VYPR

CVEs

346,580 total · page 5936 of 6,932

AllCriticalHighKEV
  • CVE-2012-1180Apr 17, 2012
    Nginx
    Nginx
    risk 0.01cvss —epss 0.10

    Use-after-free vulnerability in nginx before 1.0.14 and 1.1.x before 1.1.17 allows remote HTTP servers to obtain sensitive information from process memory via a crafted backend response, in conjunction with a client request.

  • CVE-2012-1979Apr 17, 2012
    Syndeocms
    Syndeocms
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in starnet/index.php in SyndeoCMS 3.0.01 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the email parameter (aka Email address field) in an edit_user configuration action.

  • CVE-2011-2478Apr 17, 2012
    Google
    Sketchup
    risk 0.00cvss —epss 0.02

    Google SketchUp before 8 does not properly handle edge geometry in SketchUp (aka .SKP) files, which allows remote attackers to execute arbitrary code via a crafted file.

  • CVE-2012-2268Apr 17, 2012
    RealNetworks
    Helix Mobile Server
    risk 0.00cvss —epss 0.02

    master.exe in the SNMP Master Agent in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to cause a denial of service (unhandled exception and daemon crash) via a crafted Open-PDU request that triggers incorrect DisplayString…

  • CVE-2012-2267Apr 17, 2012
    RealNetworks
    Helix Mobile Server
    risk 0.00cvss —epss 0.02

    master.exe in the SNMP Master Agent in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to cause a denial of service (daemon crash) by establishing and closing a port-705 TCP connection, a different vulnerability than CVE-2012-1923.

  • CVE-2012-1985Apr 17, 2012
    RealNetworks
    Helix Mobile Server
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to hijack the authentication of administrators for requests that cause a denial of service (stack consumption and daemon crash) via a…

  • CVE-2012-1984Apr 17, 2012
    RealNetworks
    Helix Mobile Server
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1923Apr 17, 2012
    RealNetworks
    Helix Mobile Server
    risk 0.03cvss —epss 0.38

    RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x store passwords in cleartext under adm_b_db\users\, which allows local users to obtain sensitive information by reading a database.

  • CVE-2012-0942Apr 17, 2012
    RealNetworks
    Helix Mobile Server
    risk 0.00cvss —epss 0.04

    Buffer overflow in rn5auth.dll in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to execute arbitrary code via crafted authentication credentials.

  • CVE-2012-1241Apr 16, 2012
    ActiveScriptRuby
    GRScript18.dll
    risk 0.00cvss —epss 0.02

    GRScript18.dll before 1.2.2.0 in ActiveScriptRuby (ASR) before 1.8.7 does not properly restrict interaction with an Internet Explorer ActiveX environment, which allows remote attackers to execute arbitrary Ruby code via a crafted HTML document.

  • CVE-2012-1240Apr 16, 2012
    Recruit
    Dokodemo Rikunabi 2013
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the RECRUIT Dokodemo Rikunabi 2013 extension before 1.0.1 for Google Chrome allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-0036Apr 13, 2012
    Curl
    Curl
    risk 0.00cvss —epss 0.17

    curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or…

  • CVE-2011-1779Apr 13, 2012
    Libarchive
    Libarchive
    risk 0.00cvss —epss 0.01

    Multiple use-after-free vulnerabilities in libarchive 2.8.4 and 2.8.5 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted (1) TAR archive or (2) ISO9660 image.

  • CVE-2011-1778Apr 13, 2012
    Libarchive
    Libarchive
    risk 0.00cvss —epss 0.04

    Buffer overflow in libarchive through 2.8.5 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TAR archive.

  • CVE-2011-1777Apr 13, 2012
    Libarchive
    Libarchive
    risk 0.00cvss —epss 0.04

    Multiple buffer overflows in the (1) heap_add_entry and (2) relocate_dir functions in archive_read_support_format_iso9660.c in libarchive through 2.8.5 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted…

  • CVE-2010-4666Apr 13, 2012
    Libarchive
    Libarchive
    risk 0.00cvss —epss 0.02

    Buffer overflow in libarchive 3.0 pre-release code allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CAB file, which is not properly handled during the reading of Huffman code data within LZX…

  • CVE-2012-1809Apr 13, 2012
    Koyo
    ECOM Ethernet module
    risk 0.00cvss —epss 0.01

    The web server in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors.

