VYPR

CVEs

347,154 total · page 5875 of 6,944

AllCriticalHighKEV
  • CVE-2012-5905Nov 17, 2012
    KnFTP
    KnFTP
    risk 0.03cvss —epss 0.03

    Buffer overflow in KnFTPd 1.0.0 allows remote authenticated users to cause a denial of service (crash) via a long string in a FEAT command.

  • CVE-2012-5904Nov 17, 2012
    IrfanView
    Irfanview
    risk 0.00cvss —epss 0.06

    Heap-based buffer overflow in IrfanView before 4.33 allows remote attackers to execute arbitrary code via a crafted RLE compressed bitmap file such as a DIB, RLE, or BMP image.

  • CVE-2012-5903Nov 17, 2012
    Simple Machines
    Smf
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Simple Machines Forum (SMF) 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the scheduled parameter to index.php.

  • CVE-2012-5902Nov 17, 2012
    Dflabs
    Ptk
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in ptk/lib/modal_bookmark.php in DFLabs PTK 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the arg4 parameter.

  • CVE-2012-5901Nov 17, 2012
    Dflabs
    Ptk
    risk 0.00cvss —epss 0.01

    DFLabs PTK 1.0.5 stores data files with predictable names under the web document root with insufficient access control, which allows remote attackers to read logs, images, or reports via a direct request to the file in the (1) log, (2) images, or (3) report directory.

  • CVE-2012-5900Nov 17, 2012
    Samedia
    Landshop
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in SAMEDIA LandShop 0.9.2 allow remote attackers to execute arbitrary SQL commands via the (1) OB_ID parameter in a single action to admin/action/objects.php, (2) AREA_ID parameter in a single action to admin/action/areas.php, or (3) start…

  • CVE-2012-5899Nov 17, 2012
    Samedia
    Landshop
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin/action/objects.php in SAMEDIA LandShop 0.9.2 allows remote attackers to inject arbitrary web script or HTML via the OTR_HEADS[] parameter in an edit action. NOTE: some of these details are obtained from third party information.

  • CVE-2012-5898Nov 17, 2012
    Samedia
    Landshop
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in SAMEDIA LandShop 0.9.2 allows remote attackers to hijack the authentication of administrators for requests that change account settings.

  • CVE-2012-5897Nov 17, 2012
    Quest
    Intrust
    risk 0.03cvss —epss 0.04

    The (1) SimpleTree and (2) ReportTree classes in the ARDoc ActiveX control (ARDoc.dll) in Quest InTrust 10.4.0.853 and earlier do not properly implement the SaveToFile method, which allows remote attackers to write or overwrite arbitrary files via the bstrFileName argument.

  • CVE-2012-5896Nov 17, 2012
    Quest
    Intrust
    risk 0.09cvss —epss 0.69

    The Annotation Objects Extension ActiveX control in AnnotateX.dll in Quest InTrust 10.4.0.853 and earlier does not properly implement the Add method, which allows remote attackers to execute arbitrary code via a memory address in the first argument, related to an "uninitialized…

  • CVE-2012-5895Nov 17, 2012
    Irods
    Irods
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in iRODS before 3.1 have unknown impact and attack vectors.

  • CVE-2012-5894Nov 17, 2012
    Havalite
    CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the postId parameter.

  • CVE-2012-5893Nov 17, 2012
    Havalite
    CMS
    risk 0.00cvss —epss 0.03

    Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary code by uploading a file with a .php;.gif extension, then accessing it via a direct request to the file in tmp/files/.

  • CVE-2012-5892Nov 17, 2012
    Havalite
    CMS
    risk 0.00cvss —epss 0.01

    Havalite CMS 1.1.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the configuration database via a direct request for data/havalite.db3.

  • CVE-2012-5891Nov 17, 2012
    Dalbum
    Dalbum
    risk 0.03cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in photo/pass.php in DAlbum 1.44 build 174 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add a user via an add action, (2) change user passwords via a change…

  • CVE-2012-5890Nov 17, 2012
    Stanislas Rolland
    Sr Feuser Register
    risk 0.00cvss —epss 0.01

    The Front End User Registration (sr_feuser_register) extension before 2.6.2 for TYPO3 allows remote attackers to obtain user names and passwords via the (1) edit perspective or (2) autologin feature.

