VYPR

CVEs

347,079 total · page 5907 of 6,942

AllCriticalHighKEV
  • CVE-2012-4672Aug 25, 2012
    Apple Inc.
    Ichat Server
    risk 0.00cvss —epss 0.01

    Apple iChat Server does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via responses for domains that were not asserted.

  • CVE-2012-4671Aug 25, 2012
    Psyced
    Psyced
    risk 0.00cvss —epss 0.01

    psyced before 20120821 does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via responses for domains that were not asserted.

  • CVE-2012-4670Aug 25, 2012
    Tigase
    Tigase Xmpp Server
    risk 0.00cvss —epss 0.01

    Tigase XMPP Server before 5.1.0 does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.

  • CVE-2012-4669Aug 25, 2012
    Isode
    M Link
    risk 0.00cvss —epss 0.01

    M-Link R14.6 before R14.6v14 and R15.1 before R15.1v10 does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via responses for domains that were not asserted.

  • CVE-2012-3525Aug 25, 2012
    Jabber
    Jabberd
    risk 0.00cvss —epss 0.02

    s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.

  • CVE-2012-4668Aug 25, 2012
    Roundcube
    Webmail
    risk 0.00cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in Roundcube Webmail 0.8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the signature in an email.

  • CVE-2012-4667Aug 25, 2012
    Darold
    Squidclamav
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in SquidClamav 5.x before 5.8 allow remote attackers to inject arbitrary web script or HTML via the (1) url, (2) virus, (3) source, or (4) user parameter to (a) clwarn.cgi, (b) clwarn.cgi.de_DE, (c) clwarn.cgi.en_EN, (d)…

  • CVE-2012-3514Aug 25, 2012
    Nicolas Cannasse
    Ocaml XML Light Library
    risk 0.00cvss —epss 0.01

    OCaml Xml-Light Library before r234 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via unspecified vectors.

  • CVE-2012-3508Aug 25, 2012
    Roundcube
    Webmail
    risk 0.00cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in program/lib/washtml.php in Roundcube Webmail 0.8.0 allows remote attackers to inject arbitrary web script or HTML by using "javascript:" in an href attribute in the body of an HTML-formatted email.

  • CVE-2012-3507Aug 25, 2012
    Roundcube
    Webmail
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in program/steps/mail/func.inc in RoundCube Webmail before 0.8.0, when using the Larry skin, allows remote attackers to inject arbitrary web script or HTML via the email message subject.

  • CVE-2012-3503CriAug 25, 2012
    Theforeman
    Katello
    risk 0.57cvss 9.8epss 0.03

    The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web…

  • CVE-2012-3501Aug 25, 2012
    SquidClamav
    SquidClamav
    risk 0.00cvss —epss 0.03

    The squidclamav_check_preview_handler function in squidclamav.c in SquidClamav 5.x before 5.8 and 6.x before 6.7 passes an unescaped URL to a system command call, which allows remote attackers to cause a denial of service (daemon crash) via a URL with certain characters, as…

  • CVE-2012-3481Aug 25, 2012
    GIMP
    Gimp
    risk 0.00cvss —epss 0.05

    Integer overflow in the ReadImage function in plug-ins/common/file-gif-load.c in the GIF image format plug-in in GIMP 2.8.x and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted height and len…

  • CVE-2012-3480Aug 25, 2012
    GNU
    Glibc
    risk 0.03cvss —epss 0.01

    Multiple integer overflows in the (1) strtod, (2) strtof, (3) strtold, (4) strtod_l, and other unspecified "related functions" in stdlib in GNU C Library (aka glibc or libc6) 2.16 allow local users to cause a denial of service (application crash) and possibly execute arbitrary…

  • CVE-2012-3479Aug 25, 2012
    GNU
    Emacs
    risk 0.00cvss —epss 0.04

    lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1 automatically executes eval forms in local-variable sections when the enable-local-variables option is set to :safe, which allows user-assisted remote attackers to execute arbitrary Emacs Lisp code via a crafted file.

  • CVE-2012-3441Aug 25, 2012
    Icinga
    Icinga
    risk 0.00cvss —epss 0.02

    The database creation script (module/idoutils/db/scripts/create_mysqldb.sh) in Icinga 1.7.1 grants access to all databases to the icinga user, which allows icinga users to access other databases via unspecified vectors.

  • CVE-2012-3416Aug 25, 2012
    Condor Project
    Condor
    risk 0.00cvss —epss 0.05

    Condor before 7.8.2 allows remote attackers to bypass host-based authentication and execute actions such as ALLOW_ADMINISTRATOR or ALLOW_WRITE by connecting from a system with a spoofed reverse DNS hostname.

  • CVE-2012-3403Aug 25, 2012
    GIMP
    Gimp
    risk 0.00cvss —epss 0.05

    Heap-based buffer overflow in the KiSS CEL file format plug-in in GIMP 2.8.x and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted KiSS palette file, which triggers an "invalid free."

