VYPR

CVEs

347,154 total · page 5870 of 6,944

AllCriticalHighKEV
  • CVE-2012-5552Dec 3, 2012
    Drupal
    Password Policy
    risk 0.00cvss —epss 0.01

    The Password policy module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to obtain password hashes by sniffing the network, related to "client-side password history checks."

  • CVE-2012-5551Dec 3, 2012
    Drupal
    MailChimp
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the MailChimp module 7.x-2.x before 7.x-2.7 for Drupal allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) a predictable "webhook URL key" and (2) improper sanitization of "Webhook…

  • CVE-2012-5550Dec 3, 2012
    Drupal
    Time Spent
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-5549Dec 3, 2012
    Drupal
    Time Spent
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2012-5548Dec 3, 2012
    Drupal
    Time Spent
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-5547Dec 3, 2012
    Drupal
    Search API
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Search API module 7.x-1.x before 7.x-1.3 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) enable a server via a server action or (2) enable a search index via…

  • CVE-2012-5545Dec 3, 2012
    Sharethis
    Sharethis
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the ShareThis module 7.x-2.x before 7.x-2.5 for Drupal allow remote authenticated users with the "administer sharethis" permission to inject arbitrary web script or HTML via unspecified vectors related to "JavaScript…

  • CVE-2012-5544Dec 3, 2012
    Drupal
    Mandrill
    risk 0.00cvss —epss 0.01

    The Mandrill module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users to obtain password reset links by reading the logs in the Mandrill dashboard.

  • CVE-2012-5543Dec 3, 2012
    Drupal
    Feeds
    risk 0.00cvss —epss 0.01

    The Feeds module 7.x-2.x before 7.x-2.0-alpha6 for Drupal, when a field is mapped to the node's author, does not properly check permissions, which allows remote attackers to create arbitrary nodes via a crafted source feed.

  • CVE-2012-5542Dec 3, 2012
    Drupal
    Commerce Extra Panes
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Commerce Extra Panes module 7.x-1.x before 7.x-1.1 in Drupal allows remote attackers to hijack the authentication of administrators for requests that enable or disable a Commerce extra panes pane via unspecified vectors…

  • CVE-2012-5541Dec 3, 2012
    Drupal
    Twitter Pull
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Twitter Pull module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.0-rc3 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "data coming from Twitter."

  • CVE-2012-5540Dec 3, 2012
    Drupal
    Hostip
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Hostip module 6.x-2.x before 6.x-2.2 and 7.x-2.x before 7.x-2.2 for Drupal allow remote attackers with control of hostip.info to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-5539Dec 3, 2012
    Drupal
    Organic Groups
    risk 0.00cvss —epss 0.01

    The Organic Groups (OG) module 7.x-1.x before 7.x-1.5 for Drupal does not properly maintain pending group memberships, which allows remote authenticated users to post to arbitrary groups by modifying their own account while a pending membership is waiting to be approved.

  • CVE-2012-5538Dec 3, 2012
    Drupal
    FileField Sources
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the FileField Sources module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.6 for Drupal, when the field has "Reference existing" source enabled, allows remote authenticated users to inject arbitrary web script or HTML via the…

  • CVE-2012-5537Dec 3, 2012
    Drupal
    Simplenews Scheduler
    risk 0.00cvss —epss 0.01

    The Simplenews Scheduler module 6.x-2.x before 6.x-2.4 for Drupal allows remote authenticated users with the "send scheduled newsletters" permission to inject arbitrary PHP code into the scheduling form, which is later executed by cron.

  • CVE-2012-5534Dec 3, 2012
    Weechat
    Weechat
    risk 0.00cvss —epss 0.04

    The hook_process function in the plugin API for WeeChat 0.3.0 through 0.3.9.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a command from a plugin, related to "shell expansion."

  • CVE-2012-5450Dec 3, 2012
    Cmsmadesimple
    Cmsmadesimple
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) 1.11.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deld parameter.

