Search
Total
166 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2015-4637 | 1 F5 | 4 Big-iq Adc, Big-iq Cloud, Big-iq Device and 1 more | 2015-07-21 | 4.3 MEDIUM | N/A |
| The REST API in F5 BIG-IQ Cloud, Device, and Security 4.4.0 and 4.5.0 before HF2 and ADC 4.5.0 before HF2, when configured for LDAP remote authentication and the LDAP server allows anonymous BIND operations, allows remote attackers to obtain an authentication token for arbitrary users by guessing an LDAP user account name. | |||||
| CVE-2014-9090 | 1 Linux | 1 Linux Kernel | 2015-06-04 | 4.9 MEDIUM | N/A |
| The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel through 3.17.4 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to cause a denial of service (panic) via a modify_ldt system call, as demonstrated by sigreturn_32 in the linux-clock-tests test suite. | |||||
| CVE-2014-6092 | 1 Ibm | 1 Curam Social Program Management | 2015-04-27 | 5.0 MEDIUM | N/A |
| IBM Curam Social Program Management (SPM) 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.6 requires failed-login handling for web-service accounts to have the same lockout policy as for standard user accounts, which makes it easier for remote attackers to cause a denial of service (web-service outage) by making many login attempts with a valid caseworker account name. | |||||
| CVE-2013-2184 | 1 Sixapart | 1 Movable Type | 2015-03-27 | 7.5 HIGH | N/A |
| Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the comment_state parameter. | |||||
| CVE-2014-8172 | 1 Linux | 1 Linux Kernel | 2015-03-24 | 4.9 MEDIUM | N/A |
| The filesystem implementation in the Linux kernel before 3.13 performs certain operations on lists of files with an inappropriate locking approach, which allows local users to cause a denial of service (soft lockup or system crash) via unspecified use of Asynchronous I/O (AIO) operations. | |||||
| CVE-2014-9426 | 1 Php | 1 Php | 2015-03-17 | 7.5 HIGH | N/A |
| ** DISPUTED ** The apprentice_load function in libmagic/apprentice.c in the Fileinfo component in PHP through 5.6.4 attempts to perform a free operation on a stack-based character array, which allows remote attackers to cause a denial of service (memory corruption or application crash) or possibly have unspecified other impact via unknown vectors. NOTE: this is disputed by the vendor because the standard erealloc behavior makes the free operation unreachable. | |||||
| CVE-2015-1361 | 1 Google | 1 Chrome | 2015-02-21 | 6.8 MEDIUM | N/A |
| platform/image-decoders/ImageFrame.h in Blink, as used in Google Chrome before 40.0.2214.91, does not initialize a variable that is used in calls to the Skia SkBitmap::setAlphaType function, which might allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted HTML document, a different vulnerability than CVE-2015-1205. | |||||
| CVE-2015-1452 | 1 Fortinet | 1 Fortios | 2015-02-19 | 7.8 HIGH | N/A |
| The Control and Provisioning of Wireless Access Points (CAPWAP) daemon in Fortinet FortiOS 5.0 Patch 7 build 4457 allows remote attackers to cause a denial of service (locked CAPWAP Access Controller) via a large number of ClientHello DTLS messages. | |||||
| CVE-2014-4467 | 1 Apple | 1 Iphone Os | 2015-02-02 | 4.3 MEDIUM | N/A |
| WebKit, as used in Apple iOS before 8.1.3, does not properly determine scrollbar boundaries during the rendering of FRAME elements, which allows remote attackers to spoof the UI via a crafted web site. | |||||
| CVE-2014-6386 | 1 Juniper | 1 Junos | 2015-01-26 | 7.8 HIGH | N/A |
| Juniper Junos 11.4 before 11.4R8, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, 12.1X47 before 12.1X47-D10, 12.2 before 12.2R9, 12.3R2 before 12.3R2-S3, 12.3 before 12.3R3, 13.1 before 13.1R4, and 13.2 before 13.2R1 allows remote attackers to cause a denial of service (assertion failure and rpd restart) via a crafted BGP FlowSpec prefix. | |||||
| CVE-2014-6383 | 1 Juniper | 1 Junos | 2015-01-26 | 5.0 MEDIUM | N/A |
| The stateless firewall in Juniper Junos 13.3R3, 14.1R1, and 14.1R2, when using Trio-based PFE modules, does not properly match ports, which might allow remote attackers to bypass firewall rule. | |||||
| CVE-2014-7843 | 1 Linux | 1 Linux Kernel | 2015-01-22 | 4.9 MEDIUM | N/A |
| The __clear_user function in arch/arm64/lib/clear_user.S in the Linux kernel before 3.17.4 on the ARM64 platform allows local users to cause a denial of service (system crash) by reading one byte beyond a /dev/zero page boundary. | |||||
| CVE-2010-2055 | 1 Artifex | 3 Afpl Ghostscript, Ghostscript Fonts, Gpl Ghostscript | 2015-01-09 | 7.2 HIGH | N/A |
| Ghostscript 8.71 and earlier reads initialization files from the current working directory, which allows local users to execute arbitrary PostScript commands via a Trojan horse file, related to improper support for the -P- option to the gs program, as demonstrated using gs_init.ps, a different vulnerability than CVE-2010-4820. | |||||
| CVE-2013-6494 | 2 Fedoraproject, Fedup Project | 2 Fedora, Fedup | 2014-12-02 | 2.1 LOW | N/A |
| fedup 0.9.0 in Fedora 19, 20, and 21 uses a temporary directory with a static name for its download cache, which allows local users to cause a denial of service (prevention of system updates). | |||||
| CVE-2014-5426 | 1 Matrikonopc | 1 Dnp3 Opc Server | 2014-11-28 | 5.0 MEDIUM | N/A |
| MatrikonOPC OPC Server for DNP3 1.2.3 and earlier allows remote attackers to cause a denial of service (unhandled exception and DNP3 process crash) via a crafted message. | |||||
| CVE-2014-3500 | 1 Apache | 1 Cordova | 2014-11-17 | 6.4 MEDIUM | N/A |
| Apache Cordova Android before 3.5.1 allows remote attackers to change the start page via a crafted intent URL. | |||||