VYPR

CVEs

346,392 total · page 5990 of 6,928

AllCriticalHighKEV
  • CVE-2011-3125Aug 10, 2011
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Various security hardening."

  • CVE-2011-2137Aug 10, 2011
    Adobe Inc.
    Air
    risk 0.01cvss —epss 0.12

    Buffer overflow in Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android, allows attackers to execute arbitrary code via unspecified…

  • CVE-2011-2134Aug 10, 2011
    Adobe Inc.
    Air
    risk 0.01cvss —epss 0.12

    Buffer overflow in Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android, allows attackers to execute arbitrary code via unspecified…

  • CVE-2011-2130Aug 10, 2011
    Adobe Inc.
    Air
    risk 0.01cvss —epss 0.12

    Buffer overflow in Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android, allows attackers to execute arbitrary code via unspecified…

  • CVE-2011-1979Aug 10, 2011
    Microsoft
    Visio
    risk 0.02cvss —epss 0.22

    Microsoft Visio 2003 SP3 and 2007 SP2 does not properly validate objects in memory during Visio file parsing, which allows remote attackers to execute arbitrary code via a crafted file, aka "Move Around the Block RCE Vulnerability."

  • CVE-2011-1978Aug 10, 2011
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.20

    Microsoft .NET Framework 2.0 SP2, 3.5.1, and 4 does not properly validate the System.Net.Sockets trust level, which allows remote attackers to obtain sensitive information or trigger arbitrary outbound network traffic via (1) a crafted XAML browser application (aka XBAP), (2) a…

  • CVE-2011-1977Aug 10, 2011
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.21

    The ASP.NET Chart controls in Microsoft .NET Framework 4, and Chart Control for Microsoft .NET Framework 3.5 SP1, do not properly verify functions in URIs, which allows remote attackers to read arbitrary files via special characters in a URI in an HTTP request, aka "Chart…

  • CVE-2011-1976Aug 10, 2011
    Microsoft
    Visual Studio
    risk 0.05cvss —epss 0.21

    Cross-site scripting (XSS) vulnerability in the Report Viewer Control in Microsoft Visual Studio 2005 SP1 and Report Viewer 2005 SP1 allows remote attackers to inject arbitrary web script or HTML via a parameter in a data source, aka "Report Viewer Controls XSS Vulnerability."

  • CVE-2011-1975Aug 10, 2011
    Microsoft
    Windows Server 2008
    risk 0.03cvss —epss 0.43

    Untrusted search path vulnerability in the Data Access Tracing component in Windows Data Access Components (Windows DAC) 6.0 in Microsoft Windows 7 Gold and SP1 and Windows Server 2008 R2 and R2 SP1 allows local users to gain privileges via a Trojan horse DLL in the current…

  • CVE-2011-1974Aug 10, 2011
    Microsoft
    Windows Xp
    risk 0.04cvss —epss 0.07

    NDISTAPI.sys in the NDISTAPI driver in Remote Access Service (RAS) in Microsoft Windows XP SP2 and SP3 and Windows Server 2003 SP2 does not properly validate user-mode input, which allows local users to gain privileges via a crafted application, aka "NDISTAPI Elevation of…

  • CVE-2011-1972Aug 10, 2011
    Microsoft
    Visio
    risk 0.02cvss —epss 0.22

    Microsoft Visio 2003 SP3, 2007 SP2, and 2010 Gold and SP1 does not properly validate objects in memory during Visio file parsing, which allows remote attackers to execute arbitrary code via a crafted file, aka "pStream Release RCE Vulnerability."

  • CVE-2011-1971Aug 10, 2011
    Microsoft
    Windows
    risk 0.00cvss —epss 0.03

    The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly parse file metadata, which allows local users to cause a denial of service (reboot) via a crafted file, aka "Windows Kernel Metadata Parsing DOS…

  • CVE-2011-1970Aug 10, 2011
    Microsoft
    Windows Server 2003
    risk 0.02cvss —epss 0.23

    The DNS server in Microsoft Windows Server 2003 SP2 and Windows Server 2008 SP2, R2, and R2 SP1 does not properly initialize memory, which allows remote attackers to cause a denial of service (service outage) via a query for a nonexistent domain, aka "DNS Uninitialized Memory…

  • CVE-2011-1968Aug 10, 2011
    Microsoft
    Windows Xp
    risk 0.02cvss —epss 0.26

    The Remote Desktop Protocol (RDP) implementation in Microsoft Windows XP SP2 and SP3 and Windows Server 2003 SP2 does not properly process packets in memory, which allows remote attackers to cause a denial of service (reboot) by sending crafted RDP packets triggering access to…

  • CVE-2011-1967Aug 10, 2011
    Microsoft
    Windows
    risk 0.00cvss —epss 0.02

    Winsrv.dll in the Client/Server Run-time Subsystem (aka CSRSS) in the Win32 subsystem in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly check permissions for…

  • CVE-2011-1966Aug 10, 2011
    Microsoft
    Windows Server 2008
    risk 0.04cvss —epss 0.55

    The DNS server in Microsoft Windows Server 2008 SP2, R2, and R2 SP1 does not properly handle NAPTR queries that trigger recursive processing, which allows remote attackers to execute arbitrary code via a crafted query, aka "DNS NAPTR Query Vulnerability."

