VYPR

CVEs

347,154 total · page 5869 of 6,944

AllCriticalHighKEV
  • CVE-2012-4690Dec 8, 2012
    Rockwellautomation
    Slc 500 Controller
    risk 0.00cvss —epss 0.04

    Rockwell Automation Allen-Bradley MicroLogix controller 1100, 1200, 1400, and 1500; SLC 500 controller platform; and PLC-5 controller platform, when Static status is not enabled, allow remote attackers to cause a denial of service via messages that trigger modification of status…

  • CVE-2012-4687Dec 8, 2012
    Postoaktraffic
    Awam Bluetooth Reader
    risk 0.00cvss —epss 0.01

    Post Oak AWAM Bluetooth Reader Traffic System does not use a sufficient source of entropy for private keys, which makes it easier for man-in-the-middle attackers to spoof a device by predicting a key value.

  • CVE-2012-3297Dec 8, 2012
    IBM
    Tivoli Monitoring
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the embedded HTTP server in the Service Console in IBM Tivoli Monitoring 6.2.2 before 6.2.2-TIV-ITM-FP0009 and 6.3.2 before 6.2.3-TIV-ITM-FP0001 allows remote attackers to inject arbitrary web script or HTML via a crafted URI.

  • CVE-2012-5688Dec 6, 2012
    Isc
    Bind
    risk 0.01cvss —epss 0.11

    ISC BIND 9.8.x before 9.8.4-P1 and 9.9.x before 9.9.2-P1, when DNS64 is enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.

  • CVE-2012-5176Dec 6, 2012
    Kent Web
    Access Report
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in KENT-WEB ACCESS REPORT 5.02 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to tag embedding.

  • CVE-2012-5175Dec 6, 2012
    Kent Web
    Access Report
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in KENT-WEB ACCESS REPORT 4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to access-log data.

  • CVE-2012-3275Dec 6, 2012
    Microfocus
    OpenView Network Node Manager
    risk 0.01cvss —epss 0.10

    Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.1x and 9.20 allows remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2012-3274Dec 6, 2012
    Microfocus
    Intelligent Management Center
    risk 0.08cvss —epss 0.62

    Stack-based buffer overflow in uam.exe in the User Access Manager (UAM) component in HP Intelligent Management Center (IMC) before 5.1 E0101P01 allows remote attackers to execute arbitrary code via vectors related to log data.

  • CVE-2012-3273Dec 6, 2012
    Microfocus
    LaserJet 400 M401
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities on the HP LaserJet Pro 400 MFP M425 with firmware 20120625 and LaserJet 400 M401 with firmware 20120621 allow remote attackers to obtain sensitive information via unknown vectors.

  • CVE-2012-3272Dec 6, 2012
    Microfocus
    Color Laserjet Cp6015
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability on the HP Color LaserJet CM3530 with firmware before 53.190.9, Color LaserJet CM60xx with firmware before 52.210.9, Color LaserJet CP3525 with firmware before 06.140.3 18, Color LaserJet CP4xxx with firmware before 07.120.6, Color…

  • CVE-2012-5055Dec 5, 2012
    VMware
    Spring Security
    risk 0.00cvss —epss 0.02

    DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames…

  • CVE-2011-2732Dec 5, 2012
    VMware
    Spring Security
    risk 0.03cvss —epss 0.05

    CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.

  • CVE-2011-2731Dec 5, 2012
    VMware
    Spring Security
    risk 0.00cvss —epss 0.01

    Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.

  • CVE-2011-2730Dec 5, 2012
    Gopivotal
    Spring Framework
    risk 0.00cvss —epss 0.12

    VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a)…

  • CVE-2009-2899Dec 5, 2012
    VMware
    Hyperic Hq
    risk 0.00cvss —epss 0.00

    The monitor perl script in the Sybase database plug-in in SpringSource Hyperic HQ before 4.3 allows local users to obtain the database password by listing the process and its arguments.

  • CVE-2012-6062Dec 5, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The dissect_rtcp_app function in epan/dissectors/packet-rtcp.c in the RTCP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.

  • CVE-2012-6061Dec 5, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The dissect_wtp_common function in epan/dissectors/packet-wtp.c in the WTP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 uses an incorrect data type for a certain length field, which allows remote attackers to cause a denial of service (integer overflow and…

  • CVE-2012-6060Dec 5, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    Integer overflow in the dissect_iscsi_pdu function in epan/dissectors/packet-iscsi.c in the iSCSI dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.

