VYPR

CVEs

346,392 total · page 5989 of 6,928

AllCriticalHighKEV
  • CVE-2011-0257Aug 15, 2011
    Apple Inc.
    Quicktime
    risk 0.08cvss —epss 0.60

    Integer signedness error in Apple QuickTime before 7.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PnSize opcode in a PICT file that triggers a stack-based buffer overflow.

  • CVE-2011-0256Aug 15, 2011
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.04

    Integer overflow in Apple QuickTime before 7.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted track run atoms in a QuickTime movie file.

  • CVE-2011-3011Aug 15, 2011
    Ca
    Arcserve D2d
    risk 0.09cvss —epss 0.72

    BaseServiceImpl.class in CA ARCserve D2D r15 does not properly handle sessions, which allows remote attackers to obtain credentials, and consequently execute arbitrary commands, via unspecified vectors.

  • CVE-2011-2907Aug 15, 2011
    Terascale
    TORQUE Resource Manager
    risk 0.00cvss —epss 0.03

    Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 3.0.1 and earlier allows remote attackers to bypass host-based authentication and submit arbitrary jobs via a modified PBS_O_HOST variable to the qsub program.

  • CVE-2011-0551Aug 15, 2011
    Symantec
    Endpoint Protection
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Web Interface in the Endpoint Protection Manager in Symantec Endpoint Protection (SEP) 11.0.600x through 11.0.6300 allows remote attackers to hijack the authentication of administrators for requests that create…

  • CVE-2011-0550Aug 15, 2011
    Symantec
    Endpoint Protection
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Web Interface in the Endpoint Protection Manager in Symantec Endpoint Protection (SEP) 11.0.600x through 11.0.6300 allow remote attackers to inject arbitrary web script or HTML via (1) the token parameter to…

  • CVE-2011-0527Aug 15, 2011
    VMware
    Tc Server
    risk 0.00cvss —epss 0.02

    VMware vFabric tc Server (aka SpringSource tc Server) 2.0.x before 2.0.6.RELEASE and 2.1.x before 2.1.2.RELEASE accepts obfuscated passwords during JMX authentication, which makes it easier for context-dependent attackers to obtain access by leveraging an ability to read stored…

  • CVE-2011-2357Aug 12, 2011
    Google
    Android
    risk 0.03cvss —epss 0.05

    Cross-application scripting vulnerability in the Browser URL loading functionality in Android 2.3.4 and 3.1 allows local applications to bypass the sandbox and execute arbitrary Javascript in arbitrary domains by (1) causing the MAX_TAB number of tabs to be opened, then loading…

  • CVE-2011-1898Aug 12, 2011
    Xen
    Xen
    risk 0.00cvss —epss 0.01

    Xen 4.1 before 4.1.1 and 4.0 before 4.0.2, when using PCI passthrough on Intel VT-d chipsets that do not have interrupt remapping, allows guest OS users to gain host OS privileges by "using DMA to generate MSI interrupts by writing to the interrupt injection registers."

  • CVE-2011-1583Aug 12, 2011
    Xen
    Xen
    risk 0.00cvss —epss 0.01

    Multiple integer overflows in tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allow local users to cause a denial of service and possibly execute arbitrary code via a crafted paravirtualised guest kernel image that triggers (1) a buffer overflow during a…

  • CVE-2011-3138Aug 12, 2011
    IBM
    Tivoli Federated Identity Manager
    risk 0.00cvss —epss 0.02

    The LTPA STS module support implementation in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.9 relies on a static instance of a Java Development Kit (JDK) class, which might…

  • CVE-2011-3137Aug 12, 2011
    IBM
    Tivoli Federated Identity Manager
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Management Console in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.9 has unknown impact and attack vectors, aka APAR IV03050.

  • CVE-2011-3136Aug 12, 2011
    IBM
    Tivoli Federated Identity Manager
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Management Console in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.9 has unknown impact and attack vectors, aka APAR IV03048.

  • CVE-2011-3135Aug 12, 2011
    IBM
    Tivoli Federated Identity Manager
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Runtime in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.9 has unknown impact and attack vectors.