  • CVE-2012-5367Dec 3, 2012
    Orangehrm
    Orangehrm
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in OrangeHRM 2.7.1 RC 1 allow remote authenticated administrators to execute arbitrary SQL commands via the sortField parameter to (1) viewCustomers, (2) viewPayGrades, or (3) viewSystemUsers in symfony/web/index.php/admin/, as demonstrated…

  • CVE-2012-3432Dec 3, 2012
    Xen
    Xen
    risk 0.00cvss —epss 0.01

    The handle_mmio function in arch/x86/hvm/io.c in the MMIO operations emulator for Xen 3.3 and 4.x, when running an HVM guest, does not properly reset certain state information between emulation cycles, which allows local guest OS users to cause a denial of service (guest OS…

  • CVE-2012-2934Dec 3, 2012
    Xen
    Xen
    risk 0.00cvss —epss 0.00

    Xen 4.0, and 4.1, when running a 64-bit PV guest on "older" AMD CPUs, does not properly protect against a certain AMD processor bug, which allows local guest OS users to cause a denial of service (host hang) via sequential execution of instructions across a non-canonical…

  • CVE-2012-1599Dec 3, 2012
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.01

    Joomla! 1.5.x before 1.5.26 does not properly check permissions, which allows attackers to obtain sensitive "administrative back end information" via unknown vectors. NOTE: this might be a duplicate of CVE-2012-1611.

  • CVE-2012-1598Dec 3, 2012
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.01

    Joomla! 1.5.x before 1.5.26 has unspecified impact and attack vectors related to "insufficient randomness" and a "password reset vulnerability."

  • CVE-2012-0218Dec 3, 2012
    Xen
    Xen
    risk 0.00cvss —epss 0.00

    Xen 3.4, 4.0, and 4.1, when the guest OS has not registered a handler for a syscall or sysenter instruction, does not properly clear a flag for exception injection when injecting a General Protection Fault, which allows local PV guest OS users to cause a denial of service (guest…

  • CVE-2012-5615Dec 3, 2012
    MariaDB
    MariaDB
    risk 0.04cvss —epss 0.15

    Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid…

  • CVE-2012-5614Dec 3, 2012
    MariaDB
    MariaDB
    risk 0.04cvss —epss 0.13

    Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (mysqld crash) via a SELECT command with an UpdateXML command containing XML with a large number of unique,…

  • CVE-2012-5613Dec 3, 2012
    MariaDB
    MariaDB
    risk 0.06cvss —epss 0.32

    MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows remote authenticated users to gain privileges by leveraging the FILE privilege…

  • CVE-2012-5612Dec 3, 2012
    MariaDB
    MariaDB
    risk 0.05cvss —epss 0.21

    Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code, as demonstrated…

  • CVE-2012-5611Dec 3, 2012
    MariaDB
    MariaDB
    risk 0.05cvss —epss 0.25

    Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53 and other versions through 5.1.66, and MariaDB 5.5.2.x before 5.5.28a, 5.3.x before 5.3.11, 5.2.x before 5.2.13 and 5.1.x before 5.1.66, allows remote…

  • CVE-2012-6063Nov 30, 2012
    Libssh
    Libssh
    risk 0.00cvss —epss 0.04

    Double free vulnerability in the sftp_mkdir function in sftp.c in libssh before 0.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors, a different vector than CVE-2012-4559.

  • CVE-2012-4571Nov 30, 2012
    Python (programming language)
    Keyring
    risk 0.00cvss —epss 0.00

    Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack.

  • CVE-2012-4562Nov 30, 2012
    Libssh
    Libssh
    risk 0.01cvss —epss 0.13

    Multiple integer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (infinite loop or crash) and possibly execute arbitrary code via unspecified vectors, which triggers a buffer overflow, infinite loop, or possibly some other unspecified…

  • CVE-2012-4561Nov 30, 2012
    Libssh
    Libssh
    risk 0.00cvss —epss 0.05

    The (1) publickey_make_dss, (2) publickey_make_rsa, (3) signature_from_string, (4) ssh_do_sign, and (5) ssh_sign_session_id functions in keys.c in libssh before 0.5.3 free "an invalid pointer on an error path," which might allow remote attackers to cause a denial of service…

  • CVE-2012-4560Nov 30, 2012
    Libssh
    Libssh
    risk 0.01cvss —epss 0.06

    Multiple buffer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors.