  • CVE-2012-6059Dec 5, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The dissect_isakmp function in epan/dissectors/packet-isakmp.c in the ISAKMP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 uses an incorrect data structure to determine IKEv2 decryption parameters, which allows remote attackers to cause a denial of service…

  • CVE-2012-6058Dec 5, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    Integer overflow in the dissect_icmpv6 function in epan/dissectors/packet-icmpv6.c in the ICMPv6 dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted Number of Sources value.

  • CVE-2012-6057Dec 5, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The dissect_eigrp_metric_comm function in epan/dissectors/packet-eigrp.c in the EIGRP dissector in Wireshark 1.8.x before 1.8.4 uses the wrong data type for a certain offset value, which allows remote attackers to cause a denial of service (integer overflow and infinite loop)…

  • CVE-2012-6056Dec 5, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    Integer overflow in the dissect_sack_chunk function in epan/dissectors/packet-sctp.c in the SCTP dissector in Wireshark 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted Duplicate TSN count.

  • CVE-2012-6055Dec 5, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    epan/dissectors/packet-3g-a11.c in the 3GPP2 A11 dissector in Wireshark 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a zero value in a sub-type length field.

  • CVE-2012-6054Dec 5, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The dissect_sflow_245_address_type function in epan/dissectors/packet-sflow.c in the sFlow dissector in Wireshark 1.8.x before 1.8.4 does not properly handle length calculations for an invalid IP address type, which allows remote attackers to cause a denial of service (infinite…

  • CVE-2012-6053Dec 5, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    epan/dissectors/packet-usb.c in the USB dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 relies on a length field to calculate an offset value, which allows remote attackers to cause a denial of service (infinite loop) via a zero value for this field.

  • CVE-2012-6052Dec 5, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    Wireshark 1.8.x before 1.8.4 allows remote attackers to obtain sensitive hostname information by reading pcap-ng files.

  • CVE-2012-4985Dec 5, 2012
    Forescout
    Counteract
    risk 0.00cvss —epss 0.02

    The Forescout CounterACT NAC device 6.3.4.1 does not block ARP and ICMP traffic from unrecognized clients, which allows remote attackers to conduct ARP poisoning attacks via crafted packets.

  • CVE-2012-4983Dec 5, 2012
    Forescout
    Counteract
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities on the Forescout CounterACT NAC device before 7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the a parameter to assets/login or (2) the query parameter to assets/rangesearch.

  • CVE-2012-4982Dec 5, 2012
    Forescout
    Counteract
    risk 0.04cvss —epss 0.09

    Open redirect vulnerability in assets/login on the Forescout CounterACT NAC device before 7.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the a parameter.

  • CVE-2012-4862Dec 5, 2012
    IBM
    Rational Developer For System Z
    risk 0.00cvss —epss 0.00

    The Host Connect emulator in IBM Rational Developer for System z 7.1 through 8.5.1 does not properly store the SSL certificate password, which allows local users to obtain sensitive information via unspecified vectors.

  • CVE-2012-4609Dec 5, 2012
    EMC Corporation
    Rsa Netwitness Informer
    risk 0.00cvss —epss 0.01

    The web interface in EMC RSA NetWitness Informer before 2.0.5.6 allows remote attackers to conduct clickjacking attacks via unspecified vectors.

  • CVE-2012-4608Dec 5, 2012
    EMC Corporation
    Rsa Netwitness Informer
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the web interface in EMC RSA NetWitness Informer before 2.0.5.6 allows remote attackers to hijack the authentication of arbitrary users.

  • CVE-2012-4347Dec 5, 2012
    Symantec
    Messaging Gateway
    risk 0.08cvss —epss 0.59

    Multiple directory traversal vulnerabilities in the management console in Symantec Messaging Gateway (SMG) 9.5.x allow remote authenticated users to read arbitrary files via a .. (dot dot) in the (1) logFile parameter in a logs action to brightmail/export or (2)…

  • CVE-2012-3317Dec 5, 2012
    IBM
    Websphere Message Broker
    risk 0.00cvss —epss 0.00

    IBM WebSphere Message Broker 6.1 before 6.1.0.11, 7.0 before 7.0.0.5, and 8.0 before 8.0.0.2 has incorrect ownership of certain uninstaller Java Runtime Environment (JRE) files, which might allow local users to gain privileges by leveraging access to uid 501 or gid 300.

