VYPR

CVEs

346,511 total · page 5945 of 6,931

AllCriticalHighKEV
  • CVE-2012-0371Mar 1, 2012
    Cisco Systems, Inc.
    Wireless Lan Controller Software
    risk 0.00cvss —epss 0.02

    Cisco Wireless LAN Controller (WLC) devices with software 4.x, 5.x, 6.0, and 7.0 before 7.0.220.4, when CPU-based ACLs are enabled, allow remote attackers to read or modify the configuration via unspecified vectors, aka Bug ID CSCtu56709.

  • CVE-2012-0370Mar 1, 2012
    Cisco Systems, Inc.
    Wireless Lan Controller Software
    risk 0.00cvss —epss 0.01

    Cisco Wireless LAN Controller (WLC) devices with software 4.x, 5.x, 6.0, and 7.0 before 7.0.220.0 and 7.1 before 7.1.91.0, when WebAuth is enabled, allow remote attackers to cause a denial of service (device reload) via a sequence of (1) HTTP or (2) HTTPS packets, aka Bug ID…

  • CVE-2012-0369Mar 1, 2012
    Cisco Systems, Inc.
    Wireless Lan Controller Software
    risk 0.00cvss —epss 0.02

    Cisco Wireless LAN Controller (WLC) devices with software 6.0 and 7.0 before 7.0.220.0, 7.1 before 7.1.91.0, and 7.2 before 7.2.103.0 allow remote attackers to cause a denial of service (device reload) via a sequence of IPv6 packets, aka Bug ID CSCtt07949.

  • CVE-2012-0368Mar 1, 2012
    Cisco Systems, Inc.
    Wireless Lan Controller Software
    risk 0.00cvss —epss 0.01

    The administrative management interface on Cisco Wireless LAN Controller (WLC) devices with software 4.x, 5.x, 6.0, and 7.0 before 7.0.220.0, 7.1 before 7.1.91.0, and 7.2 before 7.2.103.0 allows remote attackers to cause a denial of service (device crash) via a malformed URL in…

  • CVE-2012-0367Mar 1, 2012
    Cisco Systems, Inc.
    Unity Connection
    risk 0.00cvss —epss 0.03

    Cisco Unity Connection before 7.1.5b(Su5), 8.0 and 8.5 before 8.5.1(Su3), and 8.6 before 8.6.2 allows remote attackers to cause a denial of service (services crash) via a series of crafted TCP segments, aka Bug ID CSCtq67899.

  • CVE-2012-0366Mar 1, 2012
    Cisco Systems, Inc.
    Unity Connection
    risk 0.00cvss —epss 0.02

    Cisco Unity Connection before 7.1.3b(Su2) allows remote authenticated users to change the administrative password by leveraging the Help Desk Administrator role, aka Bug ID CSCtd45141.

  • CVE-2012-0359Mar 1, 2012
    Cisco Systems, Inc.
    Cius
    risk 0.00cvss —epss 0.01

    The Cisco Cius with software before 9.2(1) SR2 allows remote attackers to cause a denial of service (device crash or hang) via malformed network traffic, aka Bug ID CSCto71445.

  • CVE-2012-0331Mar 1, 2012
    Cisco Systems, Inc.
    Telepresence Video Communication Server
    risk 0.00cvss —epss 0.01

    Cisco TelePresence Video Communication Server with software before X7.0.1 allows remote attackers to cause a denial of service (device crash) via a crafted SIP packet, as demonstrated by a SIP INVITE message from a Tandberg device, aka Bug ID CSCtq73319.

  • CVE-2012-0330Mar 1, 2012
    Cisco Systems, Inc.
    Telepresence Video Communication Server
    risk 0.00cvss —epss 0.01

    Cisco TelePresence Video Communication Server with software before X7.0.1 allows remote attackers to cause a denial of service (device crash) via a malformed SIP message, aka Bug ID CSCtr20426.

  • CVE-2011-4487Mar 1, 2012
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Cisco Unified Communications Manager (CUCM) with software 6.x and 7.x before 7.1(5b)su5, 8.0 before 8.0(3a)su3, and 8.5 and 8.6 before 8.6(2a)su1 and Cisco Business Edition 3000 with software before 8.6.3 and 5000 and 6000 with software before…

  • CVE-2011-4486Mar 1, 2012
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.01

    Cisco Unified Communications Manager (CUCM) with software 6.x and 7.x before 7.1(5b)su5, 8.0 before 8.0(3a)su3, and 8.5 and 8.6 before 8.6(2a)su1 and Cisco Business Edition 3000 with software before 8.6.3 and 5000 and 6000 with software before 8.6(2a)su1 allow remote attackers…

  • CVE-2012-1418Feb 29, 2012
    Acer
    Ac700 Chromebook
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Google Chrome before 17.0.963.60 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors.

  • CVE-2012-1410Feb 29, 2012
    Kadu
    Kadu
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in the History Window implementation in Kadu 0.9.0 through 0.11.0 allow remote attackers to inject arbitrary web script or HTML via a crafted (1) SMS message, (2) presence message, or (3) status description.

