CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 8 and 8.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
301 CVE-2014-2250 310 2014-03-24 2014-03-24
8.3
None Remote Medium Not required Partial Partial Complete
The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors, a different vulnerability than CVE-2014-2251.
302 CVE-2014-2174 284 2015-05-24 2015-05-26
8.3
Admin Local Network Low Not required Complete Complete Complete
Cisco TelePresence T, TelePresence TE, and TelePresence TC before 7.1 do not properly implement access control, which allows remote attackers to obtain root privileges by sending packets on the local network and allows physically proximate attackers to obtain root privileges via unspecified vectors, aka Bug ID CSCub67651.
303 CVE-2014-2127 20 +Priv 2014-04-10 2014-04-10
8.5
None Remote Medium Single system Complete Complete Complete
Cisco Adaptive Security Appliance (ASA) Software 8.x before 8.2(5.48), 8.3 before 8.3(2.40), 8.4 before 8.4(7.9), 8.6 before 8.6(1.13), 9.0 before 9.0(4.1), and 9.1 before 9.1(4.3) does not properly process management-session information during privilege validation for SSL VPN portal connections, which allows remote authenticated users to gain privileges by establishing a Clientless SSL VPN session and entering crafted URLs, aka Bug ID CSCul70099.
304 CVE-2014-2126 264 +Priv 2014-04-10 2014-04-10
8.5
None Remote Medium Single system Complete Complete Complete
Cisco Adaptive Security Appliance (ASA) Software 8.2 before 8.2(5.47), 8.4 before 8.4(7.5), 8.7 before 8.7(1.11), 9.0 before 9.0(3.10), and 9.1 before 9.1(3.4) allows remote authenticated users to gain privileges by leveraging level-0 ASDM access, aka Bug ID CSCuj33496.
305 CVE-2014-2119 264 Exec Code 2014-03-20 2018-10-30
8.5
None Remote Medium Single system Complete Complete Complete
The End User Safelist/Blocklist (aka SLBL) service in Cisco AsyncOS Software for Email Security Appliance (ESA) before 7.6.3-023 and 8.x before 8.0.1-023 and Cisco Content Security Management Appliance (SMA) before 7.9.1-110 and 8.x before 8.1.1-013 allows remote authenticated users to execute arbitrary code with root privileges via an FTP session that uploads a modified SLBL database file, aka Bug IDs CSCug79377 and CSCug80118.
306 CVE-2014-2084 264 2 DoS +Info 2014-05-17 2014-06-13
8.5
None Remote Low Not required Partial None Complete
Skybox View Appliances with ISO 6.3.33-2.14, 6.3.31-2.14, 6.4.42-2.54, 6.4.45-2.56, and 6.4.46-2.57 does not properly restrict access to the Admin interface, which allows remote attackers to obtain sensitive information via a request to (1) scripts/commands/getSystemInformation or (2) scripts/commands/getNetworkConfigurationInfo, cause a denial of service (reboot) via a request to scripts/commands/reboot, or cause a denial of service (shutdown) via a request to scripts/commands/shutdown.
307 CVE-2014-1813 94 Exec Code 2014-05-14 2018-10-12
8.5
None Remote Medium Single system Complete Complete Complete
Microsoft Web Applications 2010 SP1 and SP2 allows remote authenticated users to execute arbitrary code via crafted page content, aka "Web Applications Page Content Vulnerability."
308 CVE-2014-1666 264 DoS +Priv 2014-01-26 2018-01-02
8.3
None Local Network Low Not required Complete Complete Complete
The do_physdev_op function in Xen 4.1.5, 4.1.6.1, 4.2.2 through 4.2.3, and 4.3.x does not properly restrict access to the (1) PHYSDEVOP_prepare_msix and (2) PHYSDEVOP_release_msix operations, which allows local PV guests to cause a denial of service (host or guest malfunction) or possibly gain privileges via unspecified vectors.
