VYPR

CVEs

347,168 total · page 5849 of 6,944

AllCriticalHighKEV
  • CVE-2013-0349Feb 28, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The hidp_setup_hid function in net/bluetooth/hidp/core.c in the Linux kernel before 3.7.6 does not properly copy a certain name field, which allows local users to obtain sensitive information from kernel memory by setting a long name and making an HIDPCONNADD ioctl call.

  • CVE-2013-0343Feb 28, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.02

    The ipv6_create_tempaddr function in net/ipv6/addrconf.c in the Linux kernel through 3.8 does not properly handle problems with the generation of IPv6 temporary addresses, which allows remote attackers to cause a denial of service (excessive retries and address-generation…

  • CVE-2012-4542Feb 28, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    block/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during authorization of SCSI commands, which allows local users to bypass intended access restrictions via an SG_IO ioctl call that leverages overlapping opcodes.

  • CVE-2013-1137Feb 27, 2013
    Cisco Systems, Inc.
    Unified Presence Server
    risk 0.00cvss —epss 0.02

    Cisco Unified Presence Server (CUPS) 8.6, 9.0, and 9.1 before 9.1.1 allows remote attackers to cause a denial of service (CPU consumption) via crafted packets to the SIP TCP port, aka Bug ID CSCua89930.

  • CVE-2013-1135Feb 27, 2013
    Cisco Systems, Inc.
    Prime Central For Hosted Collaboration Solution Assurance
    risk 0.00cvss —epss 0.01

    Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance 8.6 and 9.0 allows remote attackers to cause a denial of service (CPU consumption and monitoring outage) via malformed TLS messages to TCP port (1) 9043 or (2) 9443, aka Bug ID CSCuc07155.

  • CVE-2013-1134Feb 27, 2013
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.01

    The Location Bandwidth Manager (LBM) Intracluster-communication feature in Cisco Unified Communications Manager (CUCM) 9.x before 9.1(1) does not require authentication from the remote LBM Hub node, which allows remote attackers to conduct cache-poisoning attacks against…

  • CVE-2013-1133Feb 27, 2013
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.01

    Cisco Unified Communications Manager (CUCM) 8.6 before 8.6(2a)su2, 8.6 BE3k before 8.6(4) BE3k, and 9.x before 9.0(1) allows remote attackers to cause a denial of service (CPU consumption and GUI and voice outages) via malformed packets to unused UDP ports, aka Bug ID CSCtx43337.

  • CVE-2013-0490Feb 27, 2013
    IBM
    Infosphere Guardium
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in IBM InfoSphere Guardium S-TAP 8.1 for DB2 on z/OS allows local users to gain privileges via unknown vectors.

  • CVE-2012-4844Feb 27, 2013
    IBM
    Lotus Domino
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the web server in IBM Lotus Domino 8.5.x through 8.5.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-4842Feb 27, 2013
    IBM
    Lotus Domino
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in the web server in IBM Lotus Domino 8.5.x through 8.5.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  • CVE-2013-2277Feb 27, 2013
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.02

    The ff_h264_decode_seq_parameter_set function in h264_ps.c in libavcodec in FFmpeg before 1.1.3 does not validate the relationship between luma depth and chroma depth, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash)…

  • CVE-2013-2276Feb 27, 2013
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.01

    The avcodec_decode_audio4 function in utils.c in libavcodec in FFmpeg before 1.1.3 does not verify the decoding state before proceeding with certain skip operations, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or…

  • CVE-2012-5767Feb 27, 2013
    IBM
    Ts3500 Tape Library
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the web interface on the IBM TS3500 Tape Library with firmware before C260 allows remote authenticated users to gain privileges via unspecified vectors.

  • CVE-2013-1139Feb 27, 2013
    Cisco Systems, Inc.
    Cloud Portal
    risk 0.00cvss —epss 0.01

    The nsAPI interface in Cisco Cloud Portal 9.1 SP1 and SP2, and 9.3 through 9.3.2, does not properly check privileges, which allows remote authenticated users to obtain sensitive information via a crafted URL, aka Bug ID CSCud81134.

  • CVE-2013-0648HigKEVFeb 27, 2013
    Adobe Inc.
    Flashplayer
    risk 0.70cvss 8.8epss 0.11

    Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary…

  • CVE-2013-0643HigKEVFeb 27, 2013
    Adobe Inc.
    Flashplayer
    risk 0.70cvss 8.8epss 0.11

    The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary…

  • CVE-2013-0504Feb 27, 2013
    Adobe Inc.
    Flashplayer
    risk 0.01cvss —epss 0.10

    Buffer overflow in the broker service in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows attackers to execute arbitrary code via unspecified vectors.