  • CVE-2012-1808Apr 13, 2012
    Koyo
    ECOM Ethernet module
    risk 0.00cvss —epss 0.04

    The web server in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 does not require authentication, which allows remote attackers to perform unspecified functions via unknown vectors.

  • CVE-2012-1807Apr 13, 2012
    Koyo
    ECOM Ethernet module
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the web server in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1806Apr 13, 2012
    Koyo
    ECOM Ethernet module
    risk 0.00cvss —epss 0.02

    The ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 supports a maximum password length of 8 bytes, which makes it easier for remote attackers to obtain access via a brute-force attack.

  • CVE-2012-1805Apr 13, 2012
    Koyo
    H0 Ecom100
    risk 0.00cvss —epss 0.06

    Buffer overflow in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 allows remote attackers to execute arbitrary code via long strings in unspecified parameters.

  • CVE-2011-4883Apr 13, 2012
    Atvise
    Webmi2ads
    risk 0.03cvss —epss 0.03

    The web server in Certec atvise webMI2ADS (aka webMI) before 2.0.2 does not properly validate values in HTTP requests, which allows remote attackers to cause a denial of service (resource consumption) via a crafted request.

  • CVE-2011-4882Apr 13, 2012
    Atvise
    Webmi2ads
    risk 0.03cvss —epss 0.03

    The web server in Certec atvise webMI2ADS (aka webMI) before 2.0.2 allows remote attackers to cause a denial of service (application exit) via an unspecified command in an HTTP request.

  • CVE-2011-4881Apr 13, 2012
    Atvise
    Webmi2ads
    risk 0.04cvss —epss 0.08

    The web server in Certec atvise webMI2ADS (aka webMI) before 2.0.2 does not properly check return values from functions, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted HTTP request.

  • CVE-2011-4880Apr 13, 2012
    Atvise
    Webmi2ads
    risk 0.03cvss —epss 0.06

    Directory traversal vulnerability in the web server in Certec atvise webMI2ADS (aka webMI) before 2.0.2 allows remote attackers to read arbitrary files via a crafted HTTP request.

  • CVE-2011-4874Apr 13, 2012
    Microsys
    Promotic
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in MICROSYS PROMOTIC before 8.1.7 allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (data corruption and application crash) via a crafted project (aka .pra) file.

  • CVE-2012-2230Apr 12, 2012
    Cloudera
    Manager
    risk 0.00cvss —epss 0.02

    Cloudera Manager 3.7.x before 3.7.5 and Service and Configuration Manager 3.5, when Kerberos is not enabled, does not properly install taskcontroller.cfg, which allows remote authenticated users to impersonate arbitrary user accounts via unspecified vectors, a different…

  • CVE-2012-1574Apr 12, 2012
    Apache
    Hadoop
    risk 0.00cvss —epss 0.05

    The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera hadoop-0.20-sbin before 0.20.2+923.197, and other products, allows remote…

  • CVE-2012-0133Apr 12, 2012
    Microfocus
    ProCurve 5400 zl
    risk 0.00cvss —epss 0.01

    HP ProCurve 5400 zl switches with certain serial numbers include a compact flash card that contains an unspecified virus, which might allow user-assisted remote attackers to execute arbitrary code on a PC by leveraging manual transfer of this card.

  • CVE-2011-3846Apr 12, 2012
    Microfocus
    System Management Homepage
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in HP System Management Homepage (SMH) 6.2.2.7 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts.

  • CVE-2012-2225Apr 11, 2012
    risk 0.00cvss —epss 0.03

    360zip 1.93beta allows remote attackers to execute arbitrary code via vectors related to file browsing and file extraction.

