2015-02-24
7.8
None Remote Low Not required None None Complete
Zhone GPON 2520 with firmware R4.0.2.566b allows remote attackers to cause a denial of service via a long string in the oldpassword parameter.
2 CVE-2015-2053 20 2015-02-23 2015-02-24
4.3
None Remote Medium Not required None Partial None
The log viewer in McAfee Agent (MA) before 4.8.0 Patch 3 and 5.0.0, when the "Accept connections only from the ePO server" option is disabled, allows remote attackers to conduct clickjacking attacks via a crafted web page, aka an "http-generic-click-jacking" vulnerability.
3 CVE-2015-1604 20 Exec Code 2015-02-19 2015-02-20
6.5
None Remote Low Single system Partial Partial Partial
Unrestricted file upload vulnerability in asys/site/files.php in Adminsystems CMS before 4.0.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in upload/files/.
4 CVE-2015-1382 20 DoS 2015-02-03 2015-02-19
5.0
None Remote Low Not required None None Partial
parsers.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (invalid read and crash) via vectors related to an HTTP time header.
5 CVE-2015-1380 20 DoS 2015-02-03 2015-02-19
5.0
None Remote Low Not required None None Partial
jcc.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (abort) via a crafted chunk-encoded body.
6 CVE-2015-1371 20 Exec Code 2015-01-27 2015-01-27
7.5
None Remote Low Not required Partial Partial Partial
Unrestricted file upload vulnerability in ferretCMS 1.0.4-alpha allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in custom/uploads/.
7 CVE-2015-1049 20 2015-02-02 2015-02-04
6.8
None Remote Medium Not required Partial Partial Partial
The web server on Siemens SCALANCE X-200IRT switches with firmware before 5.2.0 allows remote attackers to hijack sessions via unspecified vectors.
8 CVE-2015-1043 20 DoS 2015-01-29 2015-02-20
3.3
None Local Network Low Not required None None Partial
The Host Guest File System (HGFS) in VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, and VMware Fusion 6.x before 6.0.5 and 7.x before 7.0.1 allows guest OS users to cause a guest OS denial of service via unspecified vectors.
9 CVE-2015-0879 20 DoS 2015-02-20 2015-02-20
4.3
None Remote Medium Not required None None Partial
CREAR AL-Mail32 before 1.13d allows remote attackers to cause a denial of service (application crash) via a (1) CON, (2) AUX, or (3) NUL device name in the filename of an attachment.
10 CVE-2015-0633 20 Bypass 2015-02-25 2015-02-26
6.8
None Local Network Low Not required None Partial Complete
The Integrated Management Controller (IMC) in Cisco Unified Computing System (UCS) 1.4(7h) and earlier on C-Series servers allows remote attackers to bypass intended access restrictions by sending crafted DHCP response packets on the local network, aka Bug ID CSCuf52876.
11 CVE-2015-0626 20 2015-02-18 2015-02-19
4.3
None Remote Medium Not required Partial None None
The SOAP interface in Cisco Hosted Collaboration Solution (HCS) allows remote attackers to obtain access to system-management tools via crafted Challenge SOAP calls, aka Bug ID CSCuc38114.
12 CVE-2015-0624 20 2015-02-21 2015-02-27
4.3
None Remote Medium Not required None Partial None
The web framework in Cisco AsyncOS on Email Security Appliance (ESA), Content Security Management Appliance (SMA), and Web Security Appliance (WSA) devices allows remote attackers to trigger redirects via a crafted HTTP header, aka Bug IDs CSCur44412, CSCur44415, CSCur89630, CSCur89636, CSCur89633, and CSCur89639.
13 CVE-2015-0622 20 DoS 2015-02-18 2015-02-19
7.1
None Remote Medium Not required None None Complete
The Wireless Intrusion Detection (aka WIDS) functionality on Cisco Wireless LAN Controller (WLC) devices allows remote attackers to cause a denial of service (device outage) via crafted packets that are improperly handled during rendering of the Signature Events Summary page, aka Bug ID CSCus46861.
14 CVE-2015-0620 20 DoS 2015-02-17 2015-02-20
4.0
None Remote Low Single system None None Partial
The XML parser in Cisco TelePresence Management Suite (TMS) 14.3(.2) and earlier does not properly handle external entities, which allows remote authenticated users to cause a denial of service via POST requests, aka Bug ID CSCus51494.
15 CVE-2015-0606 20 DoS 2015-02-11 2015-02-18
4.9
None Local Low Not required None None Complete
The IOS Shell in Cisco IOS allows local users to cause a denial of service (device crash) via unspecified commands, aka Bug ID CSCur59696.
16 CVE-2015-0604 20 2015-02-06 2015-02-19
5.0
None Remote Low Not required None Partial None
The web framework on Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allows remote attackers to upload files to arbitrary locations on a phone's filesystem via crafted HTTP requests, aka Bug ID CSCup90424.
