VYPR

CVEs

346,473 total · page 5959 of 6,930

AllCriticalHighKEV
  • CVE-2011-5004Dec 25, 2011
    Fabrikar
    Fabrik
    risk 0.00cvss —epss 0.02

    Unrestricted file upload vulnerability in models/importcsv.php in the Fabrik (com_fabrik) component before 2.1.1 for Joomla! allows remote authenticated users with Manager privileges to execute arbitrary code by uploading a file with an executable extension, then accessing it…

  • CVE-2011-5003Dec 25, 2011
    Avid
    Media Composer
    risk 0.08cvss —epss 0.63

    Stack-based buffer overflow in the Phonetic Indexer (AvidPhoneticIndexer.exe) in Avid Media Composer 5.5.3 and earlier allows remote attackers to execute arbitrary code via a long request to TCP port 4659.

  • CVE-2011-5002Dec 25, 2011
    Finaldraft
    Finaldraft
    risk 0.04cvss —epss 0.08

    Multiple stack-based buffer overflows in Final Draft 8 before 8.02 allow remote attackers to execute arbitrary code via a .fdx or .fdxt file with long (1) Word, (2) Transition, (3) Location, (4) Extension, (5) SceneIntro, (6) TimeOfDay, and (7) Character elements.

  • CVE-2011-5001Dec 25, 2011
    Trend Micro
    Control Manager
    risk 0.08cvss —epss 0.65

    Stack-based buffer overflow in the CGenericScheduler::AddTask function in cmdHandlerRedAlertController.dll in CmdProcessor.exe in Trend Micro Control Manager 5.5 before Build 1613 allows remote attackers to execute arbitrary code via a crafted IPC packet to TCP port 20101.

  • CVE-2011-4862Dec 25, 2011
    Heimdal
    Heimdal
    risk 0.04cvss —epss 0.95

    Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long…

  • CVE-2011-4601Dec 25, 2011
    Pidgin (software)
    Pidgin
    risk 0.00cvss —epss 0.05

    family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted (1) AIM or (2) ICQ message associated…

  • CVE-2010-5081Dec 25, 2011
    Mini Stream
    Rm Mp3 Converter
    risk 0.05cvss —epss 0.31

    Stack-based buffer overflow in Mini-Stream RM-MP3 Converter 3.1.2.1 allows remote attackers to execute arbitrary code via a long URL in a .pls file.

  • CVE-2009-5109Dec 25, 2011
    Mini Stream
    Ripper
    risk 0.06cvss —epss 0.33

    Stack-based buffer overflow in Mini-Stream Ripper 3.0.1.1 allows remote attackers to execute arbitrary code via a long entry in a .pls file.

  • CVE-2011-4362Dec 24, 2011
    Lighttpd
    Lighttpd
    risk 0.05cvss —epss 0.23

    Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that…

  • CVE-2011-3839Dec 24, 2011
    Wuzly
    Wuzly
    risk 0.00cvss —epss 0.02

    The administration functionality in Wuzly 2.0 allows remote attackers to bypass authentication by setting the dXNlcm5hbWU cookie.

  • CVE-2011-3838Dec 24, 2011
    Wuzly
    Wuzly
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Wuzly 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) u parameter to fp.php, (2) epage parameter to newpage.php, (3) epost parameter to newpost.php, and (4) username parameter to login.php in admin/; or the (5)…

  • CVE-2011-3837Dec 24, 2011
    Wuzly
    Wuzly
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in blog_system/data_functions.php in Wuzly 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the preview parameter to index.php.

  • CVE-2011-3836Dec 24, 2011
    Wuzly
    Wuzly
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Wuzly 2.0 allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator, (2) perform cross-site scripting (XSS), (3) perform SQL injection, or have other unspecified…

  • CVE-2011-3835Dec 24, 2011
    Wuzly
    Wuzly
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Wuzly 2.0 allow remote attackers to inject arbitrary web script or HTML via the Referer header to (1) admin/login.php and (2) admin/404.php; the (3) q parameter to search.php; the (4) theme_name parameter to…

  • CVE-2011-3378Dec 24, 2011
    Rpm
    Rpm
    risk 0.00cvss —epss 0.06

    RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or…

  • CVE-2011-3372Dec 24, 2011
    Cyrus
    IMAP
    risk 0.00cvss —epss 0.03

    imap/nntpd.c in the NNTP server (nntpd) for Cyrus IMAPd 2.4.x before 2.4.12 allows remote attackers to bypass authentication by sending an AUTHINFO USER command without sending an additional AUTHINFO PASS command.

  • CVE-2011-4596Dec 23, 2011
    OpenStack
    Nova
    risk 0.00cvss —epss 0.02

    Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1, when the EC2 API and the S3/RegisterImage image-registration method are enabled, allow remote authenticated users to overwrite arbitrary files via a crafted (1) tarball or (2) manifest.