  • CVE-2011-1965Aug 10, 2011
    Microsoft
    Windows Server 2008
    risk 0.05cvss —epss 0.25

    Tcpip.sys in the TCP/IP stack in Microsoft Windows 7 Gold and SP1 and Windows Server 2008 R2 and R2 SP1 does not properly implement URL-based QoS, which allows remote attackers to cause a denial of service (reboot) via a crafted URL to a web server, aka "TCP/IP QOS Denial of…

  • CVE-2011-1964Aug 10, 2011
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.23

    Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka "Style Object Memory Corruption Vulnerability."

  • CVE-2011-1963Aug 10, 2011
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.23

    Microsoft Internet Explorer 7 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka "XSLT Memory Corruption Vulnerability."

  • CVE-2011-1962Aug 10, 2011
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.13

    Microsoft Internet Explorer 6 through 9 does not properly handle unspecified character sequences, which allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site that triggers "inactive filtering," aka "Shift JIS Character Encoding…

  • CVE-2011-1961Aug 10, 2011
    Microsoft
    Internet Explorer
    risk 0.03cvss —epss 0.34

    The telnet URI handler in Microsoft Internet Explorer 6 through 9 does not properly launch the handler application, which allows remote attackers to execute arbitrary programs via a crafted web site, aka "Telnet Handler Remote Code Execution Vulnerability."

  • CVE-2011-1960Aug 10, 2011
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.18

    Microsoft Internet Explorer 6 through 9 does not properly implement JavaScript event handlers, which allows remote attackers to access content from a different (1) domain or (2) zone via unspecified script code, aka "Event Handlers Information Disclosure Vulnerability."

  • CVE-2011-1871Aug 10, 2011
    Microsoft
    Windows
    risk 0.03cvss —epss 0.38

    Tcpip.sys in the TCP/IP stack in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to cause a denial of service (reboot) via a series of crafted ICMP messages, aka "ICMP Denial of Service Vulnerability."

  • CVE-2011-1263Aug 10, 2011
    Microsoft
    Windows Server 2008
    risk 0.01cvss —epss 0.15

    Cross-site scripting (XSS) vulnerability in the logon page in Remote Desktop Web Access (RD Web Access) in Microsoft Windows Server 2008 R2 and R2 SP1 allows remote attackers to inject arbitrary web script or HTML via the URI, aka "Remote Desktop Web Access Vulnerability."

  • CVE-2011-1257Aug 10, 2011
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.15

    Race condition in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors involving access to an object, aka "Window Open Race Condition Vulnerability."

  • CVE-2011-3124Aug 10, 2011
    IBM
    Infosphere Information Server
    risk 0.00cvss —epss 0.00

    IBM InfoSphere Information Server 8.5 and 8.5.0.1 on Unix and Linux, as used in IBM InfoSphere DataStage 8.5 and 8.5.0.1 and other products, assigns incorrect ownership to unspecified files, which allows local users to gain privileges via unknown vectors.

  • CVE-2011-3123Aug 10, 2011
    IBM
    Infosphere Information Server
    risk 0.00cvss —epss 0.00

    IBM InfoSphere Information Server 8.5 and 8.5.0.1 on Unix and Linux, as used in IBM InfoSphere DataStage 8.5 and 8.5.0.1 and other products, uses weak permissions for unspecified files, which allows local users to gain privileges via unknown vectors.

  • CVE-2011-3122Aug 10, 2011
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Media security."

  • CVE-2011-3007Aug 10, 2011
    McAfee
    SaaS Endpoint Protection
    risk 0.00cvss —epss 0.01

    The myCIOScn ActiveX control (myCIOScn.dll) in McAfee SaaS Endpoint Protection 5.2.1 and earlier allows remote attackers to write to arbitrary files by specifying an arbitrary filename in the MyCioScan.Scan.ReportFile parameter, as demonstrated by injecting script into a log…

  • CVE-2011-3006Aug 10, 2011
    McAfee
    SaaS Endpoint Protection
    risk 0.00cvss —epss 0.02

    The MyAsUtil ActiveX control in MyAsUtil5.2.0.603.dll in McAfee SaaS Endpoint Protection 5.2.1 and earlier allows remote attackers to bypass the MyASUtil.SecureObjectFactory.CreateSecureObject domain execution policy using a cross-site scripting (XSS) attack, execute arbitrary…

  • CVE-2011-2511Aug 10, 2011
    Libvirt
    Libvirt
    risk 0.00cvss —epss 0.04

    Integer overflow in libvirt before 0.9.3 allows remote authenticated users to cause a denial of service (libvirtd crash) and possibly execute arbitrary code via a crafted VirDomainGetVcpus RPC call that triggers memory corruption.

