VYPR

CVEs

346,574 total · page 5939 of 6,932

AllCriticalHighKEV
  • CVE-2012-0126Mar 28, 2012
    Microfocus
    Hpux
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the WBEM implementation in HP HP-UX 11.11 and 11.23 allows remote attackers to obtain access to diagnostic information via unknown vectors, a related issue to CVE-2012-0125.

  • CVE-2012-0125Mar 28, 2012
    Microfocus
    Hpux
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the WBEM implementation in HP HP-UX 11.31 allows local users to obtain access to diagnostic information via unknown vectors, a related issue to CVE-2012-0126.

  • CVE-2007-6752Mar 28, 2012
    Drupal
    Drupal
    risk 0.03cvss —epss 0.04

    Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI. NOTE: the vendor disputes the significance of this issue, by considering…

  • CVE-2012-1931Mar 28, 2012
    Opera
    Opera
    risk 0.00cvss —epss 0.00

    Opera before 11.62 on UNIX, when used in conjunction with an unspecified printing application, allows local users to overwrite arbitrary files via a symlink attack on a temporary file during printing.

  • CVE-2012-1930Mar 28, 2012
    Opera
    Opera
    risk 0.00cvss —epss 0.00

    Opera before 11.62 on UNIX uses world-readable permissions for temporary files during printing, which allows local users to obtain sensitive information by reading these files.

  • CVE-2012-1929Mar 28, 2012
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera before 11.62 on Mac OS X allows remote attackers to spoof the address field and security dialogs via crafted styling that causes page content to be displayed outside of the intended content area.

  • CVE-2012-1928Mar 28, 2012
    Opera
    Opera
    risk 0.00cvss —epss 0.03

    Opera before 11.62 allows remote attackers to spoof the address field by triggering a page reload followed by a redirect to a different domain.

  • CVE-2012-1927Mar 28, 2012
    Opera
    Opera
    risk 0.00cvss —epss 0.03

    Opera before 11.62 allows remote attackers to spoof the address field by triggering the launch of a dialog window associated with a different domain.

  • CVE-2012-1926Mar 28, 2012
    Opera
    Opera
    risk 0.00cvss —epss 0.03

    Opera before 11.62 allows remote attackers to bypass the Same Origin Policy via the (1) history.pushState and (2) history.replaceState functions in conjunction with cross-domain frames, leading to unintended read access to history.state information.

  • CVE-2012-1925Mar 28, 2012
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera before 11.62 does not ensure that a dialog window is placed on top of content windows, which makes it easier for user-assisted remote attackers to trick users into downloading and executing arbitrary files via a download dialog located under other windows.

  • CVE-2012-1924Mar 28, 2012
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera before 11.62 allows user-assisted remote attackers to trick users into downloading and executing arbitrary files via a small window for the download dialog.

  • CVE-2012-1920Mar 27, 2012
    Atmail
    Atmail
    risk 0.00cvss —epss 0.03

    @Mail WebMail Client in AtMail Open-Source 1.04 and earlier allows remote attackers to obtain configuration information via a direct request to install/info.php, which calls the phpinfo function.

  • CVE-2012-1919Mar 27, 2012
    Atmail
    Atmail
    risk 0.00cvss —epss 0.02

    CRLF injection vulnerability in mime.php in @Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to conduct directory traversal attacks and read arbitrary files via a %0A sequence followed by a .. (dot dot) in the file parameter.

  • CVE-2012-1918Mar 27, 2012
    Atmail
    Atmail
    risk 0.00cvss —epss 0.04

    Multiple directory traversal vulnerabilities in (1) compose.php and (2) libs/Atmail/SendMsg.php in @Mail WebMail Client in AtMail Open-Source before 1.05 allow remote attackers to read arbitrary files via a .. (dot dot) in the Attachment[] parameter.

  • CVE-2012-1917Mar 27, 2012
    Atmail
    Atmail
    risk 0.00cvss —epss 0.02

    compose.php in @Mail WebMail Client in AtMail Open-Source before 1.05 does not properly handle ../ (dot dot slash) sequences in the unique parameter, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ..././ (dot dot dot slash dot…

  • CVE-2012-1916Mar 27, 2012
    Atmail
    Atmail
    risk 0.00cvss —epss 0.03

    @Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to execute arbitrary code via an e-mail attachment with an executable extension, leading to the creation of an executable file under tmp/.

