VYPR

CVEs

347,079 total · page 5904 of 6,942

AllCriticalHighKEV
  • CVE-2012-3958Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in the nsHTMLEditRules::DeleteNonTableElements function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute…

  • CVE-2012-3957Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.08

    Heap-based buffer overflow in the nsBlockFrame::MarkLineDirty function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via…

  • CVE-2012-3956Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in the MediaStreamGraphThreadRunnable::Run function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary…

  • CVE-2012-3581Aug 29, 2012
    Symantec
    Messaging Gateway
    risk 0.00cvss —epss 0.01

    Symantec Messaging Gateway (SMG) before 10.0 allows remote attackers to obtain potentially sensitive information about component versions via unspecified vectors.

  • CVE-2012-3580Aug 29, 2012
    Symantec
    Messaging Gateway
    risk 0.00cvss —epss 0.01

    Symantec Messaging Gateway (SMG) before 10.0 allows remote authenticated users to modify the web application by leveraging access to the management interface.

  • CVE-2012-3579Aug 29, 2012
    Symantec
    Messaging Gateway
    risk 0.06cvss —epss 0.40

    Symantec Messaging Gateway (SMG) before 10.0 has a default password for an unspecified account, which makes it easier for remote attackers to obtain privileged access via an SSH session.

  • CVE-2012-1976Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in the nsHTMLSelectElement::SubmitNamesValues function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary…

  • CVE-2012-1975Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in the PresShell::CompleteMove function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause…

  • CVE-2012-1974Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in the gfxTextRun::CanBreakLineBefore function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or…

  • CVE-2012-1973Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in the nsObjectLoadingContent::LoadObject function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary…

  • CVE-2012-1972Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in the nsHTMLEditor::CollapseAdjacentTextNodes function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute…

  • CVE-2012-1971Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey before 2.12 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via…

  • CVE-2012-1970Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allow remote attackers to cause a denial of service (memory…

  • CVE-2012-1956Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey before 2.12 do not prevent use of the Object.defineProperty method to shadow the location object (aka window.location), which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks…

  • CVE-2012-0308Aug 29, 2012
    Symantec
    Messaging Gateway
    risk 0.03cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in Symantec Messaging Gateway (SMG) before 10.0 allows remote attackers to hijack the authentication of administrators.

  • CVE-2012-0307Aug 29, 2012
    Symantec
    Messaging Gateway
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Symantec Messaging Gateway (SMG) before 10.0 allow remote attackers to inject arbitrary web script or HTML via (1) web content or (2) e-mail content.

  • CVE-2011-5128Aug 29, 2012
    WordPress
    Adminimize
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Adminimize plugin before 1.7.22 for WordPress allow remote attackers to inject arbitrary web script or HTML via the page parameter to (1) inc-options/deinstall_options.php, (2) inc-options/theme_options.php, or (3)…

  • CVE-2011-4926Aug 29, 2012
    WordPress
    Adminimize
    risk 0.04cvss —epss 0.11

    Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2011-4918Aug 29, 2012
    Elxis
    CMS
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Elxis CMS 2009.2, 2009.3 and 2009.3 Aphrodite before revision 2684 allow remote attackers to inject arbitrary web script or HTML via the (1) task parameter to elxis/index.php, and (2) PATH_INFO to…

  • CVE-2012-4686Aug 28, 2012
    Jelsoft
    Vbulletin
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in announcement.php in vBulletin 4.1.10 allows remote attackers to execute arbitrary SQL commands via the announcementid parameter.

  • CVE-2012-4685Aug 28, 2012
    Arbor Networks
    Peakflow Sp
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Arbor Networks Peakflow SP 5.1.1 before patch 6, 5.5 before patch 4, and 5.6.0 before patch 1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.

  • CVE-2012-2085Aug 28, 2012
    Gajim
    Gajim
    risk 0.00cvss —epss 0.03

    The exec_command function in common/helpers.py in Gajim before 0.15 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in an href attribute.

  • CVE-2012-1650Aug 28, 2012
    Giantrobot
    Zipcart
    risk 0.00cvss —epss 0.01

    The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead of the "access ZipCart downloads" permission when building archives, which allows remote authenticated users with access content permission to bypass intended access restrictions.