  • CVE-2011-1392Dec 23, 2011
    IBM
    Rational Rhapsody
    risk 0.00cvss —epss 0.04

    The Blueberry FlashBack ActiveX control in BB FlashBack Recorder.dll in Blueberry BB FlashBack, as used in IBM Rational Rhapsody before 7.6.1 and other products, does not properly implement the (1) Start, (2) PauseAndSave, (3) InsertMarker, and (4) InsertSoundToFBRAtMarker…

  • CVE-2011-1391Dec 23, 2011
    IBM
    Rational Rhapsody
    risk 0.00cvss —epss 0.04

    The Blueberry FlashBack ActiveX control in BB FlashBack Recorder.dll in Blueberry BB FlashBack, as used in IBM Rational Rhapsody before 7.6.1 and other products, does not properly implement the InsertMarker method, which allows remote attackers to execute arbitrary code via…

  • CVE-2011-1388Dec 23, 2011
    IBM
    Rational Rhapsody
    risk 0.00cvss —epss 0.04

    The Blueberry FlashBack ActiveX control in BB FlashBack Recorder.dll in Blueberry BB FlashBack, as used in IBM Rational Rhapsody before 7.6.1 and other products, does not properly implement the TestCompatibilityRecordMode method, which allows remote attackers to execute…

  • CVE-2011-4897Dec 23, 2011
    Tor
    Tor
    risk 0.00cvss —epss 0.02

    Tor before 0.2.2.25-alpha, when configured as a relay without the Nickname configuration option, uses the local hostname as the Nickname value, which allows remote attackers to obtain potentially sensitive information by reading this value.

  • CVE-2011-4896Dec 23, 2011
    Tor
    Tor
    risk 0.00cvss —epss 0.02

    Tor before 0.2.2.24-alpha continues to use a reachable bridge that was previously configured but is not currently configured, which might allow remote attackers to obtain sensitive information about clients in opportunistic circumstances by monitoring network traffic to the…

  • CVE-2011-4895Dec 23, 2011
    Tor
    Tor
    risk 0.00cvss —epss 0.02

    Tor before 0.2.2.34, when configured as a bridge, sets up circuits through a process different from the process used by a client, which makes it easier for remote attackers to enumerate bridges by observing circuit building.

  • CVE-2011-4894Dec 23, 2011
    Tor
    Tor
    risk 0.00cvss —epss 0.02

    Tor before 0.2.2.34, when configured as a bridge, uses direct DirPort access instead of a Tor TLS connection for a directory fetch, which makes it easier for remote attackers to enumerate bridges by observing DirPort connections.

  • CVE-2011-2778Dec 23, 2011
    Tor
    Tor
    risk 0.00cvss —epss 0.04

    Multiple heap-based buffer overflows in Tor before 0.2.2.35 allow remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code by (1) establishing a SOCKS connection to SocksPort or (2) leveraging a SOCKS proxy configuration.

  • CVE-2011-2769Dec 23, 2011
    Tor
    Tor
    risk 0.00cvss —epss 0.01

    Tor before 0.2.2.34, when configured as a bridge, accepts the CREATE and CREATE_FAST values in the Command field of a cell within an OR connection that it initiated, which allows remote relays to enumerate bridges by using these values.

  • CVE-2011-2768Dec 23, 2011
    Tor
    Tor
    risk 0.00cvss —epss 0.01

    Tor before 0.2.2.34, when configured as a client or bridge, sends a TLS certificate chain as part of an outgoing OR connection, which allows remote relays to bypass intended anonymity properties by reading this chain and then determining the set of entry guards that the client…

  • CVE-2011-4782Dec 22, 2011
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in libraries/config/ConfigFile.class.php in the setup interface in phpMyAdmin 3.4.x before 3.4.9 allows remote attackers to inject arbitrary web script or HTML via the host parameter.

  • CVE-2011-4780Dec 22, 2011
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in libraries/display_export.lib.php in phpMyAdmin 3.4.x before 3.4.9 allow remote attackers to inject arbitrary web script or HTML via crafted URL parameters, related to the export panels in the (1) server, (2) database, and…

  • CVE-2011-4634Dec 22, 2011
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.8 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted database name, related to the Database Synchronize panel; (2) a crafted database name, related to the Database…

  • CVE-2011-3990Dec 22, 2011
    Pukiwiki
    Plus!
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in plugin/comment.inc.php in PukiWiki Plus! 1.4.7plus-u2-i18n and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-4453Dec 22, 2011
    Pmwiki
    Pmwiki
    risk 0.07cvss —epss 0.52

    The PageListSort function in scripts/pagelist.php in PmWiki 2.x before 2.2.35 allows remote attackers to execute arbitrary code via PHP sequences in a crafted order parameter in a pagelist directive, leading to unintended use of the PHP create_function function.

