VYPR

CVEs

347,024 total · page 5928 of 6,941

AllCriticalHighKEV
  • CVE-2012-2711Jun 27, 2012
    Drupal
    Taxonomy List
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Taxonomy List module 6.x-1.x before 6.x-1.4 for Drupal allow remote authenticated users with create or edit taxonomy terms permissions to inject arbitrary web script or HTML via vectors related to taxonomy information.

  • CVE-2012-2710Jun 27, 2012
    Drupal
    Zen
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Zen module 6.x-1.x before 6.x-1.1 for Drupal, when "Append the content title to the end of the breadcrumb" is enabled, allows remote attackers to inject arbitrary web script or HTML via the content title in a breadcrumb.

  • CVE-2012-2708Jun 27, 2012
    Drupal
    Hostmaster
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the _hosting_task_log_table function in modules/hosting/task/hosting_task.module in the Hostmaster (Aegir) module 6.x-1.x before 6.x-1.9 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web…

  • CVE-2012-2707Jun 27, 2012
    Drupal
    Hostmaster
    risk 0.00cvss —epss 0.02

    The Hostmaster (Aegir) module 6.x-1.x before 6.x-1.9 for Drupal does not properly exit when users do not have access to package/task nodes, which allows remote attackers to bypass intended access restrictions and edit unauthorized nodes.

  • CVE-2012-2706Jun 27, 2012
    Drupal
    Post Affiliate Pro
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Post Affiliate Pro (PAP) module for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to user registration.

  • CVE-2012-2705Jun 27, 2012
    Drupal
    Smart Breadcrumb
    risk 0.00cvss —epss 0.02

    The filter_titles function in the Smart Breadcrumb module 6.x-1.x before 6.x-1.3 for Drupal does not properly convert a title to plain-text, which allows remote authenticated users with create or edit node permissions to conduct cross-site scripting (XSS) attacks via the title…

  • CVE-2012-2703Jun 27, 2012
    Drupal
    Ad
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Advertisement module 6.x-2.x before 6.x-2.3 for Drupal, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via vectors related to the "$conf variable in settings.php."

  • CVE-2012-2702Jun 27, 2012
    Drupal
    Ubercart Product Keys
    risk 0.00cvss —epss 0.03

    The Ubercart Product Keys module 6.x-1.x before 6.x-1.1 for Drupal does not properly check access for product keys, which allows remote attackers to read all unassigned product keys via certain conditions related to the uid.

  • CVE-2012-2122Jun 26, 2012
    MariaDB
    MariaDB
    risk 0.11cvss —epss 0.96

    sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp…

  • CVE-2012-2381Jun 26, 2012
    Apache
    Roller
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the blogger role.

  • CVE-2012-2380Jun 26, 2012
    Apache
    Roller
    risk 0.00cvss —epss 0.02

    Multiple cross-site request forgery (CSRF) vulnerabilities in the admin/editor console in Apache Roller before 5.0.1 allow remote attackers to hijack the authentication of admins or editors by leveraging the HTTP POST functionality.

  • CVE-2010-2021Jun 25, 2012
    Drupal
    Global Redirect
    risk 0.00cvss —epss 0.03

    Open redirect vulnerability in the Global Redirect module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.4 for Drupal, when non-clean to clean is enabled, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter.

  • CVE-2012-3797Jun 25, 2012
    Pro Face
    Wingp Pc Runtime
    risk 0.04cvss —epss 0.13

    Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, does not properly check packet sizes before reusing packet memory buffers, which allows remote attackers to cause a denial of service (heap memory corruption) or…

  • CVE-2012-3796Jun 25, 2012
    Pro Face
    Wingp Pc Runtime
    risk 0.04cvss —epss 0.11

    Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to obtain sensitive information from daemon memory via a crafted packet with a certain opcode.

  • CVE-2012-3795Jun 25, 2012
    Pro Face
    Wingp Pc Runtime
    risk 0.04cvss —epss 0.11

    Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to cause a denial of service (daemon crash) via a crafted packet with a certain opcode and a large value in a size field.

