VYPR

CVEs

347,154 total · page 5864 of 6,944

AllCriticalHighKEV
  • CVE-2013-0007Jan 9, 2013
    Microsoft
    XML Core Services
    risk 0.03cvss —epss 0.32

    Microsoft XML Core Services (aka MSXML) 4.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML XSLT Vulnerability."

  • CVE-2013-0006HigJan 9, 2013
    Microsoft
    XML Core Services
    risk 0.59cvss 8.8epss 0.28

    Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML Integer Truncation Vulnerability."

  • CVE-2013-0005Jan 9, 2013
    Microsoft
    .net Framework
    risk 0.03cvss —epss 0.32

    The WCF Replace function in the Open Data (aka OData) protocol implementation in Microsoft .NET Framework 3.5, 3.5 SP1, 3.5.1, and 4, and the Management OData IIS Extension on Windows Server 2012, allows remote attackers to cause a denial of service (resource consumption and…

  • CVE-2013-0004Jan 9, 2013
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.21

    Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate the permissions of objects in memory, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET…

  • CVE-2013-0003Jan 9, 2013
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.24

    Buffer overflow in a System.DirectoryServices.Protocols (S.DS.P) namespace method in Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET…

  • CVE-2013-0002Jan 9, 2013
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.25

    Buffer overflow in the Windows Forms (aka WinForms) component in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET…

  • CVE-2013-0001Jan 9, 2013
    Microsoft
    .net Framework
    risk 0.01cvss —epss 0.14

    The Windows Forms (aka WinForms) component in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 4, and 4.5 does not properly initialize memory arrays, which allows remote attackers to obtain sensitive information via (1) a crafted XAML browser application (XBAP) or…

  • CVE-2013-0631HigKEVJan 9, 2013
    Adobe Inc.
    Coldfusion
    risk 0.66cvss 7.5epss 0.66

    Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in January 2013.

  • CVE-2013-0629HigKEVJan 9, 2013
    Adobe Inc.
    Coldfusion
    risk 0.69cvss 7.5epss 0.66

    Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspecified vectors, as exploited in the wild in January 2013.

  • CVE-2013-0625CriKEVJan 9, 2013
    Adobe Inc.
    Coldfusion
    risk 0.86cvss 9.8epss 0.94

    Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013.

  • CVE-2012-6498Jan 8, 2013
    Atomymaxsite
    Atomymaxsite
    risk 0.00cvss —epss 0.02

    Unrestricted file upload vulnerability in index.php in Atomymaxsite 2.5 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file, as exploited in the wild in October 2012.

  • CVE-2012-4550MedJan 5, 2013
    Red Hat
    Jboss Enterprise Application Platform
    risk 0.35cvss 5.3epss 0.02

    A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans (EJB) access, the system does not correctly call the necessary authorization modules. This prevents Java Authorization Contract for Containers (JACC)…

  • CVE-2012-4549MedJan 5, 2013
    Red Hat
    Jboss Enterprise Application Platform
    risk 0.42cvss 6.5epss 0.01

    A flaw was found in JBoss Enterprise Application Platform. The `processInvocation` function within the `org.jboss.as.ejb3.security.AuthorizationInterceptor` component incorrectly authorizes all requests when no roles are defined for an Enterprise Java Beans (EJB) method…

  • CVE-2012-2378Jan 5, 2013
    Apache
    Cxf
    risk 0.00cvss —epss 0.04

    Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote attackers to bypass the (1) AlgorithmSuite, (2) SignedParts, (3)…

  • CVE-2011-3937Jan 5, 2013
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.02

    The H.263 codec (libavcodec/h263dec.c) in FFmpeg 0.7.x before 0.7.12, 0.8.x before 0.8.11, and unspecified versions before 0.10, and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1 has unspecified impact and attack vectors related to…

  • CVE-2012-5605Jan 4, 2013
    Red Hat
    Cloudforms
    risk 0.00cvss —epss 0.00

    Grinder in Red Hat CloudForms before 1.1 uses world-writable permissions for /var/lib/pulp/cache/grinder/, which allows local users to modify grinder cache files.

  • CVE-2012-5603Jan 4, 2013
    Red Hat
    Cloudforms
    risk 0.00cvss —epss 0.01

    proxies_controller.rb in Katello in Red Hat CloudForms before 1.1 does not properly check permissions, which allows remote authenticated users to read consumer certificates or change arbitrary users' settings via unspecified vectors related to the "consumer UUID" of a system.