  • CVE-2012-3402Aug 25, 2012
    GIMP
    Gimp
    risk 0.00cvss —epss 0.04

    Integer overflow in plug-ins/common/psd.c in the Adobe Photoshop PSD plugin in GIMP 2.2.13 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted channels header value in a PSD image file, which triggers a heap-based…

  • CVE-2012-0048Aug 25, 2012
    OpenTTD
    Openttd
    risk 0.00cvss —epss 0.03

    OpenTTD 0.3.5 through 1.1.4 allows remote attackers to cause a denial of service (game pause) by connecting to the server and not finishing the (1) authorization phase or (2) map download, aka a "slow read" attack.

  • CVE-2012-2990Aug 24, 2012
    MarkAny
    ContentSAFER
    risk 0.00cvss —epss 0.04

    The MASetupCaller ActiveX control before 1.4.2012.508 in MASetupCaller.dll in MarkAny ContentSAFER, as distributed in Samsung KIES before 2.3.2.12074_13_13, does not properly implement unspecified methods, which allows remote attackers to download an arbitrary program onto a…

  • CVE-2012-2984Aug 24, 2012
    Websense
    Content Gateway
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in monitor/m_overview.ink in Websense Content Gateway before 7.7.3 allow remote attackers to inject arbitrary web script or HTML via the (1) menu or (2) item parameter.

  • CVE-2012-0713Aug 24, 2012
    IBM
    Db2
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the XML feature in IBM DB2 9.7 before FP6 on Linux, UNIX, and Windows allows remote authenticated users to read arbitrary XML files via unknown vectors.

  • CVE-2011-5117Aug 24, 2012
    Sophos
    Safeguard Easy Device Encryption Client
    risk 0.00cvss —epss 0.00

    Sophos SafeGuard Enterprise Device Encryption 5.x through 5.50.8.13, Sophos SafeGuard Easy Device Encryption Client 5.50.x, and Sophos Disk Encryption 5.50.x have a delay before removal of (1) out-of-date credentials and (2) invalid credentials, which allows physically proximate…

  • CVE-2011-5116Aug 23, 2012
    Setseed
    Setseed CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in setseed-hub in SetSeed CMS 5.8.20, 5.11.2, and earlier allows remote attackers to execute arbitrary SQL commands via the loggedInUser cookie.

  • CVE-2011-5115Aug 23, 2012
    Dlguard
    Dlguard
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in DLGuard, possibly 4.6 and earlier, allows remote attackers to inject arbitrary web script or HTML via the searchCart parameter to index.php.

  • CVE-2011-5114Aug 23, 2012
    Barraguard
    Barracuda Link Balancer Series Firmware
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Authoritative DNS - DNS Zones page in Barracuda Link Balancer 330 Firmware 1.3.2.005 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) zoneid or (2) scope parameter.

  • CVE-2011-5113Aug 23, 2012
    Joomla
    Techfolio
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in frontend/models/techfoliodetail.php in Techfolio (com_techfolio) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter.

  • CVE-2011-5112Aug 23, 2012
    Joomla
    Alameda
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Alameda (com_alameda) component before 1.0.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the storeid parameter to index.php.

  • CVE-2011-5111Aug 23, 2012
    Kajianwebsite
    CMS Balitbang
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Kajian Website CMS Balitbang 3.x allow remote attackers to execute arbitrary SQL commands via the hal parameter to (1) the data module in alumni.php; or the (2) lih_buku, (3) artikel, (4) album, or (5) berita module in index.php.

  • CVE-2011-5110Aug 23, 2012
    John Geo
    Blogs Manager
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Blogs Manager 1.101 and earlier allow remote attackers to execute arbitrary SQL commands via the SearchField parameter in a search action to (1) _authors_list.php, (2) _blogs_list.php, (3) _category_list.php, (4) _comments_list.php, (5)…

  • CVE-2011-5109Aug 23, 2012
    Freelancer
    Calendar
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Freelancer calendar 1.01 and earlier allow remote attackers to inject arbitrary web script or HTML via the SearchField parameter in a search action to (1) category_list.php, (2) Copy_of_calendar_list.php, (3)…

  • CVE-2011-5108Aug 23, 2012
    Adaptcms
    Adaptcms
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in config.php in AdaptCMS 2.0.0 and 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-5107Aug 23, 2012
    WordPress
    Alert Before You Post
    risk 0.04cvss —epss 0.09

    Cross-site scripting (XSS) vulnerability in post_alert.php in Alert Before Your Post plugin, possibly 0.1.1 and earlier, for WordPress allows remote attackers to inject arbitrary web script or HTML via the name parameter.