  • CVE-2012-5889Nov 17, 2012
    Alex Kellner
    Powermail
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the powermail extension before 1.6.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-5888Nov 17, 2012
    Benjamin Mack
    Seo Basics
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Basic SEO Features (seo_basics) extension before 0.8.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-5887Nov 17, 2012
    risk 0.01cvss —epss 0.12

    The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to…

  • CVE-2012-5886Nov 17, 2012
    Apache
    Tomcat
    risk 0.01cvss —epss 0.09

    The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via…

  • CVE-2012-5885Nov 17, 2012
    Apache
    Tomcat
    risk 0.01cvss —epss 0.09

    The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count)…

  • CVE-2012-5856Nov 17, 2012
    WordPress
    Uk Cookie
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Uk Cookie (aka uk-cookie) plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-5172Nov 16, 2012
    Asial
    Monaca Debugger
    risk 0.00cvss —epss 0.01

    The Asial Monaca Debugger application before 1.4.2 for Android allows remote attackers to obtain sensitive (1) account or (2) session ID information in a system log file via a crafted application.

  • CVE-2012-2733Nov 16, 2012
    Apache
    Tomcat
    risk 0.01cvss —epss 0.09

    java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 does not properly restrict the request-header size, which allows remote attackers to cause a denial of service (memory consumption) via a…

  • CVE-2012-5884Nov 16, 2012
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    The User.get method in Bugzilla/WebService/User.pm in Bugzilla 4.3.2 allows remote attackers to obtain sensitive information about the saved searches of arbitrary users via an XMLRPC request or a JSONRPC request, a different vulnerability than CVE-2012-4198.

  • CVE-2012-5883Nov 16, 2012
    YUI
    YUI 2
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.8.0 through 2.9.0, as used in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1, allows remote attackers to inject arbitrary web script or…

  • CVE-2012-5882Nov 16, 2012
    YUI
    YUI 2
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to uploader.swf, a similar issue to CVE-2010-4208.

  • CVE-2012-5881Nov 16, 2012
    Yahoo
    Yui
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to charts.swf, a similar issue to CVE-2010-4207.

  • CVE-2012-4199Nov 16, 2012
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    template/en/default/bug/field-events.js.tmpl in Bugzilla 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 generates JavaScript function calls containing private product names or private component names in certain…

  • CVE-2012-4198Nov 16, 2012
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    The User.get method in Bugzilla/WebService/User.pm in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 has a different outcome for a groups request depending on whether a group exists, which allows remote authenticated users…

  • CVE-2012-4197Nov 16, 2012
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    Bugzilla/Attachment.pm in attachment.cgi in Bugzilla 2.x and 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 allows remote attackers to read attachment descriptions from private bugs via an obsolete=1 insert action.

  • CVE-2012-4189Nov 16, 2012
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Bugzilla 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1, allows remote attackers to inject arbitrary web script or HTML via a field value that is not properly handled during construction of a tabular report, as…

  • CVE-2012-5777Nov 16, 2012
    Phome
    Empirecms
    risk 0.00cvss —epss 0.02

    Eval injection vulnerability in the ReplaceListVars function in the template parser in e/class/connect.php in EmpireCMS 6.6 allows user-assisted remote attackers to execute arbitrary PHP code via a crafted template.

  • CVE-2012-5523Nov 16, 2012
    Mantisbt
    Mantisbt
    risk 0.00cvss —epss 0.02

    core/email_api.php in MantisBT before 1.2.12 does not properly manage the sending of e-mail notifications about restricted bugs, which might allow remote authenticated users to obtain sensitive information by adding a note to a bug before losing permission to view that bug.

