VYPR

CVEs

346,511 total · page 5949 of 6,931

AllCriticalHighKEV
  • CVE-2012-0788Feb 14, 2012
    PHP
    PHP
    risk 0.04cvss —epss 0.09

    The PDORow implementation in PHP before 5.3.9 does not properly interact with the session feature, which allows remote attackers to cause a denial of service (application crash) via a crafted application that uses a PDO driver for a fetch and then calls the session_start…

  • CVE-2012-1063Feb 14, 2012
    Manageengine
    Applications Manager
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to execute arbitrary SQL commands via the (1) viewId parameter to fault/AlarmView.do or (2) period parameter to showHistoryData.do.

  • CVE-2012-1062Feb 14, 2012
    Manageengine
    Applications Manager
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to inject arbitrary web script or HTML via the (1) period parameter to showHistoryData.do; (2) selectedNetwork, (3) network, or (4) group parameters to…

  • CVE-2012-1061Feb 14, 2012
    GForge
    Gforge
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in GForge Advanced Server 6.0.0 and other versions before 6.0.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-1060Feb 14, 2012
    Drupal
    revisioning
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in revisioning_theme.inc in the Taxonomy module in the Revisioning module 6.x-3.13 and other versions before 6.x-3.14 for Drupal allow remote authenticated users with certain privileges to inject arbitrary web script or HTML…

  • CVE-2012-1059Feb 14, 2012
    OsCommerce
    Online Merchant
    risk 0.00cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Shop/Application/Cart/pages/main.php in OSCommerce Online Merchant 3.0.2 allows remote attackers to inject arbitrary web script or HTML via the value_title parameter, as demonstrated using the "Front" field in…

  • CVE-2012-1058Feb 14, 2012
    Flyspray
    Flyspray
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Flyspray 0.9.9.6 allows remote attackers to hijack the authentication of admins for requests that add admin accounts via an admin.newuser action to index.php.

  • CVE-2012-1057Feb 14, 2012
    Drupal
    Forward
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the clickthrough tracking functionality in the Forward module 6.x-1.x before 6.x-1.21 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of administrators for requests that increase node…

  • CVE-2012-1056Feb 14, 2012
    Drupal
    Forward
    risk 0.00cvss —epss 0.01

    The Forward module 6.x-1.x before 6.x-1.21 and 7.x-1.x before 7.x-1.3 for Drupal does not properly enforce permissions for (1) Recent forwards, (2) Most forwarded, or (3) Dynamic blocks, which allows remote attackers to obtain node titles via unspecified vectors.

  • CVE-2012-1055Feb 14, 2012
    PhotoLine
    PhotoLine
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in PhotoLine 17.01 and possibly other versions before 17.02 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment.

  • CVE-2012-0829Feb 14, 2012
    Mibew
    Mibew Messenger
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Mibew Messenger 1.6.4 and earlier allow remote attackers to hijack the authentication of operators for requests that insert cross-site scripting (XSS) sequences via the (1) address or (2) threadid parameters to…

  • CVE-2012-0340Feb 13, 2012
    Cisco Systems, Inc.
    Ironport Encryption Appliance
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the management interface on the Cisco IronPort Encryption Appliance with software before 6.5.3 allows remote attackers to inject arbitrary web script or HTML via the header parameter to the default URI under admin/, aka bug ID 72410.

  • CVE-2012-1052Feb 13, 2012
    Ivanview
    Ivanview
    risk 0.00cvss —epss 0.03

    Buffer overflow in IvanView 1.2.15 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment.

  • CVE-2012-1051Feb 13, 2012
    Xnview
    Xnview
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in Xjp2.dll in the JPEG2000 plug-in in XnView 1.98.5 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment.

  • CVE-2012-1050Feb 13, 2012
    Mathopd
    Mathopd
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in Mathopd 1.4.x and 1.5.x before 1.5p7, when configured with the * construct for mass virtual hosting, allows remote attackers to read arbitrary files via a crafted Host header.

  • CVE-2012-1049Feb 13, 2012
    Manageengine
    Admanager Plus
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ADManager Plus 5.2 Build 5210 allow remote attackers to inject arbitrary web script or HTML via the (1) domainName parameter to jsp/AddDC.jsp or (2) operation parameter to DomainConfig.do.

  • CVE-2012-1048Feb 12, 2012
    Epignosis
    Community++ edition
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in communityplusplus/www/administrator.php in eFront Community++ edition 3.6.10, and possibly other editions, allows remote attackers to inject arbitrary web script or HTML via the filter parameter.

  • CVE-2012-1047Feb 12, 2012
    Cyberoam
    Cyberoam Central Console
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in the WWWHELP Service (js/html/wwhelp.htm) in Cyberoam Central Console (CCC) 2.00.2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the file parameter in an Online_help action.