  • CVE-2011-2178Aug 10, 2011
    Libvirt
    Libvirt
    risk 0.00cvss —epss 0.00

    The virSecurityManagerGetPrivateData function in security/security_manager.c in libvirt 0.8.8 through 0.9.1 uses the wrong argument for a sizeof call, which causes incorrect processing of "security manager private data" that "reopens disk probing" and might allow guest OS users…

  • CVE-2011-3014Aug 9, 2011
    Novell
    Data Synchronizer
    risk 0.00cvss —epss 0.01

    The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 does not properly restrict caching of HTTPS responses, which makes it easier for remote attackers to obtain sensitive information by leveraging an unattended workstation.

  • CVE-2011-3013Aug 9, 2011
    Novell
    Data Synchronizer
    risk 0.00cvss —epss 0.01

    WebAdmin in the Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 supports weak SSL ciphers, which makes it easier for remote attackers to obtain access via a brute-force attack.

  • CVE-2011-2590Aug 9, 2011
    Uusee
    Uusee
    risk 0.00cvss —epss 0.02

    The Play method in the UUPlayer ActiveX control 6.0.0.1 in UUSee 2010 6.11.0609.2 allows remote attackers to execute arbitrary programs via a UNC share pathname in the MPlayerPath parameter.

  • CVE-2011-2589Aug 9, 2011
    Uusee
    Uusee
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in the SendLogAction method in the UUPlayer ActiveX control 6.0.0.1 in UUSee 2010 6.11.0609.2 might allow remote attackers to execute arbitrary code via a long argument.

  • CVE-2011-2224Aug 9, 2011
    Novell
    Data Synchronizer
    risk 0.00cvss —epss 0.01

    The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

  • CVE-2011-2223Aug 9, 2011
    Novell
    Data Synchronizer
    risk 0.00cvss —epss 0.01

    The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 sends the Admin LDAP password in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.

  • CVE-2011-2222Aug 9, 2011
    Novell
    Data Synchronizer
    risk 0.00cvss —epss 0.01

    Session fixation vulnerability in WebAdmin in the Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 allows remote attackers to hijack web sessions via unspecified vectors.

  • CVE-2011-2221Aug 9, 2011
    Novell
    Data Synchronizer
    risk 0.00cvss —epss 0.01

    The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 allows remote attackers to bypass WebAdmin authentication and obtain sensitive GroupWise information via unspecified vectors.

  • CVE-2011-3012Aug 9, 2011
    Ioquake3
    Ioquake3 Engine
    risk 0.01cvss —epss 0.08

    The ioQuake3 engine, as used in World of Padman 1.2 and earlier, Tremulous 1.1.0, and ioUrbanTerror 2007-12-20, does not check for dangerous file extensions before writing to the quake3 directory, which allows remote attackers to execute arbitrary code via a crafted third-party…

  • CVE-2011-2979Aug 9, 2011
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    Bugzilla 4.1.x before 4.1.3 generates different responses for certain assignee queries depending on whether the group name is valid, which allows remote attackers to determine the existence of private group names via a custom search. NOTE: this vulnerability exists because of a…

  • CVE-2011-2978Aug 9, 2011
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    Bugzilla 2.16rc1 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 does not prevent changes to the confirmation e-mail address (aka old_email field) for e-mail change notifications, which makes…

  • CVE-2011-2977Aug 9, 2011
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.00

    Bugzilla 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 on Windows does not delete the temporary files associated with uploaded attachments, which allows local users to obtain sensitive information by reading these files. NOTE: this issue exists because…

  • CVE-2011-2976Aug 9, 2011
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Bugzilla 2.16rc1 through 2.22.7, 3.0.x through 3.3.x, and 3.4.x before 3.4.12 allows remote attackers to inject arbitrary web script or HTML via vectors involving a BUGLIST cookie.

  • CVE-2011-2381Aug 9, 2011
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    CRLF injection vulnerability in Bugzilla 2.17.1 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 allows remote attackers to inject arbitrary e-mail headers via an attachment description in a…

  • CVE-2011-2380Aug 9, 2011
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    Bugzilla 2.23.3 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 allows remote attackers to determine the existence of private group names via a crafted parameter during (1) bug creation or (2)…

  • CVE-2011-2379Aug 9, 2011
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Bugzilla 2.4 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3, when Internet Explorer before 9 or Safari before 5.0.6 is used for Raw Unified mode,…

  • CVE-2008-7298Aug 9, 2011
    Google
    Android
    risk 0.00cvss —epss 0.01

    The Android browser in Android cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict…

  • CVE-2008-7297Aug 9, 2011
    Opera
    Opera
    risk 0.00cvss —epss 0.01

    Opera cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS)…