VYPR

CVEs

346,580 total · page 5934 of 6,932

AllCriticalHighKEV
  • CVE-2012-2415Apr 30, 2012
    Asterisk
    Opensource
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in chan_skinny.c in the Skinny channel driver in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 allows remote authenticated users to cause a denial of service or possibly have unspecified other impact via a…

  • CVE-2012-2414Apr 30, 2012
    Asterisk
    Business Edition
    risk 0.00cvss —epss 0.03

    main/manager.c in the Manager Interface in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before C.3.7.4 does not properly enforce System class authorization requirements, which allows remote…

  • CVE-2012-2111Apr 30, 2012
    Samba (software)
    Samba
    risk 0.00cvss —epss 0.05

    The (1) CreateAccount, (2) OpenAccount, (3) AddAccountRights, and (4) RemoveAccountRights LSA RPC procedures in smbd in Samba 3.4.x before 3.4.17, 3.5.x before 3.5.15, and 3.6.x before 3.6.5 do not properly restrict modifications to the privileges database, which allows remote…

  • CVE-2012-0863Apr 30, 2012
    Mumble
    Mumble
    risk 0.00cvss —epss 0.00

    Mumble 1.2.3 and earlier uses world-readable permissions for .local/share/data/Mumble/.mumble.sqlite files in home directories, which might allow local users to obtain a cleartext password and configuration data by reading a file.

  • CVE-2012-2213Apr 28, 2012
    Squid Cache
    Squid
    risk 0.01cvss —epss 0.12

    Squid 3.1.9 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher is unable to provide a squid.conf file for a…

  • CVE-2012-2212Apr 28, 2012
    McAfee
    Web Gateway
    risk 0.00cvss —epss 0.01

    McAfee Web Gateway 7.0 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher did not provide configuration details…

  • CVE-2012-2441Apr 28, 2012
    Siemens Foundation
    Rugged Operating System
    risk 0.04cvss —epss 0.09

    RuggedCom Rugged Operating System (ROS) before 3.3 has a factory account with a password derived from the MAC Address field in a banner, which makes it easier for remote attackers to obtain access by performing a calculation on this address value, and then establishing a (1) SSH…

  • CVE-2012-2440Apr 28, 2012
    TP-Link
    8840t
    risk 0.00cvss —epss 0.01

    The default configuration of the TP-Link 8840T router enables web-based administration on the WAN interface, which allows remote attackers to establish an HTTP connection and possibly have unspecified other impact via unknown vectors.

  • CVE-2012-2439Apr 28, 2012
    Netgear
    Prosafe Fvs318n
    risk 0.00cvss —epss 0.02

    The default configuration of the NETGEAR ProSafe FVS318N firewall enables web-based administration on the WAN interface, which allows remote attackers to establish an HTTP connection and possibly have unspecified other impact via unknown vectors.

  • CVE-2012-1803Apr 28, 2012
    Siemens Foundation
    Rugged Operating System
    risk 0.07cvss —epss 0.49

    RuggedCom Rugged Operating System (ROS) 3.10.x and earlier has a factory account with a password derived from the MAC Address field in the banner, which makes it easier for remote attackers to obtain access by performing a calculation on this address value, and then establishing…

  • CVE-2012-0466Apr 27, 2012
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    template/en/default/list/list.js.tmpl in Bugzilla 2.x and 3.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1 does not properly handle multiple logins, which allows remote attackers to conduct cross-site scripting (XSS) attacks and obtain sensitive…

  • CVE-2012-0465Apr 27, 2012
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    Bugzilla 3.5.x and 3.6.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1, when the inbound_proxies option is enabled, does not properly validate the X-Forwarded-For HTTP header, which allows remote attackers to bypass the lockout policy via a series…

  • CVE-2012-1244Apr 27, 2012
    Nttdocomo
    sp mode mail
    risk 0.00cvss —epss 0.01

