VYPR

CVEs

347,079 total · page 5903 of 6,942

AllCriticalHighKEV
  • CVE-2012-4600Aug 31, 2012
    OTRS
    Otrs
    risk 0.04cvss —epss 0.06

    Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.14, 3.0.x before 3.0.16, and 3.1.x before 3.1.10, when Firefox or Opera is used, allows remote attackers to inject arbitrary web script or HTML via an e-mail message body…

  • CVE-2012-4170Aug 31, 2012
    Adobe Inc.
    Photoshop
    risk 0.04cvss —epss 0.11

    Buffer overflow in Adobe Photoshop CS6 13.x before 13.0.1 allows remote attackers to execute arbitrary code via a crafted file.

  • CVE-2012-4009Aug 31, 2012
    Cybozu
    Live
    risk 0.00cvss —epss 0.02

    The WebView class in the Cybozu Live application 1.0.4 and earlier for Android allows remote attackers to execute arbitrary JavaScript code, and obtain sensitive information, via a crafted application that places this code into a local file associated with a file: URL.

  • CVE-2012-4008Aug 31, 2012
    Cybozu
    Live
    risk 0.00cvss —epss 0.02

    The Cybozu Live application 1.0.4 and earlier for Android allows remote attackers to execute arbitrary Java methods, and obtain sensitive information or execute arbitrary commands, via a crafted web site.

  • CVE-2012-2186Aug 31, 2012
    Asterisk
    Certified Asterisk
    risk 0.00cvss —epss 0.04

    Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert6, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x…

  • CVE-2012-3136Aug 30, 2012
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans, a different vulnerability than CVE-2012-1682.

  • CVE-2012-1682Aug 30, 2012
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans, a different vulnerability than CVE-2012-3136. …

  • CVE-2012-0547Aug 30, 2012
    Sun Corporation
    Jre
    risk 0.04cvss —epss 0.12

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier, and 6 Update 34 and earlier, has no impact and remote attack vectors involving AWT and "a security-in-depth issue that is not directly exploitable but which can be…

  • CVE-2012-3548Aug 30, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    The dissect_drda function in epan/dissectors/packet-drda.c in Wireshark 1.6.x through 1.6.10 and 1.8.x through 1.8.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a small value for a certain length field in a capture file.

  • CVE-2012-3325Aug 30, 2012
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.45, 7.0.x before 7.0.0.25, 8.0.x before 8.0.0.5, and 8.5.x Full Profile before 8.5.0.1, when the PM44303 fix is installed, does not properly validate credentials, which allows remote authenticated users to obtain…

  • CVE-2011-5136Aug 30, 2012
    Epractizelabs
    Subscription Manager
    risk 0.00cvss —epss 0.02

    showImg.php in EPractize Labs Subscription Manager, possibly 1.0, allows remote attackers to overwrite arbitrary files via the db parameter.

  • CVE-2011-5135Aug 30, 2012
    Docebo
    Docebo
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the save_connection function in lib/lib.iotask.php in the iotask module in DoceboLMS 4.0.4 and earlier allow remote authenticated users with admin or teacher privileges to execute arbitrary SQL commands via the (1)…

  • CVE-2011-5134Aug 30, 2012
    JoomlaContentEditor
    JCE
    risk 0.00cvss —epss 0.01

    Unrestricted file upload vulnerability in editor/extensions/browser/file.php in the JCE component before 2.0.18 for Joomla! allows remote authenticated users with the author privileges to execute arbitrary PHP code by uploading a file with a double extension, as demonstrated by…

  • CVE-2011-5133Aug 30, 2012
    MyBB
    Mybb
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in MyBB before 1.6.5 has unknown impact and attack vectors, related to an "unparsed user avatar in the buddy list."

  • CVE-2011-5132Aug 30, 2012
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in MyBB before 1.6.5 allows remote attackers to inject arbitrary web script or HTML via vectors related to "usernames via AJAX."

  • CVE-2011-5131Aug 30, 2012
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in global.php in MyBB before 1.6.5 allows remote attackers to hijack the authentication of a user for requests that change the user's language via the language parameter.

  • CVE-2011-5130Aug 30, 2012
    Family Connections
    Family Connections CMS
    risk 0.06cvss —epss 0.37

    dev/less.php in Family Connections CMS (FCMS) 2.5.0 - 2.7.1, when register_globals is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the argv[1] parameter.

  • CVE-2011-5129Aug 30, 2012
    Xchat
    Xchat
    risk 0.04cvss —epss 0.08

    Heap-based buffer overflow in XChat 2.8.9 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long response string.

  • CVE-2011-1398Aug 30, 2012
    PHP
    PHP
    risk 0.04cvss —epss 0.10

    The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to…

  • CVE-2012-4010Aug 30, 2012
    Opera
    Opera
    risk 0.00cvss —epss 0.01

    Opera before 11.60 allows remote attackers to spoof the address bar via unspecified homograph characters, a different vulnerability than CVE-2010-2660.

  • CVE-2012-3254Aug 30, 2012
    Microfocus
    iNode Management Center
    risk 0.01cvss —epss 0.10

    Multiple unspecified vulnerabilities in HP iNode Management Center before iNode PC 5.1 E0304 allow remote attackers to execute arbitrary code via crafted input, as demonstrated by a stack-based buffer overflow in iNodeMngChecker.exe for a crafted 0x0A0BF007 packet.

