VYPR

CVEs

346,580 total · page 5935 of 6,932

AllCriticalHighKEV
  • CVE-2012-0471Apr 25, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to inject arbitrary web script or HTML via a multibyte…

  • CVE-2012-0470Apr 25, 2012
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.10

    Heap-based buffer overflow in the nsSVGFEDiffuseLightingElement::LightPixel function in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to cause a…

  • CVE-2012-0469Apr 25, 2012
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.07

    Use-after-free vulnerability in the mozilla::dom::indexedDB::IDBKeyRange::cycleCollection::Trace function in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote…

  • CVE-2012-0468Apr 25, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The browser engine in Mozilla Firefox 4.x through 11.0, Thunderbird 5.0 through 11.0, and SeaMonkey before 2.9 allows remote attackers to cause a denial of service (assertion failure and memory corruption) or possibly execute arbitrary code via vectors related to jsval.h and the…

  • CVE-2012-0467Apr 25, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allow remote attackers to cause a denial of service (memory…

  • CVE-2012-2131Apr 24, 2012
    OpenSSL Project
    OpenSSL
    risk 0.04cvss —epss 0.17

    Multiple integer signedness errors in crypto/buffer/buffer.c in OpenSSL 0.9.8v allow remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an…

  • CVE-2012-2405Apr 22, 2012
    Maianscriptworld
    Gallery
    risk 0.00cvss —epss 0.01

    Gallery 2 before 2.3.2 and 3 before 3.0.3 does not properly implement encryption, which has unspecified impact and attack vectors, a different vulnerability than CVE-2012-1113.

  • CVE-2012-1575Apr 22, 2012
    Trevor Mckay
    Cumin
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Cumin before r5238 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) widgets or (2) pages.

  • CVE-2012-1113Apr 22, 2012
    Maianscriptworld
    Gallery
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the administration subsystem in Gallery 2 before 2.3.2 and 3 before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-0946Apr 22, 2012
    Nvidia
    UNIX driver
    risk 0.03cvss —epss 0.01

    The NVIDIA UNIX driver before 295.40 allows local users to access arbitrary memory locations by leveraging GPU device-node read/write privileges.

  • CVE-2012-0743Apr 22, 2012
    IBM
    Tivoli Directory Server
    risk 0.00cvss —epss 0.02

    IBM Tivoli Directory Server (TDS) 6.3 and earlier allows remote attackers to cause a denial of service (daemon crash) via a malformed LDAP paged search request.

  • CVE-2012-0740Apr 22, 2012
    IBM
    Tivoli Directory Server
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Web Admin Tool in IBM Tivoli Directory Server (TDS) 6.2 before 6.2.0.22 and 6.3 before 6.3.0.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-0726Apr 22, 2012
    IBM
    Tivoli Directory Server
    risk 0.00cvss —epss 0.02

    The default configuration of TLS in IBM Tivoli Directory Server (TDS) 6.3 and earlier supports the (1) NULL-MD5 and (2) NULL-SHA ciphers, which allows remote attackers to trigger unencrypted communication via the TLS Handshake Protocol.

  • CVE-2012-0708Apr 22, 2012
    IBM
    Rational Clearquest
    risk 0.05cvss —epss 0.31

    Heap-based buffer overflow in the Ole API in the CQOle ActiveX control in cqole.dll in IBM Rational ClearQuest 7.1.1 before 7.1.1.9, 7.1.2 before 7.1.2.6, and 8.0.0 before 8.0.0.2 allows remote attackers to execute arbitrary code via a crafted web page that leverages a…

  • CVE-2012-0216Apr 22, 2012
    Debian
    Apache HTTP Server
    risk 0.00cvss —epss 0.00

    The default configuration of the apache2 package in Debian GNU/Linux squeeze before 2.2.16-6+squeeze7, wheezy before 2.2.22-4, and sid before 2.2.22-4, when mod_php or mod_rivet is used, provides example scripts under the doc/ URI, which might allow local users to conduct…

  • CVE-2012-2234Apr 22, 2012
    Nilsteampassnet
    Teampass
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in sources/users.queries.php in TeamPass before 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the login parameter in an add_new_user action.

  • CVE-2012-1243Apr 22, 2012
    Studiohitori
    Twitrocker2 Android
    risk 0.00cvss —epss 0.02

    The TwitRocker2 application before 1.0.23 for Android does not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application.