    The NTT DOCOMO sp mode mail application 5400 and earlier for Android does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2012-1242Apr 27, 2012
    Justsystems
    Ichitaro
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in JustSystems Ichitaro 2011 Sou, Ichitaro 2006 through 2011, Ichitaro Government 2006 through 2010, Ichitaro Portable with oreplug, Ichitaro Viewer, JUST School, JUST School 2009 and 2010, JUST Jump 4, JUST Frontier, and oreplug allows local…

  • CVE-2012-0269Apr 27, 2012
    Justsystems
    Ichitaro
    risk 0.00cvss —epss 0.04

    Buffer overflow in JustSystems Ichitaro 2011 Sou, Ichitaro 2006 through 2011, Ichitaro Government 2006 through 2010, Ichitaro Portable with oreplug, Ichitaro Viewer, JUST School, JUST School 2009 and 2010, JUST Jump 4, JUST Frontier, oreplug, Shuriken Pro4, Shuriken 2007 through…

  • CVE-2012-1245Apr 27, 2012
    Osqa
    Osqa
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the cleanup_urls function in forum/utils/html.py in OSQA before 1234, and 0.9.0 Beta 3 and earlier, allows remote attackers to inject arbitrary web script or HTML via vectors related to a crafted URI.

  • CVE-2012-2425Apr 25, 2012
    Intuit
    Quickbooks
    risk 0.00cvss —epss 0.01

    The intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, allow remote attackers to cause a denial of service (application crash) via a long URI.

  • CVE-2012-2424Apr 25, 2012
    Intuit
    Quickbooks
    risk 0.00cvss —epss 0.01

    The intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, allow remote attackers to cause a denial of service (NULL pointer dereference and application…

  • CVE-2012-2423Apr 25, 2012
    Intuit
    Quickbooks
    risk 0.00cvss —epss 0.01

    The intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, provide different responses to remote requests depending on whether a ZIP pathname is valid,…

  • CVE-2012-2422Apr 25, 2012
    Intuit
    Quickbooks
    risk 0.00cvss —epss 0.01

    Intuit QuickBooks 2009 through 2012 might allow remote attackers to obtain pathname information via the qbwc://docontrol/GetCompanyFile functionality.

  • CVE-2012-2421Apr 25, 2012
    Intuit
    Quickbooks
    risk 0.00cvss —epss 0.01

    Absolute path traversal vulnerability in the intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, might allow remote attackers to read arbitrary files in…

  • CVE-2012-2420Apr 25, 2012
    Intuit
    Quickbooks
    risk 0.00cvss —epss 0.01

    The intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, might allow remote attackers to obtain sensitive information via a URI with a % (percent)…

  • CVE-2012-2419Apr 25, 2012
    Intuit
    Quickbooks
    risk 0.00cvss —epss 0.01

    Memory leak in the intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, allows remote attackers to cause a denial of service (memory consumption) via a…

  • CVE-2012-2418Apr 25, 2012
    Intuit
    Quickbooks
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in the intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, allows remote attackers to cause a denial of service (memory…

  • CVE-2012-1144Apr 25, 2012
    FreeType
    Freetype
    risk 0.00cvss —epss 0.05

    FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and memory corruption) or possibly execute arbitrary code via a crafted TrueType font.

  • CVE-2012-1143Apr 25, 2012
    FreeType
    Freetype
    risk 0.00cvss —epss 0.02

    FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted font.

  • CVE-2012-1142Apr 25, 2012
    FreeType
    Freetype
    risk 0.00cvss —epss 0.04

    FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and memory corruption) or possibly execute arbitrary code via crafted glyph-outline data in a font.

  • CVE-2012-1141Apr 25, 2012
    FreeType
    Freetype
    risk 0.00cvss —epss 0.04

    FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via a crafted ASCII string in a BDF font.

  • CVE-2012-1140Apr 25, 2012
    FreeType
    Freetype
    risk 0.00cvss —epss 0.04

    FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via a crafted PostScript font object.

