VYPR

CVEs

346,580 total · page 5938 of 6,932

AllCriticalHighKEV
  • CVE-2012-0249Apr 5, 2012
    Quagga (software)
    Quagga
    risk 0.00cvss —epss 0.02

    Buffer overflow in the ospf_ls_upd_list_lsa function in ospf_packet.c in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a Link State Update (aka LS Update) packet that is…

  • CVE-2012-0130Apr 5, 2012
    Microfocus
    Onboard Administrator
    risk 0.00cvss —epss 0.04

    HP Onboard Administrator (OA) before 3.50 allows remote attackers to obtain sensitive information via unspecified vectors.

  • CVE-2012-0129Apr 5, 2012
    Microfocus
    Onboard Administrator
    risk 0.01cvss —epss 0.09

    HP Onboard Administrator (OA) before 3.50 allows remote attackers to bypass intended access restrictions and execute arbitrary code via unspecified vectors.

  • CVE-2012-0128Apr 5, 2012
    Microfocus
    Onboard Administrator
    risk 0.00cvss —epss 0.03

    HP Onboard Administrator (OA) before 3.50 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  • CVE-2012-0132Apr 5, 2012
    Microfocus
    Business Availability Center
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in HP Business Availability Center (BAC) 9.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-7311Apr 5, 2012
    Spree
    Spree
    risk 0.00cvss —epss 0.01

    The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value…

  • CVE-2008-7310Apr 5, 2012
    Spree
    Spree
    risk 0.00cvss —epss 0.01

    Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability.

  • CVE-2008-7309Apr 5, 2012
    Insoshi
    Insoshi
    risk 0.00cvss —epss 0.01

    Insoshi before 20080920 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the ForumPost user_id value via a modified URL, related to a "mass assignment" vulnerability.

  • CVE-2012-1337Apr 5, 2012
    Cisco Systems, Inc.
    Webex Recording Format Player
    risk 0.02cvss —epss 0.24

    Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26, T27 LB through SP21 EP10, T27 LC before SP25 EP10, and T27 LD before SP32 CP1 allows remote attackers to execute arbitrary code via a crafted WRF file, a different vulnerability than…

  • CVE-2012-1336Apr 5, 2012
    Cisco Systems, Inc.
    Webex Recording Format Player
    risk 0.00cvss —epss 0.05

    Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26, T27 LB through SP21 EP10, T27 LC before SP25 EP10, and T27 LD before SP32 CP1 allows remote attackers to execute arbitrary code via a crafted WRF file, a different vulnerability than…

  • CVE-2012-1335Apr 5, 2012
    Cisco Systems, Inc.
    Webex Recording Format Player
    risk 0.00cvss —epss 0.04

    Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26, T27 LB through SP21 EP10, T27 LC before SP25 EP10, and T27 LD before SP32 CP1 allows remote attackers to execute arbitrary code via a crafted WRF file, a different vulnerability than…

  • CVE-2011-4535Apr 3, 2012
    Scadatec
    Modbustagserver
    risk 0.05cvss —epss 0.27

    Buffer overflow in TurboPower Abbrevia before 4.0, as used in ScadaTEC ScadaPhone 5.3.11.1230 and earlier, ScadaTEC ModbusTagServer 4.1.1.81 and earlier, and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary…

  • CVE-2011-4045Apr 3, 2012
    ARC Informatique
    PcVue
    risk 0.03cvss —epss 0.04

    Buffer overflow in an unspecified ActiveX control in aipgctl.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to cause a denial of service via a crafted HTML document.

  • CVE-2011-4044Apr 3, 2012
    ARC Informatique
    PcVue
    risk 0.05cvss —epss 0.27

    An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to modify files via calls to unknown methods.

  • CVE-2011-4043Apr 3, 2012
    ARC Informatique
    PcVue
    risk 0.04cvss —epss 0.07

    Integer overflow in an unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to execute arbitrary code via a large value for an integer parameter, leading to a buffer overflow.

  • CVE-2011-4042Apr 3, 2012
    ARC Informatique
    PcVue
    risk 0.04cvss —epss 0.06

    An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to execute arbitrary code by using a crafted HTML document to obtain control of a function pointer.

