VYPR

CVEs

347,095 total · page 5891 of 6,942

AllCriticalHighKEV
  • CVE-2012-3260Sep 25, 2012
    Microfocus
    Sitescope
    risk 0.06cvss —epss 0.40

    Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1462.

  • CVE-2012-3259Sep 25, 2012
    Microfocus
    Sitescope
    risk 0.05cvss —epss 0.60

    Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1461.

  • CVE-2012-3037Sep 25, 2012
    Siemens Foundation
    Simatic S7 1200 Firmware
    risk 0.00cvss —epss 0.01

    The Siemens SIMATIC S7-1200 2.x PLC does not properly protect the private key of the SIMATIC CONTROLLER Certification Authority certificate, which allows remote attackers to spoof the S7-1200 web server by using this key to create a forged certificate.

  • CVE-2012-3011Sep 25, 2012
    Fultek
    Wintr SCADA
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in the web server in Fultek WinTr Scada 4.0.5 and earlier allows remote attackers to read arbitrary files via a crafted request.

  • CVE-2012-2287Sep 25, 2012
    EMC Corporation
    Rsa Authentication Agent
    risk 0.00cvss —epss 0.03

    The authentication functionality in EMC RSA Authentication Agent 7.1 and RSA Authentication Client 3.5 on Windows XP and Windows Server 2003, when an unspecified configuration exists, allows remote authenticated users to bypass an intended token-authentication step, and…

  • CVE-2012-5054HigKEVSep 24, 2012
    Adobe Inc.
    Flashplayer
    risk 0.71cvss 8.8epss 0.21

    Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code via malformed arguments.

  • CVE-2012-4655Sep 24, 2012
    Cisco Systems, Inc.
    Secure Desktop
    risk 0.00cvss —epss 0.05

    The WebLaunch feature in Cisco Secure Desktop before 3.6.6020 does not properly validate binaries that are received by the downloader process, which allows remote attackers to execute arbitrary code via vectors involving (1) ActiveX or (2) Java components, aka Bug IDs CSCtz76128…

  • CVE-2012-3451Sep 24, 2012
    Apache
    Cxf
    risk 0.00cvss —epss 0.09

    Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body.

  • CVE-2012-5105Sep 23, 2012
    Sqlitemanager
    Sqlitemanager
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in SQLiteManager 1.2.4 allow remote attackers to inject arbitrary web script or HTML via the dbsel parameter to (1) main.php or (2) index.php; or (3) nsextt parameter to index.php.

  • CVE-2012-5104Sep 23, 2012
    Ubbcentral
    Ubb.threads
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in forums/ubbthreads.php in UBB.threads 7.5.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the Loginname parameter.

  • CVE-2012-5103Sep 23, 2012
    Shiromuku
    Guestbook
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in action/add-submit.php in Ggb Guestbook 0.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) url or (2) message parameter.

  • CVE-2012-5102Sep 23, 2012
    VertrigoServ
    VertrigoServ
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in inc/extensions.php in VertrigoServ 2.25 allows remote attackers to inject arbitrary web script or HTML via the ext parameter.

  • CVE-2012-5101Sep 23, 2012
    Jextensions
    Je Poll Component
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the JExtensions JE Poll component before 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-5100Sep 23, 2012
    Luizpicanco
    Hserver
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in HServer 0.1.1 allows remote attackers to read arbitrary files via a (1) ..%5c (dot dot encoded backslash) or (2) %2e%2e%5c (encoded dot dot backslash) in the PATH_INFO.

  • CVE-2012-5099Sep 23, 2012
    Phpb2b
    Phpb2b
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in list.php in PHPB2B 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action.

  • CVE-2012-5098Sep 23, 2012
    J Waite
    PHP X Links
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Php-X-Links, possibly 1.0, allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to rate.php, (2) cid parameter to view.php, or (3) t parameter to pop.php.

  • CVE-2011-5201Sep 23, 2012
    Tinyguestbook
    tinyguestbook
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in sign.php in tinyguestbook allow remote attackers to execute arbitrary SQL commands via the (1) name and (2) msg parameters. NOTE: some of these details are obtained from third party information.

  • CVE-2011-5200Sep 23, 2012
    Dedecms
    Dedecms
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in DeDeCMS, possibly 5.6, allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) list.php, (2) members.php, or (3) book.php.

  • CVE-2011-5199Sep 23, 2012
    Tinyguestbook
    tinyguestbook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in sign.php in tinyguestbook allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

  • CVE-2011-5198Sep 23, 2012
    Neturf
    Ecommerce Shopping Cart
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in search.php in Neturf eCommerce Shopping Cart allows remote attackers to execute arbitrary SQL commands via the SearchFor parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2011-5197Sep 23, 2012
    Public Knowledge Project
    Open Harvester Systems
    risk 0.03cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in index/manager/fileUpload in Public Knowledge Project Open Harvester Systems 2.3.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that upload PHP files.

  • CVE-2011-5196Sep 23, 2012
    Public Knowledge Project
    Open Journal Systems
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in index/manager/fileUpload in Public Knowledge Project Open Journal Systems 2.3.6 and earlier allows remote attackers to hijack the authentication of administrators for requests that upload PHP files.

  • CVE-2011-5195Sep 23, 2012
    Public Knowledge Project
    Open Conference Systems
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in index/manager/fileUpload in Public Knowledge Project Open Conference Systems 2.3.4 and earlier allows remote attackers to hijack the authentication of administrators for requests that upload a PHP file.

  • CVE-2011-5194Sep 23, 2012
    WordPress
    Whois Search
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin before 1.4.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the domain parameter, a different vulnerability than CVE-2011-5193.