  • CVE-2012-2404Apr 21, 2012
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

  • CVE-2012-2403Apr 21, 2012
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

  • CVE-2012-2402Apr 21, 2012
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors.

  • CVE-2012-2401Apr 21, 2012
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.

  • CVE-2012-2400Apr 21, 2012
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in wp-includes/js/swfobject.js in WordPress before 3.3.2 has unknown impact and attack vectors.

  • CVE-2012-2399Apr 21, 2012
    WordPress
    WordPress
    risk 0.00cvss —epss 0.09

    Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earlier, and other products allows remote attackers to inject arbitrary web script or HTML via the buttonText parameter, a…

  • CVE-2012-2398Apr 20, 2012
    OwnCloud
    Owncloud
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in files/ajax/download.php in ownCloud before 3.0.3 allows remote attackers to inject arbitrary web script or HTML via the files parameter, a different vulnerability than CVE-2012-2269.4.

  • CVE-2012-2397Apr 20, 2012
    OwnCloud
    Owncloud
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in ownCloud before 3.0.3 allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site scripting (XSS) sequences via vectors involving contacts.

  • CVE-2012-2270Apr 20, 2012
    OwnCloud
    Owncloud
    risk 0.00cvss —epss 0.06

    Open redirect vulnerability in index.php (aka the Login Page) in ownCloud before 3.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect_url parameter.

  • CVE-2012-2269Apr 20, 2012
    OwnCloud
    Owncloud
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary field to apps/contacts/ajax/addcard.php, (2) the parameter parameter to apps/contacts/ajax/addproperty.php, (3) the…

  • CVE-2012-2236Apr 20, 2012
    PHP Gift Registry
    PHP Gift Registry
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in users.php in PHP Gift Registry 1.5.5 allows remote authenticated users to execute arbitrary SQL commands via the userid parameter in an edit action.

  • CVE-2012-2273Apr 20, 2012
    Comodo
    Internet Security
    risk 0.00cvss —epss 0.01

    Comodo Internet Security before 5.10.228257.2253 on Windows 7 x64 allows local users to cause a denial of service (system crash) via a crafted 32-bit Portable Executable (PE) file with a kernel ImageBase value.

  • CVE-2012-0407Apr 20, 2012
    EMC Corporation
    Data Protection Advisor
    risk 0.03cvss —epss 0.03

    Integer overflow in the DPA_Utilities library in EMC Data Protection Advisor (DPA) 5.5 through 5.8 SP1 allows remote attackers to cause a denial of service (infinite loop) via a negative 64-bit value in a certain size field.

  • CVE-2012-0406Apr 20, 2012
    EMC Corporation
    Data Protection Advisor
    risk 0.04cvss —epss 0.09

    The DPA_Utilities.cProcessAuthenticationData function in EMC Data Protection Advisor (DPA) 5.5 through 5.8 SP1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an AUTHENTICATECONNECTION command that (1) lacks a password field…

  • CVE-2012-2396Apr 19, 2012
    VideoLAN
    VLC media player
    risk 0.04cvss —epss 0.07

    VideoLAN VLC media player 2.0.1 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted MP4 file.

  • CVE-2012-0134Apr 19, 2012
    Microfocus
    Openvms
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in HP OpenVMS 7.3-2 on the Alpha platform, 8.3 and 8.4 on the Alpha and IA64 platforms, and 8.3-1h1 on the IA64 platform allows local users to cause a denial of service via unknown vectors.

  • CVE-2012-2110Apr 19, 2012
    OpenSSL Project
    OpenSSL
    risk 0.07cvss —epss 0.48

    The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory…

  • CVE-2012-0253Apr 18, 2012
    Demandmedia
    Pluck Sitelife
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Demand Media Pluck SiteLife before 5.0.13 allow remote attackers to inject arbitrary web script or HTML via (1) the jsonRequest parameter to Direct/Process, the (2) r or (3) cb parameter to Direct/jsonp.htm, or (4) the cb…

  • CVE-2011-5089Apr 18, 2012
    Iconics
    Bizviz
    risk 0.00cvss —epss 0.04

    Buffer overflow in the Security Login ActiveX controls in ICONICS GENESIS32 8.05, 9.0, 9.1, and 9.2 and BizViz 8.05, 9.0, 9.1, and 9.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long password.