  • CVE-2012-0258Apr 2, 2012
    Invensys
    Wonderware Application Server
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Information Server 4.5 and…

  • CVE-2012-0257Apr 2, 2012
    Invensys
    Wonderware Application Server
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Information Server 4.5 and…

  • CVE-2012-0228Apr 2, 2012
    Invensys
    Wonderware Information Server
    risk 0.00cvss —epss 0.02

    Invensys Wonderware Information Server 4.0 SP1 and 4.5 does not properly implement client controls, which allows remote attackers to bypass intended access restrictions via unspecified vectors.

  • CVE-2012-0226Apr 2, 2012
    Invensys
    Wonderware Information Server
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in Invensys Wonderware Information Server 4.0 SP1 and 4.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-0225Apr 2, 2012
    Invensys
    Wonderware Information Server
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Invensys Wonderware Information Server 4.0 SP1 and 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-0222Apr 2, 2012
    Rockwellautomation
    Factorytalk
    risk 0.00cvss —epss 0.04

    The FactoryTalk (FT) RNADiagReceiver service in Rockwell Automation Allen-Bradley FactoryTalk CPR9 through SR5 and RSLogix 5000 17 through 20 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted packet.

  • CVE-2012-0221Apr 2, 2012
    Rockwellautomation
    Factorytalk
    risk 0.04cvss —epss 0.10

    The FactoryTalk (FT) RNADiagReceiver service in Rockwell Automation Allen-Bradley FactoryTalk CPR9 through SR5 and RSLogix 5000 17 through 20 does not properly handle the return value from an unspecified function, which allows remote attackers to cause a denial of service…

  • CVE-2011-5085Apr 2, 2012
    Movabletype
    Movabletype
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Movable Type 4.x before 4.36 and 5.x before 5.05 allows remote attackers to read or modify data via unknown vectors.

  • CVE-2011-5084Apr 2, 2012
    Movabletype
    Movabletype
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Movable Type 4.x before 4.36 and 5.x before 5.05 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1515Apr 2, 2012
    VMware
    Esx
    risk 0.00cvss —epss 0.01

    VMware ESXi 3.5, 4.0, and 4.1 and ESX 3.5, 4.0, and 4.1 do not properly implement port-based I/O operations, which allows guest OS users to gain guest OS privileges by overwriting memory locations in a read-only memory block associated with the Virtual DOS Machine.

  • CVE-2012-0246Apr 2, 2012
    Ecava
    Integraxor
    risk 0.00cvss —epss 0.06

    Directory traversal vulnerability in an unspecified ActiveX control in Ecava IntegraXor before 3.71.4200 allows remote attackers to execute arbitrary code via vectors involving an HTML document on the server.

  • CVE-2012-1670Mar 31, 2012
    Phpgradebook
    PHP Grade Book
    risk 0.04cvss —epss 0.08

    admin/index.php in PHP Grade Book before 1.9.5 BETA allows remote attackers to read the database via a SaveSQL action.

  • CVE-2012-0127Mar 31, 2012
    Microfocus
    Performance Manager
    risk 0.02cvss —epss 0.23

    Unspecified vulnerability in HP Performance Manager 9.00 allows remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2011-3065Mar 30, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Skia, as used in Google Chrome before 18.0.1025.142, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.

  • CVE-2011-3064Mar 30, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 18.0.1025.142 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to SVG clipping.

  • CVE-2011-3063Mar 30, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 18.0.1025.142 does not properly validate the renderer's navigation requests, which has unspecified impact and remote attack vectors.

  • CVE-2011-3062Mar 30, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Off-by-one error in the OpenType Sanitizer in Google Chrome before 18.0.1025.142 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted OpenType file.

  • CVE-2011-3061Mar 30, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 18.0.1025.142 does not properly check X.509 certificates before use of a SPDY proxy, which might allow man-in-the-middle attackers to spoof servers or obtain sensitive information via a crafted certificate.

