VYPR

CVEs

347,048 total · page 5925 of 6,941

AllCriticalHighKEV
  • CVE-2012-1861Jul 10, 2012
    Microsoft
    Sharepoint Server
    risk 0.01cvss —epss 0.15

    Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 Gold and SP1, SharePoint Foundation 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL, aka…

  • CVE-2012-1860Jul 10, 2012
    Microsoft
    Sharepoint Server
    risk 0.01cvss —epss 0.13

    Microsoft Office SharePoint Server 2007 SP2 and SP3, SharePoint Server 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 do not properly check permissions for search scopes, which allows remote authenticated users to obtain sensitive information or cause a denial of…

  • CVE-2012-1859Jul 10, 2012
    Microsoft
    Sharepoint Server
    risk 0.02cvss —epss 0.23

    Cross-site scripting (XSS) vulnerability in scriptresx.ashx in Microsoft SharePoint Server 2010 Gold and SP1, SharePoint Foundation 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript…

  • CVE-2012-1854HigKEVJul 10, 2012
    Microsoft
    Office
    risk 0.64cvss 7.8epss 0.21

    Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges via a Trojan horse…

  • CVE-2012-1524Jul 10, 2012
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.21

    Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Attribute Remove Remote Code Execution Vulnerability."

  • CVE-2012-1522Jul 10, 2012
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.21

    Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Cached Object Remote Code Execution Vulnerability."

  • CVE-2012-0175HigJul 10, 2012
    Microsoft
    Windows
    risk 0.59cvss 8.8epss 0.26

    The Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted name for a (1) file or (2) directory, aka "Command…

  • CVE-2012-3812Jul 9, 2012
    Digium
    Asterisk
    risk 0.00cvss —epss 0.03

    Double free vulnerability in apps/app_voicemail.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones allows remote authenticated users…

  • CVE-2012-3238Jul 9, 2012
    Astaro
    Security Gateway
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the Backup/Restore component in WebAdmin in Astaro Security Gateway before 8.305 allows remote attackers to inject arbitrary web script or HTML via the "Comment (optional)" field.

  • CVE-2012-2970Jul 9, 2012
    Synel
    SY-780/A
    risk 0.00cvss —epss 0.01

    The Synel SY-780/A Time & Attendance terminal allows remote attackers to cause a denial of service (device hang) via network traffic to port (1) 1641, (2) 3734, or (3) 3735.

  • CVE-2012-2138Jul 9, 2012
    Apache
    Sling Servlets Post
    risk 0.00cvss —epss 0.14

    The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted…

  • CVE-2012-1493Jul 9, 2012
    F5, Inc.
    Big IP
    risk 0.08cvss —epss 0.63

    F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers'…

  • CVE-2012-3859Jul 9, 2012
    Netsweeper
    Netsweeper
    risk 0.03cvss —epss 0.03

    Unspecified vulnerability in the WebAdmin Portal in Netsweeper has unknown impact and attack vectors, a different vulnerability than CVE-2012-2446 and CVE-2012-2447.

  • CVE-2012-2447Jul 9, 2012
    Netsweeper
    Netsweeper
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in accountmgr/adminupdate.php in the WebAdmin Portal in Netsweeper allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via an add action.

  • CVE-2012-2446Jul 9, 2012
    Netsweeper
    Netsweeper
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in tools/local_lookup.php in the WebAdmin Portal in Netsweeper allows remote attackers to inject arbitrary web script or HTML via the group parameter in a lookup action.

  • CVE-2012-3863Jul 9, 2012
    Digium
    Asterisk
    risk 0.00cvss —epss 0.03

    channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Asterisk Business Edition C.3.x before C.3.7.5, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones does not…

  • CVE-2012-3372HigJul 9, 2012
    Cyberoam
    Cyberoamos
    risk 0.48cvss 7.4epss 0.01

    The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the…

  • CVE-2012-3374Jul 7, 2012
    Pidgin (software)
    Pidgin
    risk 0.01cvss —epss 0.06

    Buffer overflow in markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.5 allows remote attackers to execute arbitrary code via a crafted inline image in a message.

