VYPR

CVEs

347,079 total · page 5894 of 6,942

AllCriticalHighKEV
  • CVE-2010-4824Sep 17, 2012
    Silverstripe
    Silverstripe
    risk 0.00cvss —epss 0.03

    SQL injection vulnerability in the augmentSQL method in core/model/Translatable.php in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4, when the Translatable extension is enabled, allows remote attackers to execute arbitrary SQL commands via the locale parameter.

  • CVE-2010-4823Sep 17, 2012
    Silverstripe
    Silverstripe
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the httpError method in sapphire/core/control/RequestHandler.php in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4, when custom error handling is not used, allows remote attackers to inject arbitrary web script or HTML via…

  • CVE-2010-4822Sep 17, 2012
    Silverstripe
    Silverstripe
    risk 0.00cvss —epss 0.02

    core/model/MySQLDatabase.php in SilverStripe 2.4.x before 2.4.4, when the site is running in "live mode," allows remote attackers to obtain the SQL queries for a page via the showqueries and ajax parameters.

  • CVE-2012-2996Sep 17, 2012
    Trend Micro
    Interscan Messaging Security Suite
    risk 0.03cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in saveAccountSubTab.imss in Trend Micro InterScan Messaging Security Suite 7.1-Build_Win32_1394 allows remote attackers to hijack the authentication of administrators for requests that create admin accounts via a saveAuth action.

  • CVE-2012-2995Sep 17, 2012
    Trend Micro
    Interscan Messaging Security Suite
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro InterScan Messaging Security Suite 7.1-Build_Win32_1394 allow remote attackers to inject arbitrary web script or HTML via (1) the wrsApprovedURL parameter to addRuleAttrWrsApproveUrl.imss or (2) the src parameter…

  • CVE-2012-2575Sep 17, 2012
    Netwin
    Surgemail
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in NetWin SurgeMail 6.0a4 allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of an IFRAME element in the body of an HTML e-mail message.

  • CVE-2012-3924Sep 16, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    The SSLVPN implementation in Cisco IOS 15.1 and 15.2, when DTLS is enabled, does not properly handle certain outbound ACL configurations, which allows remote authenticated users to cause a denial of service (device crash) via a session involving a PPP over ATM (PPPoA) interface,…

  • CVE-2012-3923Sep 16, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    The SSLVPN implementation in Cisco IOS 12.4, 15.0, 15.1, and 15.2, when DTLS is not enabled, does not properly handle certain outbound ACL configurations, which allows remote authenticated users to cause a denial of service (device crash) via a session involving a PPP over ATM…

  • CVE-2012-3919Sep 16, 2012
    Cisco Systems, Inc.
    Application Control Engine Module
    risk 0.00cvss —epss 0.01

    The Cisco Application Control Engine (ACE) module 3.0 for Cisco Catalyst switches and Cisco routers does not properly monitor Load Balancer (LB) queues, which allows remote attackers to cause a denial of service (incorrect memory access and module reboot) via application…

  • CVE-2012-3915Sep 16, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    The DMVPN tunnel implementation in Cisco IOS 15.2 allows remote attackers to cause a denial of service (persistent IKE state) via a large volume of hub-to-spoke traffic, aka Bug ID CSCtq39602.

  • CVE-2012-3908Sep 16, 2012
    Cisco Systems, Inc.
    Identity Services Engine Software
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the ISE Administrator user interface (aka the Apache Tomcat interface) on Cisco Identity Services Engine (ISE) 3300 series appliances before 1.1.0.665 Cumulative Patch 1 allow remote attackers to hijack the…

  • CVE-2012-3901Sep 16, 2012
    Cisco Systems, Inc.
    IPS 4200 series sensors
    risk 0.00cvss —epss 0.01

    The updateTime function in sensorApp on Cisco IPS 4200 series sensors 7.0 and 7.1 allows remote attackers to cause a denial of service (process crash and traffic-inspection outage) via network traffic, aka Bug ID CSCta96144.

  • CVE-2012-3899Sep 16, 2012
    Cisco Systems, Inc.
    IPS 4200 series
    risk 0.00cvss —epss 0.01

    sensorApp on Cisco IPS 4200 series sensors 6.0, 6.2, and 7.0 does not properly allocate memory, which allows remote attackers to cause a denial of service (memory corruption and process crash, and traffic-inspection outage) via network traffic, aka Bug ID CSCtn23051.

  • CVE-2012-3895Sep 16, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    Cisco IOS 15.0 through 15.3 allows remote authenticated users to cause a denial of service (device crash) via an MVPNv6 update, aka Bug ID CSCty89224.

  • CVE-2012-3893Sep 16, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    The FlexVPN implementation in Cisco IOS 15.2 and 15.3 allows remote authenticated users to cause a denial of service (spoke crash) via spoke-to-spoke traffic, aka Bug ID CSCtz02622.

  • CVE-2012-3096Sep 16, 2012
    Cisco Systems, Inc.
    Unity Connection
    risk 0.00cvss —epss 0.01

    Cisco Unity Connection (UC) 7.1, 8.0, and 8.5 allows remote authenticated users to cause a denial of service (resource consumption and administration outage) via extended use of the product, aka Bug ID CSCtd79132.