  • CVE-2012-1573Mar 26, 2012
    GNU
    Gnutls
    risk 0.00cvss —epss 0.04

    gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with a block cipher, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) via a crafted record, as…

  • CVE-2012-1569Mar 26, 2012
    GNU
    Gnutls
    risk 0.00cvss —epss 0.04

    The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and…

  • CVE-2012-0256Mar 26, 2012
    Apache
    trafficserver
    risk 0.00cvss —epss 0.03

    Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service (daemon crash) via a long HTTP Host header.

  • CVE-2012-1089Mar 23, 2012
    Apache
    Wicket
    risk 0.00cvss —epss 0.05

    Directory traversal vulnerability in Apache Wicket 1.4.x before 1.4.20 and 1.5.x before 1.5.5 allows remote attackers to read arbitrary web-application files via a relative pathname in a URL for a Wicket resource that corresponds to a null package.

  • CVE-2012-0047Mar 23, 2012
    Apache
    Wicket
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the wicket:pageMapName parameter.

  • CVE-2011-3049Mar 23, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 17.0.963.83 does not properly restrict the extension web request API, which allows remote attackers to cause a denial of service (disrupted system requests) via a crafted extension.

  • CVE-2012-1846Mar 22, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.04

    Google Chrome 17.0.963.66 and earlier allows remote attackers to bypass the sandbox protection mechanism by leveraging access to a sandboxed process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012. NOTE: the primary affected product may be clarified…

  • CVE-2012-1845Mar 22, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in Google Chrome 17.0.963.66 and earlier allows remote attackers to bypass the DEP and ASLR protection mechanisms, and execute arbitrary code, via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012. NOTE:…

  • CVE-2011-3057Mar 22, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google V8, as used in Google Chrome before 17.0.963.83, allows remote attackers to cause a denial of service via vectors that trigger an invalid read operation.

  • CVE-2011-3056Mar 22, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 17.0.963.83 allows remote attackers to bypass the Same Origin Policy via vectors involving a "magic iframe."

  • CVE-2011-3055Mar 22, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The browser native UI in Google Chrome before 17.0.963.83 does not require user confirmation before an unpacked extension installation, which allows user-assisted remote attackers to have an unspecified impact via a crafted extension.

  • CVE-2011-3054Mar 22, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The WebUI privilege implementation in Google Chrome before 17.0.963.83 does not properly perform isolation, which allows remote attackers to bypass intended access restrictions via unspecified vectors.

  • CVE-2011-3053Mar 22, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 17.0.963.83 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to block splitting.

  • CVE-2011-3052Mar 22, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The WebGL implementation in Google Chrome before 17.0.963.83 does not properly handle CANVAS elements, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.

  • CVE-2011-3051Mar 22, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 17.0.963.83 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the cross-fade function.

  • CVE-2011-3050Mar 22, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 17.0.963.83 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the :first-letter pseudo-element.

  • CVE-2011-3045HigMar 22, 2012
    Libpng
    Libpng
    risk 0.57cvss 8.8epss 0.04

    Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a…

  • CVE-2012-1844Mar 22, 2012
    Quantum
    Scalar I500
    risk 0.00cvss —epss 0.03

    The Quantum Scalar i500 tape library with firmware before i7.0.3 (604G.GS00100), also distributed as the Dell ML6000 tape library with firmware before A20-00 (590G.GS00100) and the IBM TS3310 tape library with firmware before R6C (606G.GS001), uses default passwords for…

  • CVE-2012-1843Mar 22, 2012
    Quantum
    Scalar I500
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in saveRestore.htm on the Quantum Scalar i500 tape library with firmware before i7.0.3 (604G.GS00100), also distributed as the Dell ML6000 tape library with firmware before A20-00 (590G.GS00100), allows remote attackers to hijack…

  • CVE-2012-1842Mar 22, 2012
    Quantum
    Scalar I500
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in checkQKMProg.htm on the Quantum Scalar i500 tape library with firmware before i7.0.3 (604G.GS00100), also distributed as the Dell ML6000 tape library with firmware before A20-00 (590G.GS00100), allows remote attackers to inject…

  • CVE-2012-1841Mar 22, 2012
    Quantum
    Scalar I500
    risk 0.00cvss —epss 0.02

