VYPR

CVEs

347,154 total · page 5876 of 6,944

AllCriticalHighKEV
  • CVE-2012-4847Nov 14, 2012
    IBM
    Cognos Business Intelligence
    risk 0.00cvss —epss 0.01

    IBM Cognos Business Intelligence (BI) 8.4 and 8.4.1 allows remote authenticated users to cause a denial of service (CPU consumption) via a crafted request containing a zero-valued byte.

  • CVE-2012-3569Nov 14, 2012
    VMware
    Workstation
    risk 0.07cvss —epss 0.48

    Format string vulnerability in VMware OVF Tool 2.1 on Windows, as used in VMware Workstation 8.x before 8.0.5, VMware Player 4.x before 4.0.5, and other products, allows user-assisted remote attackers to execute arbitrary code via a crafted OVF file.

  • CVE-2012-3330Nov 14, 2012
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    The proxy server in IBM WebSphere Application Server 7.0 before 7.0.0.27, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1, and WebSphere Virtual Enterprise, allows remote attackers to cause a denial of service (daemon outage) via a crafted request.

  • CVE-2012-2619Nov 14, 2012
    Broadcom Corporation
    Bcm4325
    risk 0.04cvss —epss 0.13

    The Broadcom BCM4325 and BCM4329 Wi-Fi chips, as used in certain Acer, Apple, Asus, Ford, HTC, Kyocera, LG, Malata, Motorola, Nokia, Pantech, Samsung, and Sony products, allow remote attackers to cause a denial of service (out-of-bounds read and Wi-Fi outage) via an RSN 802.11i…

  • CVE-2012-4777Nov 14, 2012
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.25

    The code-optimization feature in the reflection implementation in Microsoft .NET Framework 4 and 4.5 does not properly enforce object permissions, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET…

  • CVE-2012-4776Nov 14, 2012
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.25

    The Web Proxy Auto-Discovery (WPAD) functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not validate configuration data that is returned during acquisition of proxy settings, which allows remote attackers to execute arbitrary JavaScript code by…

  • CVE-2012-4775HigNov 14, 2012
    Microsoft
    Internet Explorer
    risk 0.59cvss 8.8epss 0.22

    Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site, aka "CTreeNode Use After Free Vulnerability."

  • CVE-2012-2553Nov 14, 2012
    Microsoft
    Windows
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application, aka "Win32k Use…

  • CVE-2012-2543Nov 14, 2012
    Microsoft
    Office
    risk 0.02cvss —epss 0.26

    Stack-based buffer overflow in Microsoft Excel 2007 SP2 and SP3 and 2010 SP1; Office 2011 for Mac; Excel Viewer; and Office Compatibility Pack SP2 and SP3 allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel Stack Overflow Vulnerability."

  • CVE-2012-2532Nov 14, 2012
    Microsoft
    FTP Service
    risk 0.03cvss —epss 0.42

    Microsoft FTP Service 7.0 and 7.5 for Internet Information Services (IIS) processes unspecified commands before TLS is enabled for a session, which allows remote attackers to obtain sensitive information by reading the replies to these commands, aka "FTP Command Injection…

  • CVE-2012-2531Nov 14, 2012
    Microsoft
    Internet Information Server
    risk 0.00cvss —epss 0.01

    Microsoft Internet Information Services (IIS) 7.5 uses weak permissions for the Operational log, which allows local users to discover credentials by reading this file, aka "Password Disclosure Vulnerability."

  • CVE-2012-2530Nov 14, 2012
    Microsoft
    Windows
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted…

  • CVE-2012-2519Nov 14, 2012
    Microsoft
    .net Framework
    risk 0.00cvss —epss 0.03

    Untrusted search path vulnerability in Entity Framework in ADO.NET in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, and 4 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains…

  • CVE-2012-1896Nov 14, 2012
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.24

    Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not properly consider trust levels during construction of output data, which allows remote attackers to obtain sensitive information via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application,…

  • CVE-2012-1895Nov 14, 2012
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.23

    The reflection implementation in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5.1, and 4 does not properly enforce object permissions, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET…

  • CVE-2012-1887Nov 14, 2012
    Microsoft
    Office
    risk 0.02cvss —epss 0.25

    Use-after-free vulnerability in Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 SP1, and Office 2008 and 2011 for Mac, allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel SST Invalid Length Use After Free Vulnerability."