  • CVE-2012-1647Aug 28, 2012
    Mediafront
    Mediafront
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the "stand alone PHP application for the OSM Player," as used in the MediaFront module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.5 for Drupal, allow remote attackers to inject arbitrary web script or HTML via (1)…

  • CVE-2012-1645Aug 28, 2012
    Drupal
    CDN
    risk 0.00cvss —epss 0.01

    The CDN module 6.x-2.2 and 7.x-2.2 for Drupal, when running in Origin Pull mode with the "Far Future expiration" option enabled, allows remote attackers to read arbitrary PHP files via unspecified vectors, as demonstrated by reading settings.php.

  • CVE-2012-1644Aug 28, 2012
    Drupal
    OG Vocabulary
    risk 0.00cvss —epss 0.01

    The Organic Groups (OG) Vocabulary module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with certain administrator permissions to modify the vocabularies of other groups via unspecified vectors.

  • CVE-2012-1643Aug 28, 2012
    Drupal
    Faster Permissions
    risk 0.00cvss —epss 0.01

    The Faster Permissions module 7.x-2.x before 7.x-1.2 for Drupal does not check the "administer permissions" permission, which allows remote attackers to modify access permissions via unspecified vectors.

  • CVE-2012-1642Aug 28, 2012
    Drupal
    Link checker
    risk 0.00cvss —epss 0.02

    includes/linkchecker.pages.inc in the Link checker module 6.x-2.x before 6.x-2.5 for Drupal does not properly enforce access permissions on broken links, which allows remote attackers to obtain sensitive information via unspecified vectors.

  • CVE-2012-1641Aug 28, 2012
    Danielb
    Finder
    risk 0.00cvss —epss 0.02

    The finder_import function in the Finder module 6.x-1.x before 6.x-1.26, 7.x-1.x, and 7.x-2.x before 7.x-2.0-alpha8 for Drupal allows remote authenticated users with the administer finder permission to execute arbitrary PHP code via admin/build/finder/import.

  • CVE-2012-1635Aug 28, 2012
    Drupal
    revisioning
    risk 0.00cvss —epss 0.01

    The hook_node_access function in the revisioning module 7.x-1.x before 7.x-1.3 for Drupal checks the permissions of the current user even when it is called to check permissions of other users, which allows remote attackers to bypass intended access restrictions, as demonstrated…

  • CVE-2012-4681CriKEVAug 28, 2012
    Sun Corporation
    Java SE
    risk 0.93cvss 9.8epss 0.99

    Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findCla…

  • CVE-2012-4680Aug 27, 2012
    Ioserver
    Ioserver
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in the XML Server in IOServer before 1.0.19.0, when the Root Directory pathname lacks a trailing \ (backslash) character, allows remote attackers to read arbitrary files or list arbitrary directories via a .. (dot dot) in a URI.

  • CVE-2012-4036Aug 27, 2012
    Pbboard
    Pbboard
    risk 0.03cvss —epss 0.03

    Unrestricted file upload vulnerability in admin.php in PBBoard 2.1.4 allows remote administrators to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in the addons directory. NOTE: this vulnerability…

  • CVE-2012-3467Aug 27, 2012
    Apache
    Qpid
    risk 0.01cvss —epss 0.06

    Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication.

  • CVE-2012-3421Aug 27, 2012
    Performancecopilot
    Pcp
    risk 0.00cvss —epss 0.03

    The pduread function in pdu.c in libpcp in Performance Co-Pilot (PCP) before 3.6.5 does not properly time out connections, which allows remote attackers to cause a denial of service (pmcd hang) by sending individual bytes of a PDU separately, related to an "event-driven…

  • CVE-2012-3420Aug 27, 2012
    Sgi
    Performance Co Pilot
    risk 0.00cvss —epss 0.02

    Multiple memory leaks in Performance Co-Pilot (PCP) before 3.6.5 allow remote attackers to cause a denial of service (memory consumption or daemon crash) via a large number of PDUs with (1) a crafted context number to the DoFetch function in pmcd/src/dofetch.c or (2) a negative…

  • CVE-2012-3419Aug 27, 2012
    Sgi
    Performance Co Pilot
    risk 0.00cvss —epss 0.02

    Performance Co-Pilot (PCP) before 3.6.5 exports some of the /proc file system, which allows attackers to obtain sensitive information such as proc/pid/maps and command line arguments.