  • CVE-2006-7250Feb 29, 2012
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.07

    The mime_hdr_cmp function in crypto/asn1/asn_mime.c in OpenSSL 0.9.8t and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted S/MIME message.

  • CVE-2012-0453Feb 25, 2012
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in xmlrpc.cgi in Bugzilla 4.0.2 through 4.0.4 and 4.1.1 through 4.2rc2, when mod_perl is used, allows remote attackers to hijack the authentication of arbitrary users for requests that modify the product's installation via the…

  • CVE-2012-0365Feb 25, 2012
    Cisco Systems, Inc.
    SRP 520 series
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in the Local TFTP file-upload application on Cisco SRP 520 series devices with firmware before 1.1.26 and SRP 520W-U and 540 series devices with firmware before 1.2.4 allows remote authenticated users to upload software to arbitrary directories…

  • CVE-2012-0364Feb 25, 2012
    Cisco Systems, Inc.
    SRP 520 series
    risk 0.00cvss —epss 0.01

    Cisco SRP 520 series devices with firmware before 1.1.26 and SRP 520W-U and 540 series devices with firmware before 1.2.4 allow remote attackers to replace the configuration file via an upload request to an unspecified URL, aka Bug ID CSCtw55495.

  • CVE-2012-0363Feb 25, 2012
    Cisco Systems, Inc.
    SRP 520W-U
    risk 0.00cvss —epss 0.02

    The web interface on Cisco SRP 520 series devices with firmware before 1.1.26 and SRP 520W-U and 540 series devices with firmware before 1.2.4 allows remote authenticated users to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability,"…

  • CVE-2012-1213Feb 24, 2012
    Zimbra
    Zimbra
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in zimbra/h/calendar in Zimbra Web Client in Zimbra Collaboration Suite (ZCS) 6.x before 6.0.15 and 7.x before 7.1.3 allows remote attackers to inject arbitrary web script or HTML via the view parameter.

  • CVE-2012-1212Feb 24, 2012
    Semantic Enterprise Wiki
    SMW+
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the smwfOnSfSetTargetName function in extensions/SMWHalo/includes/SMW_Initialize.php in Semantic Enterprise Wiki (SMW+) 1.5.6, 1.6.0_2 and earlier allows remote attackers to inject arbitrary web script or HTML via the target parameter…

  • CVE-2012-1211Feb 24, 2012
    Powie
    Pfile
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in pfile/kommentar.php in Powie pFile 1.02 allows remote attackers to inject arbitrary web script or HTML via the filecat parameter.

  • CVE-2012-1210Feb 24, 2012
    Powie
    Pfile
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in pfile/file.php in Powie pFile 1.02 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2012-1209Feb 24, 2012
    Fork CMS
    Fork CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to inject arbitrary web script or HTML via the highlight parameter.

  • CVE-2012-1208Feb 24, 2012
    Fork CMS
    Fork CMS
    risk 0.00cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allow remote attackers to inject arbitrary web script or HTML via the (1) report parameter to blog/settings or (2) error parameter to…

  • CVE-2012-1207Feb 24, 2012
    Fork CMS
    Fork CMS
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in frontend/core/engine/javascript.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the module parameter to frontend/js.php.

  • CVE-2012-1206Feb 24, 2012
    Hancom
    Hancom Office 2010 Se
    risk 0.00cvss —epss 0.05

    Multiple integer overflows in Hancom Office 2010 SE 8.5.5 allow remote attackers to execute arbitrary code via large dimension values in a (1) JPG image to the ImportGR in the JPG image filter module (HncJpeg10.flt) or (2) PNG image to the PNG image filter module (HncPng10.flt),…

  • CVE-2012-1205Feb 24, 2012
    WordPress
    Relocate Upload
    risk 0.00cvss —epss 0.25

    PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload plugin before 0.20 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.

  • CVE-2012-1000Feb 24, 2012
    Lepton CMS
    Lepton
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in LEPTON 1.1.3 and other versions before 1.1.4 allow remote attackers to inject arbitrary web script or HTML via the (1) message parameter to admins/login/forgot/index.php, or the (2) display_name or (3) email parameter to…

  • CVE-2012-0999Feb 24, 2012
    Lepton CMS
    Lepton
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in modules/news/rss.php in LEPTON before 1.1.4 allows remote attackers to execute arbitrary SQL commands via the group_id parameter.

  • CVE-2012-0998Feb 24, 2012
    Lepton CMS
    Lepton
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in account/preferences.php in LEPTON before 1.1.4 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the language parameter.

  • CVE-2012-0997Feb 24, 2012
    11in1
    11in1
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in admin/index.php in 11in1 1.2.1 stable 12-31-2011 allows remote attackers to hijack the authentication of administrators for requests that add new topics via an addTopic action.