  • CVE-2012-1886Nov 14, 2012
    Microsoft
    Excel
    risk 0.02cvss —epss 0.22

    Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Excel Viewer; and Office Compatibility Pack SP2 and SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted spreadsheet, aka "Excel Memory Corruption…

  • CVE-2012-1885Nov 14, 2012
    Microsoft
    Office
    risk 0.02cvss —epss 0.29

    Heap-based buffer overflow in Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Office 2008 and 2011 for Mac; and Office Compatibility Pack SP2 and SP3 allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel SerAuxErrBar Heap Overflow…

  • CVE-2012-1539HigNov 14, 2012
    Microsoft
    Internet Explorer
    risk 0.55cvss 8.1epss 0.25

    Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site, aka "CTreePos Use After Free Vulnerability."

  • CVE-2012-1538Nov 14, 2012
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.21

    Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site, aka "CFormElement Use After Free Vulnerability."

  • CVE-2012-1528Nov 14, 2012
    Microsoft
    Windows
    risk 0.01cvss —epss 0.18

    Integer overflow in Windows Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 allows local users to gain privileges via a crafted briefcase,…

  • CVE-2012-1527Nov 14, 2012
    Microsoft
    Windows
    risk 0.01cvss —epss 0.18

    Integer underflow in Windows Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 allows local users to gain privileges via a crafted briefcase,…

  • CVE-2012-5673Nov 13, 2012
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 10.3.183.29 and 11.x before 11.2.202.243 on Linux, before 11.1.111.19 on Android 2.x and 3.x, and before 11.1.115.20 on Android 4.x; Adobe AIR before…

  • CVE-2012-5287Nov 13, 2012
    Adobe Inc.
    Air
    risk 0.01cvss —epss 0.07

    Buffer overflow in Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 10.3.183.29 and 11.x before 11.2.202.243 on Linux, before 11.1.111.19 on Android 2.x and 3.x, and before 11.1.115.20 on Android 4.x; Adobe AIR before 3.4.0.2710;…

  • CVE-2012-5286Nov 13, 2012
    Adobe Inc.
    Air
    risk 0.01cvss —epss 0.07

    Buffer overflow in Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 10.3.183.29 and 11.x before 11.2.202.243 on Linux, before 11.1.111.19 on Android 2.x and 3.x, and before 11.1.115.20 on Android 4.x; Adobe AIR before 3.4.0.2710;…

  • CVE-2012-5285Nov 13, 2012
    Adobe Inc.
    Air
    risk 0.01cvss —epss 0.09

    Buffer overflow in Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 10.3.183.29 and 11.x before 11.2.202.243 on Linux, before 11.1.111.19 on Android 2.x and 3.x, and before 11.1.115.20 on Android 4.x; Adobe AIR before 3.4.0.2710;…

  • CVE-2012-1813Nov 13, 2012
    C3 Ilex
    Eoscada
    risk 0.00cvss —epss 0.02

    eosfailoverservice.exe in C3-ilex EOScada before 11.0.19.2 allows remote attackers to cause a denial of service by sending a large amount of data to TCP port 12000.

  • CVE-2012-1812Nov 13, 2012
    C3 Ilex
    Eoscada
    risk 0.00cvss —epss 0.02

    eosfailoverservice.exe in C3-ilex EOScada before 11.0.19.2 allows remote attackers to obtain sensitive cleartext information via a session on TCP port 12000.

  • CVE-2012-1811Nov 13, 2012
    C3 Ilex
    Eoscada
    risk 0.00cvss —epss 0.02

    EOSDataServer.exe in C3-ilex EOScada before 11.0.19.2 allows remote attackers to cause a denial of service by sending a large amount of data to TCP port 24006.

  • CVE-2012-1810Nov 13, 2012
    C3 Ilex
    Eoscada
    risk 0.00cvss —epss 0.02

    EOSCoreScada.exe in C3-ilex EOScada before 11.0.19.2 allows remote attackers to cause a denial of service (daemon restart) by sending data to TCP port (1) 5050 or (2) 24004.

  • CVE-2012-5827Nov 11, 2012
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.01

    Joomla! 2.5.x before 2.5.8 and 3.0.x before 3.0.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors involving "Inadequate protection."

  • CVE-2012-5482Nov 11, 2012
    OpenStack
    Essex
    risk 0.00cvss —epss 0.03

    The v2 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to delete arbitrary non-protected images via an image deletion request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-4573.

  • CVE-2012-4884Nov 11, 2012
    Bestpractical
    Rt
    risk 0.00cvss —epss 0.02

    Argument injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to create arbitrary files via unspecified vectors related to the GnuPG client.

  • CVE-2012-4734Nov 11, 2012
    Bestpractical
    Rt
    risk 0.00cvss —epss 0.02

    Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to conduct a "confused deputy" attack to bypass the CSRF warning protection mechanism and cause victims to "modify arbitrary state" via unknown vectors related to a crafted link.

