VYPR

CVEs

346,414 total · page 5986 of 6,929

AllCriticalHighKEV
  • CVE-2009-5088Sep 12, 2011
    Ideacart
    Ideacart
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in secure/index.php in IdeaCart 0.02 allows remote attackers to execute arbitrary SQL commands via the cID parameter.

  • CVE-2009-5087Sep 12, 2011
    Geovision
    Digital Surveillance System
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in geohttpserver in Geovision Digital Video Surveillance System 8.2 allows remote attackers to read arbitrary files via a .. (dot dot) in a GET request.

  • CVE-2011-3392Sep 8, 2011
    Phorum
    Phorum
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in control.php in the controlcenter in Phorum before 5.2.17 allows remote attackers to inject arbitrary web script or HTML via the real_name parameter.

  • CVE-2011-3391Sep 8, 2011
    IBM
    Rational Build Forge
    risk 0.00cvss —epss 0.01

    IBM Rational Build Forge 7.1.2 relies on client-side JavaScript code to enforce the EditSecurity permission requirement for the Export Key File function, which allows remote authenticated users to read a key file by removing a disable attribute in the Security sub-menu.

  • CVE-2011-3384Sep 8, 2011
    Sage
    Sage
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Sage add-on 1.3.10 and earlier for Firefox allows remote attackers to inject arbitrary web script or HTML via a crafted feed, a different vulnerability than CVE-2009-4102.

  • CVE-2011-3382Sep 8, 2011
    Phorum
    Phorum
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Phorum before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-3381Sep 8, 2011
    Phorum
    Phorum
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Phorum before 5.2.16 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2011-3343Sep 8, 2011
    OpenTTD
    Openttd
    risk 0.00cvss —epss 0.00

    Multiple buffer overflows in OpenTTD before 1.1.3 allow local users to cause a denial of service (daemon crash) or possibly gain privileges via (1) a crafted BMP file with RLE compression or (2) crafted dimensions in a BMP file.

  • CVE-2011-3342Sep 8, 2011
    OpenTTD
    Openttd
    risk 0.00cvss —epss 0.05

    Multiple buffer overflows in OpenTTD before 1.1.3 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors related to (1) NAME, (2) PLYR, (3) CHTS, or (4) AIPL (aka AI config) chunk loading from a savegame.

  • CVE-2011-3341Sep 8, 2011
    OpenTTD
    Openttd
    risk 0.00cvss —epss 0.04

    Multiple off-by-one errors in order_cmd.cpp in OpenTTD before 1.1.3 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted CMD_INSERT_ORDER command.

  • CVE-2011-3389Sep 6, 2011
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.73

    The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to…

  • CVE-2011-3388Sep 6, 2011
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera before 11.51 allows remote attackers to cause an insecure site to appear secure or trusted via unspecified actions related to Extended Validation and loading content from trusted sources in an unspecified sequence that causes the address field and page information dialog…

  • CVE-2011-3204Sep 6, 2011
    Hammerhead
    Hammerhead
    risk 0.00cvss —epss 0.00

    hammerhead.cc in Hammerhead 2.1.4 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/hammer.log (aka the HH_LOG file) or (2) the REPORT_LOG file.

  • CVE-2011-3200Sep 6, 2011
    Rsyslog
    Rsyslog
    risk 0.05cvss —epss 0.21

    Stack-based buffer overflow in the parseLegacySyslogMsg function in tools/syslogd.c in rsyslogd in rsyslog 4.6.x before 4.6.8 and 5.2.0 through 5.8.4 might allow remote attackers to cause a denial of service (application exit) via a long TAG in a legacy syslog message.

  • CVE-2011-2724Sep 6, 2011
    Samba (software)
    Samba
    risk 0.00cvss —epss 0.00

    The check_mtab function in client/mount.cifs.c in mount.cifs in smbfs in Samba 3.5.10 and earlier does not properly verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab…

  • CVE-2011-2660Sep 6, 2011
    SUSE S.A.
    Linux Enterprise Desktop
    risk 0.00cvss —epss 0.03

    The modify_resolvconf_suse script in the vpnc package before 0.5.1-55.10.1 in SUSE Linux Enterprise Desktop 11 SP1 might allow remote attackers to execute arbitrary commands via a crafted DNS domain name.