  • CVE-2012-5581Jan 4, 2013
    LibTIFF
    Libtiff
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in tif_dir.c in LibTIFF before 4.0.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DOTRANGE tag in a TIFF image.

  • CVE-2012-5516Jan 4, 2013
    Red Hat
    Enterprise Virtualization
    risk 0.00cvss —epss 0.00

    Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when moving disks between storage domains, does not properly wipe-after-delete, which prevents disks from being securely deleted and might allow local users to obtain sensitive information via unspecified vectors.

  • CVE-2012-4574Jan 4, 2013
    Red Hat
    Cloudforms
    risk 0.00cvss —epss 0.00

    Pulp in Red Hat CloudForms before 1.1 uses world-readable permissions for pulp.conf, which allows local users to read the administrative password by reading this file.

  • CVE-2012-4556Jan 4, 2013
    Red Hat
    Certificate System
    risk 0.00cvss —epss 0.01

    The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 allows remote attackers to cause a denial of service (Apache httpd web server child process restart) via certain unspecified empty search fields in a user certificate search query.

  • CVE-2012-4555Jan 4, 2013
    Red Hat
    Certificate System
    risk 0.00cvss —epss 0.01

    The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 does not properly handle interruptions of token format operations, which allows remote attackers to cause a denial of service (NULL pointer dereference and Apache httpd web server child…

  • CVE-2012-4543Jan 4, 2013
    Red Hat
    Certificate System
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) pageStart or (2) pageSize to the displayCRL script, or (3) nonce variable to the profileProcess script.

  • CVE-2012-3538Jan 4, 2013
    Red Hat
    Cloudforms
    risk 0.00cvss —epss 0.01

    Pulp in Red Hat CloudForms before 1.1 logs administrative passwords in a world-readable file, which allows local users to read pulp administrative passwords by reading production.log.

  • CVE-2012-2696Jan 4, 2013
    Red Hat
    Enterprise Virtualization
    risk 0.00cvss —epss 0.01

    The backend in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1 does not properly check privileges, which allows remote authenticated users to query arbitrary information via a (1) SOAP or (2) GWT request.

  • CVE-2012-0861Jan 4, 2013
    Red Hat
    Enterprise Virtualization
    risk 0.00cvss —epss 0.01

    The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vds_bootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute…

  • CVE-2012-0860Jan 4, 2013
    Red Hat
    Enterprise Virtualization
    risk 0.00cvss —epss 0.00

    Multiple untrusted search path vulnerabilities in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, allow local users to gain privileges via a Trojan horse (1) deployUtil.py or (2) vds_bootstrap.py Python module in /tmp/.

  • CVE-2011-4316Jan 4, 2013
    Red Hat
    Enterprise Virtualization
    risk 0.00cvss —epss 0.00

    Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, in certain unspecified conditions, does not lock the desktop screen between SPICE sessions, which allows local users with access to a virtual machine to gain access to other users' desktop sessions via unspecified…

  • CVE-2012-6348Jan 4, 2013
    Centrify
    Centrify Deployment Manager
    risk 0.00cvss —epss 0.00

    Centrify Deployment Manager 2.1.0.283, as distributed in Centrify Suite before 2012.5, allows local users to (1) overwrite arbitrary files via a symlink attack on the adcheckDMoutput temporary file, or (2) overwrite arbitrary files and consequently gain privileges via a symlink…

  • CVE-2012-6330Jan 4, 2013
    TWiki
    Twiki
    risk 0.06cvss —epss 0.36

    The localization functionality in TWiki before 5.1.3, and Foswiki 1.0.x through 1.0.10 and 1.1.x through 1.1.6, allows remote attackers to cause a denial of service (memory consumption) via a large integer in a %MAKETEXT% macro.

  • CVE-2012-6329Jan 4, 2013
    Perl Foundation
    Perl
    risk 0.01cvss —epss 0.62

    The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket notation, which allows context-dependent attackers to execute arbitrary commands…

  • CVE-2012-5977Jan 4, 2013
    Digium
    Asterisk
    risk 0.00cvss —epss 0.02

    Asterisk Open Source 1.8.x before 1.8.19.1, 10.x before 10.11.1, and 11.x before 11.1.2; Certified Asterisk 1.8.11 before 1.8.11-cert10; and Asterisk Digiumphones 10.x-digiumphones before 10.11.1-digiumphones, when anonymous calls are enabled, allow remote attackers to cause a…

  • CVE-2012-6090Jan 4, 2013
    Swi Prolog
    Swi Prolog
    risk 0.00cvss —epss 0.03

    Multiple stack-based buffer overflows in the expand function in os/pl-glob.c in SWI-Prolog before 6.2.5 and 6.3.x before 6.3.7 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted filename.