  • CVE-2012-6067Dec 4, 2012
    Freeftpd
    Freeftpd
    risk 0.00cvss —epss 0.03

    freeFTPd.exe in freeFTPd through 1.0.11 allows remote attackers to bypass authentication via a crafted SFTP session, as demonstrated by an OpenSSH client with modified versions of ssh.c and sshconnect2.c.

  • CVE-2012-6066Dec 4, 2012
    Freesshd
    Freesshd
    risk 0.06cvss —epss 0.40

    freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demonstrated by an OpenSSH client with modified versions of ssh.c and sshconnect2.c.

  • CVE-2012-5975Dec 4, 2012
    SSH
    Tectia Server
    risk 0.06cvss —epss 0.36

    The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6.2.5, and 6.3.0 through 6.3.2 on UNIX and Linux, when old-style password authentication is enabled, allows remote attackers to bypass authentication via a…

  • CVE-2012-5138Dec 4, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 23.0.1271.95 does not properly handle file paths, which has unspecified impact and attack vectors.

  • CVE-2012-5137Dec 4, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.03

    Use-after-free vulnerability in Google Chrome before 23.0.1271.95 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the Media Source API.

  • CVE-2012-5129Dec 4, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Heap-based buffer overflow in the WebGL subsystem in Google Chrome OS before 23.0.1271.94 allows remote attackers to cause a denial of service (GPU process crash) or possibly have unspecified other impact via unknown vectors.

  • CVE-2012-6065Dec 3, 2012
    Drupal
    OM Maximenu
    risk 0.00cvss —epss 0.01

    The OM Maximenu module 6.x-1.43 and earlier for Drupal, when the "Title has PHP" option is enabled, allows remote authenticated users with the "Administer OM Maximenu" permission to execute arbitrary PHP code via a "Link Title," a different vulnerability than CVE-2012-5553.

  • CVE-2012-6064Dec 3, 2012
    Cmsmadesimple
    Cmsmadesimple
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. (dot dot) in the deld parameter. NOTE: this can be leveraged using CSRF…

  • CVE-2012-5859Dec 3, 2012
    Samsung Mobile
    Kies Air
    risk 0.00cvss —epss 0.02

    Samsung Kies Air 2.1.207051 and 2.1.210161 allows remote attackers to cause a denial of service (crash) via a crafted request to www/apps/KiesAir/jws/ssd.php.

  • CVE-2012-5858Dec 3, 2012
    Samsung Mobile
    Kies Air
    risk 0.03cvss —epss 0.04

    Samsung Kies Air 2.1.207051 and 2.1.210161 relies on the IP address for authentication, which allows remote man-in-the-middle attackers to read arbitrary phone contents by spoofing or controlling the IP address.

  • CVE-2012-5569Dec 3, 2012
    Drupal
    Basic webmail
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allow remote attackers to inject arbitrary web script or HTML via a (1) page title or (2) crafted email message.

  • CVE-2012-5559Dec 3, 2012
    Drupal
    Chaos tool suite (ctools)
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the page manager node view task in the Chaos tool suite (ctools) module 6.x-1.x before 6.x-1.10 for Drupal allows remote authenticated users with permissions to submit or edit nodes to inject arbitrary web script or HTML via the page…

  • CVE-2012-5557Dec 3, 2012
    Drupal
    User Read-Only
    risk 0.00cvss —epss 0.01

    The User Read-Only module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.4 for Drupal, does not properly assign roles when there are more than three roles on the site and certain unspecified configurations, which might allow remote authenticated users to gain privileges by…

  • CVE-2012-5556Dec 3, 2012
    Drupal
    restws
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the RESTful Web Services (RESTWS) module 7.x-1.x before 7.x-1.1 and 7.x-2.x before 7.x-2.0-alpha3 for Drupal allow remote attackers to hijack the authentication of arbitrary users via unknown vectors.

  • CVE-2012-5554Dec 3, 2012
    Coleman Watts
    Webform Civicrm
    risk 0.00cvss —epss 0.01

    The default configuration for the Webform CiviCRM Integration module 7.x-3.x before 7.x-3.2 has "Enforce Permissions" disabled, which allows remote attackers to obtain contact information by reading webforms.

  • CVE-2012-5553Dec 3, 2012
    Drupal
    OM Maximenu
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the OM Maximenu module 6.x-1.x before 6.x-1.44 and 7.x-1.x before 7.x-1.44 for Drupal allow remote authenticated users with the "administer OM Maximenu" permission to inject arbitrary web script or HTML via the (1) Menu…