  • CVE-2012-2644Jul 7, 2012
    Hazama
    Mt4i
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the MT4i plugin 3.1 beta 4 and earlier for Movable Type allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-2642.

  • CVE-2012-2643Jul 7, 2012
    Kent Web
    Yy Board
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in KENT-WEB YY-BOARD before 6.4 allows remote attackers to inject arbitrary web script or HTML via a crafted form entry.

  • CVE-2012-2642Jul 7, 2012
    Hazama
    Mt4i
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the MT4i plugin 3.1 beta 4 and earlier for Movable Type allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-2644.

  • CVE-2012-2386Jul 7, 2012
    PHP
    PHP
    risk 0.06cvss —epss 0.42

    Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tar file that triggers a…

  • CVE-2012-3585Jul 5, 2012
    IrfanView
    Irfanview
    risk 0.04cvss —epss 0.08

    Heap-based buffer overflow in jpeg_ls.dll in the Jpeg_LS (aka JLS) plugin in the formats plugins in IrfanView PlugIns before 4.34 allows remote attackers to execute arbitrary code via a crafted JLS file.

  • CVE-2012-2018Jul 5, 2012
    Microfocus
    OpenView Network Node Manager
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in HP Network Node Manager i (NNMi) 8.x, 9.0x, and 9.1x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-2641Jul 5, 2012
    Zenphoto
    Zenphoto
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Zenphoto before 1.4.3 allows remote attackers to inject arbitrary web script or HTML by triggering improper interaction with an unspecified library.

  • CVE-2012-2640Jul 5, 2012
    NEC
    BIGLOBE Yome Collection
    risk 0.00cvss —epss 0.01

    The NEC BIGLOBE Yome Collection application 1.8.3 and earlier for Android allows remote attackers to read the IMEI value from an SD card via a crafted application that lacks the READ_PHONE_STATE permission.

  • CVE-2012-0303Jul 5, 2012
    Symantec
    Message Filter
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Brightmail Control Center in Symantec Message Filter 6.3 allow remote attackers to hijack the authentication of arbitrary users for requests that (1) execute application commands or (2) create admin accounts.

  • CVE-2012-0302Jul 5, 2012
    Symantec
    Message Filter
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Brightmail Control Center in Symantec Message Filter 6.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-0301Jul 5, 2012
    Symantec
    Message Filter
    risk 0.00cvss —epss 0.01

    Session fixation vulnerability in Brightmail Control Center in Symantec Message Filter 6.3 allows remote attackers to hijack web sessions via unspecified vectors.

  • CVE-2012-0300Jul 5, 2012
    Symantec
    Message Filter
    risk 0.00cvss —epss 0.01

    Brightmail Control Center in Symantec Message Filter 6.3 does not properly restrict establishment of sessions to the listening port, which allows remote attackers to obtain potentially sensitive version information via unspecified vectors.

  • CVE-2012-2281Jul 5, 2012
    Rsa
    Access Manager Agent
    risk 0.00cvss —epss 0.01

    EMC RSA Access Manager Server 6.x before 6.1 SP4 and RSA Access Manager Agent do not properly validate session tokens after a logout, which might allow remote attackers to conduct replay attacks via unspecified vectors.

  • CVE-2012-2143Jul 5, 2012
    PHP
    PHP
    risk 0.00cvss —epss 0.06

    The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to…

  • CVE-2012-0410Jul 5, 2012
    Novell
    Groupwise
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in WebAccess in Novell GroupWise before 8.03 allows remote attackers to read arbitrary files via the User.interface parameter.

  • CVE-2012-3847Jul 5, 2012
    Invensys
    Wonderware Application Server
    risk 0.00cvss —epss 0.01

    slssvc.exe in Invensys Wonderware SuiteLink in Invensys InTouch 2012 and Wonderware Application Server 2012 allows remote attackers to cause a denial of service (resource consumption) via a long Unicode string, a different vulnerability than CVE-2012-3007.