  • CVE-2012-3094Sep 16, 2012
    Cisco Systems, Inc.
    Anyconnect Secure Mobility Client
    risk 0.00cvss —epss 0.01

    The VPN downloader in the download_install component in Cisco AnyConnect Secure Mobility Client 3.1.x before 3.1.00495 on Linux accepts arbitrary X.509 server certificates without user interaction, which allows remote attackers to obtain sensitive information via vectors…

  • CVE-2012-3088Sep 16, 2012
    Cisco Systems, Inc.
    Anyconnect Secure Mobility Client
    risk 0.00cvss —epss 0.02

    Cisco AnyConnect Secure Mobility Client 3.1.x before 3.1.00495, and 3.2.x, does not check whether an HTTP request originally contains ScanSafe headers, which allows remote attackers to have an unspecified impact via a crafted request, aka Bug ID CSCua13166.

  • CVE-2012-3079Sep 16, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Cisco IOS 12.2 allows remote attackers to cause a denial of service (CPU consumption) by establishing many IPv6 neighbors, aka Bug ID CSCtn78957.

  • CVE-2012-3060Sep 16, 2012
    Cisco Systems, Inc.
    Unity Connection
    risk 0.00cvss —epss 0.01

    Cisco Unity Connection (UC) 8.6, 9.0, and 9.5 allows remote attackers to cause a denial of service (CPU consumption) via malformed UDP packets, aka Bug ID CSCtz76269.

  • CVE-2012-3052Sep 16, 2012
    Cisco Systems, Inc.
    VPN Client
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in Cisco VPN Client 5.0 allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka Bug ID CSCua28747.

  • CVE-2012-3051Sep 16, 2012
    Cisco Systems, Inc.
    Nexus 7000
    risk 0.00cvss —epss 0.01

    Cisco NX-OS 5.2 and 6.1 on Nexus 7000 series switches allows remote attackers to cause a denial of service (process crash or packet loss) via a large number of ARP packets, aka Bug ID CSCtr44822.

  • CVE-2012-4930Sep 15, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The SPDY protocol 3 and earlier, as used in Mozilla Firefox, Google Chrome, and other products, can perform TLS encryption of compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP…

  • CVE-2012-4929Sep 15, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.04

    The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by…

  • CVE-2012-4928Sep 15, 2012
    Oxwall
    Oxwall
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in ow_updates/index.php in Oxwall 1.1.1 allows remote attackers to inject arbitrary web script or HTML via the plugin parameter.

  • CVE-2012-4927Sep 15, 2012
    Limesurvey
    Limesurvey
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in Limesurvey (a.k.a PHPSurveyor) before 1.91+ Build 120224 and earlier allows remote attackers to execute arbitrary SQL commands via the fieldnames parameter to index.php.

  • CVE-2012-4926Sep 15, 2012
    Imgpals
    Img Pals Photo Host
    risk 0.03cvss —epss 0.02

    approve.php in Img Pals Photo Host 1.0 does not authenticate requests, which allows remote attackers to change the activation of administrators via the u parameter in an (1) app0 (disable) or (2) app1 (enable) action.

  • CVE-2012-4925Sep 15, 2012
    Imgpals
    Img Pals Photo Host
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in approve.php in Img Pals Photo Host 1.0 allow remote attackers to execute arbitrary SQL commands via the u parameter in a (1) app0 or (2) app1 action. NOTE: the provenance of this information is unknown; the details are obtained solely…

  • CVE-2012-4924Sep 15, 2012
    Asus
    Net4switch
    risk 0.06cvss —epss 0.36

    Buffer overflow in the CxDbgPrint function in the ipswcom.dll ActiveX component 1.0.0.1 for ASUS Net4Switch 1.0.0020 allows remote attackers to execute arbitrary code via a long parameter to the Alert method.

  • CVE-2012-4923Sep 15, 2012
    Endian
    Firewall
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Endian Firewall 2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) createrule parameter to dnat.cgi, (2) addrule parameter to dansguardian.cgi, or (3) PATH_INFO to openvpn_users.cgi.

  • CVE-2012-4336Sep 15, 2012
    Flogr
    Flogr
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in Flogr 2.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO or (2) an arbitrary parameter.

  • CVE-2012-3458Sep 15, 2012
    Python (programming language)
    Beaker
    risk 0.00cvss —epss 0.02

    Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.

  • CVE-2012-3233Sep 15, 2012
    Kayako
    Fusion
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in __swift/thirdparty/PHPExcel/PHPExcel/Shared/JAMA/docs/download.php in Kayako Fusion 4.40.1148, and possibly before 4.50.1581, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

  • CVE-2012-2275Sep 15, 2012
    Testlink
    Testlink
    risk 0.00cvss —epss 0.03

    Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijack the authentication of users for requests that add, delete, or modify sensitive information, as demonstrated by changing the administrator's email via an…

  • CVE-2011-5176Sep 15, 2012
    Bananadance
    Banana Dance
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in search.php in Banana Dance, possibly B.1.5 and earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) q or (2) category parameter.