  • CVE-2011-5088Apr 18, 2012
    Iconics
    Bizviz
    risk 0.00cvss —epss 0.03

    The GENESIS32 IcoSetServer ActiveX control in ICONICS GENESIS32 9.21 and BizViz 9.21 configures the trusted zone on the basis of user input, which allows remote attackers to execute arbitrary code via a crafted web site, related to a "Workbench32/WebHMI component SetTrustedZone…

  • CVE-2012-1993Apr 18, 2012
    Microfocus
    System Management Homepage
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in HP System Management Homepage (SMH) before 7.0 allows local users to modify data or obtain sensitive information via unknown vectors.

  • CVE-2012-1802Apr 18, 2012
    Siemens Foundation
    Scalance X
    risk 0.00cvss —epss 0.06

    Buffer overflow in the embedded web server on the Siemens Scalance X Industrial Ethernet switch X414-3E before 3.7.1, X308-2M before 3.7.2, X-300EEC before 3.7.2, XR-300 before 3.7.2, and X-300 before 3.7.2 allows remote attackers to cause a denial of service (device reboot) or…

  • CVE-2012-1801Apr 18, 2012
    Abb
    Interlink Module
    risk 0.00cvss —epss 0.02

    Multiple stack-based buffer overflows in (1) COM and (2) ActiveX controls in ABB WebWare Server, WebWare SDK, Interlink Module, S4 OPC Server, QuickTeach, RobotStudio S4, and RobotStudio Lite allow remote attackers to execute arbitrary code via crafted input data.

  • CVE-2012-1800Apr 18, 2012
    Siemens Foundation
    Scalance S Security Module
    risk 0.00cvss —epss 0.02

    Stack-based buffer overflow in the Profinet DCP protocol implementation on the Siemens Scalance S Security Module firewall S602 V2, S612 V2, and S613 V2 with firmware before 2.3.0.3 allows remote attackers to cause a denial of service (device outage) or possibly execute…

  • CVE-2012-1799Apr 18, 2012
    Siemens Foundation
    Scalance S Firmware
    risk 0.00cvss —epss 0.05

    The web server on the Siemens Scalance S Security Module firewall S602 V2, S612 V2, and S613 V2 with firmware before 2.3.0.3 does not limit the rate of authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack on the…

  • CVE-2012-0883Apr 18, 2012
    Apache
    HTTP Server
    risk 0.00cvss —epss 0.01

    envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.

  • CVE-2012-0278Apr 18, 2012
    IrfanView
    Flashpix Plugin
    risk 0.04cvss —epss 0.10

    Heap-based buffer overflow in the FlashPix PlugIn before 4.3.4.0 for IrfanView might allow remote attackers to execute arbitrary code via a .fpx file containing a crafted FlashPix image that is not properly handled during decompression.

  • CVE-2012-0135Apr 18, 2012
    Microfocus
    System Management Homepage
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in HP System Management Homepage (SMH) before 7.0 allows remote authenticated users to cause a denial of service via unknown vectors.

  • CVE-2011-5087Apr 18, 2012
    Adastra
    Trace Mode Data Center
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in AdAstrA TRACE MODE Data Center allows remote attackers to read arbitrary files via unknown vectors, as demonstrated by the GLEG Agora SCADA+ Exploit Pack for Immunity CANVAS.

  • CVE-2011-5086Apr 18, 2012
    Unitronics
    UniOPC
    risk 0.00cvss —epss 0.02

    https50.ocx in IP*Works! SSL in the server in Unitronics UniOPC before 2.0.0 does not properly implement an unspecified function, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site.

  • CVE-2011-4871Apr 18, 2012
    Open Automation Software
    Open Automation Software
    risk 0.03cvss —epss 0.03

    Open Automation Software OPC Systems.NET before 5.0 allows remote attackers to cause a denial of service via a malformed .NET RPC packet on TCP port 58723.

  • CVE-2012-2089Apr 17, 2012
    Nginx
    Nginx
    risk 0.01cvss —epss 0.10

    Buffer overflow in ngx_http_mp4_module.c in the ngx_http_mp4_module module in nginx 1.0.7 through 1.0.14 and 1.1.3 through 1.1.18, when the mp4 directive is used, allows remote attackers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a…

  • CVE-2012-1518Apr 17, 2012
    VMware
    Workstation
    risk 0.00cvss —epss 0.02

    VMware Workstation 8.x before 8.0.2, VMware Player 4.x before 4.0.2, VMware Fusion 4.x before 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 use an incorrect ACL for the VMware Tools folder, which allows guest OS users to gain guest OS privileges via…