VYPR

CVEs

346,414 total · page 5987 of 6,929

AllCriticalHighKEV
  • CVE-2011-2524Aug 31, 2011
    Libsoup
    Libsoup
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4 allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in a URI.

  • CVE-2011-1576Aug 31, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The Generic Receive Offload (GRO) implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux 5 and 2.6.32 on Red Hat Enterprise Linux 6, as used in Red Hat Enterprise Virtualization (RHEV) Hypervisor and other products, allows remote attackers to cause a denial of…

  • CVE-2009-5063Aug 31, 2011
    Libpng
    Libpng
    risk 0.00cvss —epss 0.01

    Memory leak in the embedded_profile_len function in pngwutil.c in libpng before 1.2.39beta5 allows context-dependent attackers to cause a denial of service (memory leak or segmentation fault) via a JPEG image containing an iCCP chunk with a negative embedded profile length. …

  • CVE-2006-7244Aug 31, 2011
    Libpng
    Libpng
    risk 0.00cvss —epss 0.01

    Memory leak in pngwutil.c in libpng 1.2.13beta1, and other versions before 1.2.15beta3, allows context-dependent attackers to cause a denial of service (memory leak or segmentation fault) via a JPEG image containing an iCCP chunk with a negative embedded profile length.

  • CVE-2011-1781Aug 29, 2011
    Systemtap
    Systemtap
    risk 0.00cvss —epss 0.00

    SystemTap 1.4, when unprivileged (aka stapusr) mode is enabled, allows local users to cause a denial of service (divide-by-zero error and OOPS) via a crafted ELF program with DWARF expressions that are not properly handled by a stap script that performs stack unwinding (aka…

  • CVE-2011-1769Aug 29, 2011
    Systemtap
    Systemtap
    risk 0.00cvss —epss 0.00

    SystemTap 1.4 and earlier, when unprivileged (aka stapusr) mode is enabled, allows local users to cause a denial of service (divide-by-zero error and OOPS) via a crafted ELF program with DWARF expressions that are not properly handled by a stap script that performs context…

  • CVE-2011-2555Aug 29, 2011
    Cisco Systems, Inc.
    Telepresence Recording Server
    risk 0.00cvss —epss 0.03

    Cisco TelePresence Recording Server 1.7.2.x before 1.7.2.1 has a default password for the root administrator account, which makes it easier for remote attackers to modify the configuration via an SSH session, aka Bug ID CSCtr76182.

  • CVE-2011-0228Aug 29, 2011
    Apple Inc.
    iOS
    risk 0.01cvss —epss 0.06

    The Data Security component in Apple iOS before 4.2.10 and 4.3.x before 4.3.5 does not check the basicConstraints parameter during validation of X.509 certificate chains, which allows man-in-the-middle attackers to spoof an SSL server by using a non-CA certificate to sign a…

  • CVE-2011-3187Aug 29, 2011
    Rubyonrails
    Rails
    risk 0.04cvss —epss 0.07

    The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass…

  • CVE-2011-3186Aug 29, 2011
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.02

    CRLF injection vulnerability in actionpack/lib/action_controller/response.rb in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the Content-Type header.

  • CVE-2011-2932Aug 29, 2011
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed…

  • CVE-2011-2931Aug 29, 2011
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML…

  • CVE-2011-2930Aug 29, 2011
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connection_adapters/ in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary…

  • CVE-2011-2929Aug 29, 2011
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.02

    The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle glob characters, which allows remote attackers to render arbitrary views via a crafted URL, related to…

  • CVE-2011-2497Aug 29, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.02

    Integer underflow in the l2cap_config_req function in net/bluetooth/l2cap_core.c in the Linux kernel before 3.0 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a small command-size value within the…

  • CVE-2011-2213Aug 29, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The inet_diag_bc_audit function in net/ipv4/inet_diag.c in the Linux kernel before 2.6.39.3 does not properly audit INET_DIAG bytecode, which allows local users to cause a denial of service (kernel infinite loop) via crafted INET_DIAG_REQ_BYTECODE instructions in a netlink…

  • CVE-2011-3185Aug 29, 2011
    Pidgin (software)
    Pidgin
    risk 0.00cvss —epss 0.05

    gtkutils.c in Pidgin before 2.10.0 on Windows allows user-assisted remote attackers to execute arbitrary programs via a file: URL in a message.

  • CVE-2011-3184Aug 29, 2011
    Pidgin (software)
    Pidgin
    risk 0.00cvss —epss 0.04

    The msn_httpconn_parse_data function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service (incorrect memory access and application crash) via vectors…

  • CVE-2011-3181Aug 29, 2011
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Tracking feature in phpMyAdmin 3.3.x before 3.3.10.4 and 3.4.x before 3.4.4 allow remote attackers to inject arbitrary web script or HTML via a (1) table name, (2) column name, or (3) index name.

  • CVE-2011-2943Aug 29, 2011
    Pidgin (software)
    Pidgin
    risk 0.00cvss —epss 0.04

    The irc_msg_who function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and…

  • CVE-2011-2928Aug 29, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The befs_follow_link function in fs/befs/linuxvfs.c in the Linux kernel before 3.1-rc3 does not validate the length attribute of long symlinks, which allows local users to cause a denial of service (incorrect pointer dereference and OOPS) by accessing a long symlink on a…

  • CVE-2011-3192Aug 29, 2011
    Apache
    HTTP Server
    risk 0.11cvss —epss 0.99

    The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in…

  • CVE-2011-2839Aug 29, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    The PDF implementation in Google Chrome before 13.0.782.215 on Linux does not properly use the memset library function, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

  • CVE-2011-2829Aug 29, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Integer overflow in Google Chrome before 13.0.782.215 on 32-bit platforms allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving uniform arrays.