  • CVE-2012-4559Nov 30, 2012
    Libssh
    Libssh
    risk 0.00cvss —epss 0.05

    Multiple double free vulnerabilities in the (1) agent_sign_data function in agent.c, (2) channel_request function in channels.c, (3) ssh_userauth_pubkey function in auth.c, (4) sftp_parse_attr_3 function in sftp.c, and (5) try_publickey_from_file function in keyfiles.c in libssh…

  • CVE-2012-4551Nov 30, 2012
    Ps Project Management Team
    Libunity Webapps
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in libunity-webapps before 2.4.1 allows remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via a crafted web site, related to "certain hash tables."

  • CVE-2012-4479Nov 30, 2012
    Drupal
    Drag & Drop Gallery
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-4478Nov 30, 2012
    Drupal
    Drag & Drop Gallery
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to hijack the authentication of administrators.

  • CVE-2012-4477Nov 30, 2012
    Drupal
    Drag & Drop Gallery
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to bypass access restrictions via unknown attack vectors.

  • CVE-2012-4476Nov 30, 2012
    Drupal
    Drag & Drop Gallery
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-4475Nov 30, 2012
    Drupal
    Security Questions
    risk 0.00cvss —epss 0.01

    The Security Questions module for Drupal 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.1 does not properly restrict access, which allows remote attackers to edit an arbitrary user's questions and answers via unspecified vectors.

  • CVE-2012-4474Nov 30, 2012
    Drupal
    Colorbox Node
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Colorbox Node module 7.x-2.x before 7.x-2.2 for Drupal allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.

  • CVE-2012-4473Nov 30, 2012
    Christian Johansson
    Restrict Node Page View
    risk 0.00cvss —epss 0.01

    The Restrict node page view module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "view any node page" or "view any node {type} page" permission to access unpublished nodes via a direct request.

  • CVE-2012-4472Nov 30, 2012
    Drupal
    Drag & Drop Gallery
    risk 0.00cvss —epss 0.01

    Unrestricted file upload vulnerability in upload.php in the Drag & Drop Gallery module 6.x-1.5 and earlier for Drupal allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension followed by a safe extension, then accessing it via a…

  • CVE-2012-4471Nov 30, 2012
    Dominique Clause
    Search Autocomplete
    risk 0.00cvss —epss 0.01

    The Search Autocomplete module 7.x-2.x before 7.x-2.4 for Drupal does not properly restrict access to the module admin page, which allows remote attackers to disable an autocompletion or change the priority order via unspecified vectors.

  • CVE-2012-4470Nov 30, 2012
    Drupal
    Listhandler
    risk 0.00cvss —epss 0.01

    The Listhandler module 6.x-1.x before 6.x-1.1 for Drupal does not properly check permissions when importing emails, which allows remote comment authors to bypass access restrictions and possibly have other unspecified impact.

  • CVE-2012-4469Nov 30, 2012
    Drupal
    Hashcash
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Hashcash module 6.x-2.x before 6.x-2.6 and 7.x-2.x before 7.x-2.2 for Drupal, when "Log failed hashcash" is enabled, allows remote attackers to inject arbitrary web script or HTML via an invalid token, which is not properly handled…

  • CVE-2012-4468Nov 30, 2012
    Drupal
    Privatemsg
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Privatemsg module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via a user name in a private message.

  • CVE-2012-5568Nov 30, 2012
    Apache
    Tomcat
    risk 0.01cvss —epss 0.10

    Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.

  • CVE-2012-4834Nov 30, 2012
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in LayerLoader.jsp in the theme component in IBM WebSphere Portal 7.0.0.1 and 7.0.0.2 before CF19 and 8.0 before CF03 allows remote attackers to read arbitrary files via a crafted URI.

  • CVE-2012-4557Nov 30, 2012
    Apache
    HTTP Server
    risk 0.01cvss —epss 0.17

    The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an expensive request.