  • CVE-2012-3007Jul 5, 2012
    Invensys
    Wonderware Application Server
    risk 0.00cvss —epss 0.02

    Stack-based buffer overflow in slssvc.exe before 58.x in Invensys Wonderware SuiteLink in the Invensys System Platform software suite, as used in InTouch/Wonderware Application Server IT before 10.5 and WAS before 3.5, DASABCIP before 4.1 SP2, DASSiDirect before 3.0, DAServer…

  • CVE-2012-2560Jul 5, 2012
    Wellintech
    Kingview
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in WellinTech KingView 6.53 allows remote attackers to read arbitrary files via a crafted HTTP request to port 8001.

  • CVE-2012-2559Jul 5, 2012
    Wellintech
    Kinghistorian
    risk 0.00cvss —epss 0.05

    WellinTech KingHistorian 3.0 allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer write) via a crafted packet to TCP port 5678.

  • CVE-2012-2516Jul 5, 2012
    Ge
    Intelligent Platforms Proficy Historian
    risk 0.06cvss —epss 0.40

    An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module (aka the HTML Help component), as used in GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; Proficy HMI/SCADA iFIX 5.0 and 5.1; Proficy Pulse 1.0; Proficy Batch Execution 5.6; SI7 I/O Driver 7.20…

  • CVE-2012-2515Jul 5, 2012
    Ge
    Intelligent Platforms Proficy Historian
    risk 0.05cvss —epss 0.28

    Multiple stack-based buffer overflows in the KeyHelp.KeyCtrl.1 ActiveX control in KeyHelp.ocx 1.2.312 in KeyWorks KeyHelp Module (aka the HTML Help component), as used in EMC Documentum ApplicationXtender Desktop 5.4; EMC Captiva Quickscan Pro 4.6 SP1; GE Intelligent Platforms…

  • CVE-2012-1832Jul 5, 2012
    Wellintech
    Kingview
    risk 0.00cvss —epss 0.06

    WellinTech KingView 6.53 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a crafted packet to (1) TCP or (2) UDP port 2001.

  • CVE-2012-1831Jul 5, 2012
    Wellintech
    Kingview
    risk 0.04cvss —epss 0.16

    Heap-based buffer overflow in WellinTech KingView 6.53 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 555.

  • CVE-2012-1830Jul 5, 2012
    Wellintech
    Kingview
    risk 0.04cvss —epss 0.08

    Stack-based buffer overflow in WellinTech KingView 6.53 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 555.

  • CVE-2012-3846Jul 3, 2012
    PHP Pastebin
    PHP-pastebin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in PHP-pastebin 2.1 allows remote attackers to inject arbitrary web script or HTML via the title parameter.

  • CVE-2012-3845Jul 3, 2012
    Lan Messenger
    Lan Messenger1.2.28
    risk 0.03cvss —epss 0.03

    Buffer overflow in LAN Messenger 1.2.28 and earlier allows remote attackers to cause a denial of service (crash) via a long string in an initiation request.

  • CVE-2012-3844Jul 3, 2012
    Jelsoft
    Vbulletin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in vBulletin 4.1.12 allows remote attackers to inject arbitrary web script or HTML via a long string in the subject parameter when creating a post.

  • CVE-2012-3843Jul 3, 2012
    E107
    E107
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the registration page in e107, probably 1.0.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-3842Jul 3, 2012
    Directadmin
    Directadmin
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in CMD_DOMAIN in JBMC Software DirectAdmin 1.403 allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via the (1) select0 or (2) select8 parameters.

  • CVE-2012-3841Jul 3, 2012
    Kmplayer
    Kmplayer
    risk 0.00cvss —epss 0.03

    Untrusted search path vulnerability in KMPlayer 3.2.0.19 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse ehtrace.dll that is located in the current working directory.

  • CVE-2012-3840Jul 3, 2012
    Myclientbase
    Myclientbase
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in index.php/users/form/user_id in MyClientBase 0.12 allow remote attackers to inject arbitrary web script or HTML via the (1) first_name or (2) last_name parameters.

  • CVE-2012-3839Jul 3, 2012
    Myclientbase
    Myclientbase
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in application/core/MY_Model.php in MyClientBase 0.12 allow remote attackers to execute arbitrary SQL commands via the (1) invoice_number or (2) tags parameter to index.php/invoice_search.