Filtered by vendor Subscriptions
Total 323399 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2014-0883 1 Ibm 1 Power Hardware Management Console 2024-11-21 N/A
IBM Power HMC 7.1.0 through 7.8.0 and 7.3.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  91163.
CVE-2014-0882 1 Ibm 16 Flex System Manager 7955, Flex System Manager 8731, Flex System X220 and 13 more 2024-11-21 N/A
Integrated Management Module II (IMM2) on IBM Flex System, NeXtScale, System x3xxx, and System x iDataPlex systems might allow remote authenticated users to obtain sensitive account information via vectors related to generated Service Advisor data (FFDC). IBM X-Force ID: 91149.
CVE-2014-0881 1 Ibm 2 Flex System X222, Integrated Management Module Firmware 2024-11-21 N/A
The TPM on Integrated Management Module II (IMM2) on IBM Flex System x222 servers with firmware 1.00 through 3.56 allows remote attackers to obtain sensitive key information or cause a denial of service by leveraging an incorrect configuration. IBM X-Force ID: 91146.
CVE-2014-0872 1 Ibm 1 Security Key Lifecycle Manager 2024-11-21 N/A
The installation process in IBM Security Key Lifecycle Manager 2.5 stores unencrypted credentials, which might allow local users to obtain sensitive information by leveraging root access. IBM X-Force ID: 90988.
CVE-2014-0841 1 Ibm 1 Rational Focal Point 2024-11-21 N/A
IBM Rational Focal Point 6.4.0, 6.4.1, 6.5.1, 6.5.2, and 6.6.0 use a weak algorithm to hash passwords, which makes it easier for context-dependent attackers to obtain cleartext values via a brute-force attack. IBM X-Force ID: 90704.
CVE-2014-0594 1 Opensuse 1 Open Build Service 2024-11-21 N/A
In the Open Build Service (OBS) before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent.
CVE-2014-0593 1 Opensuse 1 Open Build Service 2024-11-21 N/A
The set_version script as shipped with obs-service-set_version is a source validator for the Open Build Service (OBS). In versions prior to 0.5.3-1.1 this script did not properly sanitize the input provided by the user, allowing for code execution on the executing server.
CVE-2014-0486 1 Nic 1 Knot Cms 2024-11-21 N/A
Knot DNS before 1.5.2 allows remote attackers to cause a denial of service (application crash) via a crafted DNS message.
CVE-2014-0245 1 Redhat 2 Jboss Enterprise Portal Platform, Jboss Portal 2024-11-21 5.9 Medium
It was found that the implementation of the GTNSubjectCreatingInterceptor class in gatein-wsrp was not thread safe. For a specific WSRP endpoint, under high-concurrency scenarios or scenarios where SOAP messages take long to execute, it was possible for an unauthenticated remote attacker to gain privileged information if WS-Security is enabled for the WSRP Consumer, and the endpoint in question is being used by a privileged user. This affects JBoss Portal 6.2.0.
CVE-2014-0243 1 Check Mk Project 1 Check Mk 2024-11-21 N/A
Check_MK through 1.2.5i2p1 allows local users to read arbitrary files via a symlink attack to a file in /var/lib/check_mk_agent/job.
CVE-2014-0242 2 Modwsgi, Redhat 2 Mod Wsgi, Enterprise Linux 2024-11-21 7.5 High
mod_wsgi module before 3.4 for Apache, when used in embedded mode, might allow remote attackers to obtain sensitive information via the Content-Type header which is generated from memory that may have been freed and then overwritten by a separate thread.
CVE-2014-0241 2 Redhat, Theforeman 2 Satellite, Hammer Cli 2024-11-21 5.5 Medium
rubygem-hammer_cli_foreman: File /etc/hammer/cli.modules.d/foreman.yml world readable
CVE-2014-0234 1 Redhat 1 Openshift 2024-11-21 9.8 Critical
The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this may overlap CVE-2013-4253 and CVE-2013-4281.
CVE-2014-0212 1 Apache 1 Qpid-cpp 2024-11-21 7.5 High
qpid-cpp: ACL policies only loaded if the acl-file option specified enabling DoS by consuming all available file descriptors
CVE-2014-0197 1 Redhat 3 Cloudforms, Cloudforms Management Engine, Cloudforms Managementengine 2024-11-21 8.8 High
CFME: CSRF protection vulnerability via permissive check of the referrer header
CVE-2014-0183 1 Redhat 1 Subscription Asset Manager 2024-11-21 6.1 Medium
Versions of Katello as shipped with Red Hat Subscription Asset Manager 1.4 are vulnerable to a XSS via HTML in the systems name when registering.
CVE-2014-0175 3 Debian, Puppet, Redhat 3 Debian Linux, Marionette Collective, Openshift 2024-11-21 9.8 Critical
mcollective has a default password set at install
CVE-2014-0169 1 Redhat 1 Jboss Enterprise Application Platform 2024-11-21 6.5 Medium
In JBoss EAP 6 a security domain is configured to use a cache that is shared between all applications that are in the security domain. This could allow an authenticated user in one application to access protected resources in another application without proper authorization. Although this is an intended functionality, it was not clearly documented which can mislead users into thinking that a security domain cache is isolated to a single application.
CVE-2014-0163 1 Redhat 1 Openshift 2024-11-21 8.8 High
Openshift has shell command injection flaws due to unsanitized data being passed into shell commands.
CVE-2014-0161 1 Ovirt-engine-sdk-python Project 1 Ovirt-engine-sdk-python 2024-11-21 5.9 Medium
ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an arbitrary valid certificate.