    Absolute path traversal vulnerability in logShow.htm on the Quantum Scalar i500 tape library with firmware before i7.0.3 (604G.GS00100), also distributed as the Dell ML6000 tape library with firmware before A20-00 (590G.GS00100), allows remote attackers to read arbitrary files…

  • CVE-2012-1840Mar 22, 2012
    Ajaxplorer
    Ajaxplorer
    risk 0.00cvss —epss 0.02

    AjaXplorer 3.2.x before 3.2.5 and 4.0.x before 4.0.4 does not properly perform cookie authentication, which allows remote attackers to obtain login access by leveraging knowledge of a password hash.

  • CVE-2012-1839Mar 22, 2012
    Ajaxplorer
    Ajaxplorer
    risk 0.00cvss —epss 0.04

    Multiple directory traversal vulnerabilities in the Get Template feature in plugins/gui.ajax/class.AJXP_ClientDriver.php in AjaXplorer 3.2.x before 3.2.5 and 4.0.x before 4.0.4 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1)…

  • CVE-2012-1838Mar 22, 2012
    Lg Nortel
    Elo Gs24m Switch
    risk 0.00cvss —epss 0.03

    The web management interface on the LG-Nortel ELO GS24M switch allows remote attackers to bypass authentication, and consequently obtain cleartext credential and configuration information, via a direct request to a configuration web page.

  • CVE-2012-1837Mar 22, 2012
    IBM
    Tivoli Endpoint Manager
    risk 0.00cvss —epss 0.01

    The (1) webreports, (2) post/create-role, and (3) post/update-role programs in IBM Tivoli Endpoint Manager (TEM) before 8.2 do not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive…

  • CVE-2012-1836Mar 22, 2012
    Inspircd
    Inspircd
    risk 0.00cvss —epss 0.07

    Heap-based buffer overflow in dns.cpp in InspIRCd 2.0.5 might allow remote attackers to execute arbitrary code via a crafted DNS query that uses compression.

  • CVE-2012-1662Mar 22, 2012
    Ca
    ARCserve Backup
    risk 0.00cvss —epss 0.02

    CA ARCserve Backup r12.0 through SP2, r12.5 before SP2, r15 through SP1, and r16 before SP1 on Windows allows remote attackers to cause a denial of service (service shutdown) via a crafted network request.

  • CVE-2012-0719Mar 22, 2012
    IBM
    Tivoli Endpoint Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Tivoli Endpoint Manager (TEM) 8 before 8.2 patch 3 allows remote attackers to inject arbitrary web script or HTML via the ScheduleParam parameter to the webreports program.

  • CVE-2012-1463Mar 21, 2012
    Cat
    Quick Heal
    risk 0.08cvss —epss 0.94

    The ELF file parser in AhnLab V3 Internet Security 2011.01.18.00, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, McAfee Anti-Virus Scanning…

  • CVE-2012-1462Mar 21, 2012
    Cat
    Quick Heal
    risk 0.08cvss —epss 0.98

    The ZIP file parser in AhnLab V3 Internet Security 2011.01.18.00, AVG Anti-Virus 10.0.0.1190, Quick Heal (aka Cat QuickHeal) 11.00, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin…

  • CVE-2012-1461Mar 21, 2012
    Trend Micro
    Housecall
    risk 0.07cvss —epss 0.92

    The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, F-Secure Anti-Virus 9.0.16160.0, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7…

  • CVE-2012-1460Mar 21, 2012
    Cat
    Quick Heal
    risk 0.08cvss —epss 0.94

    The Gzip file parser in Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.2.11.5, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, and VBA32 3.12.14.2 allows remote attackers to bypass malware…

  • CVE-2012-1459Mar 21, 2012
    Trend Micro
    Housecall
    risk 0.08cvss —epss 1.00

    The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus…

  • CVE-2012-1458Mar 21, 2012
    ClamAV
    Clamav
    risk 0.06cvss —epss 0.73

    The Microsoft CHM file parser in ClamAV 0.96.4 and Sophos Anti-Virus 4.61.0 allows remote attackers to bypass malware detection via a crafted reset interval in the LZXC header of a CHM file. NOTE: this may later be SPLIT into multiple CVEs if additional information is published…