  • CVE-2012-4558Feb 26, 2013
    Apache
    HTTP Server
    risk 0.02cvss —epss 0.23

    Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject…

  • CVE-2012-3499Feb 26, 2013
    Apache
    HTTP Server
    risk 0.02cvss —epss 0.23

    Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, (2) mod_info, (3)…

  • CVE-2013-1138Feb 25, 2013
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.01

    The NAT process on Cisco Adaptive Security Appliances (ASA) devices allows remote attackers to cause a denial of service (connections-table memory consumption) via crafted packets, aka Bug ID CSCue46386.

  • CVE-2013-0164Feb 24, 2013
    Red Hat
    Openshift
    risk 0.00cvss —epss 0.00

    The lockwrap function in port-proxy/bin/openshift-port-proxy-cfg in Red Hat OpenShift Origin before 1.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.

  • CVE-2013-0158Feb 24, 2013
    Jenkins Project
    Jenkins
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is attached and anonymous read access is enabled, allows remote attackers to obtain the master cryptographic…

  • CVE-2012-6074Feb 24, 2013
    Jenkins Project
    Jenkins
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote authenticated users with write access to inject arbitrary web…

  • CVE-2012-6073Feb 24, 2013
    Jenkins Project
    Jenkins
    risk 0.00cvss —epss 0.02

    Open redirect vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing…

  • CVE-2012-6072Feb 24, 2013
    Jenkins Project
    Jenkins
    risk 0.00cvss —epss 0.02

    CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response…

  • CVE-2012-5658Feb 24, 2013
    Red Hat
    Openshift
    risk 0.00cvss —epss 0.00

    rhc-chk.rb in Red Hat OpenShift Origin before 1.1, when -d (debug mode) is used, outputs the password and other sensitive information in cleartext, which allows context-dependent attackers to obtain sensitive information, as demonstrated by including log files or Bugzilla…

  • CVE-2013-0212Feb 24, 2013
    OpenStack
    Image Registry And Delivery Service \(glance\)
    risk 0.00cvss —epss 0.03

    store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to…

  • CVE-2012-6121Feb 24, 2013
    Roundcube
    Webmail
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a (1) data:text or (2) vbscript link.

  • CVE-2012-5647Feb 24, 2013
    Red Hat
    Openshift
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in node-util/www/html/restorer.php in Red Hat OpenShift Origin before 1.0.5-3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the PATH_INFO.

  • CVE-2012-5646Feb 24, 2013
    Red Hat
    Openshift
    risk 0.00cvss —epss 0.02

    node-util/www/html/restorer.php in the Red Hat OpenShift Origin before 1.0.5-3 allows remote attackers to execute arbitrary commands via a crafted uuid in the PATH_INFO.

  • CVE-2012-2697Feb 24, 2013
    Red Hat
    Enterprise Linux Server
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in autofs, as used in Red Hat Enterprise Linux (RHEL) 5, allows local users to cause a denial of service (autofs crash and delayed mounts) or prevent "mount expiration" via unspecified vectors related to "using an LDAP-based automount map."

  • CVE-2012-5337Feb 24, 2013
    Jforum
    Jforum
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in jforum.page in JForum 2.1.9 allow remote attackers to inject arbitrary web script or HTML via the (1) action, (2) match_type, (3) sort_by, or (4) start parameters.

  • CVE-2013-0247Feb 24, 2013
    OpenStack
    Keystone
    risk 0.00cvss —epss 0.03

    OpenStack Keystone Essex 2012.1.3 and earlier, Folsom 2012.2.3 and earlier, and Grizzly grizzly-2 and earlier allows remote attackers to cause a denial of service (disk consumption) via many invalid token requests that trigger excessive generation of log entries.

  • CVE-2013-0220Feb 24, 2013
    Fedoraproject
    Sssd
    risk 0.00cvss —epss 0.03

    The (1) sss_autofs_cmd_getautomntent and (2) sss_autofs_cmd_getautomntbyname function in responder/autofs/autofssrv_cmd.c and the (3) ssh_cmd_parse_request function in responder/ssh/sshsrv_cmd.c in System Security Services Daemon (SSSD) before 1.9.4 allow remote attackers to…

  • CVE-2013-0219Feb 24, 2013
    SSSD
    Sssd
    risk 0.00cvss —epss 0.00

    System Security Services Daemon (SSSD) before 1.9.4, when (1) creating, (2) copying, or (3) removing a user home directory tree, allows local users to create, modify, or delete arbitrary files via a symlink attack on another user's files.