  • CVE-2009-5085Aug 12, 2011
    IBM
    Tivoli Federated Identity Manager
    risk 0.00cvss —epss 0.01

    IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2, when configured as an OpenID provider, does not delete the site information cookie in response to a user's deletion of a relying-party trust entry, which allows user-assisted remote attackers to bypass intended…

  • CVE-2009-5084Aug 12, 2011
    IBM
    Tivoli Federated Identity Manager
    risk 0.00cvss —epss 0.00

    IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2, when com.tivoli.am.fim.infocard.delegates.InfoCardSTSDelegate tracing is enabled, creates a cleartext log entry containing a password, which might allow local users to obtain sensitive information by reading the…

  • CVE-2009-5083Aug 12, 2011
    IBM
    Tivoli Federated Identity Manager
    risk 0.00cvss —epss 0.01

    IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2, when configured as an OpenID relying party, does not perform the expected login rejection upon receiving an OP-Identifier from an OpenID provider, which allows remote attackers to bypass authentication via…

  • CVE-2008-7299Aug 12, 2011
    IBM
    Tivoli Federated Identity Manager
    risk 0.00cvss —epss 0.01

    IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2 uses an incomplete SAML 1.x browser-artifact, which allows remote OpenID providers to spoof assertions via vectors related to the Issuer field.

  • CVE-2011-2423Aug 11, 2011
    Adobe Inc.
    Shockwave Player
    risk 0.01cvss —epss 0.06

    msvcr90.dll in Adobe Shockwave Player before 11.6.1.629 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

  • CVE-2011-2422Aug 11, 2011
    Adobe Inc.
    Shockwave Player
    risk 0.00cvss —epss 0.05

    Textra.x32 in Adobe Shockwave Player before 11.6.1.629 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

  • CVE-2011-2421Aug 11, 2011
    Adobe Inc.
    Shockwave Player
    risk 0.00cvss —epss 0.04

    Dirapi.dll in Adobe Shockwave Player before 11.6.1.629 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .dir media file.

  • CVE-2011-2420Aug 11, 2011
    Adobe Inc.
    Shockwave Player
    risk 0.00cvss —epss 0.05

    Adobe Shockwave Player before 11.6.1.629 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

  • CVE-2011-2419Aug 11, 2011
    Adobe Inc.
    Shockwave Player
    risk 0.00cvss —epss 0.05

    IML32.dll in Adobe Shockwave Player before 11.6.1.629 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

  • CVE-2011-2409Aug 11, 2011
    Microfocus
    Palm webOS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Calendar application in HP Palm webOS 3.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-2408Aug 11, 2011
    Microfocus
    Palm webOS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Contacts application in HP Palm webOS 3.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-2407Aug 11, 2011
    Microfocus
    Performance Insight
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in HP OpenView Performance Insight 5.3, 5.31, 5.4, 5.41, 5.41.001, and 5.41.002 allows remote attackers to obtain access via unknown vectors.

  • CVE-2011-2406Aug 11, 2011
    Microfocus
    Performance Insight
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in HP OpenView Performance Insight 5.3, 5.31, 5.4, 5.41, 5.41.001, and 5.41.002 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-2405Aug 11, 2011
    Microfocus
    ProLiant SL Advanced Power Manager
    risk 0.00cvss —epss 0.02

    The HP ProLiant SL Advanced Power Manager (SL-APM) with firmware before 1.20 does not properly validate users, which allows remote attackers to cause a denial of service via unspecified vectors.

  • CVE-2011-2404Aug 11, 2011
    Microfocus
    Easy Printer Care Software
    risk 0.09cvss —epss 0.74

    A certain ActiveX control in HPTicketMgr.dll in HP Easy Printer Care Software 2.5 and earlier allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via unspecified vectors, a different vulnerability than CVE-2011-4786 and…

  • CVE-2011-2133Aug 11, 2011
    Adobe Inc.
    Robohelp
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Adobe RoboHelp 8 and 9 before 9.0.1.262, and RoboHelp Server 8 and 9, allows remote attackers to inject arbitrary web script or HTML via the URI, related to template_stock/whutils.js.

