CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (Gain Information)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
6951 CVE-2014-5526 310 +Info 2014-09-08 2014-09-09
5.4
None Local Network Medium Not required Partial Partial Partial
The Inmobi library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
6952 CVE-2014-5525 310 +Info 2014-09-08 2014-09-09
5.4
None Local Network Medium Not required Partial Partial Partial
The MoMinis library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
6953 CVE-2014-5524 310 +Info 2014-09-08 2014-09-09
5.4
None Local Network Medium Not required Partial Partial Partial
The Adcolony library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
6954 CVE-2014-5450 200 +Info 2018-03-19 2018-04-20
2.1
None Local Low Not required Partial None None
Zarafa Collaboration Platform 4.1 uses world-readable permissions for /etc/zarafa/license, which allows local users to obtain sensitive information by reading license files.
6955 CVE-2014-5449 200 +Info 2014-10-20 2017-09-07
2.1
None Local Low Not required Partial None None
Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which allows local users to obtain sensitive information by reading temporary session data.
6956 CVE-2014-5448 200 +Info 2014-10-20 2017-09-07
2.1
None Local Low Not required Partial None None
Zarafa 5.00 uses world-readable permissions for the files in the log directory, which allows local users to obtain sensitive information by reading the log files.
6957 CVE-2014-5447 200 +Info 2014-10-20 2015-11-17
2.1
None Local Low Not required Partial None None
Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which allows local users to obtain sensitive information by reading the PHP session files. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0103.
6958 CVE-2014-5427 200 +Info 2015-03-29 2015-03-30
5.0
None Remote Low Not required Partial None None
Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server 85 LCS8520, Network Automation Engine (NAE) 55xx-x, Network Integration Engine (NIE) 5xxx-x, and NxE8500, allows remote attackers to read password hashes via a POST request.
6959 CVE-2014-5423 255 +Info 2014-10-18 2014-10-22
1.9
None Local Medium Not required Partial None None
CareFusion Pyxis SupplyStation 8.1 with hardware test tool before 1.0.16 allows local users to obtain potentially sensitive information by reading a temporary (1) debugging file or (2) developer file.
6960 CVE-2014-5405 200 Bypass +Info 2015-04-03 2015-07-24
9.0
None Remote Low Single system Complete Complete Complete
Hospira MedNet before 6.1 uses a hardcoded cleartext password to control SQL database authorization, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password.
6961 CVE-2014-5403 310 +Info 2015-04-03 2015-04-03
5.0
None Remote Low Not required Partial None None
Hospira MedNet before 6.1 uses hardcoded cryptographic keys for protection of data transmission from infusion pumps, which allows remote attackers to obtain sensitive information by sniffing the network.
6962 CVE-2014-5400 200 +Info 2015-04-03 2015-04-03
2.1
None Local Low Not required Partial None None
The installation component in Hospira MedNet before 6.1 places cleartext credentials in configuration files, which allows local users to obtain sensitive information by reading a file.
6963 CVE-2014-5394 200 +Info 2018-01-08 2018-01-29
4.3
None Remote Medium Not required Partial None None
Multiple Huawei Campus switches allow remote attackers to enumerate usernames via vectors involving use of SSH by the maintenance terminal.
6964 CVE-2014-5388 119 Overflow Mem. Corr. +Info 2014-11-15 2014-11-17
4.6
None Local Low Not required Partial Partial Partial
Off-by-one error in the pci_read function in the ACPI PCI hotplug interface (hw/acpi/pcihp.c) in QEMU allows local guest users to obtain sensitive information and have other unspecified impact related to a crafted PCI device that triggers memory corruption.
6965 CVE-2014-5377 200 1 +Info 2014-09-04 2018-10-09
5.0
None Remote Low Not required Partial None None
ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request.
6966 CVE-2014-5369 310 +Info 2014-09-08 2016-12-21
4.3
None Remote Medium Not required Partial None None
Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified, which allows remote attackers to obtain sensitive information by sniffing the network.
6967 CVE-2014-5341 200 +Info 2015-02-04 2015-02-05
4.3
None Remote Medium Not required Partial None None
The SFTP external storage driver (files_external) in ownCloud Server before 6.0.5 validates the RSA Host key after login, which allows remote attackers to obtain sensitive information by sniffing the network.
6968 CVE-2014-5337 264 +Info 2014-08-29 2018-11-19
5.0
None Remote Low Not required Partial None None
The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remote attackers to obtain sensitive information via an exportarticles action to export/content.php.
6969 CVE-2014-5333 352 +Info CSRF 2014-08-19 2017-09-07
4.3
None Remote Medium Not required Partial None None
Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API, in conjunction with a manipulation involving a '$' (dollar sign) or '(' (open parenthesis) character. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671.