  • CVE-2011-5175Sep 15, 2012
    Bananadance
    Banana Dance
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in search.php in Banana Dance, possibly B.1.5 and earlier, allows remote attackers to execute arbitrary SQL commands via the category parameter.

  • CVE-2011-5174Sep 15, 2012
    Intel
    C206 Chipset
    risk 0.00cvss —epss 0.00

    Buffer overflow in Intel Trusted Execution Technology (TXT) SINIT Authenticated Code Modules (ACM) in Intel Q67 Express, C202, C204, C206 Chipsets, and Mobile Intel QM67, and QS67 Chipset before 2nd_gen_i5_i7_SINIT_51.BIN Express; Intel Q57, 3450 Chipsets and Mobile Intel QM57…

  • CVE-2011-5173Sep 15, 2012
    Bugbear Entertainment
    Flatout
    risk 0.03cvss —epss 0.03

    Buffer overflow in Bugbear Entertainment FlatOut 2005 allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the title field in a bed file.

  • CVE-2011-5172Sep 15, 2012
    StoryBoard Quick
    StoryBoard Quick
    risk 0.04cvss —epss 0.06

    Stack-based buffer overflow in StoryBoard Quick 6 Build 3786, and possibly StoryBoard Artist and StoryBoard Studio, allows remote attackers to execute arbitrary code via a long string in the string element field in a frame xml file.

  • CVE-2011-5171Sep 15, 2012
    Cyberlink
    Power2go
    risk 0.07cvss —epss 0.46

    Multiple stack-based buffer overflows in CyberLink Power2Go 7 (build 196) and 8 (build 1031) allow remote attackers to execute arbitrary code via the (1) src and (2) name parameters in a p2g project file.

  • CVE-2011-5170Sep 15, 2012
    Castillo Bueno Systems
    CCMPlayer
    risk 0.06cvss —epss 0.32

    Stack-based buffer overflow in Castillo Bueno Systems CCMPlayer 1.5 allows remote attackers to execute arbitrary code via a long track name in an m3u playlist.

  • CVE-2011-5169Sep 15, 2012
    SonicWall
    ViewPoint
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in sgms/reports/scheduledreports/configure/scheduleProps.jsp in SonicWall ViewPoint 6.0 SP2 allows remote attackers to execute arbitrary SQL commands via the scheduleID parameter.

  • CVE-2011-5168Sep 15, 2012
    Bananadance
    Banana Dance
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in user.php in Banana Dance before B.1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2011-5167Sep 15, 2012
    Tidestone
    Formula One Activex Control
    risk 0.04cvss —epss 0.10

    Heap-based buffer overflow in the SetDevNames method of the Tidestone Formula One ActiveX control (TTF16.ocx) 6.3.5 Build 1 in Oracle Hyperion Strategic Finance 12.x and possibly earlier allows remote attackers to execute arbitrary code via a long string to the DriverName…

  • CVE-2011-5166Sep 15, 2012
    KnFTP
    KnFTP
    risk 0.04cvss —epss 0.06

    Multiple stack-based buffer overflows in KnFTP 1.0.0 allow remote attackers to execute arbitrary code via a long string to the (1) USER, (2) PASS, (3) REIN, (4) QUIT, (5) PORT, (6) PASV, (7) TYPE, (8) STRU, (9) MODE, (10) RETR, (11) STOR, (12) APPE, (13) ALLO, (14) REST, (15)…

  • CVE-2011-5165Sep 15, 2012
    Cleanersoft
    Free Mp3 Cd Ripper
    risk 0.06cvss —epss 0.37

    Stack-based buffer overflow in Free MP3 CD Ripper 1.1, 2.6 and earlier, when converting a file, allows user-assisted remote attackers to execute arbitrary code via a crafted .wav file.

  • CVE-2011-5164Sep 15, 2012
    VanDyke Software
    Absoluteftp
    risk 0.05cvss —epss 0.29

    Stack-based buffer overflow in VanDyke Software AbsoluteFTP 1.9.6 through 2.2.10 allows remote FTP servers to execute arbitrary code via a crafted file name in a LIST command response.

  • CVE-2011-5163Sep 15, 2012
    Schneider Electric
    Citectscada
    risk 0.00cvss —epss 0.00

    Buffer overflow in an unspecified third-party component in the Batch module for Schneider Electric CitectSCADA before 7.20 and Mitsubishi MX4 SCADA before 7.20 allows local users to execute arbitrary code via a long string in a login sequence.

  • CVE-2011-5162Sep 15, 2012
    Gomlab
    GOM Player
    risk 0.04cvss —epss 0.07

    Stack-based buffer overflow in GOM Player 2.1.33.5071 allows user-assisted remote attackers to execute arbitrary code via a .ASX file with a long URI in the "ref href" tag. NOTE: this issue exists because of a CVE-2007-0707 regression.

  • CVE-2012-4360Sep 15, 2012
    Google
    Mod Pagespeed
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the mod_pagespeed module 0.10.19.1 through 0.10.22.4 for the Apache HTTP Server allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.