VYPR

CVEs

1,630 total · page 31 of 33

AllCriticalHighKEV
  • CVE-2014-3153HigKEVJun 7, 2014
    Linux
    Kernel
    risk 0.62cvss 7.8epss 0.37

    The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.

  • CVE-2014-1812HigKEVMay 14, 2014
    Microsoft
    Windows
    risk 0.83cvss 8.8epss 0.64

    The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly handle distribution of passwords, which allows remote authenticated users to obtain…

  • CVE-2014-0196MedKEVMay 7, 2014
    Linux
    Kernel
    risk 0.46cvss 5.5epss 0.22

    The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering…

  • CVE-2014-0130HigKEVMay 7, 2014
    Rubyonrails
    Rails
    risk 0.65cvss 7.5epss 0.54

    Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to…

  • CVE-2014-1776CriKEVApr 27, 2014
    Microsoft
    Internet Explorer
    risk 0.83cvss 9.8epss 0.88

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in the wild in April…

  • CVE-2014-0780CriKEVApr 25, 2014
    Indusoft
    Web Studio
    risk 0.85cvss 9.8epss 0.75

    Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.

  • CVE-2014-0160HigKEVApr 7, 2014
    OpenSSL Project
    OpenSSL
    risk 0.72cvss 7.5epss 1.00

    The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by…

  • CVE-2014-1761HigKEVMar 25, 2014
    Microsoft
    Word
    risk 0.72cvss 7.8epss 0.78

    Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013…

  • CVE-2014-2120MedKEVMar 19, 2014
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.53cvss 6.1epss 0.14

    Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025.

  • CVE-2013-7331MedKEVFeb 26, 2014
    Microsoft
    Windows
    risk 0.62cvss 6.5epss 0.58

    The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, as demonstrated by a res:// URL, and…

  • CVE-2014-0502HigKEVFeb 21, 2014
    Adobe Inc.
    Air
    risk 0.71cvss 8.8epss 0.24

    Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before…

  • CVE-2014-0322HigKEVFeb 14, 2014
    Microsoft
    Internet Explorer
    risk 0.79cvss 8.8epss 0.85

    Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February…

  • CVE-2014-0497CriKEVFeb 5, 2014
    Google
    Chrome
    risk 0.87cvss 9.8epss 1.00

    Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2014-0496HigKEVJan 15, 2014
    Adobe Inc.
    Acrobat
    risk 0.72cvss 8.8epss 0.40

    Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors.

  • CVE-2013-3900MedKEVDec 11, 2013
    Microsoft
    Windows Server 2003
    risk 0.51cvss 5.5epss 0.45

    Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Windows 10 and Windows…

  • CVE-2013-5065HigKEVNov 28, 2013
    Microsoft
    Windows Xp
    risk 0.68cvss 7.8epss 0.35

    NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.

  • CVE-2013-6282HigKEVNov 20, 2013
    Linux
    Kernel
    risk 0.68cvss 8.8epss 0.40

    The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited…

  • CVE-2013-5223MedKEVNov 19, 2013
    Dlink
    DSL-2760U Gateway
    risk 0.53cvss 5.4epss 0.34

    Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the (1) ntpServer1 parameter to sntpcfg.cgi, username parameter to (2) ddnsmngr.cmd or (3) todmngr.tod, (4)…

  • CVE-2013-3918HigKEVNov 12, 2013
    Microsoft
    Windows
    risk 0.78cvss 8.8epss 0.74

    The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold…

  • CVE-2013-3906HigKEVNov 6, 2013
    Microsoft
    Office
    risk 0.72cvss 7.8epss 0.85

    GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated…

  • CVE-2013-3897HigKEVOct 9, 2013
    Microsoft
    Internet Explorer
    risk 0.78cvss 8.8epss 0.77

    Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JavaScript code that uses the onpropertychange event…

  • CVE-2013-3896MedKEVOct 9, 2013
    Microsoft
    Silverlight
    risk 0.56cvss 5.5epss 0.70

    Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application, aka "Silverlight Vulnerability."

