PatchTheCVE: vdgsecurityhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2014-9579: VDG Security SENSE (formerly DIVA) 2.3.13 stores administrator credentials in cleartext, which allows attackerhttps://patchthecve.com/cve/CVE-2014-9579.htmlhttps://patchthecve.com/cve/CVE-2014-9579.htmlWed, 17 Jun 2026 00:18:35 +0000MEDIUM 5.0: VDG Security SENSE (formerly DIVA) 2.3.13 stores administrator credentials in cleartext, which allows attackers to obtain sensitive information by reading the plugin configuration files.CVE-2014-9578: VDG Security SENSE (formerly DIVA) 2.3.13 performs authentication with a password hash instead of a password, https://patchthecve.com/cve/CVE-2014-9578.htmlhttps://patchthecve.com/cve/CVE-2014-9578.htmlWed, 17 Jun 2026 00:18:35 +0000MEDIUM 5.0: VDG Security SENSE (formerly DIVA) 2.3.13 performs authentication with a password hash instead of a password, which allows remote attackers to gain login access by leveraging knowledge of a password hash.CVE-2014-9577: VDG Security SENSE (formerly DIVA) 2.3.13 sends the user database when a user logs in, which allows remote authttps://patchthecve.com/cve/CVE-2014-9577.htmlhttps://patchthecve.com/cve/CVE-2014-9577.htmlWed, 17 Jun 2026 00:18:35 +0000MEDIUM 4.0: VDG Security SENSE (formerly DIVA) 2.3.13 sends the user database when a user logs in, which allows remote authenticated users to obtain usernames and password hashes by logging in to TCP port 51410 and reading the response.CVE-2014-9576: VDG Security SENSE (formerly DIVA) 2.3.13 has a hardcoded password of (1) ArpaRomaWi for the root Postgres acchttps://patchthecve.com/cve/CVE-2014-9576.htmlhttps://patchthecve.com/cve/CVE-2014-9576.htmlWed, 17 Jun 2026 00:18:35 +0000MEDIUM 5.0: VDG Security SENSE (formerly DIVA) 2.3.13 has a hardcoded password of (1) ArpaRomaWi for the root Postgres account and !DVService for the (2) postgres and (3) NTP Windows user accounts, which allows remote attackers to obtain access.CVE-2014-9575: VDG Security SENSE (formerly DIVA) before 2.3.15 allows remote attackers to bypass authentication, and consequhttps://patchthecve.com/cve/CVE-2014-9575.htmlhttps://patchthecve.com/cve/CVE-2014-9575.htmlWed, 17 Jun 2026 00:18:34 +0000MEDIUM 6.4: VDG Security SENSE (formerly DIVA) before 2.3.15 allows remote attackers to bypass authentication, and consequently read and modify arbitrary plugin settings, via an encoded : (colon) character in the Authorization HTTP header.CVE-2014-9452: Directory traversal vulnerability in VDG Security SENSE (formerly DIVA) 2.3.13 allows remote attackers to readhttps://patchthecve.com/cve/CVE-2014-9452.htmlhttps://patchthecve.com/cve/CVE-2014-9452.htmlWed, 17 Jun 2026 00:18:24 +0000MEDIUM 5.0: Directory traversal vulnerability in VDG Security SENSE (formerly DIVA) 2.3.13 allows remote attackers to read arbitrary files via a .. (dot dot) in the default URI to images/.CVE-2014-9451: Multiple stack-based buffer overflows in the DIVA web service API (/webservice) in VDG Security SENSE (formerlhttps://patchthecve.com/cve/CVE-2014-9451.htmlhttps://patchthecve.com/cve/CVE-2014-9451.htmlWed, 17 Jun 2026 00:18:23 +0000HIGH 7.5: Multiple stack-based buffer overflows in the DIVA web service API (/webservice) in VDG Security SENSE (formerly DIVA) 2.3.13 allow remote attackers to execute arbitrary code via the (1) user or (2) password parameter in an AuthenticateUser request.