VYPR

CVEs

346,392 total · page 5992 of 6,928

AllCriticalHighKEV
  • CVE-2011-2782Aug 3, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    The drag-and-drop implementation in Google Chrome before 13.0.782.107 on Linux does not properly enforce permissions for files, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors.

  • CVE-2011-2711Aug 3, 2011
    Cgit
    cgit
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the print_fileinfo function in ui-diff.c in cgit 0.9.0.2 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the filename associated with the rename hint.

  • CVE-2011-2361Aug 3, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    The Basic Authentication dialog implementation in Google Chrome before 13.0.782.107 does not properly handle strings, which might make it easier for remote attackers to capture credentials via a crafted web site.

  • CVE-2011-2360Aug 3, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 13.0.782.107 does not ensure that the user is prompted before download of a dangerous file, which makes it easier for remote attackers to bypass intended content restrictions via a crafted web site.

  • CVE-2011-2359Aug 3, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 13.0.782.107 does not properly track line boxes during rendering, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

  • CVE-2011-2358Aug 3, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 13.0.782.107 does not ensure that extension installations are confirmed by a browser dialog, which makes it easier for remote attackers to modify the product's functionality via a Trojan horse extension.

  • CVE-2011-2975Aug 1, 2011
    MapServer
    Mapserver
    risk 0.03cvss —epss 0.05

    Double free vulnerability in the msAddImageSymbol function in mapsymbol.c in MapServer before 6.0.1 might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact via crafted mapfile data.

  • CVE-2011-2719Aug 1, 2011
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.02

    libraries/auth/swekey/swekey.auth.lib.php in phpMyAdmin 3.x before 3.3.10.3 and 3.4.x before 3.4.3.2 does not properly manage sessions associated with Swekey authentication, which allows remote attackers to modify the SESSION superglobal array, other superglobal arrays, and…

  • CVE-2011-2718Aug 1, 2011
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.02

    Multiple directory traversal vulnerabilities in the relational schema implementation in phpMyAdmin 3.4.x before 3.4.3.2 allow remote authenticated users to include and execute arbitrary local files via directory traversal sequences in an export type field, related to (1)…

  • CVE-2011-2704Aug 1, 2011
    MapServer
    Mapserver
    risk 0.00cvss —epss 0.05

    Stack-based buffer overflow in MapServer before 4.10.7 and 5.x before 5.6.7 allows remote attackers to execute arbitrary code via vectors related to OGC filter encoding.

  • CVE-2011-2703Aug 1, 2011
    MapServer
    Mapserver
    risk 0.00cvss —epss 0.03

    Multiple SQL injection vulnerabilities in MapServer before 4.10.7, 5.x before 5.6.7, and 6.x before 6.0.1 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) OGC filter encoding or (2) WMS time support.

  • CVE-2011-2643Aug 1, 2011
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in sql.php in phpMyAdmin 3.4.x before 3.4.3.2, when configuration storage is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in a MIME-type transformation parameter.

  • CVE-2011-2642Aug 1, 2011
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the table Print view implementation in tbl_printview.php in phpMyAdmin before 3.3.10.3 and 3.4.x before 3.4.3.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name.

  • CVE-2011-2403Aug 1, 2011
    Microfocus
    Network Automation
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in HP Network Automation 7.2x, 7.5x, 7.6x, 9.0, and 9.10 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2011-2402Aug 1, 2011
    Microfocus
    Network Automation
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in HP Network Automation 7.2x, 7.5x, 7.6x, 9.0, and 9.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-2399Aug 1, 2011
    Microfocus
    Storage Data Protector
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in the Media Management Daemon (mmd) in HP Data Protector 6.11 and earlier allows remote attackers to cause a denial of service via unknown vectors.

  • CVE-2011-1744Aug 1, 2011
    EMC Corporation
    Captiva Einput
    risk 0.00cvss —epss 0.01

    EMC Captiva eInput 2.1.1 before 2.1.1.37 does not restrict the origin of calls to ActiveX functions, which allows remote attackers to read arbitrary files or cause a denial of service via a crafted web site.

  • CVE-2011-1743Aug 1, 2011
    EMC Corporation
    Captiva Einput
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in EMC Captiva eInput 2.1.1 before 2.1.1.37 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-1742Aug 1, 2011
    EMC Corporation
    Data Protection Advisor
    risk 0.00cvss —epss 0.00

    EMC Data Protection Advisor before 5.8.1 places cleartext account credentials in the DPA configuration file in unspecified circumstances, which might allow local users to obtain sensitive information by reading this file.