  • CVE-2011-2132Aug 11, 2011
    Adobe Inc.
    Flash Media Server
    risk 0.04cvss —epss 0.08

    Adobe Flash Media Server (FMS) before 3.5.7, and 4.x before 4.0.3, allows attackers to cause a denial of service (memory corruption) via unspecified vectors.

  • CVE-2011-2131Aug 11, 2011
    Adobe Inc.
    Creative Suite
    risk 0.05cvss —epss 0.22

    Adobe Photoshop 12.0 in Creative Suite 5 (CS5) and 12.1 in Creative Suite 5.1 (CS5.1) allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted GIF file.

  • CVE-2011-1357Aug 11, 2011
    IBM
    Websphere Service Registry And Repository
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in agentDetect.jsp in the web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3 before 6.3.0.5, 7.0 before 7.0.0.5, and 7.5 before 7.5.0.1 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP…

  • CVE-2010-4309Aug 11, 2011
    Adobe Inc.
    Shockwave Player
    risk 0.00cvss —epss 0.04

    Adobe Shockwave Player before 11.6.1.629 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-4308.

  • CVE-2010-4308Aug 11, 2011
    Adobe Inc.
    Shockwave Player
    risk 0.00cvss —epss 0.04

    Adobe Shockwave Player before 11.6.1.629 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-4309.

  • CVE-2011-2425Aug 10, 2011
    Adobe Inc.
    Air
    risk 0.01cvss —epss 0.08

    Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory…

  • CVE-2011-2417Aug 10, 2011
    Adobe Inc.
    Air
    risk 0.01cvss —epss 0.08

    Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory…

  • CVE-2011-2416Aug 10, 2011
    Adobe Inc.
    Air
    risk 0.01cvss —epss 0.10

    Integer overflow in Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android, allows attackers to execute arbitrary code via unspecified…

  • CVE-2011-2415Aug 10, 2011
    Adobe Inc.
    Air
    risk 0.01cvss —epss 0.12

    Buffer overflow in Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android, allows attackers to execute arbitrary code via unspecified…

  • CVE-2011-2414Aug 10, 2011
    Adobe Inc.
    Air
    risk 0.01cvss —epss 0.12

    Buffer overflow in Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android, allows attackers to execute arbitrary code via unspecified…

  • CVE-2011-2140Aug 10, 2011
    Adobe Inc.
    Air
    risk 0.10cvss —epss 0.82

    Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory…

  • CVE-2011-2139Aug 10, 2011
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.05

    Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android, allows remote attackers to bypass the Same Origin Policy and obtain sensitive…

  • CVE-2011-2138Aug 10, 2011
    Adobe Inc.
    Air
    risk 0.01cvss —epss 0.10

    Integer overflow in Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android, allows attackers to execute arbitrary code via unspecified…

  • CVE-2011-2136Aug 10, 2011
    Adobe Inc.
    Air
    risk 0.01cvss —epss 0.10

    Integer overflow in Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android, allows attackers to execute arbitrary code via unspecified…

  • CVE-2011-2135Aug 10, 2011
    Adobe Inc.
    Air
    risk 0.01cvss —epss 0.08

    Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory…

  • CVE-2011-3130Aug 10, 2011
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    wp-includes/taxonomy.php in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Taxonomy query hardening," possibly involving SQL injection.

  • CVE-2011-3129Aug 10, 2011
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    The file upload functionality in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2, when running "on hosts with dangerous security settings," has unknown impact and attack vectors, possibly related to dangerous filenames.

  • CVE-2011-3128Aug 10, 2011
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 treats unattached attachments as published, which might allow remote attackers to obtain sensitive data via vectors related to wp-includes/post.php.

  • CVE-2011-3127Aug 10, 2011
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 does not prevent rendering for (1) admin or (2) login pages inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.

  • CVE-2011-3126Aug 10, 2011
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 allows remote attackers to determine usernames of non-authors via canonical redirects.