VYPR

CVEs

346,434 total · page 5967 of 6,929

AllCriticalHighKEV
  • CVE-2011-3651Nov 9, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 7.0 and Thunderbird 7.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

  • CVE-2011-3650Nov 9, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox before 3.6.24 and 4.x through 7.0 and Thunderbird before 3.1.6 and 5.0 through 7.0 do not properly handle JavaScript files that contain many functions, which allows user-assisted remote attackers to cause a denial of service (memory corruption and application…

  • CVE-2011-3649Nov 9, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    Mozilla Firefox 7.0 and Thunderbird 7.0, when the Direct2D (aka D2D) API is used on Windows in conjunction with the Azure graphics back-end, allow remote attackers to bypass the Same Origin Policy, and obtain sensitive image data from a different domain, by inserting this data…

  • CVE-2011-3648Nov 9, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.6.24 and 4.x through 7.0 and Thunderbird before 3.1.6 and 5.0 through 7.0 allows remote attackers to inject arbitrary web script or HTML via crafted text with Shift JIS encoding.

  • CVE-2011-3647Nov 9, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The JSSubScriptLoader in Mozilla Firefox before 3.6.24 and Thunderbird before 3.1.6 does not properly handle XPCNativeWrappers during calls to the loadSubScript method in an add-on, which makes it easier for remote attackers to gain privileges via a crafted web site that…

  • CVE-2011-4000Nov 8, 2011
    Nara Institute Of Science And Technology
    Chasen
    risk 0.00cvss —epss 0.04

    Buffer overflow in ChaSen 2.4.x allows remote attackers to execute arbitrary code via a crafted string.

  • CVE-2011-2449Nov 8, 2011
    Adobe Inc.
    Shockwave Player
    risk 0.00cvss —epss 0.04

    The TextXtra module in Adobe Shockwave Player before 11.6.3.633 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

  • CVE-2011-2448Nov 8, 2011
    Adobe Inc.
    Shockwave Player
    risk 0.00cvss —epss 0.04

    The DIRapi library in Adobe Shockwave Player before 11.6.3.633 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2446.

  • CVE-2011-2447Nov 8, 2011
    Adobe Inc.
    Shockwave Player
    risk 0.00cvss —epss 0.04

    Adobe Shockwave Player before 11.6.3.633 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

  • CVE-2011-2446Nov 8, 2011
    Adobe Inc.
    Shockwave Player
    risk 0.00cvss —epss 0.04

    The DIRapi library in Adobe Shockwave Player before 11.6.3.633 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2448.

  • CVE-2011-2016HigNov 8, 2011
    Microsoft
    Windows
    risk 0.48cvss 7.3epss 0.08

    Untrusted search path vulnerability in Windows Mail and Windows Meeting Space in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as…

  • CVE-2011-2014Nov 8, 2011
    Microsoft
    Windows
    risk 0.01cvss —epss 0.11

    The LDAP over SSL (aka LDAPS) implementation in Active Directory, Active Directory Application Mode (ADAM), and Active Directory Lightweight Directory Service (AD LDS) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2,…

  • CVE-2011-2013CriNov 8, 2011
    Microsoft
    Windows
    risk 0.69cvss 9.8epss 0.34

    Integer overflow in the TCP/IP implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code by sending a sequence of crafted UDP packets to a closed port, aka "Reference…

  • CVE-2011-2004Nov 8, 2011
    Microsoft
    Windows Server 2008
    risk 0.02cvss —epss 0.25

    Array index error in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to cause a denial of service (reboot) via a crafted TrueType font file, aka "TrueType Font Parsing Vulnerability," a…

  • CVE-2011-4415Nov 8, 2011
    Apache
    HTTP Server
    risk 0.03cvss —epss 0.03

    The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory…

  • CVE-2011-3607Nov 8, 2011
    Apache
    HTTP Server
    risk 0.03cvss —epss 0.05

    Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in…

  • CVE-2011-3169Nov 7, 2011
    Microfocus
    TCP/IP Services
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the SMTP service implementation in HP TCP/IP Services 5.6 and 5.7 for OpenVMS allows remote attackers to cause a denial of service via unknown vectors.

  • CVE-2011-3168Nov 7, 2011
    Microfocus
    TCP/IP Services
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the POP and IMAP service implementations in HP TCP/IP Services 5.6 and 5.7 for OpenVMS allows remote attackers to obtain sensitive information via unknown vectors.