  • CVE-2012-6089Jan 4, 2013
    Swi Prolog
    Swi Prolog
    risk 0.00cvss —epss 0.04

    Multiple stack-based buffer overflows in the canoniseFileName function in os/pl-os.c in SWI-Prolog before 6.2.5 and 6.3.x before 6.3.7 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted filename.

  • CVE-2012-5976Jan 4, 2013
    Digium
    Asterisk
    risk 0.00cvss —epss 0.03

    Multiple stack consumption vulnerabilities in Asterisk Open Source 1.8.x before 1.8.19.1, 10.x before 10.11.1, and 11.x before 11.1.2; Certified Asterisk 1.8.11 before 1.8.11-cert10; and Asterisk Digiumphones 10.x-digiumphones before 10.11.1-digiumphones allow remote attackers…

  • CVE-2012-6497Jan 4, 2013
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.03

    The Authlogic gem for Ruby on Rails, when used with certain versions before 3.2.10, makes potentially unsafe find_by_id method calls, which might allow remote attackers to conduct CVE-2012-6496 SQL injection attacks via a crafted parameter in environments that have a known…

  • CVE-2012-6496Jan 4, 2013
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.04

    SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in…

  • CVE-2012-6434Jan 3, 2013
    E107
    E107
    risk 0.03cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in e107_admin/download.php in e107 1.0.2 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) download_url, (2) download_url_extended, (3)…

  • CVE-2012-6433Jan 3, 2013
    E107
    E107
    risk 0.03cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in e107_admin/newspost.php in e107 1.0.1 allows remote attackers to hijack the authentication of administrators for requests that conduct XSS attacks via the news_title parameter in a create action.

  • CVE-2012-5667Jan 3, 2013
    GNU
    Grep
    risk 0.00cvss —epss 0.01

    Multiple integer overflows in GNU Grep before 2.11 might allow context-dependent attackers to execute arbitrary code via vectors involving a long input line that triggers a heap-based buffer overflow.

  • CVE-2012-6495Jan 3, 2013
    Moinmo
    Moinmoin
    risk 0.04cvss —epss 0.19

    Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors. …

  • CVE-2012-6082Jan 3, 2013
    Moinmo
    Moinmoin
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the rsslink function in theme/__init__.py in MoinMoin 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the page name in a rss link.

  • CVE-2012-6081Jan 3, 2013
    Moinmo
    Moinmoin
    risk 0.00cvss —epss 0.31

    Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an…

  • CVE-2012-6080Jan 3, 2013
    Moinmo
    Moinmoin
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in the _do_attachment_move function in the AttachFile action (action/AttachFile.py) in MoinMoin 1.9.3 through 1.9.5 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a file name.

  • CVE-2012-5666Jan 3, 2013
    OwnCloud
    Owncloud
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in bookmarks/js/bookmarks.js in ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to apps/bookmark/index.php.

  • CVE-2012-5665Jan 3, 2013
    OwnCloud
    Server
    risk 0.00cvss —epss 0.02

    ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 does not properly restrict access to settings.php, which allows remote attackers to edit app configurations of user_webdavauth and user_ldap by editing this file.

  • CVE-2012-5655Jan 3, 2013
    Drupal
    Context
    risk 0.00cvss —epss 0.02

    The Context module 6.x-3.x before 6.x-3.1 and 7.x-3.x before 7.x-3.0-beta6 for Drupal does not properly restrict access to block content, which allows remote attackers to obtain sensitive information via a crafted request.

  • CVE-2012-5654Jan 3, 2013
    Drupal
    Nodewords
    risk 0.00cvss —epss 0.01

    The Nodewords: D6 Meta Tags module before 6.x-1.14 for Drupal, when configured to automatically generate description meta tags from node text, does not properly filter node content when creating tags, which might allow remote attackers to obtain sensitive information by reading…

  • CVE-2012-5653Jan 3, 2013
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated users to bypass the protection mechanism and execute arbitrary PHP code via a null byte in a file name.

  • CVE-2012-5652Jan 3, 2013
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    Drupal 6.x before 6.27 allows remote attackers to obtain sensitive information about uploaded files via a (1) RSS feed or (2) search result.