VYPR

CVEs

346,392 total · page 5997 of 6,928

AllCriticalHighKEV
  • CVE-2011-2516Jul 11, 2011
    Shibboleth Project
    Shibboleth
    risk 0.01cvss —epss 0.08

    Off-by-one error in the XML signature feature in Apache XML Security for C++ 1.6.0, as used in Shibboleth before 2.4.3 and possibly other products, allows remote attackers to cause a denial of service (crash) via a signature using a large RSA key, which triggers a buffer…

  • CVE-2011-2398Jul 11, 2011
    Microfocus
    Hpux
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the dynamic loader in HP HP-UX B.11.11, B.11.23, and B.11.31 allows local users to gain privileges or cause a denial of service via unknown vectors.

  • CVE-2011-2064Jul 11, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Cisco IOS 12.4MDA before 12.4(24)MDA5 on the Cisco Content Services Gateway - Second Generation (CSG2) allows remote attackers to cause a denial of service (device reload) via crafted ICMP packets, aka Bug ID CSCtl79577.

  • CVE-2011-1951Jul 11, 2011
    Oneidentity
    Syslog Ng
    risk 0.00cvss —epss 0.02

    lib/logmatcher.c in Balabit syslog-ng before 3.2.4, when the global flag is set and when using PCRE 8.12 and possibly other versions, allows remote attackers to cause a denial of service (memory consumption) via a message that does not match a regular expression.

  • CVE-2011-1867Jul 11, 2011
    Microfocus
    Intelligent Management Center
    risk 0.02cvss —epss 0.26

    Stack-based buffer overflow in iNodeMngChecker.exe in the User Access Manager (UAM) 5.0 before SP1 E0101P03 and Endpoint Admission Defense (EAD) 5.0 before SP1 E0101P03 components in HP Intelligent Management Center (aka iNode Management Center) allows remote attackers to…

  • CVE-2011-1526Jul 11, 2011
    Mit
    Krb5 Appl
    risk 0.00cvss —epss 0.04

    ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.1 and earlier does not check the krb5_setegid return value, which allows remote authenticated users to bypass intended group access restrictions, and create, overwrite, delete, or read…

  • CVE-2011-1338Jul 11, 2011
    Xnview
    Xnview
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in XnView before 1.98.1 allows local users to gain privileges via a Trojan horse .exe file in a folder selected by the "Open containing folder" menu item.

  • CVE-2011-0549Jul 11, 2011
    Symantec
    Web Gateway
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in forget.php in the management GUI in Symantec Web Gateway 4.5.x allows remote attackers to execute arbitrary SQL commands via the username parameter.

  • CVE-2010-4814Jul 8, 2011
    Bestsoftinc
    Advance Hotel Booking System
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index1.php in Best Soft Inc. (BSI) Advance Hotel Booking System 1.0 allows remote attackers to execute arbitrary SQL commands via the page parameter.

  • CVE-2010-4813Jul 8, 2011
    Drupal
    Category Tokens
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Category Tokens module 6.x before 6.x-1.1 for Drupal allows remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML by editing or creating vocabulary names, which are not properly…

  • CVE-2010-4812Jul 8, 2011
    6kbbs
    6kbbs
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in 6kbbs 8.0 build 20100901 allow remote attackers to execute arbitrary SQL commands via the (1) tids[] parameter to ajaxadmin.php and the (2) msgids[] parameter to ajaxmember.php.

  • CVE-2010-4811Jul 8, 2011
    6kbbs
    6kbbs
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ajaxmember.php in 6kbbs 8.0 build 20100901 allow remote attackers to inject arbitrary web script or HTML via the (1) user[msn], (2) user[email], and (3) user[phone] parameters in a modifyDetails action.

  • CVE-2010-4810Jul 8, 2011
    AR Web Content Manager
    AWCM
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in AR Web Content Manager (AWCM) 2.1 final allow remote attackers to execute arbitrary PHP code via a URL in the theme_file parameter to (1) includes/window_top.php and (2) header.php, and the (3) lang_file parameter to…

  • CVE-2010-4809Jul 8, 2011
    DBSite
    DBSite
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in DBSite 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.

  • CVE-2010-4808Jul 8, 2011
    Valarsoft
    Webmatic
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Webmatic allows remote attackers to execute arbitrary SQL commands via the p parameter.

  • CVE-2011-2664Jul 8, 2011
    Checkpoint
    SmartCenter
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Check Point Multi-Domain Management / Provider-1 NGX R65, R70, R71, and R75, and SmartCenter during installation on non-Windows machines, allows local users on the MDS system to overwrite arbitrary files via unknown vectors.