  • CVE-2011-5193Sep 23, 2012
    WordPress
    Whois Search
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin 1.4.2.3 for WordPress, when the WHOIS widget is enabled, allows remote attackers to inject arbitrary web script or HTML via the domain parameter to index.php, a different…

  • CVE-2011-5192Sep 23, 2012
    Blairwilliams
    Pretty Link Lite Plugin
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite plugin before 1.5.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the slug parameter, a different vulnerability than CVE-2011-5191.

  • CVE-2011-5191Sep 23, 2012
    WordPress
    Pretty Link
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite plugin before 1.5.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the slug parameter, a different vulnerability than CVE-2011-5192.

  • CVE-2012-3137Sep 21, 2012
    Oracle Corporation
    Database Server
    risk 0.06cvss —epss 0.31

    The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to…

  • CVE-2012-2557Sep 21, 2012
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "cloneNode Use After Free Vulnerability."

  • CVE-2012-2548Sep 21, 2012
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Layout Use After Free Vulnerability."

  • CVE-2012-2546Sep 21, 2012
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Event Listener Use After Free Vulnerability."

  • CVE-2012-1529Sep 21, 2012
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    Use-after-free vulnerability in Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly initialized or (2) is deleted, aka "OnMove Use After Free Vulnerability."

  • CVE-2012-3747Sep 20, 2012
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.02

    WebKit, as used in Apple iOS before 6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

  • CVE-2012-3746Sep 20, 2012
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.01

    UIWebView in UIKit in Apple iOS before 6 does not properly use the Data Protection feature, which allows context-dependent attackers to obtain cleartext file content by leveraging direct access to a device's filesystem.

  • CVE-2012-3745Sep 20, 2012
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.02

    Off-by-one error in Telephony in Apple iOS before 6 allows remote attackers to cause a denial of service (buffer overflow and connectivity outage) via a crafted user-data header in an SMS message.

  • CVE-2012-3744Sep 20, 2012
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.02

    Telephony in Apple iOS before 6 uses an SMS message's return address as the displayed sender address, which allows remote attackers to spoof text communication via a message in which the return address does not match the originating address.

  • CVE-2012-3743Sep 20, 2012
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.02

    The System Logs implementation in Apple iOS before 6 does not restrict /var/log access by sandboxed apps, which allows remote attackers to obtain sensitive information via a crafted app that reads log files.

  • CVE-2012-3742Sep 20, 2012
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    Safari in Apple iOS before 6 does not properly restrict use of an unspecified Unicode character that looks similar to the https lock indicator, which allows remote attackers to spoof https connections by placing this character in the TITLE element of a web page.

  • CVE-2012-3741Sep 20, 2012
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.00

    The Restrictions (aka Parental Controls) implementation in Apple iOS before 6 does not properly handle purchase attempts after a Disable Restrictions action, which allows local users to bypass an intended Apple ID authentication step via an app that performs purchase…

  • CVE-2012-3740Sep 20, 2012
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.00

    The Passcode Lock implementation in Apple iOS before 6 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement via unspecified vectors.

  • CVE-2012-3739Sep 20, 2012
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.00

    The Passcode Lock implementation in Apple iOS before 6 allows physically proximate attackers to bypass an intended passcode requirement via vectors involving use of the camera.

  • CVE-2012-3738Sep 20, 2012
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.00

    The Emergency Dialer screen in the Passcode Lock implementation in Apple iOS before 6 does not properly limit the dialing methods, which allows physically proximate attackers to bypass intended access restrictions and make FaceTime calls through Voice Dialing, or obtain…

  • CVE-2012-3737Sep 20, 2012
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.00

    The Passcode Lock implementation in Apple iOS before 6 does not properly restrict photo viewing, which allows physically proximate attackers to view arbitrary stored photos by spoofing a time value.

  • CVE-2012-3736Sep 20, 2012
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.00

    The Passcode Lock implementation in Apple iOS before 6 allows physically proximate attackers to bypass an intended passcode requirement via vectors related to ending a FaceTime call.

  • CVE-2012-3735Sep 20, 2012
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.00

    The Passcode Lock implementation in Apple iOS before 6 does not properly interact with the "Slide to Power Off" feature, which allows physically proximate attackers to see the most recently used third-party app by watching the device's screen.

  • CVE-2012-3734Sep 20, 2012
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.00

    Office Viewer in Apple iOS before 6 writes cleartext document data to a temporary file, which might allow local users to bypass a document's intended (1) Data Protection level or (2) encryption state by reading the temporary content.

  • CVE-2012-3733Sep 20, 2012
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.01

    Messages in Apple iOS before 6, when multiple iMessage e-mail addresses are configured, does not ensure that a reply's sender address matches the recipient address of the original message, which allows remote attackers to obtain potentially sensitive information about alternate…

  • CVE-2012-3732Sep 20, 2012
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.01

    Mail in Apple iOS before 6 uses an S/MIME message's From address as the displayed sender address, which allows remote attackers to spoof signed content via an e-mail message in which the From field does not match the signer's identity.

  • CVE-2012-3731Sep 20, 2012
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.00

    Mail in Apple iOS before 6 does not properly implement the Data Protection feature for e-mail attachments, which allows physically proximate attackers to bypass an intended passcode requirement via unspecified vectors.

  • CVE-2012-3730Sep 20, 2012
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.02

    Mail in Apple iOS before 6 does not properly handle reuse of Content-ID header values, which allows remote attackers to spoof attachments via a header value that was also used in a previous e-mail message, as demonstrated by a message from a different sender.