309 CVE-2014-0784 119 Exec Code Overflow 2014-03-14 2015-08-05
8.3
None Remote Medium Not required Partial Partial Complete
Stack-based buffer overflow in BKBCopyD.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via a crafted TCP packet.
310 CVE-2014-0782 119 Exec Code Overflow 2014-05-16 2014-05-19
8.3
None Remote Medium Not required Partial Partial Complete
Stack-based buffer overflow in BKESimmgr.exe in the Expanded Test Functions package in Yokogawa CENTUM CS 1000, CENTUM CS 3000 Entry Class R3.09.50 and earlier, CENTUM VP R5.03.00 and earlier, CENTUM VP Entry Class R5.03.00 and earlier, Exaopc R3.71.02 and earlier, B/M9000CS R5.05.01 and earlier, and B/M9000 VP R7.03.01 and earlier allows remote attackers to execute arbitrary code via a crafted packet.
311 CVE-2014-0661 94 DoS Exec Code Mem. Corr. 2014-01-22 2017-08-28
8.3
None Local Network Low Not required Complete Complete Complete
The System Status Collection Daemon (SSCD) in Cisco TelePresence System 500-37, 1000, 1300-65, and 3xxx before 1.10.2(42), and 500-32, 1300-47, TX1310 65, and TX9xxx before 6.0.4(11), allows remote attackers to execute arbitrary commands or cause a denial of service (stack memory corruption) via a crafted XML-RPC message, aka Bug ID CSCui32796.
312 CVE-2014-0629 264 +Priv +Info 2014-03-06 2014-03-07
8.5
None Remote Medium Single system Complete Complete Complete
EMC Documentum TaskSpace (TSP) 6.7SP1 before P25 and 6.7SP2 before P11 does not properly handle the interaction between the dm_world group and the dm_superusers_dynamic group, which allows remote authenticated users to obtain sensitive information and gain privileges in opportunistic circumstances by leveraging an incorrect group-addition implementation.
313 CVE-2013-7179 20 Exec Code 2014-02-04 2015-12-18
8.3
None Local Network Low Not required Complete Complete Complete
The ping functionality in cgi-bin/diagnostic.cgi on Seowon Intech SWC-9100 routers allows remote attackers to execute arbitrary commands via shell metacharacters in the ping_ipaddr parameter.
314 CVE-2013-7043 352 1 CSRF 2013-12-10 2017-08-28
8.3
None Remote Medium Not required Partial Partial Complete
Multiple cross-site request forgery (CSRF) vulnerabilities on Cisco Scientific Atlanta DPR2320R2 routers with software 2.0.2r1262-090417 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password via the Password parameter to goform/RgSecurity; (2) reboot the device via the Restart parameter to goform/restart; (3) modify Wi-Fi settings, as demonstrated by the WpaPreSharedKey parameter to goform/wlanSecurity; or (4) modify parental controls via the ParentalPassword parameter to goform/RgParentalBasic.
315 CVE-2013-6926 264 Bypass 2013-12-16 2013-12-17
8.0
None Remote Low Single system Partial Partial Complete
The integrated HTTPS server in Siemens RuggedCom ROS before 3.12.2 allows remote authenticated users to bypass intended restrictions on administrative actions by leveraging access to a (1) guest or (2) operator account.
316 CVE-2013-6925 2013-12-16 2013-12-17
8.3
None Remote Medium Not required Partial Partial Complete
The integrated HTTPS server in Siemens RuggedCom ROS before 3.12.2 allows remote attackers to hijack web sessions by predicting a session id value.
317 CVE-2013-6859 287 +Priv 2013-11-23 2013-11-25
8.5
None Remote Medium Single system Complete Complete Complete
SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3. 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 does not properly perform authorization, which allows remote authenticated users to gain privileges via unspecified vectors.
318 CVE-2013-6744 264 +Priv 2014-05-30 2017-08-28
8.5
User Remote Medium Single system Complete Complete Complete
The Stored Procedure infrastructure in IBM DB2 9.5, 9.7 before FP9a, 10.1 before FP3a, and 10.5 before FP3a on Windows allows remote authenticated users to gain privileges by leveraging the CONNECT privilege and the CREATE_EXTERNAL_ROUTINE authority.