  • CVE-2013-3893HigKEVSep 18, 2013
    Microsoft
    Internet Explorer
    risk 0.79cvss 8.8epss 0.86

    Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript strings, as demonstrated by use of an ms-help: URL that triggers loading of…

  • CVE-2013-4810CriKEVSep 16, 2013
    Microfocus
    Application LifeCycle Management
    risk 0.85cvss 9.8epss 0.79

    HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet, aka ZDI-CAN-1760. NOTE:…

  • CVE-2013-3346CriKEVAug 30, 2013
    Adobe Inc.
    Acrobat
    risk 0.85cvss 9.8epss 0.79

    Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-2718, CVE-2013-2719, CVE-2013-2720,…

  • CVE-2013-2251CriKEVJul 20, 2013
    Apache
    Struts
    risk 0.80cvss 9.8epss 1.00

    Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

  • CVE-2013-3163HigKEVJul 10, 2013
    Microsoft
    Internet Explorer
    risk 0.78cvss 8.8epss 0.71

    Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3144 and…

  • CVE-2013-1690HigKEVJun 26, 2013
    Mozilla Corporation
    Firefox
    risk 0.78cvss 8.8epss 0.69

    Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service…

  • CVE-2013-2465CriKEVJun 18, 2013
    Openjdk
    OpenJDK
    risk 0.93cvss 9.8epss 0.99

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown…

  • CVE-2013-1331HigKEVJun 12, 2013
    Microsoft
    Office
    risk 0.69cvss 7.8epss 0.82

    Buffer overflow in Microsoft Office 2003 SP3 and Office 2011 for Mac allows remote attackers to execute arbitrary code via crafted PNG data in an Office document, leading to improper memory allocation, aka "Office Buffer Overflow Vulnerability."

  • CVE-2013-3660HigKEVMay 24, 2013
    Microsoft
    Windows
    risk 0.69cvss 7.8epss 0.40

    The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 does not properly initialize a…

  • CVE-2013-2729CriKEVMay 16, 2013
    Adobe Inc.
    Acrobat
    risk 0.84cvss 9.8epss 0.67

    Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-2727.

  • CVE-2013-1675MedKEVMay 16, 2013
    Mozilla Corporation
    Firefox
    risk 0.55cvss 6.5epss 0.07

    Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote…

  • CVE-2013-2094HigKEVMay 14, 2013
    Linux
    Kernel
    risk 0.66cvss 8.4epss 0.48

    The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.

  • CVE-2013-1347HigKEVMay 5, 2013
    Microsoft
    Internet Explorer
    risk 0.78cvss 8.8epss 0.78

    Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly allocated or (2) is deleted, as exploited in the wild in May 2013.

  • CVE-2013-2423LowKEVApr 17, 2013
    Openjdk
    OpenJDK
    risk 0.46cvss 3.7epss 0.85

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU.…

  • CVE-2013-2596HigKEVApr 13, 2013
    Linux
    Kernel
    risk 0.56cvss 7.8epss 0.03

    Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and…

  • CVE-2013-0074HigKEVMar 13, 2013
    Microsoft
    Silverlight
    risk 0.78cvss 7.8epss 0.82

    Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference…

  • CVE-2013-2551HigKEVMar 11, 2013
    Microsoft
    Internet Explorer
    risk 0.84cvss 8.8epss 0.74

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013, aka "Internet…

  • CVE-2013-0648HigKEVFeb 27, 2013
    Adobe Inc.
    Flashplayer
    risk 0.70cvss 8.8epss 0.11

    Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary…

  • CVE-2013-0643HigKEVFeb 27, 2013
    Adobe Inc.
    Flashplayer
    risk 0.70cvss 8.8epss 0.11

    The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary…

  • CVE-2013-0641HigKEVFeb 14, 2013
    Adobe Inc.
    Acrobat
    risk 0.65cvss 7.8epss 0.32

    Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in the wild in February 2013.

  • CVE-2013-0640HigKEVFeb 14, 2013
    Adobe Inc.
    Acrobat
    risk 0.73cvss 7.8epss 0.87

    Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document, as exploited in the wild in February 2013.

  • CVE-2013-0431MedKEVJan 31, 2013
    Openjdk
    OpenJDK
    risk 0.63cvss 5.3epss 0.90

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different…

  • CVE-2013-0632CriKEVJan 17, 2013
    Adobe Inc.
    Coldfusion
    risk 0.86cvss 9.8epss 0.94

    administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web…

  • CVE-2013-0422CriKEVJan 10, 2013
    IBM
    Java
    risk 0.93cvss 9.8epss 0.98

    Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary…

  • CVE-2013-0631HigKEVJan 9, 2013
    Adobe Inc.
    Coldfusion
    risk 0.66cvss 7.5epss 0.66

    Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in January 2013.

  • CVE-2013-0629HigKEVJan 9, 2013
    Adobe Inc.
    Coldfusion
    risk 0.69cvss 7.5epss 0.66

    Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspecified vectors, as exploited in the wild in January 2013.

  • CVE-2013-0625CriKEVJan 9, 2013
    Adobe Inc.
    Coldfusion
    risk 0.86cvss 9.8epss 0.94

    Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013.

  • CVE-2012-4792HigKEVDec 30, 2012
    Microsoft
    Internet Explorer
    risk 0.79cvss 8.8epss 0.79

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and…