  • CVE-2012-1139Apr 25, 2012
    FreeType
    Freetype
    risk 0.00cvss —epss 0.04

    Array index error in FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid stack read operation and memory corruption) or possibly execute arbitrary code via crafted glyph data in…

  • CVE-2012-1138Apr 25, 2012
    FreeType
    Freetype
    risk 0.00cvss —epss 0.05

    FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via vectors involving the MIRP instruction in a…

  • CVE-2012-1137Apr 25, 2012
    FreeType
    Freetype
    risk 0.00cvss —epss 0.04

    FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via a crafted header in a BDF font.

  • CVE-2012-1136Apr 25, 2012
    FreeType
    Freetype
    risk 0.00cvss —epss 0.04

    FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and memory corruption) or possibly execute arbitrary code via crafted glyph or bitmap data in a BDF font…

  • CVE-2012-1135Apr 25, 2012
    FreeType
    Freetype
    risk 0.00cvss —epss 0.05

    FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via vectors involving the NPUSHB and NPUSHW…

  • CVE-2012-1134Apr 25, 2012
    FreeType
    Freetype
    risk 0.00cvss —epss 0.05

    FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and memory corruption) or possibly execute arbitrary code via crafted private-dictionary data in a Type 1…

  • CVE-2012-1133Apr 25, 2012
    FreeType
    Freetype
    risk 0.00cvss —epss 0.05

    FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and memory corruption) or possibly execute arbitrary code via crafted glyph or bitmap data in a BDF font.

  • CVE-2012-1132Apr 25, 2012
    FreeType
    Freetype
    risk 0.00cvss —epss 0.04

    FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via crafted dictionary data in a Type 1 font.

  • CVE-2012-1131Apr 25, 2012
    FreeType
    Freetype
    risk 0.00cvss —epss 0.04

    FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, on 64-bit platforms allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via vectors related to the…

  • CVE-2012-1130Apr 25, 2012
    FreeType
    Freetype
    risk 0.00cvss —epss 0.04

    FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via crafted property data in a PCF font.

  • CVE-2012-1129Apr 25, 2012
    FreeType
    Freetype
    risk 0.00cvss —epss 0.04

    FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via a crafted SFNT string in a Type 42 font.

  • CVE-2012-1128Apr 25, 2012
    FreeType
    Freetype
    risk 0.00cvss —epss 0.05

    FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and memory corruption) or possibly execute arbitrary code via a crafted TrueType font.

  • CVE-2012-1127Apr 25, 2012
    FreeType
    Freetype
    risk 0.00cvss —epss 0.04

    FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via crafted glyph or bitmap data in a BDF font.

  • CVE-2012-1126Apr 25, 2012
    FreeType
    Freetype
    risk 0.00cvss —epss 0.06

    FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via crafted property data in a BDF font.

  • CVE-2012-0479Apr 25, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allow remote attackers to spoof the address bar via an https URL for invalid (1) RSS or (2) Atom XML content.

  • CVE-2012-0478Apr 25, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The texImage2D implementation in the WebGL subsystem in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 does not properly restrict JSVAL_TO_OBJECT casts, which might…

  • CVE-2012-0477Apr 25, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allow remote attackers to inject arbitrary web script or HTML via…

  • CVE-2012-0475Apr 25, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 4.x through 11.0, Thunderbird 5.0 through 11.0, and SeaMonkey before 2.9 do not properly construct the Origin and Sec-WebSocket-Origin HTTP headers, which might allow remote attackers to bypass an IPv6 literal ACL via a cross-site (1) XMLHttpRequest or (2)…

  • CVE-2012-0474Apr 25, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the docshell implementation in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to inject arbitrary web…

  • CVE-2012-0473Apr 25, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The WebGLBuffer::FindMaxUshortElement function in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 calls the FindMaxElementInSubArray function with incorrect template…

  • CVE-2012-0472Apr 25, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The cairo-dwrite implementation in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9, when certain Windows Vista and Windows 7 configurations are used, does not properly…