VYPR

CVEs

346,483 total · page 5951 of 6,930

AllCriticalHighKEV
  • CVE-2012-0980Feb 2, 2012
    Phux
    Download Manager
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in download.php in phux Download Manager allows remote attackers to execute arbitrary SQL commands via the file parameter.

  • CVE-2012-0979Feb 2, 2012
    TWiki
    Twiki
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in TWiki allows remote attackers to inject arbitrary web script or HTML via the organization field in a profile, involving (1) registration or (2) editing of the user.

  • CVE-2012-0978Feb 2, 2012
    LuraWave
    JP2 Browser Plug-In
    risk 0.00cvss —epss 0.03

    Stack-based buffer overflow in npjp2.dll in LuraWave JP2 Browser Plug-In 1.1.1.11 and other versions before 2.1.1.11 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment.

  • CVE-2012-0977Feb 2, 2012
    LuraWave
    JP2 ActiveX Control
    risk 0.00cvss —epss 0.05

    Stack-based buffer overflow in jp2_x.dll in LuraWave JP2 ActiveX Control 2.1.5.5 and other versions before 2.1.5.11 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment.

  • CVE-2012-0976Feb 2, 2012
    Silverstripe
    Silverstripe
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin/EditForm in SilverStripe 2.4.6 allows remote authenticated users with Content Authors privileges to inject arbitrary web script or HTML via the Title parameter. NOTE: some of these details are obtained from third party…

  • CVE-2012-0975Feb 2, 2012
    Clixint
    Image Hosting Script Dpi
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in misc.php in Image Hosting Script DPI 1.0, 1.3, and earlier allows remote attackers to inject arbitrary web script or HTML via the showseries parameter.

  • CVE-2011-2393Feb 2, 2012
    FreeBSD
    FreeBSD
    risk 0.00cvss —epss 0.02

    The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in FreeBSD, NetBSD, and possibly other BSD-based operating systems allows remote attackers to cause a denial of service (CPU consumption and device hang) by sending many Router Advertisement (RA) messages with…

  • CVE-2010-4563Feb 2, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.03

    The Linux kernel, when using IPv6, allows remote attackers to determine whether a host is sniffing the network by sending an ICMPv6 Echo Request to a multicast address and determining whether an Echo Reply is sent, as demonstrated by thcping.

  • CVE-2010-4562Feb 2, 2012
    Microsoft
    Windows
    risk 0.01cvss —epss 0.15

    Microsoft Windows 2008, 7, Vista, 2003, 2000, and XP, when using IPv6, allows remote attackers to determine whether a host is sniffing the network by sending an ICMPv6 Echo Request to a multicast address and determining whether an Echo Reply is sent, as demonstrated by thcping.…

  • CVE-2011-4194Feb 2, 2012
    Novell
    Open Enterprise Server
    risk 0.00cvss —epss 0.03

    Buffer overflow in Novell iPrint Server in Novell Open Enterprise Server 2 (OES2) through SP3 on Linux allows remote attackers to execute arbitrary code via a crafted attributes-natural-language field.

  • CVE-2011-4144Feb 2, 2012
    EMC Corporation
    Documentum Content Server
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in EMC Documentum Content Server 6.0, 6.5 before SP2 P02, 6.5 SP3 before SP3 P02, and 6.6 before P02 allows local users to obtain "highest super user privileges" by leveraging system administrator privileges.

  • CVE-2011-2525HigFeb 2, 2012
    Linux
    Kernel
    risk 0.51cvss 7.8epss 0.01

    The qdisc_notify function in net/sched/sch_api.c in the Linux kernel before 2.6.35 does not prevent tc_fill_qdisc function calls referencing builtin (aka CQ_F_BUILTIN) Qdisc structures, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) or…

  • CVE-2011-1573MedFeb 2, 2012
    Linux
    Kernel
    risk 0.39cvss 5.9epss 0.03

    net/sctp/sm_make_chunk.c in the Linux kernel before 2.6.34, when addip_enable and auth_enable are used, does not consider the amount of zero padding during calculation of chunk lengths for (1) INIT and (2) INIT ACK chunks, which allows remote attackers to cause a denial of…

  • CVE-2012-0057Feb 2, 2012
    PHP
    PHP
    risk 0.00cvss —epss 0.03

    PHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create arbitrary files via a crafted XSLT stylesheet that uses the libxslt output extension.