  • CVE-2011-4341Feb 12, 2012
    Getsymphony
    Symphonycms
    risk 0.00cvss —epss 0.03

    Multiple SQL injection vulnerabilities in symphony/content/content.publish.php in Symphony CMS 2.2.3 and possibly other versions before 2.2.4 allow remote authenticated users with Author permissions to execute arbitrary SQL commands via the filter parameter to (1)…

  • CVE-2011-4340Feb 12, 2012
    Getsymphony
    Symphonycms
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.2.3 and possibly other versions before 2.2.4 allow remote authenticated users with Author privileges to inject arbitrary web script or HTML via (1) the profile parameter to…

  • CVE-2012-0834Feb 11, 2012
    Phpldapadmin Project
    Phpldapadmin
    risk 0.00cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in lib/QueryRender.php in phpLDAPadmin 1.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the base parameter in a query_engine action to cmd.php.

  • CVE-2012-0452Feb 11, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    Use-after-free vulnerability in Mozilla Firefox 10.x before 10.0.1, Thunderbird 10.x before 10.0.1, and SeaMonkey 2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger failure of an…

  • CVE-2012-0831Feb 10, 2012
    PHP
    PHP
    risk 0.01cvss —epss 0.07

    PHP before 5.3.10 does not properly perform a temporary change to the magic_quotes_gpc directive during the importing of environment variables, which makes it easier for remote attackers to conduct SQL injection attacks via a crafted request, related to main/php_variables.c,…

  • CVE-2012-1046Feb 10, 2012
    IBM
    Cognos Tm1
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in TM1 Web in IBM Cognos TM1 9.5.2 FP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0696.

  • CVE-2012-0840Feb 10, 2012
    Apache
    Portable Runtime
    risk 0.06cvss —epss 0.43

    tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to…

  • CVE-2011-4534Feb 10, 2012
    Copadata
    Zenon
    risk 0.00cvss —epss 0.03

    ZenSysSrv.exe in Ing. Punzenberger COPA-DATA zenon 6.51 SP0 allows remote attackers to cause a denial of service (service crash) or possibly execute arbitrary code via a series of connections and disconnections on TCP port 1101, aka Reference Number 25212.

  • CVE-2011-4533Feb 10, 2012
    Copadata
    Zenon
    risk 0.00cvss —epss 0.03

    zenAdminSrv.exe in Ing. Punzenberger COPA-DATA zenon 6.51 SP0 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted packet to TCP port 50777, aka Reference Number 25240.

  • CVE-2011-4039Feb 10, 2012
    Invensys
    Wonderware Hmi Reports
    risk 0.00cvss —epss 0.04

    Invensys Wonderware HMI Reports 3.42.835.0304 and earlier, as used in Ocean Data Systems Dream Report before 4.0 and other products, allows user-assisted remote attackers to execute arbitrary code via a malformed file that triggers a "write access violation."

  • CVE-2011-4038Feb 10, 2012
    Invensys
    Wonderware Hmi Reports
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Invensys Wonderware HMI Reports 3.42.835.0304 and earlier, as used in Ocean Data Systems Dream Report before 4.0 and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

  • CVE-2011-3972Feb 9, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    The shader translator implementation in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

  • CVE-2011-3971Feb 9, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 17.0.963.46 allows user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to mousemove events.

  • CVE-2011-3970Feb 9, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    libxslt, as used in Google Chrome before 17.0.963.46, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

  • CVE-2011-3969Feb 9, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to layout of SVG documents.

  • CVE-2011-3968Feb 9, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving Cascading Style Sheets (CSS) token sequences.

  • CVE-2011-3967Feb 9, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service (application crash) via a crafted certificate.

  • CVE-2011-3966Feb 9, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to error handling for Cascading Style Sheets (CSS) token-sequence data.

  • CVE-2011-3965Feb 9, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 17.0.963.46 does not properly check signatures, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.

  • CVE-2011-3964Feb 9, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 17.0.963.46 does not properly implement the drag-and-drop feature, which makes it easier for remote attackers to spoof the URL bar via unspecified vectors.

  • CVE-2011-3963Feb 9, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 17.0.963.46 does not properly handle PDF FAX images, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

  • CVE-2011-3962Feb 9, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 17.0.963.46 does not properly perform path clipping, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

  • CVE-2011-3961Feb 9, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Race condition in Google Chrome before 17.0.963.46 allows remote attackers to execute arbitrary code via vectors that trigger a crash of a utility process.

  • CVE-2011-3960Feb 9, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 17.0.963.46 does not properly decode audio data, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

  • CVE-2011-3959Feb 9, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Buffer overflow in the locale implementation in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

  • CVE-2011-3958Feb 9, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 17.0.963.46 does not properly perform casts of variables during handling of a column span, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.

  • CVE-2011-3957Feb 9, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in the garbage-collection functionality in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving PDF documents.

  • CVE-2011-3956Feb 9, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    The extension implementation in Google Chrome before 17.0.963.46 does not properly handle sandboxed origins, which might allow remote attackers to bypass the Same Origin Policy via a crafted extension.

  • CVE-2011-3955Feb 9, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via vectors that trigger the aborting of an IndexedDB transaction.

  • CVE-2011-3954Feb 9, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service (application crash) via vectors that trigger a large amount of database usage.

  • CVE-2011-3953Feb 9, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 17.0.963.46 does not prevent monitoring of the clipboard after a paste event, which has unspecified impact and remote attack vectors.

  • CVE-2012-1035Feb 8, 2012
    Adacore
    Ada Web Services
    risk 0.00cvss —epss 0.02

    AdaCore Ada Web Services (AWS) before 2.10.2 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.