  • CVE-2011-2828Aug 29, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google V8, as used in Google Chrome before 13.0.782.215, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an out-of-bounds write.

  • CVE-2011-2827Aug 29, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 13.0.782.215 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to text searching.

  • CVE-2011-2826Aug 29, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 13.0.782.215 allows remote attackers to bypass the Same Origin Policy via vectors related to empty origins.

  • CVE-2011-2825Aug 29, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 13.0.782.215 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving custom fonts.

  • CVE-2011-2824Aug 29, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in Google Chrome before 13.0.782.215 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving counter nodes.

  • CVE-2011-2823Aug 29, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 13.0.782.215 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a line box.

  • CVE-2011-2822Aug 29, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 13.0.782.215 on Windows does not properly parse URLs located on the command line, which has unspecified impact and attack vectors.

  • CVE-2011-2821Aug 29, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Double free vulnerability in libxml2, as used in Google Chrome before 13.0.782.215, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted XPath expression.

  • CVE-2011-2806Aug 29, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 13.0.782.215 on Windows does not properly handle vertex data, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

  • CVE-2011-2746Aug 29, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Kernel/Modules/AdminPackageManager.pm in OTRS-Core in Open Ticket Request System (OTRS) 2.x before 2.4.11 and 3.x before 3.0.10 allows remote authenticated administrators to read arbitrary files via unknown vectors.

  • CVE-2011-2712Aug 29, 2011
    Apache
    Wicket
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.18, when setAutomaticMultiWindowSupport is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

  • CVE-2011-2564Aug 29, 2011
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Service Advertisement Framework (SAF) in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 8.x before 8.5(1) and Cisco Intercompany Media Engine 8.x before 8.5(1) allows remote attackers to cause a denial of service (device…

  • CVE-2011-2563Aug 29, 2011
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Service Advertisement Framework (SAF) in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 8.x before 8.5(1) and Cisco Intercompany Media Engine 8.x before 8.5(1) allows remote attackers to cause a denial of service (device…

  • CVE-2011-2562Aug 29, 2011
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su2, 7.x before 7.1(5b)su3, 8.x before 8.0(3a)su1, and 8.5 before 8.5(1) allows remote attackers to cause a denial of service (service outage) via a SIP INVITE…

  • CVE-2011-2561Aug 29, 2011
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.01

    The SIP process in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 7.x before 7.1(5b)su4 and 8.x before 8.0(1) does not properly handle SDP data within a SIP call in certain situations related to use of the g729ar8 codec for a Media Termination Point (MTP),…

  • CVE-2011-2560Aug 29, 2011
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.02

    The Packet Capture Service in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.x does not properly handle idle TCP connections, which allows remote attackers to cause a denial of service (memory consumption and restart) by making many connections, aka Bug…

  • CVE-2011-1643Aug 29, 2011
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.02

    Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x, 7.x before 7.1(5b)su4, 8.0, and 8.5 before 8.5(1)su2 and Cisco Unified Presence Server 6.x, 7.x, 8.0, and 8.5 before 8.5xnr allow remote attackers to read database data by connecting to a query interface…

  • CVE-2011-3268Aug 25, 2011
    PHP
    PHP
    risk 0.00cvss —epss 0.06

    Buffer overflow in the crypt function in PHP before 5.3.7 allows context-dependent attackers to have an unspecified impact via a long salt argument, a different vulnerability than CVE-2011-2483.

  • CVE-2011-3267Aug 25, 2011
    PHP
    PHP
    risk 0.00cvss —epss 0.03

    PHP before 5.3.7 does not properly implement the error_log function, which allows context-dependent attackers to cause a denial of service (application crash) via unspecified vectors.

  • CVE-2011-3189Aug 25, 2011
    PHP
    PHP
    risk 0.00cvss —epss 0.04

    The crypt function in PHP 5.3.7, when the MD5 hash type is used, returns the value of the salt argument instead of the hashed string, which might allow remote attackers to bypass authentication via an arbitrary password, a different vulnerability than CVE-2011-2483.

  • CVE-2011-3182Aug 25, 2011
    PHP
    PHP
    risk 0.05cvss —epss 0.19

    PHP before 5.3.7 does not properly check the return values of the malloc, calloc, and realloc library functions, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger a buffer overflow by leveraging the…

  • CVE-2011-2940Aug 25, 2011
    Stunnel
    Stunnel
    risk 0.00cvss —epss 0.06

    stunnel 4.40 and 4.41 might allow remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

  • CVE-2011-2737Aug 25, 2011
    Rsa
    Envision
    risk 0.00cvss —epss 0.01

    RSA enVision 3.x and 4.x before 4 SP4 P3 allows remote attackers to read arbitrary files via unspecified vectors, related to an "arbitrary file retrieval vulnerability."

  • CVE-2011-2736Aug 25, 2011
    Rsa
    Envision
    risk 0.00cvss —epss 0.01

    RSA enVision 4.x before 4 SP4 P3 places cleartext administrative credentials in Task Escalation e-mail messages, which allows remote attackers to obtain sensitive information by sniffing the network or leveraging access to a recipient mailbox.

  • CVE-2011-2483Aug 25, 2011
    PHP
    PHP
    risk 0.00cvss —epss 0.05

    crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of…

  • CVE-2011-1657Aug 25, 2011
    PHP
    PHP
    risk 0.00cvss —epss 0.05

    The (1) ZipArchive::addGlob and (2) ZipArchive::addPattern functions in ext/zip/php_zip.c in PHP 5.3.6 allow context-dependent attackers to cause a denial of service (application crash) via certain flags arguments, as demonstrated by (a) GLOB_ALTDIRFUNC and (b) GLOB_APPEND.