  • CVE-2011-4790Feb 2, 2012
    Microfocus
    Network Automation
    risk 0.01cvss —epss 0.09

    Unspecified vulnerability in HP Network Automation 7.5x, 7.6x, 9.0, and 9.10 allows remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2012-0450Feb 1, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.00

    Mozilla Firefox 4.x through 9.0 and SeaMonkey before 2.7 on Linux and Mac OS X set weak permissions for Firefox Recovery Key.html, which might allow local users to read a Firefox Sync key via standard filesystem operations.

  • CVE-2012-0449Feb 1, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a malformed XSLT…

  • CVE-2012-0447Feb 1, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize data for image/vnd.microsoft.icon images, which allows remote attackers to obtain potentially sensitive information by reading a PNG image that was created through…

  • CVE-2012-0446Feb 1, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to inject arbitrary web script or HTML via a (1) web page or (2) Firefox extension, related to improper…

  • CVE-2012-0445Feb 1, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to bypass the HTML5 frame-navigation policy and replace arbitrary sub-frames by creating a form submission target with a sub-frame's name attribute.

  • CVE-2012-0444Feb 1, 2012
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.08

    Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize nsChildView data structures, which allows remote attackers to cause a denial of service (memory corruption and application crash)…

  • CVE-2012-0443Feb 1, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code…

  • CVE-2012-0442Feb 1, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash)…

  • CVE-2011-3670Feb 1, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox before 3.6.26 and 4.x through 6.0, Thunderbird before 3.1.18 and 5.0 through 6.0, and SeaMonkey before 2.4 do not properly enforce the IPv6 literal address syntax, which allows remote attackers to obtain sensitive information by making XMLHttpRequest calls…

  • CVE-2011-3659Feb 1, 2012
    Mozilla Corporation
    Firefox
    risk 0.06cvss —epss 0.37

    Use-after-free vulnerability in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 might allow remote attackers to execute arbitrary code via vectors related to incorrect AttributeChildRemoved notifications…

  • CVE-2012-0809Feb 1, 2012
    Todd Miller
    Sudo
    risk 0.03cvss —epss 0.03

    Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbitrary code via format string sequences in the program name for sudo.

  • CVE-2012-0937Jan 30, 2012
    WordPress
    WordPress
    risk 0.00cvss —epss 0.08

    wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to external MySQL database servers, which allows remote attackers to use WordPress as a proxy for brute-force attacks or denial of service…

  • CVE-2012-0817Jan 30, 2012
    Samba (software)
    Samba
    risk 0.00cvss —epss 0.04

    Memory leak in smbd in Samba 3.6.x before 3.6.3 allows remote attackers to cause a denial of service (memory and CPU consumption) by making many connection requests.

  • CVE-2012-0782Jan 30, 2012
    WordPress
    WordPress
    risk 0.00cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dbhost, (2) dbname, or (3) uname parameter. NOTE: the vendor…

  • CVE-2011-4899Jan 30, 2012
    WordPress
    WordPress
    risk 0.00cvss —epss 0.09

    wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and…

  • CVE-2011-4898Jan 30, 2012
    WordPress
    WordPress
    risk 0.00cvss —epss 0.10

    wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct…

  • CVE-2011-5075Jan 29, 2012
    Support Incident Tracker
    SiT!
    risk 0.03cvss —epss 0.03

    translate.php in Support Incident Tracker (aka SiT!) 3.45 through 3.65 allows remote attackers to obtain sensitive information via a direct request using the save action, which reveals the installation path.

  • CVE-2011-5074Jan 29, 2012
    Support Incident Tracker
    SiT!
    risk 0.03cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Support Incident Tracker (aka SiT!) before 3.65 allow remote attackers to hijack the authentication of administrators for requests that change administrator email, add a new administrator, or insert arbitrary script…

  • CVE-2011-5073Jan 29, 2012
    Sitracker
    Support Incident Tracker
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Support Incident Tracker (aka SiT!) before 3.65 allow remote attackers to inject arbitrary web script or HTML via the (1) mode parameter to contact_support.php; (2) contractid parameter to contract_add_service.php; (3) user…

  • CVE-2011-5072Jan 29, 2012
    Sitracker
    Support Incident Tracker
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Support Incident Tracker (aka SiT!) before 3.65 allow remote attackers to execute arbitrary SQL commands via the (1) start parameter to portal/kb.php; (2) contractid parameter to contract_add_service.php; (3) id parameter to…

  • CVE-2011-4337Jan 29, 2012
    Sitracker
    Support Incident Tracker
    risk 0.03cvss —epss 0.03

    Static code injection vulnerability in translate.php in Support Incident Tracker (aka SiT!) 3.45 through 3.65 allows remote attackers to inject arbitrary PHP code into an executable language file in the i18n directory via the lang variable.

