VYPR

CVEs

347,160 total · page 5859 of 6,944

AllCriticalHighKEV
  • CVE-2012-5668Jan 24, 2013
    FreeType
    Freetype
    risk 0.00cvss —epss 0.02

    FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to BDF fonts and the improper handling of an "allocation error" in the bdf_free_font function.

  • CVE-2012-6521Jan 24, 2013
    Elefantcms
    Elefantcms
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in apps/admin/handlers/versions.php in Elefant CMS 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter to admin/versions.

  • CVE-2012-6520Jan 24, 2013
    Wikidforum
    Wikidforum
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the advanced search in Wikidforum 2.10 allow remote attackers to execute arbitrary SQL commands via the (1) select_sort or (2) opt_search_select parameters. NOTE: this issue could not be reproduced by third parties.

  • CVE-2012-6519Jan 24, 2013
    Diy CMS
    Diy CMS
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in modules/poll/index.php in DIY-CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the start parameter to mod.php.

  • CVE-2012-6518Jan 24, 2013
    Diy CMS
    Diy CMS
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in mod.php in DiY-CMS 1.0 allows remote attackers to hijack the authentication of administrators for requests that create a poll via an add action to the poll module.

  • CVE-2012-6517Jan 24, 2013
    Diy CMS
    Diy CMS
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in DiY-CMS 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) question parameter to in /modules/poll/add.php or (2) question or (3) answer parameter to modules/poll/edit.php.

  • CVE-2012-6516Jan 24, 2013
    PHP Ticket
    PHP Ticket
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in PHP Ticket System Beta 1 allows remote attackers to execute arbitrary SQL commands via the q parameter to index.php.

  • CVE-2012-6515Jan 24, 2013
    Epignosis
    Efront
    risk 0.00cvss —epss 0.01

    eFront 3.6.10, 3.6.11 build 15059, and earlier allows remote attackers to obtain sensitive information via invalid courses_ID parameter in the lesson_info module to index.php, which reveals the installation path in an error message.

  • CVE-2012-6514Jan 24, 2013
    nBill
    nBill
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the nBill (com_nbill) component 2.3.2 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the message parameter in an income action to administrator/index.php.

  • CVE-2012-6513Jan 24, 2013
    Gpeasy
    Gpeasy CMS
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php/Admin_Preferences in gpEasy CMS 2.3.3 allows remote attackers to inject arbitrary web script or HTML via the jsoncallback parameter.

  • CVE-2012-6512Jan 24, 2013
    WordPress
    Organizer
    risk 0.00cvss —epss 0.03

    The Organizer plugin 1.2.1 for WordPress allows remote attackers to obtain the installation path via unspecified vectors to (1) plugin_hook.php, (2) page/index.php, (3) page/dir.php (4) page/options.php, (5) page/resize.php, (6) page/upload.php, (7) page/users.php, or (8)…

  • CVE-2012-6511Jan 24, 2013
    WordPress
    Organizer
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in organizer/page/users.php in the Organizer plugin 1.2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) delete_id parameter or (2) extension parameter in an "Update Setting" action to…

  • CVE-2012-6510Jan 24, 2013
    Netartmedia
    Car Portal
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) PWRS or (2) Description field when posting a new vehicle; (3) news title when creating news; (4) Name when creating a sub…

  • CVE-2012-6509Jan 24, 2013
    Netartmedia
    Car Portal
    risk 0.04cvss —epss 0.07

    Unrestricted file upload vulnerability in NetArt Media Car Portal 3.0 allows remote attackers to execute arbitrary PHP code by uploading a file a double extension, as demonstrated by .php%00.jpg.

  • CVE-2012-6508Jan 24, 2013
    Netartmedia
    Car Portal
    risk 0.03cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to hijack the authentication of administrators for requests that (1) change arbitrary user passwords via a nouveau action in the security module to…

  • CVE-2012-6507Jan 24, 2013
    ChurchCMS
    ChurchCMS
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in admin.php in ChurchCMS 0.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) uname or (2) pass parameters in a login action.

  • CVE-2012-6506Jan 24, 2013
    Zingiri
    Zingiri Web Shop
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in the Zingiri Web Shop plugin 2.4.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in zing.inc.php or (2) notes parameter in fws/pages-front/onecheckout.php.

  • CVE-2012-6505Jan 24, 2013
    PHP Volunteer Management
    PHP Volunteer Management
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in mods/hours/data/get_hours.php in PHP Volunteer Management 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2012-6504Jan 24, 2013
    Shawn Bradley
    PHP Volunteer Management
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in mods/hours/data/get_hours.php in PHP Volunteer Management 1.0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2012-6503Jan 24, 2013
    Ninjaforge
    Com Ninjaxplorer
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the NinjaXplorer component before 1.0.7 for Joomla! has unknown impact and attack vectors.