  • CVE-2011-2465Jul 8, 2011
    Isc
    Bind
    risk 0.01cvss —epss 0.09

    Unspecified vulnerability in ISC BIND 9 9.8.0, 9.8.0-P1, 9.8.0-P2, and 9.8.1b1, when recursion is enabled and the Response Policy Zone (RPZ) contains DNAME or certain CNAME records, allows remote attackers to cause a denial of service (named daemon crash) via an unspecified…

  • CVE-2011-2464Jul 8, 2011
    Isc
    Bind
    risk 0.02cvss —epss 0.19

    Unspecified vulnerability in ISC BIND 9 9.6.x before 9.6-ESV-R4-P3, 9.7.x before 9.7.3-P3, and 9.8.x before 9.8.0-P4 allows remote attackers to cause a denial of service (named daemon crash) via a crafted UPDATE request.

  • CVE-2011-2344Jul 8, 2011
    Google
    Android
    risk 0.00cvss —epss 0.01

    Android Picasa in Android 3.0 and 2.x through 2.3.4 uses a cleartext HTTP session when transmitting the authToken obtained from ClientLogin, which allows remote attackers to gain privileges and access private pictures and web albums by sniffing the token from connections with…

  • CVE-2011-1001Jul 8, 2011
    Google
    Android SDK
    risk 0.00cvss —epss 0.01

    dexdump in Android SDK before 2.3 does not properly perform structural verification, which allows user-assisted remote attackers to cause a denial of service (dexdump crash) and possibly execute arbitrary code via a malformed APK or dex file that calls a method using more…

  • CVE-2011-2192Jul 7, 2011
    Curl
    Libcurl
    risk 0.00cvss —epss 0.03

    The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.

  • CVE-2011-1946Jul 7, 2011
    Libgnomesu
    libgnomesu
    risk 0.00cvss —epss 0.00

    gnomesu-pam-backend in libgnomesu 1.0.0 prints an error message but proceeds with the non-error code path upon failure of the setgid or setuid function, which allows local users to gain privileges by leveraging access to two unprivileged user accounts, and running many processes…

  • CVE-2011-1931Jul 7, 2011
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.02

    sp5xdec.c in the Sunplus SP5X JPEG decoder in libavcodec in FFmpeg before 0.6.3 and libav through 0.6.2, as used in VideoLAN VLC media player 1.1.9 and earlier and other products, performs a write operation outside the bounds of an unspecified array, which allows remote…

  • CVE-2011-1498Jul 7, 2011
    Apache
    Httpclient
    risk 0.00cvss —epss 0.07

    Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.

  • CVE-2011-1224Jul 7, 2011
    IBM
    Websphere Mq
    risk 0.00cvss —epss 0.01

    IBM WebSphere MQ 6.0 before 6.0.2.11 and 7.0 before 7.0.1.5 does not use the CRL Distribution Points (CDP) certificate extension, which might allow man-in-the-middle attackers to spoof an SSL partner via a revoked certificate for a (1) client, (2) queue manager, or (3)…

  • CVE-2011-2682Jul 7, 2011
    IBM
    Rational Doors Web Access
    risk 0.00cvss —epss 0.01

    The Login component in IBM Rational DOORS Web Access 1.4.x before 1.4.0.4 allows remote authenticated users to cause a denial of service (license consumption) by trying to login to DOORS Web Access with a new user account that has never been used for a DOORS login.

  • CVE-2011-2681Jul 7, 2011
    IBM
    Rational Doors Web Access
    risk 0.00cvss —epss 0.02

    IBM Rational DOORS Web Access 1.4.x before 1.4.0.4 does not properly handle exceptions, which has unspecified impact and remote attack vectors.

  • CVE-2011-2680Jul 7, 2011
    IBM
    Rational Doors Web Access
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in IBM Rational DOORS Web Access 1.4.x before 1.4.0.4 has unknown impact and remote attack vectors related to the "server error response."

  • CVE-2011-2679Jul 7, 2011
    IBM
    Rational Doors Web Access
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Rational DOORS Web Access 1.4.x before 1.4.0.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-2678Jul 7, 2011
    Cisco Systems, Inc.
    VPN Client
    risk 0.00cvss —epss 0.00

    The Cisco VPN Client 5.0.7.0240 and 5.0.7.0290 on 64-bit Windows platforms uses weak permissions (NT AUTHORITY\INTERACTIVE:F) for cvpnd.exe, which allows local users to gain privileges by replacing this executable file with an arbitrary program, aka Bug ID CSCtn50645. NOTE: this…

  • CVE-2011-2597Jul 7, 2011
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The Lucent/Ascend file parser in Wireshark 1.2.x before 1.2.18, 1.4.x through 1.4.7, and 1.6.0 allows remote attackers to cause a denial of service (infinite loop) via malformed packets.