  • CVE-2012-0936Jan 29, 2012
    Opennms
    Opennms
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in web/springframework/security/SecurityAuthenticationEventOnmsEventBuilder.java in OpenNMS 1.8.x before 1.8.17, 1.9.93 and earlier, and 1.10.x before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via the Username…

  • CVE-2012-0935Jan 29, 2012
    Aryadad
    Aryadad CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Default.aspx in Aryadad CMS allows remote attackers to execute arbitrary SQL commands via the PageID parameter.

  • CVE-2012-0934Jan 29, 2012
    WordPress
    Theme Tuner
    risk 0.00cvss —epss 0.08

    PHP remote file inclusion vulnerability in ajax/savetag.php in the Theme Tuner plugin for WordPress before 0.8 allows remote attackers to execute arbitrary PHP code via a URL in the tt-abspath parameter.

  • CVE-2012-0933Jan 29, 2012
    Acidcat
    Acidcat CMS
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in Acidcat CMS 3.5.1, 3.5.2, 3.5.6, and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) admin_colors.asp, (2) admin_config.asp, and (3) admin_cat_add.asp in admin/.

  • CVE-2012-0932Jan 29, 2012
    Leadcapturepagesystem
    Lead Capture Page System
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin/login.php in Lead Capture Page System allows remote attackers to inject arbitrary web script or HTML via the message parameter.

  • CVE-2011-5071Jan 29, 2012
    Sitracker
    Support Incident Tracker
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Support Incident Tracker (aka SiT!) before 3.64 allow remote attackers to execute arbitrary SQL commands via the (1) exc[] parameter to report_marketing.php, (2) selected[] parameter to tasks.php, (3) sites[] parameter to…

  • CVE-2011-5070Jan 29, 2012
    Support Incident Tracker
    SiT!
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Support Incident Tracker (aka SiT!) 3.65 allow remote attackers to inject arbitrary web script or HTML via (1) the file name to incident_attachments.php; (2) unspecified vectors in link_add.php, possibly involving origref,…

  • CVE-2011-5069Jan 29, 2012
    Sitracker
    Support Incident Tracker
    risk 0.00cvss —epss 0.02

    Unrestricted file upload vulnerability in incident_attachments.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in…

  • CVE-2011-5068Jan 29, 2012
    Support Incident Tracker
    SiT!
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Support Incident Tracker (aka SiT!) 3.65 allow remote attackers to hijack the authentication of user for requests that delete a user via user_delete.php and other unspecified programs.

  • CVE-2011-5067Jan 29, 2012
    Sitracker
    Support Incident Tracker
    risk 0.00cvss —epss 0.01

    move_uploaded_file.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to obtain sensitive information via the file name, which reveals the installation path in an error message.

  • CVE-2011-3833Jan 29, 2012
    Sitracker
    Support Incident Tracker
    risk 0.05cvss —epss 0.20

    Unrestricted file upload vulnerability in ftp_upload_file.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in an unspecified directory.

  • CVE-2011-3832Jan 29, 2012
    Support Incident Tracker
    SiT!
    risk 0.00cvss —epss 0.01

    Eval injection vulnerability in config.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated administrators to execute arbitrary PHP code via the application_name parameter in a save action.

  • CVE-2011-3831Jan 29, 2012
    Support Incident Tracker
    SiT!
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in incident_attachments.php in Support Incident Tracker (aka SiT!) 3.65 allows remote attackers to execute arbitrary SQL commands via an uploaded file with a crafted file name.

  • CVE-2011-3830Jan 29, 2012
    Sitracker
    Support Incident Tracker
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in Support Incident Tracker (aka SiT!) 3.65 allows remote attackers to inject arbitrary web script or HTML via the search_string parameter.