  • CVE-2012-6085Jan 24, 2013
    Gnupg
    Gnupg
    risk 0.00cvss —epss 0.03

    The read_block function in g10/import.c in GnuPG 1.4.x before 1.4.13 and 2.0.x through 2.0.19, when importing a key, allows remote attackers to corrupt the public keyring database or cause a denial of service (application crash) via a crafted length field of an OpenPGP packet.

  • CVE-2012-2099Jan 24, 2013
    Wikidforum
    Wikidforum
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in Wikidforum 2.10 allow remote attackers to inject arbitrary web script or HTML via the (1) search field, or the (2) Author or (3) select_sort parameters in an advanced search.

  • CVE-2012-1922Jan 24, 2013
    Sitecom
    Wlm 2501
    risk 0.03cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Sitecom WLM-2501 allow remote attackers to hijack the authentication of administrators for requests that modify settings for (1) Mac Filtering via admin/formFilter, (2) IP/Port Filtering via formFilter, (3) Port…

  • CVE-2011-4618Jan 24, 2013
    WordPress
    Advanced Text Widget
    risk 0.04cvss —epss 0.10

    Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2013-0209Jan 23, 2013
    Movabletype
    Movabletype
    risk 0.07cvss —epss 0.45

    lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated…

  • CVE-2012-6096Jan 22, 2013
    Nagios
    Nagios
    risk 0.08cvss —epss 0.66

    Multiple stack-based buffer overflows in the get_history function in history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2, 1.7.x before 1.7.4, and 1.8.x before 1.8.4, might allow remote attackers to execute arbitrary code via a long (1) host_name variable (host…

  • CVE-2012-5616Jan 22, 2013
    Apache
    Cloudstack
    risk 0.00cvss —epss 0.01

    Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform (formerly Citrix CloudStack) before 3.0.6 stores sensitive information in the log4j.conf log file, which allows local users to obtain (1) the SSH private key as recorded by the createSSHKeyPair API, (2) the password of…

  • CVE-2012-4918Jan 22, 2013
    Call Of Duty
    Call of Duty
    risk 0.00cvss —epss 0.01

    Call of Duty Elite for iOS 2.0.1 does not properly validate the server SSL certificate, which allows remote attackers to obtain sensitive information via a Man-in-the-Middle (MITM) attack.

  • CVE-2012-4461Jan 22, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The KVM subsystem in the Linux kernel before 3.6.9, when running on hosts that use qemu userspace without XSAVE, allows local users to cause a denial of service (kernel OOPS) by using the KVM_SET_SREGS ioctl to set the X86_CR4_OSXSAVE bit in the guest cr4 register, then calling…

  • CVE-2012-4414Jan 22, 2013
    MariaDB
    MariaDB
    risk 0.00cvss —epss 0.03

    Multiple SQL injection vulnerabilities in the replication code in Oracle MySQL possibly before 5.5.29, and MariaDB 5.1.x through 5.1.62, 5.2.x through 5.2.12, 5.3.x through 5.3.7, and 5.5.x through 5.5.25, allow remote authenticated users to execute arbitrary SQL commands via…

  • CVE-2012-3364Jan 22, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.05

    Multiple stack-based buffer overflows in the Near Field Communication Controller Interface (NCI) in the Linux kernel before 3.4.5 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via incoming frames with crafted length fields.

  • CVE-2012-2372Jan 22, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The rds_ib_xmit function in net/rds/ib_send.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel 3.7.4 and earlier allows local users to cause a denial of service (BUG_ON and kernel panic) by establishing an RDS connection with the source IP…

  • CVE-2012-2137Jan 22, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Buffer overflow in virt/kvm/irq_comm.c in the KVM subsystem in the Linux kernel before 3.2.24 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to Message Signaled Interrupts (MSI), irq routing entries, and an…

  • CVE-2012-2119Jan 22, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Buffer overflow in the macvtap device driver in the Linux kernel before 3.4.5, when running in certain configurations, allows privileged KVM guest users to cause a denial of service (crash) via a long descriptor with a long vector length.

  • CVE-2012-6502Jan 22, 2013
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.10

    Microsoft Internet Explorer before 10 allows remote attackers to obtain sensitive information about the existence of files, and read certain data from files, via a UNC share pathname in the SRC attribute of a SCRIPT element, as demonstrated by reading a name-value pair from a…

  • CVE-2013-1110Jan 21, 2013
    Cisco Systems, Inc.
    Webex Training Center
    risk 0.00cvss —epss 0.02

    Cisco WebEx Training Center allow remote authenticated users to bypass intended privilege restrictions and (1) enable or (2) disable training-center recordings via a crafted URL, aka Bug ID CSCzu81065.