  • CVE-2012-6128Feb 24, 2013
    Openconnect
    OpenConnect
    risk 0.00cvss —epss 0.03

    Multiple stack-based buffer overflows in http.c in OpenConnect before 4.08 allow remote VPN gateways to cause a denial of service (application crash) via a long (1) hostname, (2) path, or (3) cookie list in a response.

  • CVE-2012-6093Feb 24, 2013
    Qt
    Qt
    risk 0.00cvss —epss 0.02

    The QSslSocket::sslErrors function in Qt before 4.6.5, 4.7.x before 4.7.6, 4.8.x before 4.8.5, when using certain versions of openSSL, uses an "incompatible structure layout" that can read memory from the wrong location, which causes Qt to report an incorrect error when…

  • CVE-2012-5624Feb 24, 2013
    Qt
    Qt
    risk 0.00cvss —epss 0.02

    The XMLHttpRequest object in Qt before 4.8.4 enables http redirection to the file scheme, which allows man-in-the-middle attackers to force the read of arbitrary local files and possibly obtain sensitive information via a file: URL to a QML application.

  • CVE-2013-0786Feb 24, 2013
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    The Bugzilla::Search::build_subselect function in Bugzilla 2.x and 3.x before 3.6.13 and 3.7.x and 4.0.x before 4.0.10 generates different error messages for invalid product queries depending on whether a product exists, which allows remote attackers to discover private product…

  • CVE-2013-0785Feb 24, 2013
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in show_bug.cgi in Bugzilla before 3.6.13, 3.7.x and 4.0.x before 4.0.10, 4.1.x and 4.2.x before 4.2.5, and 4.3.x and 4.4.x before 4.4rc2 allows remote attackers to inject arbitrary web script or HTML via the id parameter in conjunction…

  • CVE-2013-0120Feb 24, 2013
    Dell
    Powerconnect 6248p
    risk 0.00cvss —epss 0.01

    The web interface on Dell PowerConnect 6248P switches allows remote attackers to cause a denial of service (device crash) via a malformed request.

  • CVE-2013-0118Feb 24, 2013
    Office Ocx
    Cs Cart
    risk 0.00cvss —epss 0.02

    CS-Cart before 3.0.6, when PayPal Standard Payments is configured, allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self.

  • CVE-2013-0113Feb 24, 2013
    Nuance
    PDF Reader
    risk 0.00cvss —epss 0.03

    Nuance PDF Reader 7.0 and PDF Viewer Plus 7.1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document.

  • CVE-2013-0108Feb 24, 2013
    Honeywell
    Symmetre
    risk 0.05cvss —epss 0.27

    An ActiveX control in HscRemoteDeploy.dll in Honeywell Enterprise Buildings Integrator (EBI) R310, R400.2, R410.1, and R410.2; SymmetrE R310, R410.1, and R410.2; ComfortPoint Open Manager (aka CPO-M) Station R100; and HMIWeb Browser client packages allows remote attackers to…

  • CVE-2012-6275Feb 24, 2013
    Bigantsoft
    Bigant Im Message Server
    risk 0.07cvss —epss 0.47

    Multiple stack-based buffer overflows in AntDS.exe in BigAntSoft BigAnt IM Message Server allow remote attackers to have an unspecified impact via (1) the filename header in an SCH request or (2) the userid component in a DUPF request.

  • CVE-2012-6274Feb 24, 2013
    Bigantsoft
    Bigant Im Message Server
    risk 0.07cvss —epss 0.47

    BigAntSoft BigAnt IM Message Server does not require authentication for file uploading, which allows remote attackers to create arbitrary files under AntServer\DocData\Public via unspecified vectors.

  • CVE-2012-6273Feb 24, 2013
    Bigantsoft
    Bigant Im Message Server
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in BigAntSoft BigAnt IM Message Server allows remote attackers to execute arbitrary SQL commands via an SHU (aka search user) request.

  • CVE-2012-4708Feb 24, 2013
    3S Smart Software Solutions
    CODESYS Gateway Server
    risk 0.01cvss —epss 0.07

    Stack-based buffer overflow in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via a crafted packet.

  • CVE-2012-4707Feb 24, 2013
    3S Smart Software Solutions
    CODESYS Gateway Server
    risk 0.00cvss —epss 0.04

    3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via vectors that trigger an out-of-bounds memory access.

  • CVE-2012-4706Feb 24, 2013
    3S Smart Software Solutions
    CODESYS Gateway Server
    risk 0.00cvss —epss 0.02

    Integer signedness error in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to cause a denial of service via a crafted packet that triggers a heap-based buffer overflow.