  • CVE-2011-2964Jul 29, 2011
    Foomatic
    foomatic-filters
    risk 0.00cvss —epss 0.05

    foomaticrip.c in foomatic-rip in foomatic-filters in Foomatic 4.0.6 allows remote attackers to execute arbitrary code via a crafted *FoomaticRIPCommandLine field in a .ppd file, a different vulnerability than CVE-2011-2697.

  • CVE-2011-2697Jul 29, 2011
    Microfocus
    Hplip
    risk 0.01cvss —epss 0.11

    foomatic-rip-hplip in HP Linux Imaging and Printing (HPLIP) 3.11.5 allows remote attackers to execute arbitrary code via a crafted *FoomaticRIPCommandLine field in a .ppd file.

  • CVE-2011-2694Jul 29, 2011
    Samba (software)
    Samba
    risk 0.01cvss —epss 0.06

    Cross-site scripting (XSS) vulnerability in the chg_passwd function in web/swat.c in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd…

  • CVE-2011-2522Jul 29, 2011
    Samba (software)
    Samba
    risk 0.04cvss —epss 0.10

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allow remote attackers to hijack the authentication of administrators for requests that (1) shut down daemons, (2) start daemons, (3) add shares, (4)…

  • CVE-2011-2401Jul 29, 2011
    Microfocus
    Sitescope
    risk 0.00cvss —epss 0.04

    Session fixation vulnerability in HP SiteScope 9.x, 10.x, and 11.x allows remote attackers to hijack web sessions via unspecified vectors.

  • CVE-2011-2400Jul 29, 2011
    Microfocus
    Sitescope
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in HP SiteScope 9.x, 10.x, and 11.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-2963Jul 29, 2011
    Progea
    Movicon
    risk 0.04cvss —epss 0.08

    TCPUploadServer.exe in Progea Movicon 11.2 before Build 1084 does not require authentication for critical functions, which allows remote attackers to obtain sensitive information, delete files, execute arbitrary programs, or cause a denial of service (crash) via a crafted packet…

  • CVE-2011-2962Jul 29, 2011
    Invensys
    Wonderware Information Server
    risk 0.00cvss —epss 0.05

    Multiple stack-based buffer overflows in Invensys Wonderware Information Server 3.1, 4.0, and 4.0 SP1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via two unspecified ActiveX controls.

  • CVE-2011-2961Jul 29, 2011
    Sunwayland
    Pnetpower
    risk 0.01cvss —epss 0.06

    Heap-based buffer overflow in AngelServer.exe 6.0.11.3 in Sunway pNetPower allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted UDP packet.

  • CVE-2011-2960Jul 29, 2011
    Sunwayland
    Forcecontrol
    risk 0.04cvss —epss 0.18

    Heap-based buffer overflow in httpsvr.exe 6.0.5.3 in Sunway ForceControl 6.1 SP1, SP2, and SP3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted URL.

  • CVE-2011-2959Jul 29, 2011
    7-Technologies
    Interactive Graphical SCADA System (IGSS)
    risk 0.01cvss —epss 0.07

    Stack-based buffer overflow in the Open Database Connectivity (ODBC) service (Odbcixv9se.exe) in 7-Technologies Interactive Graphical SCADA System (IGSS) 9 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted…

  • CVE-2011-2695Jul 28, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Multiple off-by-one errors in the ext4 subsystem in the Linux kernel before 3.0-rc5 allow local users to cause a denial of service (BUG_ON and system crash) by accessing a sparse file in extent format with a write operation involving a block number corresponding to the largest…

  • CVE-2011-2689Jul 28, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The gfs2_fallocate function in fs/gfs2/file.c in the Linux kernel before 3.0-rc1 does not ensure that the size of a chunk allocation is a multiple of the block size, which allows local users to cause a denial of service (BUG and system crash) by arranging for all resource groups…

  • CVE-2011-2667Jul 28, 2011
    Ca
    Gateway Security
    risk 0.01cvss —epss 0.16

    Icihttp.exe in CA Gateway Security for HTTP, as used in CA Gateway Security 8.1 before 8.1.0.69 and CA Total Defense r12, does not properly parse URLs, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and daemon crash)…

  • CVE-2011-2549Jul 28, 2011
    Cisco Systems, Inc.
    iOS Xr
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Cisco IOS XR 4.1.x before 4.1.1 on Cisco Aggregation Services Routers (ASR) 9000 series devices allows remote attackers to cause a denial of service (line-card reload) via an IPv4 packet, aka Bug ID CSCtr26695.