  • CVE-2013-1108Jan 21, 2013
    Cisco Systems, Inc.
    Webex Training Center
    risk 0.00cvss —epss 0.01

    Cisco WebEx Training Center allows remote authenticated users to remove hands-on lab-session reservations via a crafted URL, aka Bug ID CSCzu81064.

  • CVE-2013-0929Jan 21, 2013
    EMC Corporation
    Alphastor
    risk 0.00cvss —epss 0.03

    Format string vulnerability in the _vsnsprintf function in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote attackers to execute arbitrary code via format string specifiers in a command.

  • CVE-2013-0928Jan 21, 2013
    EMC Corporation
    Alphastor
    risk 0.06cvss —epss 0.34

    The NetWorker command processor in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote attackers to execute arbitrary commands via a DCP "run command" operation.

  • CVE-2013-0656Jan 21, 2013
    Siemens Foundation
    RF-MANAGER Basic
    risk 0.00cvss —epss 0.03

    Buffer overflow in a third-party ActiveX component in Siemens SIMATIC RF-MANAGER 2008, and RF-MANAGER Basic 3.0 and earlier, allows remote attackers to execute arbitrary code via a crafted web site.

  • CVE-2012-6069CriJan 21, 2013
    Codesys
    Runtime Toolkit
    risk 0.65cvss 10.0epss 0.03

    The CoDeSys Runtime Toolkit’s file transfer functionality does not perform input validation, which allows an attacker to access files and directories outside the intended scope. This may allow an attacker to upload and download any file on the device. This could allow the …

  • CVE-2012-6068CriJan 21, 2013
    3S Smart Software Solutions
    Codesys Runtime System
    risk 0.64cvss 9.8epss 0.05

    The Runtime Toolkit in CODESYS Runtime System 2.3.x and 2.4.x does not require authentication, which allows remote attackers to execute commands via the command-line interface in the TCP listener service or transfer files via requests to the TCP listener service.

  • CVE-2012-2291Jan 21, 2013
    EMC Corporation
    Avamar
    risk 0.00cvss —epss 0.00

    EMC Avamar Client 4.x, 5.x, and 6.x on HP-UX and Mac OS X, and the EMC Avamar plugin 4.x, 5.x, and 6.x for Oracle, uses world-writable permissions for cache directories, which allows local users to gain privileges via an unspecified symlink attack.

  • CVE-2013-0657Jan 21, 2013
    Schneider Electric
    Interactive Graphical SCADA System
    risk 0.05cvss —epss 0.21

    Stack-based buffer overflow in Schneider Electric Interactive Graphical SCADA System (IGSS) 10 and earlier allows remote attackers to execute arbitrary code by sending TCP port-12397 data that does not comply with a protocol.

  • CVE-2013-0655Jan 21, 2013
    Schneider Electric
    Software Update Utility
    risk 0.00cvss —epss 0.03

    The client in Schneider Electric Software Update (SESU) Utility 1.0.x and 1.1.x does not ensure that updates have a valid origin, which allows man-in-the-middle attackers to spoof updates, and consequently execute arbitrary code, by modifying the data stream on TCP port 80.

  • CVE-2012-6113Jan 19, 2013
    PHP
    PHP
    risk 0.00cvss —epss 0.03

    The openssl_encrypt function in ext/openssl/openssl.c in PHP 5.3.9 through 5.3.13 does not initialize a certain variable, which allows remote attackers to obtain sensitive information from process memory by providing zero bytes of input data.

  • CVE-2012-6396Jan 19, 2013
    Cisco Systems, Inc.
    Nexus 7000
    risk 0.00cvss —epss 0.01

    Cisco NX-OS on Nexus 7000 series switches does not properly handle certain line-card replacements, which might allow remote authenticated users to cause a denial of service (memory consumption) via a crafted configuration that references interfaces that do not exist on the new…

  • CVE-2012-5185Jan 19, 2013
    Olive Toast
    Documents Pro File Viewer
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the Olive Toast Documents Pro File Viewer (formerly Files HD) app before 1.11.1 for iOS allows remote attackers to read or delete files by leveraging guest access.

  • CVE-2012-5184Jan 19, 2013
    Olive Toast
    Documents Pro File Viewer
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Olive Toast Documents Pro File Viewer (formerly Files HD) app before 1.11.1 for iOS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-5134Jan 18, 2013
    Utorrent
    Utorrent
    risk 0.04cvss —epss 0.08

    Buffer overflow in the "create torrent dialog" functionality in uTorrent 1.8.3 build 15772, and possibly other versions before 1.8.3 (Build 16010), allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a…