  • CVE-2011-4203Dec 22, 2011
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    CRLF injection vulnerability in calendar/set.php in the Calendar component in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, 2.1.x before 2.1.3, and 2.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors involving…

  • CVE-2011-4037Dec 22, 2011
    Sielcosistemi
    Winlog Pro
    risk 0.00cvss —epss 0.05

    Buffer overflow in Sielco Sistemi Winlog PRO before 2.07.09 and Winlog Lite before 2.07.09 allows user-assisted remote attackers to execute arbitrary code via invalid data in unspecified fields of a project file.

  • CVE-2011-3666Dec 21, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    Mozilla Firefox before 3.6.25 and Thunderbird before 3.1.17 on Mac OS X do not consider .jar files to be executable files, which allows user-assisted remote attackers to bypass intended access restrictions via a crafted file. NOTE: this vulnerability exists because of an…

  • CVE-2011-3665Dec 21, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an Ogg VIDEO element that is not properly handled after scaling.

  • CVE-2011-3664Dec 21, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    Mozilla Firefox before 9.0, Thunderbird before 9.0, and SeaMonkey before 2.6 on Mac OS X do not properly handle certain DOM frame deletions by plugins, which allows remote attackers to cause a denial of service (incorrect pointer dereference and application crash) or possibly…

  • CVE-2011-3663Dec 21, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to capture keystrokes entered on a web page, even when JavaScript is disabled, by using SVG animation accessKey events within that web page.

  • CVE-2011-3661Dec 21, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    YARR, as used in Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted JavaScript.

  • CVE-2011-3660Dec 21, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code…

  • CVE-2011-3658Dec 21, 2011
    Mozilla Corporation
    Firefox
    risk 0.09cvss —epss 0.70

    The SVG implementation in Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5 does not properly interact with DOMAttrModified event handlers, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact…

  • CVE-2011-4869Dec 20, 2011
    Unbound
    Unbound
    risk 0.00cvss —epss 0.03

    validator/val_nsec3.c in Unbound before 1.4.13p2 does not properly perform proof processing for NSEC3-signed zones, which allows remote DNS servers to cause a denial of service (daemon crash) via a malformed response that lacks expected NSEC3 records, a different vulnerability…

  • CVE-2011-4723MedKEVDec 20, 2011
    Dlink
    DIR-300
    risk 0.49cvss 5.7epss 0.03

    The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information via unspecified vectors.

  • CVE-2011-4717Dec 20, 2011
    Zftpserver
    Zftpserver Suite
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in zFTPServer Suite 6.0.0.52 allows remote authenticated users to delete arbitrary directories via a crafted RMD (aka rmdir) command.

  • CVE-2011-4528Dec 20, 2011
    Unbound
    Unbound
    risk 0.00cvss —epss 0.03

    Unbound before 1.4.13p2 attempts to free unallocated memory during processing of duplicate CNAME records in a signed zone, which allows remote DNS servers to cause a denial of service (daemon crash) via a crafted response.

  • CVE-2011-4861Dec 17, 2011
    Schneider Electric
    Quantum Ethernet Module
    risk 0.00cvss —epss 0.03

    The modbus_125_handler function in the Schneider Electric Quantum Ethernet Module on the NOE 771 device (aka the Quantum 140NOE771* module) allows remote attackers to install arbitrary firmware updates via a MODBUS 125 function code to TCP port 502.

  • CVE-2011-4860Dec 17, 2011
    Schneider Electric
    Quantum Ethernet Module
    risk 0.00cvss —epss 0.03

    The ComputePassword function in the Schneider Electric Quantum Ethernet Module on the NOE 771 device (aka the Quantum 140NOE771* module) generates the password for the fwupgrade account by performing a calculation on the MAC address, which makes it easier for remote attackers to…

  • CVE-2011-4859Dec 17, 2011
    Schneider Electric
    Quantum Ethernet Module
    risk 0.00cvss —epss 0.04

    The Schneider Electric Quantum Ethernet Module, as used in the Quantum 140NOE771* and 140CPU65* modules, the Premium TSXETY* and TSXP57* modules, the M340 BMXNOE01* and BMXP3420* modules, and the STB DIO STBNIC2212 and STBNIP2* modules, uses hardcoded passwords for the (1)…

  • CVE-2011-4603Dec 17, 2011
    Pidgin (software)
    Pidgin
    risk 0.00cvss —epss 0.04

    The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted message, a…

  • CVE-2011-4602Dec 17, 2011
    Pidgin (software)
    Pidgin
    risk 0.00cvss —epss 0.04

    The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers to cause a denial of service (application crash) via a crafted message.