319 CVE-2013-6349 94 Exec Code 2013-11-02 2013-11-04
8.5
None Remote Medium Single system Complete Complete Complete
McAfee Email Gateway (MEG) 7.0 before 7.0.4 and 7.5 before 7.5.1 allows remote authenticated users to execute arbitrary commands via unspecified vectors.
320 CVE-2013-6332 Exec Code 2014-02-06 2017-08-28
8.5
None Remote Medium Single system Complete Complete Complete
Unrestricted file upload vulnerability in IBM Algo One UDS 4.7.0 through 5.0.0 allows remote authenticated users to execute arbitrary code by uploading a .jsp file and then launching it.
321 CVE-2013-6271 264 Bypass 2013-12-14 2013-12-18
8.8
None Remote Medium Not required Complete Complete None
Android 4.0 through 4.3 allows attackers to bypass intended access restrictions and remove device locks via a crafted application that invokes the updateUnlockMethodAndFinish method in the com.android.settings.ChooseLockGeneric class with the PASSWORD_QUALITY_UNSPECIFIED option.
322 CVE-2013-6226 22 Dir. Trav. 2013-11-14 2017-08-28
8.5
None Remote Low Not required Complete None Partial
Directory traversal vulnerability in plugins/editor.zoho/agent/save_zoho.php in the Zoho plugin in Pydio (formerly AjaXplorer) before 5.0.4 allows remote attackers to read or delete arbitrary files via unspecified vectors.
323 CVE-2013-6215 Exec Code 2014-04-19 2014-04-21
8.5
None Remote Medium Single system Complete Complete Complete
Unspecified vulnerability in the Integration Service in HP Universal Configuration Management Database 10.01 and 10.10 allows remote authenticated users to execute arbitrary code via unknown vectors, aka ZDI-CAN-1977.
324 CVE-2013-6027 119 Exec Code Overflow 2013-10-19 2013-10-21
8.5
None Remote Medium Single system Complete Complete Complete
Stack-based buffer overflow in the RuntimeDiagnosticPing function in /bin/webs on D-Link DIR-100 routers might allow remote authenticated administrators to execute arbitrary commands via a long set/runtime/diagnostic/pingIp parameter to Tools/tools_misc.xgi.
325 CVE-2013-6012 287 Bypass 2013-10-28 2013-10-29
8.5
None Remote Medium Single system Complete Complete Complete
Juniper Junos 12.1X44 before 12.1.X44-D20 and 12.1X45 before 12.1X45-D15, when the no-validate option is enabled, does not properly handle configuration validation errors during the config commit phase of the boot-up sequence, which allows remote attackers to bypass authentication via unspecified vectors.
326 CVE-2013-5948 78 Exec Code 2014-04-22 2015-09-17
8.5
None Remote Medium Single system Complete Complete Complete
The Network Analysis tab (Main_Analysis_Content.asp) in the ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the Target field (destIP parameter).
327 CVE-2013-5709 189 2013-09-17 2013-09-17
8.3
None Remote Medium Not required Partial Partial Complete
The authentication implementation in the web server on Siemens SCALANCE X-200 switches with firmware before 5.0.0 does not use a sufficient source of entropy for generating values of random numbers, which makes it easier for remote attackers to hijack sessions by predicting a value.
328 CVE-2013-5692 22 1 Dir. Trav. 2013-09-30 2013-10-01
8.5
None Remote Medium Single system Complete Complete Complete
Directory traversal vulnerability in X2Engine X2CRM before 3.5 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the file parameter to index.php/admin/translationManager.
329 CVE-2013-5598 264 Exec Code 2013-10-30 2017-09-18
8.3
None Remote Medium Not required Complete Partial Partial
PDF.js in Mozilla Firefox before 25.0 and Firefox ESR 24.x before 24.1 does not properly handle the appending of an IFRAME element, which allows remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges by using this element within an embedded PDF object.