  • CVE-2011-2547Jul 28, 2011
    Cisco Systems, Inc.
    SA 500 series
    risk 0.00cvss —epss 0.02

    The web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote authenticated users to execute arbitrary commands via crafted parameters to web forms, aka Bug ID CSCtq65681.

  • CVE-2011-2546Jul 28, 2011
    Cisco Systems, Inc.
    Sa500 Software
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCtq65669.

  • CVE-2011-2492Jul 28, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The bluetooth subsystem in the Linux kernel before 3.0-rc4 does not properly initialize certain data structures, which allows local users to obtain potentially sensitive information from kernel memory via a crafted getsockopt system call, related to (1) the…

  • CVE-2011-2958Jul 28, 2011
    Ecava
    Integraxor
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Ecava IntegraXor before 3.60 (Build 4080) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-2957Jul 28, 2011
    Rockwellautomation
    Factorytalk Diagnostics Viewer
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Rockwell Automation FactoryTalk Diagnostics Viewer before V2.30.00 (CPR9 SR3) allows local users to execute arbitrary code via a crafted FactoryTalk Diagnostics Viewer (.ftd) configuration file, which triggers memory corruption.

  • CVE-2011-2956Jul 28, 2011
    Azeotech
    Daqfactory
    risk 0.04cvss —epss 0.07

    AzeoTech DAQFactory before 5.85 (Build 1842) does not perform authentication for certain signals, which allows remote attackers to cause a denial of service (system reboot or shutdown) via a signal.

  • CVE-2011-2747Jul 28, 2011
    Google
    Picasa
    risk 0.00cvss —epss 0.04

    Google Picasa before 3.6 Build 105.67 does not properly handle invalid properties in JPEG images, which allows remote attackers to execute arbitrary code via a crafted image file.

  • CVE-2011-2688Jul 28, 2011
    Apache
    mod_authnz_external
    risk 0.00cvss —epss 0.06

    SQL injection vulnerability in mysql/mysql-auth.pl in the mod_authnz_external module 3.2.5 and earlier for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the user field.

  • CVE-2011-1339Jul 28, 2011
    Google
    Search Appliance
    risk 0.00cvss —epss 0.00

    Cross-site scripting (XSS) vulnerability in Google Search Appliance before 5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-2893Jul 27, 2011
    IBM
    Lotus Symphony
    risk 0.00cvss —epss 0.01

    The DataPilot feature in IBM Lotus Symphony 3 before FP3 allows user-assisted remote attackers to cause a denial of service (application crash) via a large .xls spreadsheet with an invalid Value reference.

  • CVE-2011-2892Jul 27, 2011
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.01

    Joomla! 1.6.x before 1.6.2 does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.

  • CVE-2011-2891Jul 27, 2011
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.01

    Joomla! 1.6.x before 1.6.2 allows remote attackers to obtain sensitive information via an empty Itemid array parameter to index.php, which reveals the installation path in an error message, a different vulnerability than CVE-2011-2488.

  • CVE-2011-2890Jul 27, 2011
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.01

    The MediaViewMedia class in administrator/components/com_media/views/media/view.html.php in Joomla! 1.5.23 and earlier allows remote attackers to obtain sensitive information via vectors involving the base variable, leading to disclosure of the installation path, a different…

  • CVE-2011-2889Jul 27, 2011
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.01

    templates/system/error.php in Joomla! before 1.5.23 might allow remote attackers to obtain sensitive information via unspecified vectors that trigger an undefined value of a certain error field, leading to disclosure of the installation path. NOTE: this might overlap…

  • CVE-2011-2888Jul 27, 2011
    IBM
    Lotus Symphony
    risk 0.00cvss —epss 0.02

    IBM Lotus Symphony 3 before FP3 allows remote attackers to cause a denial of service (application hang) via complex graphics in a presentation.

  • CVE-2011-2887Jul 27, 2011
    IBM
    Lotus Symphony
    risk 0.00cvss —epss 0.02

    IBM Lotus Symphony 3 before FP3 on Linux allows remote attackers to cause a denial of service (application crash) via a certain sample document.