6970 CVE-2014-5325 200 +Info 2014-11-23 2016-11-28
5.0
None Remote Low Not required Partial None None
The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allow remote attackers to read arbitrary files via DOM data containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
6971 CVE-2014-5323 310 +Info 2014-09-23 2014-10-04
5.4
None Local Network Medium Not required Partial Partial Partial
The Yuko Yuko (aka jp.co.yukoyuko.android.yukoyuko_android) application 1.0.5 and earlier for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
6972 CVE-2014-5321 310 +Info 2014-09-21 2014-09-22
5.8
None Remote Medium Not required Partial Partial None
FileMaker Pro before 13 and Pro Advanced before 13 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2319.
6973 CVE-2014-5320 200 +Info 2014-09-21 2014-09-22
5.0
None Remote Low Not required Partial None None
The Bump application for Android does not properly handle implicit intents, which allows attackers to obtain sensitive owner-name information via a crafted application.
6974 CVE-2014-5286 264 +Priv +Info 2015-02-18 2015-02-19
6.4
None Remote Low Not required Partial Partial None
The ActiveMatrix Policy Manager Authentication module in TIBCO ActiveMatrix Policy Agent 3.x before 3.1.2, ActiveMatrix Policy Manager 3.x before 3.1.2, ActiveMatrix Management Agent 1.x before 1.2.1 for WCF, and ActiveMatrix Management Agent 1.x before 1.2.1 for WebSphere allows remote attackers to gain privileges and obtain sensitive information via unspecified vectors.
6975 CVE-2014-5285 +Priv +Info 2014-09-04 2014-09-05
7.5
None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the Authentication Module in TIBCO Spotfire Server before 4.5.2, 5.0.x before 5.0.3, 5.5.x before 5.5.2, 6.0.x before 6.0.3, and 6.5.x before 6.5.1 allows remote attackers to gain privileges, and obtain sensitive information or modify data, via unknown vectors.
6976 CVE-2014-5270 200 +Info 2014-10-09 2017-11-03
2.1
None Local Low Not required Partial None None
Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed metal, a different vector than CVE-2013-4576.
6977 CVE-2014-5269 264 Bypass +Info 2014-09-04 2014-09-08
5.0
None Remote Low Not required Partial None None
Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to bypass the whitelist of generated files and obtain sensitive information via a crafted path, related to Plack::Middleware::Static.
6978 CVE-2014-5247 264 +Info 2014-08-29 2018-10-09
2.1
None Local Low Not required Partial None None
The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information by reading the file, related to the upgrade command.
6979 CVE-2014-5241 352 +Info CSRF 2014-08-22 2017-01-06
6.8
None Remote Medium Not required Partial Partial Partial
The JSONP endpoint in includes/api/ApiFormatJson.php in MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 accepts certain long callback values and does not restrict the initial bytes of a JSONP response, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted OBJECT element with SWF content consistent with a restricted character set.
6980 CVE-2014-5239 310 +Info 2014-08-14 2015-12-04
4.0
None Remote High Not required Partial Partial None
The Microsoft Outlook.com application before 7.8.2.12.49.7090 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
6981 CVE-2014-5233 200 +Info 2015-01-14 2015-11-13
1.9
None Local Medium Not required Partial None None
The Siemens SIMATIC WinCC [email protected] app before 1.0.2 for iOS allows physically proximate attackers to discover [email protected] credentials by leveraging an error in the credential-processing mechanism.
6982 CVE-2014-5231 200 +Info 2015-01-14 2015-11-13
2.1
None Local Low Not required Partial None None
The Siemens SIMATIC WinCC [email protected] app before 1.0.2 for iOS allows physically proximate attackers to extract the password from storage via unspecified vectors.
6983 CVE-2014-5215 200 +Info 2014-12-23 2014-12-23
4.0
None Remote Low Single system Partial None None
NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allows remote authenticated administrators to discover service-account passwords via a request to (1) roma/jsp/volsc/monitoring/dev_services.jsp or (2) roma/jsp/debug/debug.jsp.
6984 CVE-2014-5213 200 +Info 2014-12-19 2015-11-13
4.0
None Remote Low Single system Partial None None
nds/files/opt/novell/eDirectory/lib64/ndsimon/public/images in iMonitor in Novell eDirectory before 8.8 SP8 Patch 4 allows remote authenticated users to obtain sensitive information from process memory via a direct request.
6985 CVE-2014-5208 284 +Info 2014-12-22 2014-12-22
7.5
None Remote Low Not required Partial Partial Partial
BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.00 and R5.x through R5.04.00, and Exaopc through R3.72.10, does not require authentication, which allows remote attackers to read arbitrary files via a RETR operation, write to arbitrary files via a STOR operation, or obtain sensitive database-location information via a PMODE operation, a different vulnerability than CVE-2014-0784.