  • CVE-2011-4066Nov 4, 2011
    Sir
    Gnuboard
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in bbs/tb.php in Gnuboard 4.33.02 and earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO.

  • CVE-2011-3991Nov 4, 2011
    Ffftp
    Ffftp
    risk 0.00cvss —epss 0.02

    Untrusted search path vulnerability in FFFTP 1.98a and earlier allows local users to execute arbitrary code via unspecified functions.

  • CVE-2011-3989Nov 4, 2011
    Hiroyuki Oyama
    Dbd\
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in DBD::mysqlPP 0.04 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2011-3616Nov 4, 2011
    Conky
    Conky
    risk 0.00cvss —epss 0.00

    The getSkillname function in the eve module in Conky 1.8.1 and earlier allows local users to overwrite arbitrary files via a symlink attack on /tmp/.cesf.

  • CVE-2011-3594Nov 4, 2011
    Pidgin (software)
    Pidgin
    risk 0.00cvss —epss 0.03

    The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an…

  • CVE-2011-3581Nov 4, 2011
    Nlnetlabs
    Ldns
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in the ldns_rr_new_frm_str_internal function in ldns before 1.6.11 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Resource Record (RR) with an unknown type containing input that is longer than a…

  • CVE-2011-3402HigKEVNov 4, 2011
    Microsoft
    Windows
    risk 0.78cvss 8.8epss 0.78

    Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to…

  • CVE-2011-3364Nov 4, 2011
    GNOME Foundation
    Networkmanager
    risk 0.00cvss —epss 0.00

    Incomplete blacklist vulnerability in the svEscape function in settings/plugins/ifcfg-rh/shvar.c in the ifcfg-rh plug-in for GNOME NetworkManager 0.9.1, 0.9.0, 0.8.1, and possibly other versions, when PolicyKit is configured to allow users to create new connections, allows local…

  • CVE-2011-3330Nov 4, 2011
    Schneider Electric
    Monitor Pro
    risk 0.00cvss —epss 0.01

    Buffer overflow in the UnitelWay Windows Device Driver, as used in Schneider Electric Unity Pro 6 and earlier, OPC Factory Server 3.34, Vijeo Citect 7.20 and earlier, Telemecanique Driver Pack 2.6 and earlier, Monitor Pro 7.6 and earlier, and PL7 Pro 4.5 and earlier, allows…

  • CVE-2011-3171Nov 4, 2011
    Pureftpd
    Pureftpd
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in pure-FTPd 1.0.22 and possibly other versions, when running on SUSE Linux Enterprise Server and possibly other operating systems, when the Netware OES remote server feature is enabled, allows local users to overwrite arbitrary files via…

  • CVE-2011-3164Nov 4, 2011
    Microfocus
    HP-UX Containers
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in HP-UX Containers (formerly HP-UX Secure Resource Partitions (SRP)) A.03.00, A.03.00.002, and A.03.01, when running with patch PHKL_42310, allows local users to gain privileges via unknown vectors.

  • CVE-2011-1513Nov 4, 2011
    E107
    E107
    risk 0.03cvss —epss 0.06

    Static code injection vulnerability in install_.php in e107 CMS 0.7.24 and probably earlier versions, when the installation script is not removed, allows remote attackers to inject arbitrary PHP code into e107_config.php via a crafted MySQL server name.

  • CVE-2011-4277Nov 3, 2011
    Courseforum
    Projectforum
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in CourseForum ProjectForum 7.0.1.3038 allows remote attackers to inject arbitrary web script or HTML via a crafted name of an object within a more object on a wiki page.

  • CVE-2011-3996Nov 3, 2011
    Codeworks
    Csworks
    risk 0.00cvss —epss 0.02

    The LiveData Service in CSWorks before 2.0.4115.1 allows remote attackers to cause a denial of service (service crash) via crafted TCP packets.

  • CVE-2011-3994Nov 3, 2011
    Skyarc
    Autotagging
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in SKYARC MTCMS before 5.252, and the MultiFileUploader 0.44 and earlier, DuplicateEntry 1.2 and earlier, MailPack 1.741 and earlier, and AutoTagging 0.08 and earlier plugins for Movable Type, allows remote attackers to hijack the…

  • CVE-2011-3993Nov 3, 2011
    Skyarc
    Autotagging
    risk 0.00cvss —epss 0.01

    SKYARC MTCMS before 5.252, and the MultiFileUploader 0.44 and earlier, DuplicateEntry 1.2 and earlier, MailPack 1.741 and earlier, and AutoTagging 0.08 and earlier plugins for Movable Type, uses weak permissions, which allows remote authenticated users to modify files and…