  • CVE-2012-3418Aug 27, 2012
    Sgi
    Performance Co Pilot
    risk 0.00cvss —epss 0.06

    libpcp in Performance Co-Pilot (PCP) before 3.6.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via (1) a PDU with the numcreds field value greater than the number of actual elements to the __pmDecodeCreds function in p_creds.c; (2) the…

  • CVE-2012-3410Aug 27, 2012
    GNU
    Bash
    risk 0.00cvss —epss 0.00

    Stack-based buffer overflow in lib/sh/eaccess.c in GNU Bash before 4.2 patch 33 might allow local users to bypass intended restricted shell access via a long filename in /dev/fd, which is not properly handled when expanding the /dev/fd prefix.

  • CVE-2012-1586Aug 27, 2012
    cifs-utils
    mount.cifs
    risk 0.03cvss —epss 0.01

    mount.cifs in cifs-utils 2.6 allows local users to determine the existence of arbitrary files or directories via the file path in the second argument, which reveals their existence in an error message.

  • CVE-2012-0855Aug 27, 2012
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.02

    Heap-based buffer overflow in the get_sot function in the J2K decoder (j2k.c) in libavcodec in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) via unspecified vectors related to the curtileno variable.

  • CVE-2012-0849Aug 27, 2012
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.01

    Integer overflow in the ff_j2k_dwt_init function in libavcodec/j2k_dwt.c in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted JPEG2000 image that triggers an incorrect check for a negative value.

  • CVE-2011-4944Aug 27, 2012
    Python (programming language)
    Python
    risk 0.00cvss —epss 0.00

    Python 2.6 through 3.2 creates ~/.pypirc with world-readable permissions before changing them after data has been written, which introduces a race condition that allows local users to obtain a username and password by reading this file.

  • CVE-2012-4679Aug 27, 2012
    Sourcefabric
    Newscoop
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin/login.php in Newscoop before 3.5.5 allows remote attackers to inject arbitrary web script or HTML via the f_user_name parameter.

  • CVE-2012-2129Aug 27, 2012
    Dokuwiki
    Dokuwiki
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in doku.php in DokuWiki 2012-01-25 Angua allows remote attackers to inject arbitrary web script or HTML via the target parameter in an edit action.

  • CVE-2012-2128Aug 27, 2012
    Dokuwiki
    Dokuwiki
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in doku.php in DokuWiki 2012-01-25 Angua allows remote attackers to hijack the authentication of administrators for requests that add arbitrary users. NOTE: this issue has been disputed by the vendor, who states that it is…

  • CVE-2012-2112Aug 27, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x before 4.5.15, 4.6.x before 4.6.8, and 4.7 allows remote attackers to inject arbitrary web script or HTML via exception messages.

  • CVE-2012-1935Aug 27, 2012
    Sourcefabric
    Newscoop
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in Newscoop 3.5.x before 3.5.5 and 4.x before 4 RC4 allow remote attackers to inject arbitrary web script or HTML via the (1) Back parameter to admin/ad.php, or the (2) token or (3) f_email parameter to…

  • CVE-2012-1934Aug 27, 2012
    Sourcefabric
    Newscoop
    risk 0.00cvss —epss 0.03

    SQL injection vulnerability in admin/country/edit.php in Newscoop before 3.5.5 and 4.x before 4 RC4 allows remote attackers to execute arbitrary SQL commands via the f_country_code parameter.

  • CVE-2012-1933Aug 27, 2012
    Sourcefabric
    Newscoop
    risk 0.00cvss —epss 0.06

    Multiple PHP remote file inclusion vulnerabilities in Newscoop 3.5.x before 3.5.5 and 4 before RC4, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[g_campsiteDir] parameter to (1) include/phorum_load.php, (2)…