VYPR

CVEs

347,058 total · page 5914 of 6,942

AllCriticalHighKEV
  • CVE-2012-3953Aug 12, 2012
    Phplist
    Phplist
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page.

  • CVE-2012-3952Aug 12, 2012
    Phplist
    Phplist
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page.

  • CVE-2012-3457Aug 12, 2012
    Lingej
    Pnp4nagios
    risk 0.00cvss —epss 0.00

    PNP4Nagios 0.6 through 0.6.16 uses world-readable permissions for process_perfdata.cfg, which allows local users to obtain the Gearman shared secret by reading the file.

  • CVE-2012-3132Aug 10, 2012
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote authenticated users to execute arbitrary SQL commands via vectors involving CREATE INDEX with a CTXSYS.CONTEXT INDEXTYPE and…

  • CVE-2012-4235Aug 10, 2012
    Joomla
    RSGallery2
    risk 0.00cvss —epss 0.01

    The RSGallery2 (com_rsgallery2) component before 3.2.0 for Joomla! 2.5.x does not place index.html files in image directories, which allows remote attackers to list image filenames via a request for a directory URI.

  • CVE-2012-4071Aug 10, 2012
    Rsgallery2
    Com Rsgallery2
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the comments module in the RSGallery2 (com_rsgallery2) component before 2.3.0 for Joomla! 1.5.x, and before 3.2.0 for Joomla! 2.5.x, allows remote attackers to inject arbitrary web script or HTML via crafted BBCode markup in a comment.

  • CVE-2012-3554Aug 10, 2012
    Joomla
    RSGallery2
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the RSGallery2 (com_rsgallery2) component before 2.3.0 for Joomla! 1.5.x, and before 3.2.0 for Joomla! 2.5.x, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-3465Aug 10, 2012
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML…

  • CVE-2012-3464Aug 10, 2012
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a '…

  • CVE-2012-3463Aug 10, 2012
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt field to the select_tag…

  • CVE-2012-2863Aug 9, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    The PDF functionality in Google Chrome before 21.0.1180.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger out-of-bounds write operations.

  • CVE-2012-2862Aug 9, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in the PDF functionality in Google Chrome before 21.0.1180.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.

  • CVE-2012-2745Aug 9, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The copy_creds function in kernel/cred.c in the Linux kernel before 3.3.2 provides an invalid replacement session keyring to a child process, which allows local users to cause a denial of service (panic) via a crafted application that uses the fork system call.

  • CVE-2012-2744Aug 9, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.04

    net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux kernel before 2.6.34, when the nf_conntrack_ipv6 module is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via certain types of fragmented IPv6 packets.

  • CVE-2012-2373Aug 9, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The Linux kernel before 3.4.5 on the x86 platform, when Physical Address Extension (PAE) is enabled, does not properly use the Page Middle Directory (PMD), which allows local users to cause a denial of service (panic) via a crafted application that triggers a race condition.

  • CVE-2012-2136Aug 9, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The sock_alloc_send_pskb function in net/core/sock.c in the Linux kernel before 3.4.5 does not properly validate a certain length value, which allows local users to cause a denial of service (heap-based buffer overflow and system crash) or possibly gain privileges by leveraging…

  • CVE-2012-4004Aug 8, 2012
    Fenrir Inc
    Sleipnir Mobile
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Sleipnir Mobile application 2.2.0 and earlier and Sleipnir Mobile Black Edition application 2.2.0 and earlier for Android allows remote attackers to inject arbitrary web script or HTML via a crafted application that interacts with…

  • CVE-2012-2649Aug 8, 2012
    Fenrir Inc
    Sleipnir Mobile
    risk 0.00cvss —epss 0.02

    The Sleipnir Mobile application 2.2.0 and earlier and Sleipnir Mobile Black Edition application 2.2.0 and earlier for Android allow remote attackers to execute arbitrary Java methods, and obtain sensitive information or execute arbitrary commands, via a crafted web site.

  • CVE-2012-3440Aug 8, 2012
    Todd Miller
    Sudo
    risk 0.00cvss —epss 0.00

    A certain Red Hat script for sudo 1.7.2 on Red Hat Enterprise Linux (RHEL) 5 allows local users to overwrite arbitrary files via a symlink attack on the /var/tmp/nsswitch.conf.bak temporary file.

  • CVE-2012-3424Aug 8, 2012
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.02

    The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of…

  • CVE-2012-2960Aug 8, 2012
    Microfocus
    ArcSight Connector Appliance
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the import functionality in HP ArcSight Connector appliance 6.2.0.6244.0 and ArcSight Logger appliance 5.2.0.6288.0 allows remote attackers to inject arbitrary web script or HTML via a crafted file.