  • CVE-2012-4732Nov 11, 2012
    Bestpractical
    Rt
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Request Tracker (RT) 3.8.12 and other versions before 3.8.15, and 4.0.6 and other versions before 4.0.8, allows remote attackers to hijack the authentication of users for requests that toggle ticket bookmarks.

  • CVE-2012-4731Nov 11, 2012
    Bestpractical
    Rtfm
    risk 0.00cvss —epss 0.02

    FAQ manager for Request Tracker (RTFM) before 2.4.5 does not properly check user rights, which allows remote authenticated users to create arbitrary articles in arbitrary classes via unknown vectors.

  • CVE-2012-4730Nov 11, 2012
    Bestpractical
    Rt
    risk 0.00cvss —epss 0.01

    Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote authenticated users with ModifySelf or AdminUser privileges to inject arbitrary email headers and conduct phishing attacks or obtain sensitive information via unknown vectors.

  • CVE-2012-4573Nov 11, 2012
    OpenStack
    Essex
    risk 0.00cvss —epss 0.03

    The v1 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to delete arbitrary non-protected images via an image deletion request, a different vulnerability than CVE-2012-5482.

  • CVE-2012-4564Nov 11, 2012
    LibTIFF
    Libtiff
    risk 0.01cvss —epss 0.14

    ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow, a zero-memory allocation, and a heap-based…

  • CVE-2012-4554Nov 11, 2012
    Drupal
    Drupal
    risk 0.04cvss —epss 0.16

    The OpenID module in Drupal 7.x before 7.16 allows remote OpenID servers to read arbitrary files via a crafted DOCTYPE declaration in an XRDS file.

  • CVE-2012-4553Nov 11, 2012
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    Drupal 7.x before 7.16 allows remote attackers to obtain sensitive information and possibly re-install Drupal and execute arbitrary PHP code via an external database server, related to "transient conditions."

  • CVE-2012-4548Nov 11, 2012
    Cgit
    cgit
    risk 0.00cvss —epss 0.03

    Argument injection vulnerability in syntax-highlighting.sh in cgit 9.0.3 and earlier allows remote authenticated users with permissions to add files to execute arbitrary commands via the --plug-in argument to the highlight command.

  • CVE-2012-4540Nov 11, 2012
    IcedTea
    IcedTea-Web
    risk 0.00cvss —epss 0.03

    Off-by-one error in the invoke function in IcedTeaScriptablePluginObject.cc in IcedTea-Web 1.1.x before 1.1.7, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.x before 1.4.1 allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly…

  • CVE-2012-4515Nov 11, 2012
    KDE
    Kde
    risk 0.04cvss —epss 0.06

    Use-after-free vulnerability in khtml/rendering/render_replaced.cpp in Konqueror in KDE 4.7.3, when the context menu is shown, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by accessing an iframe when it is being updated.

  • CVE-2012-4514Nov 11, 2012
    KDE
    Kde
    risk 0.04cvss —epss 0.10

    rendering/render_replaced.cpp in Konqueror in KDE before 4.9.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted web page, related to "trying to reuse a frame with a null part."

  • CVE-2012-4513Nov 11, 2012
    KDE
    Kde
    risk 0.04cvss —epss 0.13

    khtml/imload/scaledimageplane.h in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service (crash) and possibly read memory via large canvas dimensions, which leads to an unexpected sign extension and a heap-based buffer over-read.

  • CVE-2012-4505Nov 11, 2012
    Libproxy Project
    Libproxy
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in the px_pac_reload function in lib/pac.c in libproxy 0.2.x and 0.3.x allows remote servers to have an unspecified impact via a crafted Content-Length size in an HTTP response header for a proxy.pac file request, a different vulnerability than…

  • CVE-2012-4504Nov 11, 2012
    Libproxy Project
    Libproxy
    risk 0.00cvss —epss 0.03

    Stack-based buffer overflow in the url::get_pac function in url.cpp in libproxy 0.4.x before 0.4.9 allows remote servers to have an unspecified impact via a large proxy.pac file.

  • CVE-2012-3523Nov 11, 2012
    Isc
    Inn
    risk 0.00cvss —epss 0.03

    The STARTTLS implementation in nnrpd in INN before 2.5.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext…

  • CVE-2012-2455Nov 10, 2012
    Advance Productivity Software
    Dte Axiom
    risk 0.00cvss —epss 0.01

    Advanced Productivity Software DTE Axiom before 12.3.3 does not validate the registration ID, which allows remote attackers to bypass authentication and read or modify data about users, customers, and projects via unspecified vectors.