VYPR

CVEs

346,580 total · page 5937 of 6,932

AllCriticalHighKEV
  • CVE-2012-0041Apr 11, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    The dissect_packet function in epan/packet.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in a capture file, as demonstrated by an airopeek file.

  • CVE-2012-0777Apr 10, 2012
    Adobe Inc.
    Acrobat
    risk 0.01cvss —epss 0.07

    The JavaScript API in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 on Mac OS X and Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

  • CVE-2012-0776Apr 10, 2012
    Adobe Inc.
    Reader
    risk 0.01cvss —epss 0.08

    The installer in Adobe Reader 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to bypass intended access restrictions and execute arbitrary code via unspecified vectors.

  • CVE-2012-0775Apr 10, 2012
    Adobe Inc.
    Acrobat
    risk 0.01cvss —epss 0.09

    The JavaScript implementation in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

  • CVE-2012-0774Apr 10, 2012
    Adobe Inc.
    Acrobat
    risk 0.01cvss —epss 0.16

    Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitrary code via a crafted TrueType font.

  • CVE-2012-1182Apr 10, 2012
    Samba (software)
    Samba
    risk 0.09cvss —epss 0.74

    The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a…

  • CVE-2012-0177Apr 10, 2012
    Microsoft
    Office
    risk 0.02cvss —epss 0.30

    Heap-based buffer overflow in the Office Works File Converter in Microsoft Office 2007 SP2, Works 9, and Works 6-9 File Converter allows remote attackers to execute arbitrary code via a crafted Works (aka .wps) file, aka "Office WPS Converter Heap Overflow Vulnerability."

  • CVE-2012-0172Apr 10, 2012
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.22

    Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "VML Style Remote Code Execution Vulnerability."

  • CVE-2012-0171Apr 10, 2012
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.27

    Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "SelectAll Remote Code Execution Vulnerability."

  • CVE-2012-0170Apr 10, 2012
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.22

    Microsoft Internet Explorer 6 and 7 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "OnReadyStateChange Remote Code Execution Vulnerability."

  • CVE-2012-0169Apr 10, 2012
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.30

    Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "JScript9 Remote Code Execution Vulnerability."

  • CVE-2012-0168Apr 10, 2012
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.18

    Microsoft Internet Explorer 6 through 9 allows user-assisted remote attackers to execute arbitrary code via a crafted HTML document that is not properly handled during a "Print table of links" print operation, aka "Print Feature Remote Code Execution Vulnerability."

  • CVE-2012-0163Apr 10, 2012
    Microsoft
    .net Framework
    risk 0.06cvss —epss 0.38

    Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate function parameters, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a…

  • CVE-2012-0158HigKEVApr 10, 2012
    Microsoft
    Office
    risk 0.80cvss 8.8epss 1.00

    The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and…

  • CVE-2012-0151HigKEVApr 10, 2012
    Microsoft
    Windows
    risk 0.69cvss 7.8epss 0.84

    The Authenticode Signature Verification function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview does not properly validate the digest of a signed…

  • CVE-2012-0147Apr 10, 2012
    Microsoft
    Forefront Unified Access Gateway
    risk 0.03cvss —epss 0.36

    Microsoft Forefront Unified Access Gateway (UAG) 2010 SP1 and SP1 Update 1 does not properly configure the default web site, which allows remote attackers to obtain sensitive information via a crafted HTTPS request, aka "Unfiltered Access to UAG Default Website Vulnerability."

  • CVE-2012-0146Apr 10, 2012
    Microsoft
    Forefront Unified Access Gateway
    risk 0.01cvss —epss 0.11

    Open redirect vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 SP1 and SP1 Update 1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL, aka "UAG Blind HTTP Redirect Vulnerability."

  • CVE-2012-2215Apr 9, 2012
    Novell
    Zenworks Configuration Management
    risk 0.05cvss —epss 0.28

    Directory traversal vulnerability in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to read arbitrary files via an opcode 0x21 request.

  • CVE-2012-0742Apr 9, 2012
    IBM
    Tivoli Event Pump
    risk 0.00cvss —epss 0.00

    IBM Tivoli Event Pump 4.2.2, when the LOG_REQUESTS and VALIDATE_SOAP_USERS options are enabled, places credentials into the AOPSCLOG (aka AOPLOG) data set, which allows local users to obtain sensitive information by reading the data.

  • CVE-2011-4188Apr 9, 2012
    Novell
    Imanager
    risk 0.00cvss —epss 0.02

    Buffer overflow in the Create Attribute function in jclient in Novell iManager 2.7.4 before patch 4 allows remote authenticated users to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted EnteredAttrName parameter, a related…

  • CVE-2011-3176Apr 9, 2012
    Novell
    Zenworks Configuration Management
    risk 0.09cvss —epss 0.70

    Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to execute arbitrary code via an opcode 0x4c request.

  • CVE-2011-3175Apr 9, 2012
    Novell
    Zenworks Configuration Management
    risk 0.08cvss —epss 0.66

    Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to execute arbitrary code via an opcode 0x6c request.