17 CVE-2015-0601 20 DoS 2015-02-06 2015-02-17
4.6
None Local Low Single system None None Complete
Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allow local users to cause a denial of service (device reload) via crafted commands, aka Bug ID CSCup92790.
18 CVE-2015-0600 20 DoS 2015-02-07 2015-02-13
5.0
None Remote Low Not required None None Partial
The mobility extension on Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allows remote attackers to cause a denial of service (logoff) via crafted packets, aka Bug ID CSCuq12139.
19 CVE-2015-0589 20 Exec Code 2015-02-07 2015-02-13
9.0
None Remote Low Single system Complete Complete Complete
The administrative web interface in Cisco WebEx Meetings Server 1.0 through 1.5 allows remote authenticated users to execute arbitrary OS commands with root privileges via unspecified fields, aka Bug ID CSCuj40460.
20 CVE-2015-0584 20 Exec Code 2015-02-19 2015-02-27
7.2
None Local Low Not required Complete Complete Complete
The image-upgrade implementation on Cisco Desktop Collaboration Experience (aka Collaboration Desk Experience or DX) DX650 endpoints allows local users to execute arbitrary OS commands via an unspecified parameter, aka Bug ID CSCus38947.
21 CVE-2015-0582 20 DoS 2015-01-09 2015-01-22
5.0
None Remote Low Not required None None Partial
The High Availability (HA) subsystem in Cisco NX-OS on MDS 9000 devices allows remote attackers to cause a denial of service via crafted traffic, aka Bug ID CSCuo09129.
22 CVE-2015-0578 20 DoS 2015-01-14 2015-02-05
5.7
None Local Network Medium Not required None None Complete
Cisco Adaptive Security Appliance (ASA) Software, when a DHCPv6 relay is configured, allows remote attackers to cause a denial of service (device reload) via crafted DHCP packets on the local network, aka Bug ID CSCur45455.
23 CVE-2015-0563 20 DoS 2015-01-09 2015-02-05
5.0
None Remote Low Not required None None Partial
epan/dissectors/packet-smtp.c in the SMTP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 uses an incorrect length value for certain string-append operations, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
24 CVE-2015-0561 20 DoS 2015-01-09 2015-02-05
5.0
None Remote Low Not required None None Partial
asn1/lpp/lpp.cnf in the LPP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 does not validate a certain index value, which allows remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted packet.
25 CVE-2015-0301 20 2015-01-13 2015-02-13
10.0
None Remote Low Not required Complete Complete Complete
Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 do not properly validate files, which has unspecified impact and attack vectors.
26 CVE-2015-0268 20 DoS 2015-02-16 2015-02-17
4.9
None Local Low Not required None None Complete
The vgic_v2_to_sgi function in arch/arm/vgic-v2.c in Xen 4.5.x, when running on ARM hardware with general interrupt controller (GIC) version 2, allows local guest users to cause a denial of service (host crash) by writing an invalid value to the GICD.SGIR register.
27 CVE-2015-0060 20 DoS 2015-02-10 2015-02-18
4.7
None Local Medium Not required None None Complete
The font mapper in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly scale fonts, which allows local users to cause a denial of service (system hang) via a crafted application, aka "Windows Font Driver Denial of Service Vulnerability."
28 CVE-2014-9603 20 DoS 2015-01-16 2015-01-20
7.5
None Remote Low Not required Partial Partial Partial
The vmd_decode function in libavcodec/vmdvideo.c in FFmpeg before 2.5.2 does not validate the relationship between a certain length value and the frame width, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Sierra VMD video data.
29 CVE-2014-9601 20 DoS 2015-01-16 2015-01-21
5.0
None Remote Low Not required None None Partial
Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed.
30 CVE-2014-9598 20 DoS Exec Code 2015-01-21 2015-01-22
6.8
None Remote Medium Not required Partial Partial Partial
The picture_Release function in misc/picture.c in VideoLAN VLC media player 2.1.5 allows remote attackers to execute arbitrary code or cause a denial of service (write access violation) via a crafted M2V file.
31 CVE-2014-9597 20 DoS Exec Code 2015-01-21 2015-01-22
6.8
None Remote Medium Not required Partial Partial Partial
The picture_pool_Delete function in misc/picture_pool.c in VideoLAN VLC media player 2.1.5 allows remote attackers to execute arbitrary code or cause a denial of service (DEP violation and application crash) via a crafted FLV file.
32 CVE-2014-9584 20 +Info 2015-01-09 2015-01-12
2.1
None Local Low Not required Partial None None
The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 does not validate a length value in the Extensions Reference (ER) System Use Field, which allows local users to obtain sensitive information from kernel memory via a crafted iso9660 image.