  • CVE-2012-2203Aug 8, 2012
    IBM
    Tivoli Directory Server
    risk 0.00cvss —epss 0.02

    IBM Global Security Kit (aka GSKit) before 8.0.14.22, as used in IBM Rational Directory Server, IBM Tivoli Directory Server, and other products, uses the PKCS #12 file format for certificate objects without enforcing file integrity, which makes it easier for remote attackers to…

  • CVE-2012-2191Aug 8, 2012
    IBM
    Tivoli Directory Server
    risk 0.00cvss —epss 0.04

    IBM Global Security Kit (aka GSKit) before 8.0.14.22, as used in IBM Rational Directory Server, IBM Tivoli Directory Server, and other products, does not properly validate data during execution of a protection mechanism against the Vaudenay SSL CBC timing attack, which allows…

  • CVE-2012-0421Aug 8, 2012
    Novell
    Suse Audit Log Keeper
    risk 0.00cvss —epss 0.00

    The SUSE Audit Log Keeper daemon before 0.2.1-0.4.6.1 for SUSE Manager and Spacewalk uses world-readable permissions for /etc/auditlog-keeper.conf, which allows local users to obtain passwords by reading this file.

  • CVE-2011-5098Aug 8, 2012
    Chef
    Chef
    risk 0.00cvss —epss 0.02

    chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x before 0.10.6, does not require administrative privileges for creating admin clients, which allows remote authenticated users to bypass intended access restrictions by leveraging read…

  • CVE-2011-5097Aug 8, 2012
    Chef
    Chef
    risk 0.00cvss —epss 0.01

    chef-server-api/app/controllers/cookbooks.rb in Chef Server in Chef before 0.9.18, and 0.10.x before 0.10.2, does not require administrative privileges for the update and destroy methods, which allows remote authenticated users to (1) upload cookbooks via a knife cookbook upload…

  • CVE-2011-4922Aug 8, 2012
    Pidgin (software)
    Pidgin
    risk 0.00cvss —epss 0.00

    cipher.c in the Cipher API in libpurple in Pidgin before 2.7.10 retains encryption-key data in process memory, which might allow local users to obtain sensitive information by reading a core file or other representation of memory contents.

  • CVE-2010-5142Aug 8, 2012
    Chef
    Chef
    risk 0.00cvss —epss 0.02

    chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI.

  • CVE-2012-4178Aug 7, 2012
    Symantec
    Web Gateway
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in spywall/includes/deptUploads_data.php in Symantec Web Gateway 5.0.3.18 allows remote attackers to execute arbitrary SQL commands via the groupid parameter.

  • CVE-2012-3445Aug 7, 2012
    Libvirt
    Libvirt
    risk 0.00cvss —epss 0.02

    The virTypedParameterArrayClear function in libvirt 0.9.13 does not properly handle virDomain* API calls with typed parameters, which might allow remote authenticated users to cause a denial of service (libvirtd crash) via an RPC command with nparams set to zero, which triggers…

  • CVE-2012-3438Aug 7, 2012
    Graphicsmagick
    Graphicsmagick
    risk 0.00cvss —epss 0.02

    The Magick_png_malloc function in coders/png.c in GraphicsMagick 6.7.8-6 does not use the proper variable type for the allocation size, which might allow remote attackers to cause a denial of service (crash) via a crafted PNG file that triggers incorrect memory allocation.

  • CVE-2012-3437Aug 7, 2012
    ImageMagick
    Imagemagick
    risk 0.00cvss —epss 0.03

    The Magick_png_malloc function in coders/png.c in ImageMagick 6.7.8 and earlier does not use the proper variable type for the allocation size, which might allow remote attackers to cause a denial of service (crash) via a crafted PNG file that triggers incorrect memory allocation.

  • CVE-2012-3429Aug 7, 2012
    Martin Nagy
    Bind Dyndb LDAP
    risk 0.00cvss —epss 0.03

    The dns_to_ldap_dn_escape function in src/ldap_convert.c in bind-dyndb-ldap 1.1.0rc1 and earlier does not properly escape distinguished names (DN) for LDAP queries, which allows remote DNS servers to cause a denial of service (named service hang) via a "$" character in a DN in a…

  • CVE-2012-3423Aug 7, 2012
    IcedTea
    IcedTea-Web
    risk 0.00cvss —epss 0.06

    The IcedTea-Web plugin before 1.2.1 does not properly handle NPVariant NPStrings without NUL terminators, which allows remote attackers to cause a denial of service (crash), obtain sensitive information from memory, or execute arbitrary code via a crafted Java applet.