  • CVE-2012-2224Apr 11, 2012
    Xunlei
    Thunder
    risk 0.00cvss —epss 0.03

    Xunlei Thunder before 7.2.6 allows remote attackers to execute arbitrary code via a crafted file, related to a "DLL injection vulnerability."

  • CVE-2012-2223Apr 11, 2012
    Novell
    Zenworks Configuration Management
    risk 0.00cvss —epss 0.01

    The xplat agent in Novell ZENworks Configuration Management (ZCM) 10.3.x before 10.3.4 and 11.x before 11.2 enables the HTTP TRACE method, which might make it easier for remote attackers to conduct cross-site tracing (XST) attacks via unspecified vectors.

  • CVE-2012-2210Apr 11, 2012
    Sony
    Bravia Tv
    risk 0.04cvss —epss 0.09

    The Sony Bravia TV KDL-32CX525 allows remote attackers to cause a denial of service (configuration outage or device crash) via a flood of TCP SYN packets, as demonstrated by hping, a related issue to CVE-1999-0116.

  • CVE-2012-2156Apr 11, 2012
    Plume CMS
    CMS
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in Plume CMS 1.2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the u_email parameter (aka Authors Email field) to manager/users.php, (2) the u_realname parameter (aka Authors Name field) to…

  • CVE-2012-1992Apr 11, 2012
    Cmsmadesimple
    Cmsmadesimple
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in admin/edituser.php in CMS Made Simple 1.10.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the email parameter (aka the Email Address field in the Edit User template).

  • CVE-2012-1673Apr 11, 2012
    Ola Lasisi
    E Ticketing
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in loginscript.php in e-ticketing allows remote attackers to execute arbitrary SQL commands via the password parameter.

  • CVE-2012-1672Apr 11, 2012
    Useasdf 4444
    Hotel Booking Portal
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in getcity.php in Hotel Booking Portal 0.1 allows remote attackers to execute arbitrary SQL commands via the country parameter.

  • CVE-2012-1596Apr 11, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    The mp2t_process_fragmented_payload function in epan/dissectors/packet-mp2t.c in the MP2T dissector in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (application crash) via a packet containing an invalid pointer value…

  • CVE-2012-1595Apr 11, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    The pcap_process_pseudo_header function in wiretap/pcap-common.c in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (application crash) via a WTAP_ENCAP_ERF file containing an Extension or Multi-Channel header with an…

  • CVE-2012-1594Apr 11, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.

  • CVE-2012-1593Apr 11, 2012
    Wireshark
    Wireshark
    risk 0.04cvss —epss 0.11

    epan/dissectors/packet-ansi_a.c in the ANSI A dissector in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed packet.

  • CVE-2012-1499Apr 11, 2012
    Uclouvain
    Openjpeg
    risk 0.00cvss —epss 0.05

    The JPEG 2000 codec (jp2.c) in OpenJPEG before 1.5 allows remote attackers to execute arbitrary code via a crafted palette index in a CMAP record of a JPEG image, which triggers memory corruption, aka "out-of heap-based buffer write."

  • CVE-2012-1036Apr 11, 2012
    Dnnsoftware
    Dotnetnuke
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message.

  • CVE-2012-1030Apr 11, 2012
    Dnnsoftware
    Dotnetnuke
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted URL containing text that is used within a modal popup.

  • CVE-2012-0068Apr 11, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    The lanalyzer_read function in wiretap/lanalyzer.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a Novell capture file containing a record that is too small.

  • CVE-2012-0067Apr 11, 2012
    Wireshark
    Wireshark
    risk 0.04cvss —epss 0.07

    wiretap/iptrace.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in an AIX iptrace file.

  • CVE-2012-0066Apr 11, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in a (1) Accellent 5Views (aka .5vw) file, (2) I4B trace file, or (3) NETMON 2 capture file.

  • CVE-2012-0043Apr 11, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    Buffer overflow in the reassemble_message function in epan/dissectors/packet-rlc.c in the RLC dissector in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a…

  • CVE-2012-0042Apr 11, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 does not properly perform certain string conversions, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet, related to epan/to_str.c.