  • CVE-2011-2184Sep 6, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The key_replace_session_keyring function in security/keys/process_keys.c in the Linux kernel before 2.6.39.1 does not initialize a certain structure member, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified…

  • CVE-2011-1776MedSep 6, 2011
    Linux
    Kernel
    risk 0.40cvss 6.1epss 0.01

    The is_gpt_valid function in fs/partitions/efi.c in the Linux kernel before 2.6.39 does not check the size of an Extensible Firmware Interface (EFI) GUID Partition Table (GPT) entry, which allows physically proximate attackers to cause a denial of service (heap-based buffer…

  • CVE-2011-1771HigSep 6, 2011
    Linux
    Kernel
    risk 0.51cvss 7.8epss 0.01

    The cifs_close function in fs/cifs/file.c in the Linux kernel before 2.6.39 allows local users to cause a denial of service (NULL pointer dereference and BUG) or possibly have unspecified other impact by setting the O_DIRECT flag during an attempt to open a file on a CIFS…

  • CVE-2011-3390Sep 6, 2011
    IBM
    Openadmin Tool
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in IBM OpenAdmin Tool (OAT) before 2.72 for Informix allow remote attackers to inject arbitrary web script or HTML via the (1) informixserver, (2) host, or (3) port parameter in a login action.

  • CVE-2011-3205Sep 6, 2011
    Squid Cache
    Squid
    risk 0.02cvss —epss 0.27

    Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have…

  • CVE-2011-2723Sep 6, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The skb_gro_header_slow function in include/linux/netdevice.h in the Linux kernel before 2.6.39.4, when Generic Receive Offload (GRO) is enabled, resets certain fields in incorrect situations, which allows remote attackers to cause a denial of service (system crash) via crafted…

  • CVE-2011-2700Sep 6, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Multiple buffer overflows in the si4713_write_econtrol_string function in drivers/media/radio/si4713-i2c.c in the Linux kernel before 2.6.39.4 on the N900 platform might allow local users to cause a denial of service or have unspecified other impact via a crafted s_ext_ctrls…

  • CVE-2011-2654Sep 6, 2011
    Novell
    Cloud Manager
    risk 0.00cvss —epss 0.04

    The RPC implementation in the server in Novell Cloud Manager 1.1.2 before Patch 3 does not properly initialize objects, which allows remote attackers to execute arbitrary code by making RPC calls that leverage incorrect privileges associated with a partially initialized session.

  • CVE-2011-1359Sep 6, 2011
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the administration console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41, 7.0 before 7.0.0.19, and 8.0 before 8.0.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.

  • CVE-2011-0258Sep 6, 2011
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.05

    Apple QuickTime before 7.7 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted image description associated with an mp4v tag in a movie file.

  • CVE-2010-4833Sep 6, 2011
    GNOME Foundation
    Gtk
    risk 0.00cvss —epss 0.02

    Untrusted search path vulnerability in modules/engines/ms-windows/xp_theme.c in GTK+ before 2.24.0 allows local users to gain privileges via a Trojan horse uxtheme.dll file in the current working directory, a different vulnerability than CVE-2010-4831.

  • CVE-2010-4831Sep 6, 2011
    GNOME Foundation
    Gtk
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in gdk/win32/gdkinput-win32.c in GTK+ before 2.21.8 allows local users to gain privileges via a Trojan horse Wintab32.dll file in the current working directory.

  • CVE-2011-3387Sep 2, 2011
    IBM
    Java
    risk 0.00cvss —epss 0.02

    The class file parser in IBM Java 1.4.2 SR13 FP9 allows remote authenticated users to cause a denial of service (memory consumption or an infinite loop) via a crafted attribute length field in a class file, related to validation of a length field at the wrong time, a different…

  • CVE-2011-3386Sep 2, 2011
    Medtronic
    Paradigm Wireless Insulin Pump
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Medtronic Paradigm wireless insulin pump 512, 522, 712, and 722 allows remote attackers to modify the delivery of an insulin bolus dose and cause a denial of service (adverse human health effects) via unspecified vectors involving wireless…

  • CVE-2011-2176Sep 2, 2011
    GNOME Foundation
    Networkmanager
    risk 0.00cvss —epss 0.00

    GNOME NetworkManager before 0.8.6 does not properly enforce the auth_admin element in PolicyKit, which allows local users to bypass intended wireless network sharing restrictions via unspecified vectors.

  • CVE-2011-1411Sep 2, 2011
    Internet2
    Opensaml
    risk 0.00cvss —epss 0.02

    Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."

  • CVE-2011-0543Sep 2, 2011
    Fuse
    Fuse
    risk 0.00cvss —epss 0.00

    Certain legacy functionality in fusermount in fuse 2.8.5 and earlier, when util-linux does not support the --no-canonicalize option, allows local users to bypass intended access restrictions and unmount arbitrary directories via a symlink attack.

  • CVE-2011-0542Sep 2, 2011
    Fuse
    Fuse
    risk 0.00cvss —epss 0.00

    fusermount in fuse 2.8.5 and earlier does not perform a chdir to / before performing a mount or umount, which allows local users to unmount arbitrary directories via unspecified vectors.

  • CVE-2011-0541Sep 2, 2011
    Fuse
    Fuse
    risk 0.00cvss —epss 0.00

    fuse 2.8.5 and earlier does not properly handle when /etc/mtab cannot be updated, which allows local users to unmount arbitrary directories via a symlink attack.