  • CVE-2011-1336Jul 7, 2011
    Estsoft
    Alzip
    risk 0.00cvss —epss 0.06

    Buffer overflow in ALZip 8.21 and earlier allows remote attackers to execute arbitrary code via a crafted mim file.

  • CVE-2011-2666Jul 6, 2011
    Asterisk
    Asterisk
    risk 0.00cvss —epss 0.01

    The default configuration of the SIP channel driver in Asterisk Open Source 1.4.x through 1.4.41.2 and 1.6.2.x through 1.6.2.18.2 does not enable the alwaysauthreject option, which allows remote attackers to enumerate account names by making a series of invalid SIP requests and…

  • CVE-2011-2665Jul 6, 2011
    Asterisk
    Asterisk Open Source
    risk 0.00cvss —epss 0.04

    reqresp_parser.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.4.3 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a SIP packet with a Contact header that lacks a < (less than) character.

  • CVE-2011-2536Jul 6, 2011
    Asterisk
    Business Edition
    risk 0.00cvss —epss 0.02

    chan_sip.c in the SIP channel driver in Asterisk Open Source 1.4.x before 1.4.41.2, 1.6.2.x before 1.6.2.18.2, and 1.8.x before 1.8.4.4, and Asterisk Business Edition C.3.x before C.3.7.3, disregards the alwaysauthreject option and generates different responses for invalid SIP…

  • CVE-2011-2535Jul 6, 2011
    Asterisk
    Asterisk
    risk 0.00cvss —epss 0.05

    chan_iax2.c in the IAX2 channel driver in Asterisk Open Source 1.4.x before 1.4.41.1, 1.6.2.x before 1.6.2.18.1, and 1.8.x before 1.8.4.3, and Asterisk Business Edition C.3 before C.3.7.3, accesses a memory address contained in an option control frame, which allows remote…

  • CVE-2011-2529Jul 6, 2011
    Asterisk
    Asterisk
    risk 0.00cvss —epss 0.04

    chan_sip.c in the SIP channel driver in Asterisk Open Source 1.6.x before 1.6.2.18.1 and 1.8.x before 1.8.4.3 does not properly handle '\0' characters in SIP packets, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified…

  • CVE-2011-2641Jul 1, 2011
    Opera
    Opera
    risk 0.03cvss —epss 0.05

    Opera 11.11 allows remote attackers to cause a denial of service (application crash) by setting the FACE attribute of a FONT element within an IFRAME element after changing the SRC attribute of this IFRAME element to an about:blank value.

  • CVE-2011-2640Jul 1, 2011
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via an HTML document that has an empty parameter value for an embedded Java applet.

  • CVE-2011-2639Jul 1, 2011
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera before 11.10 does not properly handle hidden animated GIF images, which allows remote attackers to cause a denial of service (CPU consumption) via an image file that triggers continual repaints.

  • CVE-2011-2638Jul 1, 2011
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by games on zylom.com.

  • CVE-2011-2637Jul 1, 2011
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by futura-sciences.com, seoptimise.com, and mitosyfraudes.org.

  • CVE-2011-2636Jul 1, 2011
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by a certain Tomato Firmware page.

  • CVE-2011-2635Jul 1, 2011
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    The Cascading Style Sheets (CSS) implementation in Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via vectors involving use of the :hover pseudo-class, in conjunction with transforms, for a floated element.

  • CVE-2011-2634Jul 1, 2011
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera before 11.10 allows remote attackers to hijack (1) searches and (2) customizations via unspecified third party applications.

  • CVE-2011-2633Jul 1, 2011
    Opera
    Opera
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Opera before 11.11 allows remote attackers to cause a denial of service (application crash) via vectors involving a Certificate Revocation List (CRL) file, as demonstrated by the multicert-ca-02.crl file.

  • CVE-2011-2632Jul 1, 2011
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera before 11.11 does not properly handle destruction of a Silverlight instance, which allows remote attackers to cause a denial of service (application crash) via a web page, as demonstrated by vod.onet.pl.

  • CVE-2011-2631Jul 1, 2011
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    The Cascading Style Sheets (CSS) implementation in Opera before 11.11 does not properly handle the column-count property, which allows remote attackers to cause a denial of service (infinite repaint loop and application hang) via a web page, as demonstrated by an unspecified…

  • CVE-2011-2630Jul 1, 2011
    Opera
    Opera
    risk 0.00cvss —epss 0.01

    Opera before 11.11 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted web page that is not properly handled during a reload occurring after the opening of a popup of the Easy Sticky Note extension.

  • CVE-2011-2629Jul 1, 2011
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Opera before 11.11 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by www.falk.de.