  • CVE-2012-3794Jun 25, 2012
    Pro Face
    Wingp Pc Runtime
    risk 0.05cvss —epss 0.22

    Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to cause a denial of service (unhandled exception and daemon crash) via a crafted packet with a certain opcode that triggers an invalid attempt…

  • CVE-2012-3793Jun 25, 2012
    Pro Face
    Wingp Pc Runtime
    risk 0.04cvss —epss 0.12

    Integer overflow in Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to cause a denial of service (daemon crash) via a crafted packet with a certain opcode that triggers an incorrect memory…

  • CVE-2012-3792Jun 25, 2012
    Pro Face
    Wingp Pc Runtime
    risk 0.04cvss —epss 0.11

    Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to cause a denial of service (out-of-bounds read operation) via a crafted packet that triggers a certain Find Node check attempt.

  • CVE-2012-2695Jun 22, 2012
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.03

    The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via…

  • CVE-2012-2694Jun 22, 2012
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.04

    actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to…

  • CVE-2012-2661Jun 22, 2012
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.04

    The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks…

  • CVE-2012-2660Jun 22, 2012
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.05

    actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to…

  • CVE-2012-2179Jun 22, 2012
    IBM
    Aix
    risk 0.03cvss —epss 0.02

    libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary file.

  • CVE-2012-2172Jun 22, 2012
    IBM
    DS Storage Manager
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in SoftwareRegistration.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote attackers to inject arbitrary web script or HTML via the updateRegn parameter.

  • CVE-2012-2171Jun 22, 2012
    IBM
    System Storage DS Storage Manager
    risk 0.03cvss —epss 0.05

    SQL injection vulnerability in ModuleServlet.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote authenticated users to execute arbitrary SQL commands via the selectedModuleOnly parameter in a…

  • CVE-2012-0304Jun 22, 2012
    Symantec
    Liveupdate Administrator
    risk 0.00cvss —epss 0.00

    Symantec LiveUpdate Administrator before 2.3.1 uses weak permissions (Everyone: Full Control) for the installation directory, which allows local users to gain privileges via a Trojan horse file.

  • CVE-2012-0191Jun 22, 2012
    IBM
    Lotus Expeditor
    risk 0.00cvss —epss 0.01

    The web container in IBM Lotus Expeditor 6.1.x and 6.2.x before 6.2 FP5+Security Pack does not properly perform access control for requests, which allows remote attackers to spoof a localhost request origin via crafted headers.

  • CVE-2012-0187Jun 22, 2012
    IBM
    Lotus Expeditor
    risk 0.00cvss —epss 0.02

    Untrusted search path vulnerability in IBM Lotus Expeditor 6.1.x and 6.2.x before 6.2 FP5+Security Pack allows local users to gain privileges via a Trojan horse DLL in the current working directory.

  • CVE-2012-0186Jun 22, 2012
    IBM
    Lotus Expeditor
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the Eclipse Help component in IBM Lotus Expeditor 6.1.x and 6.2.x before 6.2 FP5+Security Pack allows remote attackers to discover the locations of files via a crafted URL.

  • CVE-2012-2127Jun 21, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.04

    fs/proc/root.c in the procfs implementation in the Linux kernel before 3.2 does not properly interact with CLONE_NEWPID clone system calls, which allows remote attackers to cause a denial of service (reference leak and memory consumption) by making many connections to a daemon…

  • CVE-2012-0028Jun 21, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The robust futex implementation in the Linux kernel before 2.6.28 does not properly handle processes that make exec system calls, which allows local users to cause a denial of service or possibly gain privileges by writing to a memory location in a child process.

  • CVE-2011-4914Jun 21, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.09

    The ROSE protocol implementation in the Linux kernel before 2.6.39 does not verify that certain data-length values are consistent with the amount of data sent, which might allow remote attackers to obtain sensitive information from kernel memory or cause a denial of service…

  • CVE-2011-4913Jun 21, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.04

    The rose_parse_ccitt function in net/rose/rose_subr.c in the Linux kernel before 2.6.39 does not validate the FAC_CCITT_DEST_NSAP and FAC_CCITT_SRC_NSAP fields, which allows remote attackers to (1) cause a denial of service (integer underflow, heap memory corruption, and panic)…

  • CVE-2011-4324Jun 21, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The encode_share_access function in fs/nfs/nfs4xdr.c in the Linux kernel before 2.6.29 allows local users to cause a denial of service (BUG and system crash) by using the mknod system call with a pathname on an NFSv4 filesystem.

