Total
3455 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2014-2927 | 1 F5 | 19 Arx, Big-ip Access Policy Manager, Big-ip Advanced Firewall Manager and 16 more | 2015-01-26 | 9.3 HIGH | N/A |
| The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 before HF7, 11.3.0 before HF9, and 11.2.1 before HF11 and Enterprise Manager 3.x before 3.1.1 HF2, when configured in failover mode, does not require authentication, which allows remote attackers to read or write to arbitrary files via a cmi request to the ConfigSync IP address. | |||||
| CVE-2013-4793 | 1 Umbraco | 1 Umbraco Cms | 2014-12-30 | 7.5 HIGH | N/A |
| The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does not require authentication, which allows remote attackers to execute arbitrary ASP.NET code via a crafted SOAP request. | |||||
| CVE-2014-8006 | 1 Cisco | 1 Isb8320-e High-definition Ip-only Dvr | 2014-12-17 | 4.3 MEDIUM | N/A |
| The Disaster Recovery (DRA) feature on the Cisco ISB8320-E High-Definition IP-Only DVR allows remote attackers to bypass authentication by establishing a TELNET session during a recovery boot, aka Bug ID CSCup85422. | |||||
| CVE-2014-9184 | 1 Zte | 1 Zxdsl | 2014-12-03 | 5.0 MEDIUM | N/A |
| ZTE ZXDSL 831CII allows remote attackers to bypass authentication via a direct request to (1) main.cgi, (2) adminpasswd.cgi, (3) userpasswd.cgi, (4) upload.cgi, (5) conprocess.cgi, or (6) connect.cgi. | |||||
| CVE-2014-8424 | 1 Arris | 1 Vap2500 Firmware | 2014-11-28 | 7.8 HIGH | N/A |
| ARRIS VAP2500 before FW08.41 does not properly validate passwords, which allows remote attackers to bypass authentication. | |||||
| CVE-2014-2373 | 1 Accuenergy | 2 Acuvim Ii, Axm-net | 2014-11-05 | 7.5 HIGH | N/A |
| The web server on the AXN-NET Ethernet module accessory 3.04 for the Accuenergy Acuvim II allows remote attackers to bypass authentication and modify settings via a direct request to an unspecified URL. | |||||
| CVE-2013-4594 | 1 Payment For Webform Project | 1 Payment For Webform | 2014-10-31 | 4.3 MEDIUM | N/A |
| The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous users to use the payment of other anonymous users when submitting a form that requires payment. | |||||
| CVE-2014-8522 | 1 Mcafee | 1 Network Data Loss Prevention | 2014-10-30 | 7.5 HIGH | N/A |
| The MySQL database in McAfee Network Data Loss Prevention (NDLP) before 9.3 does not require a password, which makes it easier for remote attackers to obtain access. | |||||
| CVE-2014-8329 | 1 Schrack | 2 Technik Microcontrol, Technik Microcontrol Firmware | 2014-10-23 | 10.0 HIGH | N/A |
| Schrack Technik microControl with firmware before 1.7.0 (937) stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain access data for the ftp and telnet services via a direct request for ZTPUsrDtls.txt. | |||||
| CVE-2014-3402 | 1 Cisco | 1 Intrusion Prevention System | 2014-10-15 | 5.0 MEDIUM | N/A |
| The authentication-manager process in the web framework in Cisco Intrusion Prevention System (IPS) 7.0(8)E4 and earlier in Cisco Intrusion Detection System (IDS) does not properly manage user tokens, which allows remote attackers to cause a denial of service (temporary MainApp hang) via a crafted connection request to the management interface, aka Bug ID CSCuq39550. | |||||
| CVE-2014-6632 | 1 Joomla | 1 Joomla\! | 2014-10-09 | 7.5 HIGH | N/A |
| Joomla! 2.5.x before 2.5.25, 3.x before 3.2.4, and 3.3.x before 3.3.4 allows remote attackers to authenticate and bypass intended access restrictions via vectors involving LDAP authentication. | |||||
| CVE-2014-0074 | 1 Apache | 1 Shiro | 2014-10-07 | 7.5 HIGH | N/A |
| Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password. | |||||
| CVE-2013-3092 | 1 Belkin | 2 N300, N300 Firmware | 2014-10-01 | 8.3 HIGH | N/A |
| The Belkin N300 (F7D7301v1) router allows remote attackers to bypass authentication and gain privileges via vectors related to incorrect validation of the HTTP Authorization header. | |||||
| CVE-2014-4325 | 1 Little Kernel Project | 1 Little Kernel Bootloader | 2014-08-28 | 7.2 HIGH | N/A |
| The cmd_boot function in app/aboot/aboot.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to bypass intended device-lock and kernel-signature restrictions by using fastboot mode in a boot command for an arbitrary kernel image. | |||||
| CVE-2014-3895 | 1 Iodata | 12 Ts-ptcam\/poe Camera, Ts-ptcam\/poe Camera Firmware, Ts-ptcam Camera and 9 more | 2014-07-30 | 6.4 MEDIUM | N/A |
| The I-O DATA TS-WLCAM camera with firmware 1.06 and earlier, TS-WLCAM/V camera with firmware 1.06 and earlier, TS-WPTCAM camera with firmware 1.08 and earlier, TS-PTCAM camera with firmware 1.08 and earlier, TS-PTCAM/POE camera with firmware 1.08 and earlier, and TS-WLC2 camera with firmware 1.02 and earlier allow remote attackers to bypass authentication, and consequently obtain sensitive credential and configuration data, via unspecified vectors. | |||||
| CVE-2014-4725 | 1 Mailpoet | 1 Mailpoet Newsletters | 2014-07-28 | 7.5 HIGH | N/A |
| The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/. | |||||
| CVE-2014-2938 | 1 Hanon | 5 Faceid, Faceid F710 Firmware, Faceid F810 Firmware and 2 more | 2014-07-16 | 8.3 HIGH | N/A |
| Hanvon FaceID before 1.007.110 does not require authentication, which allows remote attackers to modify access-control and attendance-tracking data via API commands. | |||||
| CVE-2014-2955 | 1 Raritan | 2 Dpxr20a-16, Px | 2014-07-15 | 10.0 HIGH | N/A |
| Raritan PX before 1.5.11 on DPXR20A-16 devices allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password. | |||||
| CVE-2013-6117 | 1 Dahuasecurity | 1 Dvr Firmware | 2014-07-14 | 7.5 HIGH | N/A |
| Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777. | |||||
| CVE-2014-4168 | 1 Kryo | 1 Iodine | 2014-07-07 | 5.0 MEDIUM | N/A |
| (1) iodined.c and (2) user.c in iodine before 0.7.0 allows remote attackers to bypass authentication by continuing execution after an error has been triggering. | |||||