  • CVE-2012-0725Apr 6, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Adobe Flash Player before 11.2.202.229 in Google Chrome before 18.0.1025.151 allow attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2012-0724.

  • CVE-2012-0724Apr 6, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Adobe Flash Player before 11.2.202.229 in Google Chrome before 18.0.1025.151 allow attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2012-0725.

  • CVE-2012-1902Apr 6, 2012
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.02

    show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2, when a configuration file does not exist, allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message about this missing file.

  • CVE-2012-1239Apr 6, 2012
    Toshiba
    e-Studio
    risk 0.03cvss —epss 0.05

    The TopAccess web-based management interface on TOSHIBA TEC e-Studio multi-function peripheral (MFP) devices with firmware 30x through 302, 35x through 354, and 4xx through 421 allows remote attackers to bypass authentication and obtain administrative privileges via unspecified…

  • CVE-2012-1238Apr 6, 2012
    Icz
    Sencha Sns
    risk 0.00cvss —epss 0.01

    Session fixation vulnerability in SENCHA SNS before 1.0.2 allows remote attackers to hijack web sessions via unspecified vectors.

  • CVE-2012-1237Apr 6, 2012
    Sencha
    SNS
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in SENCHA SNS before 1.0.2 allows remote attackers to hijack the authentication of arbitrary users.

  • CVE-2011-3077Apr 5, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the script bindings, related to a "read-after-free" issue.

  • CVE-2011-3076Apr 5, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to focus handling.

  • CVE-2011-3075Apr 5, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to style-application commands.

  • CVE-2011-3074Apr 5, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of media.

  • CVE-2011-3073Apr 5, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of SVG resources.

  • CVE-2011-3072Apr 5, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 18.0.1025.151 allows remote attackers to bypass the Same Origin Policy via vectors related to pop-up windows.

  • CVE-2011-3071Apr 5, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in the HTMLMediaElement implementation in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

  • CVE-2011-3070Apr 5, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the Google V8 bindings.

  • CVE-2011-3069Apr 5, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to line boxes.

  • CVE-2011-3068Apr 5, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to run-in boxes.

  • CVE-2011-3067Apr 5, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 18.0.1025.151 allows remote attackers to bypass the Same Origin Policy via vectors related to replacement of IFRAME elements.

  • CVE-2011-3066Apr 5, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Skia, as used in Google Chrome before 18.0.1025.151, does not properly perform clipping, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

  • CVE-2012-2055HigApr 5, 2012
    GitHub
    GitHub
    risk 0.49cvss 7.5epss 0.02

    GitHub Enterprise before 20120304 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the public_key[user_id] value via a modified URL for the public-key update form, related to a "mass assignment"…

  • CVE-2012-2054Apr 5, 2012
    Redmine
    Redmine
    risk 0.00cvss —epss 0.02

    Redmine before 1.3.2 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set attributes in the (1) Comment, (2) Document, (3) IssueCategory, (4) MembersController, (5) Message, (6) News, (7) TimeEntry, (8)…

  • CVE-2012-2053Apr 5, 2012
    F5, Inc.
    FirePass 4100
    risk 0.00cvss —epss 0.00

    The sudoers file in the Linux system configuration in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 does not require a password for executing commands as root, which allows local users to gain privileges via the sudo program, as demonstrated by the user account that executes PHP…

  • CVE-2012-1982Apr 5, 2012
    Socialcms
    Socialcms
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in my_admin/admin1_list_pages.php in SocialCMS 1.0.2 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the TR_title parameter in an edit action.

  • CVE-2012-1777Apr 5, 2012
    F5, Inc.
    FirePass 4100
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in my.activation.php3 in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 allows remote attackers to execute arbitrary SQL commands via the state parameter.

  • CVE-2012-0327Apr 5, 2012
    Redmine
    Redmine
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Redmine before 1.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-5000Apr 5, 2012
    OpenSSH
    OpenSSH
    risk 0.00cvss —epss 0.03

    The ssh_gssapi_parse_ename function in gss-serv.c in OpenSSH 5.8 and earlier, when gssapi-with-mic authentication is enabled, allows remote authenticated users to cause a denial of service (memory consumption) via a large value in a certain length field. NOTE: there may be…

  • CVE-2012-0131Apr 5, 2012
    Microfocus
    Distributed Computing Environment
    risk 0.01cvss —epss 0.07

    Distributed Computing Environment (DCE) 1.8 and 1.9 on HP HP-UX B.11.11 and B.11.23 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

  • CVE-2012-0255Apr 5, 2012
    Quagga (software)
    Quagga
    risk 0.00cvss —epss 0.03

    The BGP implementation in bgpd in Quagga before 0.99.20.1 does not properly use message buffers for OPEN messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a message associated with a malformed Four-octet AS Number…

  • CVE-2012-0250Apr 5, 2012
    Quagga (software)
    Quagga
    risk 0.00cvss —epss 0.01

    Buffer overflow in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (daemon crash) via a Link State Update (aka LS Update) packet containing a network-LSA link-state advertisement for which the data-structure…