  • CVE-2011-1493Jun 21, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.03

    Array index error in the rose_parse_national function in net/rose/rose_subr.c in the Linux kernel before 2.6.39 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by composing FAC_NATIONAL_DIGIS data that…

  • CVE-2011-1479Jun 21, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Double free vulnerability in the inotify subsystem in the Linux kernel before 2.6.39 allows local users to cause a denial of service (system crash) via vectors involving failed attempts to create files. NOTE: this vulnerability exists because of an incorrect fix for…

  • CVE-2011-1477Jun 21, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Multiple array index errors in sound/oss/opl3.c in the Linux kernel before 2.6.39 allow local users to cause a denial of service (heap memory corruption) or possibly gain privileges by leveraging write access to /dev/sequencer.

  • CVE-2011-1476Jun 21, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Integer underflow in the Open Sound System (OSS) subsystem in the Linux kernel before 2.6.39 on unspecified non-x86 platforms allows local users to cause a denial of service (memory corruption) by leveraging write access to /dev/sequencer.

  • CVE-2011-1160Jun 21, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The tpm_open function in drivers/char/tpm/tpm.c in the Linux kernel before 2.6.39 does not initialize a certain buffer, which allows local users to obtain potentially sensitive information from kernel memory via unspecified vectors.

  • CVE-2011-1080Jun 21, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The do_replace function in net/bridge/netfilter/ebtables.c in the Linux kernel before 2.6.39 does not ensure that a certain name field ends with a '\0' character, which allows local users to obtain potentially sensitive information from kernel stack memory by leveraging the…

  • CVE-2011-1079Jun 21, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The bnep_sock_ioctl function in net/bluetooth/bnep/sock.c in the Linux kernel before 2.6.39 does not ensure that a certain device field ends with a '\0' character, which allows local users to obtain potentially sensitive information from kernel stack memory, or cause a denial of…

  • CVE-2011-1078Jun 21, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The sco_sock_getsockopt_old function in net/bluetooth/sco.c in the Linux kernel before 2.6.39 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via the SCO_CONNINFO option.

  • CVE-2011-1023Jun 21, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The Reliable Datagram Sockets (RDS) subsystem in the Linux kernel before 2.6.38 does not properly handle congestion map updates, which allows local users to cause a denial of service (BUG_ON and system crash) via vectors involving (1) a loopback (aka loop) transmit operation or…

  • CVE-2011-1021Jun 21, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    drivers/acpi/debugfs.c in the Linux kernel before 3.0 allows local users to modify arbitrary kernel memory locations by leveraging root privileges to write to the /sys/kernel/debug/acpi/custom_method file. NOTE: this vulnerability exists because of an incomplete fix for…

  • CVE-2011-0716Jun 21, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The br_multicast_add_group function in net/bridge/br_multicast.c in the Linux kernel before 2.6.38, when a certain Ethernet bridge configuration is used, allows local users to cause a denial of service (memory corruption and system crash) by sending IGMP packets to a local…

  • CVE-2011-0006Jun 21, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The ima_lsm_rule_init function in security/integrity/ima/ima_policy.c in the Linux kernel before 2.6.37, when the Linux Security Modules (LSM) framework is disabled, allows local users to bypass Integrity Measurement Architecture (IMA) rules in opportunistic circumstances by…

  • CVE-2010-4650Jun 21, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Buffer overflow in the fuse_do_ioctl function in fs/fuse/file.c in the Linux kernel before 2.6.37 allows local users to cause a denial of service or possibly have unspecified other impact by leveraging the ability to operate a CUSE server.

  • CVE-2010-4648Jun 21, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.02

    The orinoco_ioctl_set_auth function in drivers/net/wireless/orinoco/wext.c in the Linux kernel before 2.6.37 does not properly implement a TKIP protection mechanism, which makes it easier for remote attackers to obtain access to a Wi-Fi network by reading Wi-Fi frames.

  • CVE-2010-4250Jun 21, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Memory leak in the inotify_init1 function in fs/notify/inotify/inotify_user.c in the Linux kernel before 2.6.37 allows local users to cause a denial of service (memory consumption) via vectors involving failed attempts to create files.

  • CVE-2012-3791Jun 21, 2012
    CMS Center
    Simple Web Content Management System
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Simple Web Content Management System 1.1 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) item_delete.php, (2) item_status.php, (3) item_detail.php, (4) item_modify.php, or (5) item_position.php in…