  • CVE-2011-0311Sep 2, 2011
    IBM
    Runtimes For Java Technology
    risk 0.00cvss —epss 0.02

    The class file parser in IBM Java before 1.4.2 SR13 FP9, as used in IBM Runtimes for Java Technology 5.0.0 before SR13 and 6.0.0 before SR10, allows remote authenticated users to cause a denial of service (JVM segmentation fault, and possibly memory consumption or an infinite…

  • CVE-2011-3385Sep 2, 2011
    Lepton CMS
    Lepton
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in WebsiteBaker before 2.8, as used in LEPTON and possibly other products, allows remote attackers to inject arbitrary web script or HTML via unknown vectors, a different vulnerability than CVE-2006-2307.

  • CVE-2009-5086Sep 2, 2011
    Juniper Networks
    IDP
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Appliance Configuration Manager (ACM) in Juniper IDP 4.1 before 4.1r3 and 4.2 before 4.2r1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-3134Sep 2, 2011
    TIBCO Software
    Spotfire Analytics Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in TIBCO Spotfire Server 3.0.x before 3.0.2, 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.1, and Spotfire Analytics Server before 10.1.1, allows remote attackers to modify data or obtain sensitive information via a crafted URL.

  • CVE-2011-3133Sep 2, 2011
    TIBCO Software
    Spotfire Analytics Server
    risk 0.00cvss —epss 0.02

    Session fixation vulnerability in TIBCO Spotfire Server 3.0.x before 3.0.2, 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.1, and Spotfire Analytics Server before 10.1.1, allows remote attackers to hijack web sessions via unspecified vectors.

  • CVE-2011-3132Sep 2, 2011
    TIBCO Software
    Spotfire Analytics Server
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in TIBCO Spotfire Server 3.0.x before 3.0.2, 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.1, and Spotfire Analytics Server before 10.1.1, allows remote attackers to inject arbitrary web script or HTML via unspecified…

  • CVE-2011-2903Sep 2, 2011
    Tcptrack
    tcptrack
    risk 0.00cvss —epss 0.02

    Heap-based buffer overflow in tcptrack before 1.4.2 might allow attackers to execute arbitrary code via a long command line argument. NOTE: this is only a vulnerability in limited scenarios in which tcptrack is "configured as a handler for other applications." This issue might…

  • CVE-2011-2763Sep 2, 2011
    Lifesize
    Room
    risk 0.06cvss —epss 0.36

    The web interface on the LifeSize Room appliance LS_RM1_3.5.3 (11) and 4.7.18 allows remote attackers to execute arbitrary commands via a modified request to the LSRoom_Remoting.doCommand function in gateway.php.

  • CVE-2011-2762Sep 2, 2011
    Lifesize
    Room Appliance
    risk 0.00cvss —epss 0.02

    The web interface on the LifeSize Room appliance LS_RM1_3.5.3 (11) allows remote attackers to bypass authentication via unspecified data associated with a "true" authentication status, related to AMF data and the LSRoom_Remoting.authenticate function in gateway.php.

  • CVE-2011-2594Sep 2, 2011
    Kmplayer
    Kmplayer
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in KMPlayer 3.0.0.1441, and possibly other versions, allows remote attackers to execute arbitrary code via a playlist (.KPL) file with a long Title field.

  • CVE-2011-1944Sep 2, 2011
    Xmlsoft
    Libxml2
    risk 0.04cvss —epss 0.13

    Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based…

  • CVE-2011-0342Sep 2, 2011
    Indusoft
    Web Studio
    risk 0.00cvss —epss 0.06

    Multiple buffer overflows in the InduSoft ISSymbol ActiveX control in ISSymbol.ocx 301.1104.601.0 in InduSoft Web Studio 7.0B2 hotfix 7.0.01.04 allow remote attackers to execute arbitrary code via a long parameter to the (1) Open, (2) Close, or (3) SetCurrentLanguage method.

  • CVE-2011-3190Aug 31, 2011
    Apache
    Tomcat
    risk 0.00cvss —epss 0.15

    Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the…

  • CVE-2011-2899Aug 31, 2011
    Red Hat
    System Config Printer
    risk 0.00cvss —epss 0.02

    pysmb.py in system-config-printer 0.6.x and 0.7.x, as used in foomatic-gui and possibly other products, allows remote SMB servers to execute arbitrary commands via shell metacharacters in the (1) NetBIOS or (2) workgroup name, which are not properly handled when searching for…

  • CVE-2011-2577Aug 31, 2011
    Cisco Systems, Inc.
    TelePresence C Series Endpoints
    risk 0.04cvss —epss 0.13

    Unspecified vulnerability in Cisco TelePresence C Series Endpoints, E/EX Personal Video units, and MXP Series Codecs, when using software versions before TC 4.0.0 or F9.1, allows remote attackers to cause a denial of service (crash) via a crafted SIP packet to port 5060 or 5061,…