  • CVE-2011-3060Mar 30, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 18.0.1025.142 does not properly handle text fragments, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

  • CVE-2011-3059Mar 30, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 18.0.1025.142 does not properly handle SVG text elements, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

  • CVE-2011-3058Mar 30, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 18.0.1025.142 does not properly handle the EUC-JP encoding system, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

  • CVE-2012-1315Mar 29, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Memory leak in the SIP inspection feature in the Zone-Based Firewall in Cisco IOS 12.4, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted transit SIP traffic, aka Bug ID CSCti46171.

  • CVE-2012-1314Mar 29, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    The WAAS Express feature in Cisco IOS 15.1 and 15.2 allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted transit traffic, aka Bug ID CSCtt45381.

  • CVE-2012-1312Mar 29, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    The MACE feature in Cisco IOS 15.1 and 15.2 allows remote attackers to cause a denial of service (device reload) via crafted transit traffic, aka Bug IDs CSCtq64987 and CSCtu57226.

  • CVE-2012-1311Mar 29, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    The RSVP feature in Cisco IOS 15.0 and 15.1 and IOS XE 3.2.xS through 3.4.xS before 3.4.2S, when a VRF interface is configured, allows remote attackers to cause a denial of service (interface queue wedge and service outage) via crafted RSVP packets, aka Bug ID CSCts80643.

  • CVE-2012-1310Mar 29, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Memory leak in the Zone-Based Firewall in Cisco IOS 12.4, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted IP packets, aka Bug ID CSCto89536.

  • CVE-2012-0388Mar 29, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Memory leak in the H.323 inspection feature in the Zone-Based Firewall in Cisco IOS 12.4, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (memory consumption or device reload) via malformed transit H.323 traffic, aka Bug ID CSCtq45553.

  • CVE-2012-0387Mar 29, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Memory leak in the HTTP Inspection Engine feature in the Zone-Based Firewall in Cisco IOS 12.4, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted transit HTTP traffic, aka Bug ID CSCtq36153.

  • CVE-2012-0386Mar 29, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    The SSHv2 implementation in Cisco IOS 12.2, 12.4, 15.0, 15.1, and 15.2 and IOS XE 2.3.x through 2.6.x and 3.1.xS through 3.4.xS before 3.4.2S allows remote attackers to cause a denial of service (device reload) via a crafted username in a reverse SSH login attempt, aka Bug ID…

  • CVE-2012-0385Mar 29, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    The Smart Install feature in Cisco IOS 12.2, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (device reload) by sending a malformed Smart Install message over TCP, aka Bug ID CSCtt16051.

  • CVE-2012-0384HigMar 29, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.47cvss 7.2epss 0.04

    Cisco IOS 12.2 through 12.4 and 15.0 through 15.2 and IOS XE 2.1.x through 2.6.x and 3.1.xS before 3.1.2S, 3.2.xS through 3.4.xS before 3.4.2S, 3.5.xS before 3.5.1S, and 3.1.xSG and 3.2.xSG before 3.2.2SG, when AAA authorization is enabled, allow remote authenticated users to…

  • CVE-2012-0383Mar 29, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Memory leak in the NAT feature in Cisco IOS 12.4, 15.0, and 15.1 allows remote attackers to cause a denial of service (memory consumption, and device hang or reload) via SIP packets that require translation, related to a "memory starvation vulnerability," aka Bug ID CSCti35326.

  • CVE-2012-0382HigMar 29, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.49cvss 7.5epss 0.04

    The Multicast Source Discovery Protocol (MSDP) implementation in Cisco IOS 12.0, 12.2 through 12.4, and 15.0 through 15.2 and IOS XE 2.1.x through 2.6.x and 3.1.xS through 3.4.xS before 3.4.1S and 3.1.xSG and 3.2.xSG before 3.2.2SG allows remote attackers to cause a denial of…

  • CVE-2012-0381HigMar 29, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.49cvss 7.5epss 0.04

    The IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.2 and IOS XE 2.1.x through 2.6.x and 3.1.xS through 3.4.xS before 3.4.2S, 3.5.xS before 3.5.1S, and 3.2.xSG before 3.2.2SG allows remote attackers to cause a denial of service (device reload) by sending…