33 CVE-2014-9509 20 2015-01-04 2015-01-06
7.5
None Remote Low Not required Partial Partial Partial
The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set to all or cached, allows remote attackers to have an unspecified impact (possibly resource consumption) via a "Cache Poisoning" attack using a URL with arbitrary arguments, which triggers a reload of the page.
34 CVE-2014-9471 20 DoS Exec Code 2015-01-16 2015-01-21
7.5
None Remote Low Not required Partial Partial Partial
The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted date string, as demonstrated by the "--date=TZ="123"345" @1" string to the touch or date command.
35 CVE-2014-9417 20 DoS 2014-12-24 2014-12-29
2.1
None Local Low Not required None None Partial
The Meeting component in Huawei eSpace Desktop before V100R001C03 allows local users to cause a denial of service (program exit) via a crafted image.
36 CVE-2014-9415 20 DoS 2014-12-24 2014-12-29
1.9
None Local Medium Not required None None Partial
Huawei eSpace Desktop before V100R001C03 allows local users to cause a denial of service (program exit) via a crafted QES file.
37 CVE-2014-9378 20 DoS Exec Code 2014-12-19 2015-01-12
7.5
None Remote Low Not required Partial Partial Partial
Ettercap 0.8.1 does not validate certain return values, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted (1) name to the parse_line function in mdns_spoof/mdns_spoof.c or (2) base64 encoded password to the dissector_imap function in dissectors/ec_imap.c.
38 CVE-2014-9371 20 Exec Code 2014-12-16 2014-12-17
10.0
None Remote Low Not required Complete Complete Complete
The NativeAppServlet in ManageEngine Desktop Central MSP before 90075 allows remote attackers to execute arbitrary code via a crafted JSON object.
39 CVE-2014-9358 20 2014-12-16 2014-12-30
6.4
None Remote Low Not required Partial Partial None
Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry communications."
40 CVE-2014-9351 20 DoS 2014-12-09 2014-12-10
6.4
None Remote Low Not required Partial None Partial
engine/server/server.cpp in Teeworlds 0.6.x before 0.6.3 allows remote attackers to read memory and cause a denial of service (crash) via unspecified vectors.
41 CVE-2014-9268 20 Exec Code 2014-12-08 2014-12-09
6.8
None Remote Medium Not required Partial Partial Partial
The AdView.AdViewer.1 ActiveX control in Autodesk Design Review (ADR) before 2013 Hotfix 1 allows remote attackers to execute arbitrary code via a crafted DWF file.
42 CVE-2014-9130 20 DoS 2014-12-08 2015-02-26
5.0
None Remote Low Not required None None Partial
scanner.c in LibYAML 0.1.5 and 0.1.6, as used in the YAML-LibYAML (aka YAML-XS) module for Perl, allows context-dependent attackers to cause a denial of service (assertion failure and crash) via vectors involving line-wrapping.
43 CVE-2014-9093 20 DoS Exec Code 2014-11-26 2015-02-23
7.5
None Remote Low Not required Partial Partial Partial
LibreOffice before 4.3.5 allows remote attackers to cause a denial of service (invalid write operation and crash) and possibly execute arbitrary code via a crafted RTF file.
44 CVE-2014-9060 20 2014-11-24 2014-11-24
5.0
None Remote Low Not required Partial None None
The LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not properly restrict the parameters used in a return URL, which allows remote attackers to trigger the generation of arbitrary messages via a modified URL, related to mod/lti/locallib.php and mod/lti/return.php.
45 CVE-2014-9038 20 2014-11-25 2014-12-08
6.4
None Remote Low Not required Partial Partial None
wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 resource.
46 CVE-2014-9030 20 DoS 2014-11-24 2015-02-27
7.1
None Remote Medium Not required None None Complete
The do_mmu_update function in arch/x86/mm.c in Xen 3.2.x through 4.4.x does not properly manage page references, which allows remote domains to cause a denial of service by leveraging control over an HVM guest and a crafted MMU_MACHPHYS_UPDATE.
47 CVE-2014-9016 20 DoS 2014-11-24 2014-12-30
5.0
None Remote Low Not required None None Partial
The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.
48 CVE-2014-8966 20 DoS Exec Code Mem. Corr. 2014-12-10 2014-12-11
9.3
None Remote Medium Not required Complete Complete Complete
Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
49 CVE-2014-8836 20 DoS Exec Code 2015-01-30 2015-02-05
10.0
None Remote Low Not required Complete Complete Complete
The Bluetooth driver in Apple OS X before 10.10.2 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (arbitrary-size bzero of kernel memory) via a crafted app.
50 CVE-2014-8825 20 +Priv 2015-01-30 2015-02-18
7.2
None Local Low Not required Complete Complete Complete
The kernel in Apple OS X before 10.10.2 does not properly perform identitysvc validation of certain directory-service functionality, which allows local users to gain privileges or spoof directory-service responses via unspecified vectors.
Total number of vulnerabilities : 3187   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.