  • CVE-2012-3422Aug 7, 2012
    IcedTea
    IcedTea-Web
    risk 0.00cvss —epss 0.03

    The getFirstInTableInstance function in the IcedTea-Web plugin before 1.2.1 returns an uninitialized pointer when the instance_to_id_map hash is empty, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted web page,…

  • CVE-2012-3386Aug 7, 2012
    GNU
    Automake
    risk 0.00cvss —epss 0.00

    The "make distcheck" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directory, which introduces a race condition that allows local users to execute arbitrary code via unspecified vectors.

  • CVE-2012-0213Aug 7, 2012
    Apache
    Poi
    risk 0.00cvss —epss 0.07

    The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to cause a denial of service (OutOfMemoryError exception and possibly JVM destabilization) via a crafted length value in a Channel Definition…

  • CVE-2012-4177Aug 7, 2012
    Ubi
    Uplay Pc
    risk 0.08cvss —epss 0.58

    The web browser plugin for Ubisoft Uplay PC before 2.0.4 allows remote attackers to execute arbitrary programs via the -orbit_exe_path command line argument.

  • CVE-2012-3454Aug 7, 2012
    Extplorer
    Extplorer
    risk 0.00cvss —epss 0.00

    eXtplorer 2.1.0b6 uses world writable permissions for the /var/lib/extplorer/ftp_tmp directory, which allows local users to delete or overwrite arbitrary files.

  • CVE-2012-3453Aug 7, 2012
    Logol
    logol
    risk 0.00cvss —epss 0.00

    logol 1.5.0 uses world writable permissions for the /var/lib/logol/results directory, which allows local users to delete or overwrite arbitrary files.

  • CVE-2012-3452Aug 7, 2012
    GNOME Foundation
    Screensaver
    risk 0.00cvss —epss 0.00

    gnome-screensaver 3.4.x before 3.4.4 and 3.5.x before 3.5.4, when multiple screens are used, only locks the screen with the active focus, which allows physically proximate attackers to bypass screen locking and access an unattended workstation.

  • CVE-2012-3449Aug 7, 2012
    Openvswitch
    Openvswitch
    risk 0.00cvss —epss 0.00

    Open vSwitch 1.4.2 uses world writable permissions for (1) /var/lib/openvswitch/pki/controllerca/incoming/ and (2) /var/lib/openvswitch/pki/switchca/incoming/, which allows local users to delete and overwrite arbitrary files.

  • CVE-2012-3413Aug 7, 2012
    KDE
    PIM
    risk 0.00cvss —epss 0.02

    The HTMLQuoteColorer::process function in messageviewer/htmlquotecolorer.cpp in KDE PIM 4.6 through 4.8 does not disable JavaScript, Java, and Plugins, which allows remote attackers to inject arbitrary web script or HTML via a crafted email.

  • CVE-2012-2652Aug 7, 2012
    QEMU
    Qemu
    risk 0.00cvss —epss 0.00

    The bdrv_open function in Qemu 1.0 does not properly handle the failure of the mkstemp function, when in snapshot node, which allows local users to overwrite or read arbitrary files via a symlink attack on an unspecified temporary file.

  • CVE-2012-4005Aug 7, 2012
    Naver
    Nhn Japan Naver Line
    risk 0.00cvss —epss 0.01

    The NHN Japan NAVER LINE application before 2.5.5 for Android does not properly handle implicit intents, which allows remote attackers to obtain sensitive message information via a crafted application.

  • CVE-2012-2648Aug 7, 2012
    GoodReader
    GoodReader
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the GoodReader app 3.16 and earlier for iOS on the iPad, and 3.15.1 and earlier for iOS on the iPhone and iPod touch, allows remote attackers to inject arbitrary web script or HTML via vectors involving use of this app in conjunction…

  • CVE-2012-2317Aug 7, 2012
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    The Debian php_crypt_revamped.patch patch for PHP 5.3.x, as used in the php5 package before 5.3.3-7+squeeze4 in Debian GNU/Linux squeeze, the php5 package before 5.3.2-1ubuntu4.17 in Ubuntu 10.04 LTS, and the php5 package before 5.3.5-1ubuntu7.10 in Ubuntu 11.04, does not…

  • CVE-2012-2022Aug 7, 2012
    Microfocus
    OpenView Network Node Manager
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in HP Network Node Manager i (NNMi) 8.x, 9.0x, 9.1x, and 9.20 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-3448Aug 6, 2012
    Ganglia
    Web
    risk 0.04cvss —epss 0.10

    Unspecified vulnerability in Ganglia Web before 3.5.1 allows remote attackers to execute arbitrary PHP code via unknown attack vectors.

  • CVE-2012-2665Aug 6, 2012
    Libreoffice
    Libreoffice
    risk 0.01cvss —epss 0.07

    Multiple heap-based buffer overflows in the XML manifest encryption tag parsing functionality in OpenOffice.org and LibreOffice before 3.5.5 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Open Document Text (.odt) file with…