330 CVE-2013-5542 399 DoS 2013-10-21 2013-10-21
8.5
None Remote Low Not required None Partial Complete
Cisco Adaptive Security Appliance (ASA) Software 8.4 before 8.4(7.2), 8.7 before 8.7(1.8), 9.0 before 9.0(3.6), and 9.1 before 9.1(2.8) allows remote attackers to cause a denial of service (firewall-session disruption or device reload) via crafted ICMP packets, aka Bug ID CSCui77398.
331 CVE-2013-5385 20 DoS +Info 2014-01-02 2014-01-27
8.5
None Remote Low Not required Partial None Complete
The OSPF implementation in IBM i 6.1 and 7.1, in z/OS on zSeries servers, and in Networking Operating System (aka NOS, formerly BLADE Operating System) does not properly validate Link State Advertisement (LSA) type 1 packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet, a related issue to CVE-2013-0149.
332 CVE-2013-5133 264 2014-03-14 2014-03-14
8.8
None Remote Medium Not required None Complete Complete
Backup in Apple iOS before 7.1 does not properly restrict symlinks, which allows remote attackers to overwrite files during a restore operation via crafted backup data.
333 CVE-2013-4987 264 +Priv 2013-11-07 2013-11-08
8.5
None Remote Medium Single system Complete Complete Complete
PineApp Mail-SeCure before 3.70 allows remote authenticated users to gain privileges by leveraging console access and providing shell metacharacters in a "system ping" command.
334 CVE-2013-4860 264 2014-06-05 2017-08-28
8.3
None Local Network Low Not required Complete Complete Complete
Radio Thermostat CT80 And CT50 with firmware 1.4.64 and earlier does not restrict access to the API, which allows remote attackers to change the operation mode, wifi connection settings, temperature thresholds, and other settings via unspecified vectors.
335 CVE-2013-4629 255 2013-06-20 2013-06-21
8.5
None Remote Medium Single system Complete Complete Complete
The Huawei viewpoint VP9610 and VP9620 units for the Huawei Video Conference system do not update the Session ID upon successful establishment of a login session, which allows remote authenticated users to hijack sessions via an unspecified interception method.
336 CVE-2013-4408 119 Exec Code Overflow 2013-12-10 2017-01-06
8.3
None Local Network Low Not required Complete Complete Complete
Heap-based buffer overflow in the dcerpc_read_ncacn_packet_done function in librpc/rpc/dcerpc_util.c in winbindd in Samba 3.x before 3.6.22, 4.0.x before 4.0.13, and 4.1.x before 4.1.3 allows remote AD domain controllers to execute arbitrary code via an invalid fragment length in a DCE-RPC packet.
337 CVE-2013-4401 264 +Priv 2013-11-02 2015-01-02
8.5
None Remote Medium Single system Complete Complete Complete
The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:write permission, which allows attackers to gain domain:write privileges and execute Qemu binaries via crafted XML. NOTE: some of these details are obtained from third party information.
338 CVE-2013-4172 94 Exec Code 2013-08-23 2013-08-27
8.5
None Remote Medium Single system Complete Complete Complete
The Red Hat CloudForms Management Engine 5.1 allow remote administrators to execute arbitrary Ruby code via unspecified vectors.
339 CVE-2013-4049 Exec Code 2013-09-16 2017-08-28
8.5
None Remote Medium Single system Complete Complete Complete
Unrestricted file upload vulnerability in IBM SPSS Analytical Decision Management 6.1 before IF1, 6.2 before IF1, and 7.0 before FP1 IF6 allows remote authenticated users to execute arbitrary code by uploading and accessing a JSP file.
340 CVE-2013-3633 264 Exec Code 2013-05-24 2013-05-28
8.0
None Remote Low Single system Partial Partial Complete
The web interface on Siemens Scalance X200 IRT switches with firmware before X-200IRT 5.1.0 relies on client-side privilege checks, which allows remote authenticated users to execute arbitrary commands via unspecified vectors.