6986 CVE-2014-5179 264 +Info 2014-08-06 2017-09-07
4.3
None Remote Medium Not required Partial None None
The freelinking module for Drupal, as used in the Freelinking for Case Tracker module, does not properly check access permissions for (1) nodes or (2) users, which allows remote attackers to obtain sensitive information via a crafted link.
6987 CVE-2014-5174 264 +Info 2014-07-31 2017-08-28
3.5
None Remote Medium Single system Partial None None
The SAP Netweaver Business Warehouse component does not properly restrict access to the functions in the BW-SYS-DB-DB4 function group, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
6988 CVE-2014-5171 310 +Info 2014-07-31 2018-10-09
2.9
None Local Network Medium Not required Partial None None
SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authentication using SSL, which allows remote attackers to obtain credentials and other sensitive information by sniffing the network.
6989 CVE-2014-5137 200 +Info 2014-09-02 2018-10-09
5.0
None Remote Low Not required Partial None None
Innovative Interfaces Sierra Library Services Platform 1.2_3 provides different responses for login request depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of login requests, possibly related to the Webpac Pro submodule.
6990 CVE-2014-5132 200 +Info 2018-03-27 2018-10-09
4.0
None Remote Low Single system Partial None None
Avolve Software ProjectDox 8.1 allows remote attackers to enumerate users via vectors related to email addresses.
6991 CVE-2014-5131 200 +Info 2018-03-27 2018-10-09
4.0
None Remote Low Single system Partial None None
Avolve Software ProjectDox 8.1 makes it easier for remote authenticated users to obtain sensitive information by leveraging ciphertext reuse.
6992 CVE-2014-5130 200 +Info 2018-03-27 2018-10-09
4.0
None Remote Low Single system Partial None None
Avolve Software ProjectDox 8.1 allows remote authenticated users to obtain sensitive information from other users via vectors involving a direct access token.
6993 CVE-2014-5128 200 +Info 2014-08-29 2018-10-09
5.0
None Remote Low Not required Partial None None
Innovative Interfaces Encore Discovery Solution 4.3 places a session token in the URI, which might allow remote attackers to obtain sensitive information via unspecified vectors.
6994 CVE-2014-5107 200 +Info 2014-07-28 2017-11-20
5.0
None Remote Low Not required Partial None None
concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a direct request to (1) system/basics/editor.php, (2) system/view.php, (3) system/environment/file_storage_locations.php, (4) system/mail/importers.php, (5) system/mail/method.php, (6) system/permissions/file_types.php, (7) system/permissions/files.php, (8) system/permissions/tasks.php, (9) system/permissions/users.php, (10) system/seo/view.php, (11) view.php, (12) users/attributes.php, (13) scrapbook/view.php, (14) pages/attributes.php, (15) files/attributes.php, or (16) files/search.php in single_pages/dashboard/.
6995 CVE-2014-5094 200 +Info 2014-10-20 2017-08-28
5.0
None Remote Low Not required Partial None None
Status2k allows remote attackers to obtain configuration information via a phpinfo action in a request to status/index.php, which calls the phpinfo function.
6996 CVE-2014-5076 200 +Info 2014-09-02 2014-09-02
4.3
None Remote Medium Not required Partial None None
The La Banque Postale application before 3.2.6 for Android does not prevent the launching of an activity by a component of another application, which allows attackers to obtain sensitive cached banking information via crafted intents, as demonstrated by the drozer framework.
6997 CVE-2014-5038 200 +Info 2014-11-07 2014-11-10
2.1
None Local Low Not required Partial None None
Eucalyptus 3.0.0 through 4.0.1, when the log level is set to DEBUG or lower, logs user and system passwords, which allows local users to obtain sensitive information by reading the cloud log files.
6998 CVE-2014-5037 200 +Info 2014-11-07 2014-11-10
2.1
None Local Low Not required Partial None None
Eucalyptus 4.0.0 through 4.0.1, when the log level is set to INFO, logs user and system passwords, which allows local users to obtain sensitive information by reading cloud-requests.log.
6999 CVE-2014-5036 200 +Info 2014-09-05 2014-09-08
1.9
None Local Medium Not required Partial None None
The Storage Controller (SC) component in Eucalyptus 3.4.2 through 4.0.x before 4.0.1, when Dell Equallogic SAN is used, logs the CHAP user credentials, which allows local users to obtain sensitive information by reading the logs.
7000 CVE-2014-5032 264 +Info 2015-04-14 2015-04-15
5.0
None Remote Low Not required Partial None None
GLPI before 0.84.7 does not properly restrict access to cost information, which allows remote attackers to obtain sensitive information via the cost criteria in the search bar.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.