  • CVE-2012-3253Aug 30, 2012
    Microfocus
    Intelligent Management Center
    risk 0.01cvss —epss 0.10

    Multiple unspecified vulnerabilities in HP Intelligent Management Center (IMC) before 5.0 E0101P05 allow remote attackers to execute arbitrary code via crafted input, as demonstrated by an integer overflow and heap-based buffer overflow in img.exe for a crafted message packet.

  • CVE-2012-4736Aug 29, 2012
    Sophos
    Safeguard Enterprise
    risk 0.00cvss —epss 0.00

    The Device Encryption Client component in Sophos SafeGuard Enterprise 6.0, when a volume-based encryption policy is enabled in conjunction with a user-defined key, does not properly block use of exFAT USB flash drives, which makes it easier for local users to bypass intended…

  • CVE-2012-3312Aug 29, 2012
    IBM
    Infosphere Guardium
    risk 0.00cvss —epss 0.02

    The datasource definition editor in IBM InfoSphere Guardium 8.2 and earlier, when the save-password setting is enabled, transmits cleartext database credentials, which allows remote attackers to obtain sensitive information by sniffing the network.

  • CVE-2012-3309Aug 29, 2012
    IBM
    Infosphere Guardium
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the account-creation panel in IBM InfoSphere Guardium 8.2 and earlier, when the CSRF filtering (aka csrf_status) feature is disabled, allows remote attackers to hijack the authentication of administrators for requests that…

  • CVE-2012-3295Aug 29, 2012
    IBM
    Websphere Mq
    risk 0.00cvss —epss 0.01

    IBM WebSphere MQ 7.1, when an SVRCONN channel is used, allows remote attackers to bypass the security-configuration setup step and obtain queue-manager access via unspecified vectors.

  • CVE-2012-2285Aug 29, 2012
    EMC Corporation
    Cloud Tiering Appliance
    risk 0.00cvss —epss 0.01

    EMC Cloud Tiering Appliance (aka CTA, formerly FMA) 9.0 and earlier, and Cloud Tiering Appliance Virtual Edition (CTA/VE) 9.0 and earlier, allows remote attackers to obtain GUI administrative access by sending a crafted file during the authentication phase.

  • CVE-2011-4578Aug 29, 2012
    Tedfelix
    Acpid
    risk 0.00cvss —epss 0.00

    event.c in acpid (aka acpid2) before 2.0.11 does not have an appropriate umask setting during execution of event-handler scripts, which might allow local users to (1) perform write operations within directories created by a script, or (2) read files created by a script, via…

  • CVE-2011-2777Aug 29, 2012
    Tedfelix
    Acpid
    risk 0.03cvss —epss 0.01

    samples/powerbtn/powerbtn.sh in acpid (aka acpid2) 2.0.16 and earlier uses the pidof program incorrectly, which allows local users to gain privileges by running a program with the name kded4 and a DBUS_SESSION_BUS_ADDRESS environment variable containing commands.

  • CVE-2012-3980Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The web console in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, and Thunderbird ESR 10.x before 10.0.7 allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that injects…

  • CVE-2012-3979Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox before 15.0 on Android does not properly implement unspecified callers of the __android_log_print function, which allows remote attackers to execute arbitrary code via a crafted web page that calls the JavaScript dump function.

  • CVE-2012-3978Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The nsLocation::CheckURL function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 does not properly follow the security model of the location object, which allows remote…

  • CVE-2012-3976Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, and SeaMonkey before 2.12 do not properly handle onLocationChange events during navigation between different https sites, which allows remote attackers to spoof the X.509 certificate information in the address bar via…

  • CVE-2012-3975Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The DOMParser component in Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey before 2.12 loads subresources during parsing of text/html data within an extension, which allows remote attackers to obtain sensitive information by providing crafted data to…

  • CVE-2012-3974Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in the installer in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, and Thunderbird ESR 10.x before 10.0.7 on Windows allows local users to gain privileges via a Trojan horse executable file in a root…

  • CVE-2012-3973Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    The debugger in the developer-tools subsystem in Mozilla Firefox before 15.0, when remote debugging is disabled, does not properly restrict access to the remote-debugging service, which allows remote attackers to execute arbitrary code by leveraging the presence of the…

  • CVE-2012-3972Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The format-number functionality in the XSLT implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to obtain sensitive information via…

  • CVE-2012-3971Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Summer Institute of Linguistics (SIL) Graphite 2, as used in Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey before 2.12, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the (1)…

  • CVE-2012-3970Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in the nsTArray_base::Length function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a…

  • CVE-2012-3969Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Integer overflow in the nsSVGFEMorphologyElement::Filter function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via a…

  • CVE-2012-3968Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in the WebGL implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via vectors related…

  • CVE-2012-3967Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The WebGL implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 on Linux, when a large number of sampler uniforms are used, does not properly interact with Mesa…

  • CVE-2012-3966Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a negative height value in a…

  • CVE-2012-3965Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox before 15.0 does not properly restrict navigation to the about:newtab page, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers creation of a new tab and then a new window.

  • CVE-2012-3964Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in the gfxTextRun::GetUserData function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause…

  • CVE-2012-3963Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in the js::gc::MapAllocToTraceKind function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via…

  • CVE-2012-3962Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 do not properly iterate through the characters in a text run, which allows remote attackers to execute arbitrary code via a crafted…

  • CVE-2012-3961Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.07

    Use-after-free vulnerability in the RangeData implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial…

  • CVE-2012-3960Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in the mozSpellChecker::SetCurrentDictionary function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary…

  • CVE-2012-3959Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in the nsRangeUpdater::SelAdjDeleteNode function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code…