  • CVE-2012-0996Feb 24, 2012
    11in1
    11in1
    risk 0.04cvss —epss 0.10

    Multiple directory traversal vulnerabilities in 11in1 1.2.1 stable 12-31-2011 allow remote attackers to read arbitrary files via a .. (dot dot) in the class parameter to (1) index.php or (2) admin/index.php.

  • CVE-2012-1294Feb 23, 2012
    Contimex
    Impulsio CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in CONTIMEX Impulsio CMS allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.

  • CVE-2012-0873Feb 23, 2012
    Boonex
    Dolphin
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in Boonex Dolphin before 7.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) explain parameter to explanation.php or the (2) photos_only, (3) online_only, or (4) mode parameters to viewFriends.php.

  • CVE-2012-0823Feb 23, 2012
    Webmproject
    Libvpx
    risk 0.00cvss —epss 0.03

    VP8 Codec SDK (libvpx) before 1.0.0 "Duclair" allows remote attackers to cause a denial of service (application crash) via (1) unspecified "corrupt input" or (2) by "starting decoding from a P-frame," which triggers an out-of-bounds read, related to "the clamping of motion…

  • CVE-2012-1292Feb 23, 2012
    SAP
    Netweaver
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the MessagingSystem servlet in SAP NetWeaver 7.0 allows remote attackers to obtain sensitive information about the MessagingSystem Performance Data via unspecified vectors.

  • CVE-2012-1291Feb 23, 2012
    SAP
    Netweaver
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the com.sap.aii.mdt.amt.web.AMTPageProcessor servlet in SAP NetWeaver 7.0 allows remote attackers to obtain sensitive information about the Adapter Monitor via unspecified vectors, possibly related to the EnableInvokerServletGlobally property in the…

  • CVE-2012-1290Feb 23, 2012
    SAP
    Netweaver
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in b2b/auction/container.jsp in the Internet Sales (crm.b2b) module in SAP NetWeaver 7.0 allows remote attackers to inject arbitrary web script or HTML via the _loadPage parameter.

  • CVE-2012-1289Feb 23, 2012
    SAP
    Netweaver
    risk 0.00cvss —epss 0.02

    Multiple directory traversal vulnerabilities in SAP NetWeaver 7.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the logfilename parameter to (1) b2b/admin/log.jsp or (2) b2b/admin/log_view.jsp in the Internet Sales (crm.b2b) component, or (3)…

  • CVE-2012-1288Feb 23, 2012
    UTC Fire & Security
    GE-MC100-NTP/GPS-ZB Master Clock
    risk 0.00cvss —epss 0.03

    The UTC Fire & Security GE-MC100-NTP/GPS-ZB Master Clock device uses hardcoded credentials for an administrative account, which makes it easier for remote attackers to obtain access via an HTTP session.

  • CVE-2012-0870Feb 23, 2012
    Blackberry
    PlayBook
    risk 0.01cvss —epss 0.07

    Heap-based buffer overflow in process.c in smbd in Samba 3.0, as used in the file-sharing service on the BlackBerry PlayBook tablet before 2.0.0.7971 and other products, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a…

  • CVE-2012-0707Feb 23, 2012
    IBM
    WebSphere Lombardi Edition
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM WebSphere Lombardi Edition 7.2 allows remote attackers to inject arbitrary web script or HTML via crafted text input to a coach that is configured with a document attachment control section.

  • CVE-2012-1256Feb 22, 2012
    Easyvista
    Easyvista
    risk 0.00cvss —epss 0.01

    The single sign-on (SSO) implementation in EasyVista before 2010.1.1.89 allows remote attackers to bypass authentication via a modified url_account parameter, in conjunction with a valid login name in the SSPI_HEADER parameter, to index.php.

  • CVE-2012-0315Feb 22, 2012
    Estsoft
    Alftp
    risk 0.00cvss —epss 0.02

    Untrusted search path vulnerability in ALFTP before 5.31 allows local users to gain privileges via a Trojan horse executable file in a directory that is accessed for reading an extensionless file, as demonstrated by executing the README.exe file when a user attempts to access…

  • CVE-2012-0291Feb 22, 2012
    Symantec
    Pcanywhere
    risk 0.00cvss —epss 0.03

    Symantec pcAnywhere through 12.5.3, Altiris IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), Altiris Client Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), and Altiris Deployment Solution Remote pcAnywhere Solution 7.1…

  • CVE-2012-0223Feb 22, 2012
    7-Technologies
    TERMIS
    risk 0.00cvss —epss 0.02

    Untrusted search path vulnerability in 7-Technologies (7T) TERMIS 2.10 and earlier allows local users to gain privileges via a Trojan horse DLL in the current working directory, a different vulnerability than CVE-2012-0224.

  • CVE-2012-1235Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0235.

  • CVE-2012-1234Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to execute arbitrary SQL commands via a malformed URL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0234.

  • CVE-2012-0244Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Advantech/BroadWin WebAccess before 7.0 allow remote attackers to execute arbitrary SQL commands via crafted string input.

  • CVE-2012-0243Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.04

    Buffer overflow in an ActiveX control in bwocxrun.ocx in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code by leveraging the ability to write arbitrary content to any pathname.