  • CVE-2011-3992Nov 3, 2011
    D Link Japan
    DES-3800
    risk 0.00cvss —epss 0.05

    Buffer overflow in the SSH server functionality on the D-Link DES-3800 with firmware before 4.50B052, DWL-2100AP with firmware before 2.50RC548, and DWL-3200AP with firmware before 2.55RC549 allows remote attackers to execute arbitrary code or cause a denial of service via…

  • CVE-2011-3987Nov 3, 2011
    Daemon Tools
    Daemon Tools
    risk 0.00cvss —epss 0.01

    dtsoftbus01.sys in DAEMON Tools Lite before 4.41.3, Pro Standard before 4.41.0315, and Pro Advanced before 4.41.0315 allows local users to cause a denial of service (system crash) via an invalid DeviceIoControl request to \\.\dtsoftbusctl.

  • CVE-2011-3986Nov 3, 2011
    Pligg
    CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Pligg before 1.2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-4102Nov 3, 2011
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in the erf_read_header function in wiretap/erf.c in the ERF file parser in Wireshark 1.4.0 through 1.4.9 and 1.6.x before 1.6.3 allows remote attackers to cause a denial of service (application crash) via a malformed file.

  • CVE-2011-4101Nov 3, 2011
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    The dissect_infiniband_common function in epan/dissectors/packet-infiniband.c in the Infiniband dissector in Wireshark 1.4.0 through 1.4.9 and 1.6.x before 1.6.3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed…

  • CVE-2011-4100Nov 3, 2011
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    The csnStreamDissector function in epan/dissectors/packet-csn1.c in the CSN.1 dissector in Wireshark 1.6.x before 1.6.3 does not initialize a certain variable, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.

  • CVE-2011-4078Nov 3, 2011
    Roundcube
    Webmail
    risk 0.00cvss —epss 0.02

    include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service (resource consumption and inbox outage), via a Subject header containing only a URL, a…

  • CVE-2011-3379Nov 3, 2011
    PHP
    PHP
    risk 0.00cvss —epss 0.05

    The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.

  • CVE-2011-4274Nov 3, 2011
    Ark Web
    A Form Pc
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the A-Form PC and PC/Mobile before 3.1 plug-ins for Movable Type allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2011-2676.

  • CVE-2011-4273Nov 3, 2011
    Goahead
    Goahead Webserver
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in GoAhead Webserver 2.18 allow remote attackers to inject arbitrary web script or HTML via (1) the group parameter to goform/AddGroup, related to addgroup.asp; (2) the url parameter to goform/AddAccessLimit, related to…

  • CVE-2011-4005Nov 3, 2011
    Cisco Systems, Inc.
    Small Business Srp521w
    risk 0.00cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in the Services Ready Platform Configuration Utility web interface on the Cisco Small Business SRP521W, SRP526W, and SRP527W with firmware before 1.1.24 and the Small Business SRP541W, SRP546W, and SRP547W with firmware before…

  • CVE-2011-3995Nov 3, 2011
    Twilight Frontier
    Touhou Hisouten
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Twilight Frontier Touhou Hisouten 1.06 and earlier allows remote attackers to cause a denial of service (daemon crash) via unknown network traffic.

  • CVE-2011-2676Nov 3, 2011
    Ark Web
    A Form
    risk 0.00cvss —epss 0.01

    The A-Form and A-Form bamboo before 1.3.6 and 2.x before 2.0.3, and A-Form PC and PC/Mobile before 3.1, plug-ins for Movable Type do not require administrative authentication, which allows remote authenticated users to modify data via unspecified vectors.

  • CVE-2010-5045Nov 2, 2011
    Smart ASP
    Survey
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in poll/default.asp in Smart ASP Survey allows remote attackers to inject arbitrary web script or HTML via the catid parameter.

  • CVE-2010-5044Nov 2, 2011
    Joomla
    com_searchlog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in models/log.php in the Search Log (com_searchlog) component 3.1.0 for Joomla! allows remote authenticated users, with Public Back-end privileges, to execute arbitrary SQL commands via the search parameter in a log action to administrator/index.php. …

  • CVE-2010-5043Nov 2, 2011
    Joomla
    DJ-ArtGallery
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the DJ-ArtGallery (com_djartgallery) component 0.9.1 for Joomla! allows remote authenticated users to execute arbitrary SQL commands via the cid[] parameter in an editItem action to administrator/index.php.