  • CVE-2011-5106Aug 23, 2012
    WordPress
    Flexible Custom Post Type
    risk 0.04cvss —epss 0.11

    Cross-site scripting (XSS) vulnerability in edit-post.php in the Flexible Custom Post Type plugin before 0.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2011-5105Aug 23, 2012
    Zoho
    ADSelfService Plus
    risk 0.03cvss —epss 0.06

    Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch.cc in ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 allow remote attackers to inject arbitrary web script or HTML via the (1) searchType and (2) searchString parameters, a different vulnerability than…

  • CVE-2011-5104Aug 23, 2012
    WordPress
    Wp Ecommerce
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the custom_text parameter. NOTE: some of these details are…

  • CVE-2011-5103Aug 23, 2012
    Alurian
    Prismotube Video Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Alurian Prismotube PHP Video Script allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.

  • CVE-2012-4337Aug 23, 2012
    Foxitsoftware
    Reader
    risk 0.00cvss —epss 0.05

    Foxit Reader before 5.3 on Windows XP and Windows 7 allows remote attackers to execute arbitrary code via a PDF document with a crafted attachment that triggers calculation of a negative number during processing of cross references.

  • CVE-2012-4605Aug 23, 2012
    Websense
    Email Security
    risk 0.00cvss —epss 0.01

    The default configuration of the SMTP component in Websense Email Security 6.1 through 7.3 enables weak SSL ciphers in the "SurfControl plc\SuperScout Email Filter\SMTP" registry key, which makes it easier for remote attackers to obtain sensitive information by sniffing the…

  • CVE-2012-4604Aug 23, 2012
    Websense
    Websense Web Security
    risk 0.00cvss —epss 0.01

    The TRITON management console in Websense Web Security before 7.6 Hotfix 24 allows remote attackers to bypass authentication and read arbitrary reports via a crafted uid field, in conjunction with a crafted userRoles field, in a cookie, as demonstrated by a request to…

  • CVE-2012-2582Aug 23, 2012
    OTRS
    Otrs
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.13, 3.0.x before 3.0.15, and 3.1.x before 3.1.9, and OTRS ITSM 2.1.x before 2.1.5, 3.0.x before 3.0.6, and 3.1.x before 3.1.6, allow remote attackers to inject…

  • CVE-2011-5102Aug 23, 2012
    Websense
    Websense Web Security
    risk 0.00cvss —epss 0.04

    The Investigative Reports web interface in the TRITON management console in Websense Web Security 7.1 before Hotfix 109, 7.1.1 before Hotfix 06, 7.5 before Hotfix 78, 7.5.1 before Hotfix 12, 7.6 before Hotfix 24, and 7.6.2 before Hotfix 12; Web Filter; Web Security Gateway; and…

  • CVE-2010-5149Aug 23, 2012
    Websense
    Websense Web Security
    risk 0.00cvss —epss 0.02

    Websense Web Security and Web Filter before 6.3.3 Hotfix 27 and 7.x before 7.1.1 allow remote attackers to cause a denial of service (Blue Coat appliance integration outage) via a long URL.

  • CVE-2010-5148Aug 23, 2012
    Websense
    Websense Web Security
    risk 0.00cvss —epss 0.01

    Websense Web Security and Web Filter before 7.1 Hotfix 21 do not set the secure flag for the Encrypted Session (SSL) cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

  • CVE-2010-5147Aug 23, 2012
    Websense
    Websense Web Security
    risk 0.00cvss —epss 0.01

    The Remote Filtering component in Websense Web Security and Web Filter before 6.3.3 Hotfix 18 and 7.x before 7.1.1 allows remote attackers to cause a denial of service (daemon exit) via a large volume of traffic.

  • CVE-2010-5146Aug 23, 2012
    Websense
    Websense Web Security
    risk 0.00cvss —epss 0.00

    The Remote Filtering component in Websense Web Security and Web Filter before 7.1 Hotfix 66 allows local users to bypass filtering by (1) renaming the WDC.exe file or (2) deleting driver files.

  • CVE-2010-5145Aug 23, 2012
    Websense
    Websense Web Security
    risk 0.00cvss —epss 0.01

    The Filtering Service in Websense Web Security and Web Filter before 6.3.1 Hotfix 136 and 7.x before 7.1.1 on Windows allows remote attackers to cause a denial of service (filtering outage) via a crafted sequence of characters in a URI.

  • CVE-2010-5144Aug 23, 2012
    Websense
    Websense
    risk 0.00cvss —epss 0.01

    The ISAPI Filter plug-in in Websense Enterprise, Websense Web Security, and Websense Web Filter 6.3.3 and earlier, when used in conjunction with a Microsoft ISA or Microsoft Forefront TMG server, allows remote attackers to bypass intended filtering and monitoring activities for…

  • CVE-2009-5122Aug 23, 2012
    Websense
    Email Security
    risk 0.00cvss —epss 0.01

    The Personal Email Manager component in Websense Email Security before 7.2 allows remote attackers to obtain potentially sensitive information from the JBoss status page via an unspecified query.