  • CVE-2012-5522Nov 16, 2012
    Mantisbt
    Mantisbt
    risk 0.00cvss —epss 0.01

    MantisBT before 1.2.12 does not use an expected default value during decisions about whether a user may modify the status of a bug, which allows remote authenticated users to bypass intended access restrictions and make status changes by leveraging a blank value for a per-status…

  • CVE-2012-4613Nov 16, 2012
    EMC Corporation
    Rsa Data Protection Manager Appliance
    risk 0.00cvss —epss 0.00

    EMC RSA Data Protection Manager Appliance 2.7.x and 3.x before 3.2.1 does not properly restrict the number of authentication attempts by a user account, which makes it easier for local users to bypass intended access restrictions via a brute-force attack.

  • CVE-2012-4612Nov 16, 2012
    EMC Corporation
    Rsa Data Protection Manager Appliance
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in EMC RSA Data Protection Manager Appliance and Software Server 2.7.x and 3.x before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-5851Nov 15, 2012
    Google
    Chrome
    risk 0.03cvss —epss 0.02

    html/parser/XSSAuditor.cpp in WebCore in WebKit, as used in Google Chrome through 22 and Safari 5.1.7, does not consider all possible output contexts of reflected data, which makes it easier for remote attackers to bypass a cross-site scripting (XSS) protection mechanism via a…

  • CVE-2012-4955Nov 15, 2012
    Dell
    Openmanage Server Administrator
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Dell OpenManage Server Administrator (OMSA) before 6.5.0.1, 7.0 before 7.0.0.1, and 7.1 before 7.1.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-4954Nov 15, 2012
    Lussumo
    Vanilla
    risk 0.00cvss —epss 0.01

    The edit-profile page in Vanilla Forums before 2.1a32 allows remote authenticated users to modify arbitrary profile settings by replacing the UserID value during a man-in-the-middle attack, related to a "parameter manipulation" issue.

  • CVE-2012-4951Nov 15, 2012
    Verifone
    Vericentre Web Console
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in terminal/paramedit.aspx in VeriFone VeriCentre Web Console before 2.2 build 36 allow remote attackers to execute arbitrary SQL commands via the (1) TerminalId, (2) ModelName, or (3) ApplicationName parameter.

  • CVE-2012-5860Nov 14, 2012
    Oberthur
    ID One Cosmo
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability on Oberthur ID-One COSMO 5.2, 5.2a, and 64 smart cards makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging the generation of non-compliant public keys.

  • CVE-2012-5459Nov 14, 2012
    VMware
    Workstation
    risk 0.00cvss —epss 0.01

    Untrusted search path vulnerability in VMware Workstation 8.x before 8.0.5 and VMware Player 4.x before 4.0.5 on Windows allows host OS users to gain host OS privileges via a Trojan horse DLL in a "system folder."

  • CVE-2012-5458Nov 14, 2012
    VMware
    Workstation
    risk 0.00cvss —epss 0.01

    VMware Workstation 8.x before 8.0.5 and VMware Player 4.x before 4.0.5 on Windows use weak permissions for unspecified process threads, which allows host OS users to gain host OS privileges via a crafted application.

  • CVE-2012-4953Nov 14, 2012
    Symantec
    Endpoint Protection
    risk 0.00cvss —epss 0.06

    The decomposer engine in Symantec Endpoint Protection (SEP) 11.0, Symantec Endpoint Protection Small Business Edition 12.0, Symantec AntiVirus Corporate Edition (SAVCE) 10.x, and Symantec Scan Engine (SSE) before 5.2.8 does not properly perform bounds checks of the contents of…

  • CVE-2012-4949Nov 14, 2012
    Esri
    Arcgis Server
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for a REST service.

  • CVE-2012-4948Nov 14, 2012
    Fortinet
    Fortigate
    risk 0.00cvss —epss 0.00

    The default configuration of Fortinet Fortigate UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence…

  • CVE-2012-4853Nov 14, 2012
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Application Server 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger information…

  • CVE-2012-4851Nov 14, 2012
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server 8.5 Liberty Profile before 8.5.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URI.

  • CVE-2012-4850Nov 14, 2012
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    IBM WebSphere Application Server 8.5 Liberty Profile before 8.5.0.1, when JAX-RS is used, does not properly validate requests, which allows remote attackers to gain privileges via unspecified vectors.