341 CVE-2013-3600 20 +Priv 2013-09-06 2013-09-06
8.5
None Remote Medium Single system Complete Complete Complete
Coursemill Learning Management System (LMS) 6.6 allows remote authenticated users to gain privileges via a modified userid value to unspecified functions.
342 CVE-2013-3543 264 2013-10-04 2013-10-07
8.8
None Remote Medium Not required None Complete Complete
The AXIS Media Control (AMC) ActiveX control (AxisMediaControlEmb.dll) 6.2.10.11 for AXIS network cameras allows remote attackers to create or overwrite arbitrary files via a file path to the (1) StartRecord, (2) SaveCurrentImage, or (3) StartRecordMedia methods.
343 CVE-2013-3462 119 Exec Code Overflow 2013-08-24 2016-11-07
8.5
None Remote Medium Single system Complete Complete Complete
Buffer overflow in Cisco Unified Communications Manager (Unified CM) 7.1(x) before 7.1(5b)su6, 8.5(x) before 8.5(1)su6, 8.6(x) before 8.6(2a)su3, and 9.x before 9.1(2) allows remote authenticated users to execute arbitrary code via unspecified vectors, aka Bug ID CSCud54358.
344 CVE-2013-3379 264 2013-06-21 2013-06-21
8.3
None Local Network Low Not required Complete Complete Complete
The firewall subsystem in Cisco TelePresence TC Software before 4.2 does not properly implement rules that grant access to hosts, which allows remote attackers to obtain shell access with root privileges by leveraging connectivity to the management network, aka Bug ID CSCts37781.
345 CVE-2013-3365 78 Exec Code 2014-02-04 2014-02-05
8.5
None Remote Medium Single system Complete Complete Complete
TRENDnet TEW-812DRU router allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) wan network prefix to internet/ipv6.asp; (2) remote port to adm/management.asp; (3) pptp username, (4) pptp password, (5) ip, (6) gateway, (7) l2tp username, or (8) l2tp password to internet/wan.asp; (9) NtpDstStart, (10) NtpDstEnd, or (11) NtpDstOffset to adm/time.asp; or (12) device url to adm/management.asp. NOTE: vectors 9, 10, and 11 can be exploited by unauthenticated remote attackers by leveraging CVE-2013-3098.
346 CVE-2013-3092 287 +Priv Bypass 2014-09-29 2014-09-30
8.3
None Local Network Low Not required Complete Complete Complete
The Belkin N300 (F7D7301v1) router allows remote attackers to bypass authentication and gain privileges via vectors related to incorrect validation of the HTTP Authorization header.
347 CVE-2013-3005 264 Bypass 2013-07-06 2017-09-18
8.5
None Remote Medium Single system Complete Complete Complete
The TFTP client in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, when RBAC is enabled, allows remote authenticated users to bypass intended file-ownership restrictions, and read or overwrite arbitrary files, via unspecified vectors.
348 CVE-2013-1900 189 2013-04-04 2017-10-19
8.5
None Remote Medium Single system Complete Complete Complete
PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, and 8.4.x before 8.4.17, when using OpenSSL, generates insufficiently random numbers, which might allow remote authenticated users to have an unspecified impact via vectors related to the "contrib/pgcrypto functions."
349 CVE-2013-1668 78 1 Exec Code 2014-05-23 2014-06-27
8.5
None Remote Medium Single system Complete Complete Complete
The uploadFile function in upload/index.php in CosCMS before 1.822 allows remote administrators to execute arbitrary commands via shell metacharacters in the name of an uploaded file.
350 CVE-2013-1616 78 Exec Code 2013-08-01 2014-01-17
8.3
None Local Network Low Not required Complete Complete Complete
The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allows remote attackers to execute arbitrary commands by injecting a command into an application script.
Total number of vulnerabilities : 534   Page : 1 2 3 4 5 6 7 (This Page)8 9 10 11
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.