VYPR

CVEs

346,392 total · page 6005 of 6,928

AllCriticalHighKEV
  • CVE-2010-2246May 26, 2011
    Feh Project
    Feh
    risk 0.04cvss —epss 0.07

    feh before 1.8, when the --wget-timestamp option is enabled, might allow remote attackers to execute arbitrary commands via shell metacharacters in a URL.

  • CVE-2011-2173May 26, 2011
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.01

    The implementation of OutputMediator objects in IBM WebSphere Portal 6.0.1.7, and 7.0.0.1 before CF002, allows remote authenticated users to cause a denial of service (memory consumption) via requests.

  • CVE-2011-2172May 26, 2011
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the search center in IBM WebSphere Portal 7.0.0.1 before CF004 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-1807May 26, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.03

    Google Chrome before 11.0.696.71 does not properly handle blobs, which allows remote attackers to execute arbitrary code via unspecified vectors that trigger an out-of-bounds write.

  • CVE-2011-1806May 26, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.03

    Google Chrome before 11.0.696.71 does not properly implement the GPU command buffer, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

  • CVE-2011-1804May 26, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    rendering/RenderBox.cpp in WebCore in WebKit before r86862, as used in Google Chrome before 11.0.696.71, does not properly render floats, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a…

  • CVE-2011-1801May 26, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Google Chrome before 11.0.696.71 allows remote attackers to bypass the pop-up blocker via unknown vectors.

  • CVE-2011-1581May 26, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.03

    The bond_select_queue function in drivers/net/bonding/bond_main.c in the Linux kernel before 2.6.39, when a network device with a large number of receive queues is installed but the default tx_queues setting is used, does not properly restrict queue indexes, which allows remote…

  • CVE-2010-4807May 26, 2011
    IBM
    Web Content Manager
    risk 0.00cvss —epss 0.01

    Race condition in IBM Web Content Manager (WCM) 7.0.0.1 before CF003 allows remote authenticated users to cause a denial of service (infinite recursive query) via unspecified vectors, related to a StackOverflowError exception.

  • CVE-2010-4806May 26, 2011
    IBM
    Web Content Manager
    risk 0.00cvss —epss 0.01

    The authoring tool in IBM Web Content Manager (WCM) 6.1.5, and 7.0.0.1 before CF003, allows remote authenticated users to bypass intended access restrictions on draft creation by leveraging certain resource editor privileges.

  • CVE-2010-4805HigMay 26, 2011
    Linux
    Kernel
    risk 0.49cvss 7.5epss 0.04

    The socket implementation in net/core/sock.c in the Linux kernel before 2.6.35 does not properly manage a backlog of received packets, which allows remote attackers to cause a denial of service by sending a large amount of network traffic, related to the sk_add_backlog function…

  • CVE-2010-4251HigMay 26, 2011
    Linux
    Kernel
    risk 0.49cvss 7.5epss 0.04

    The socket implementation in net/core/sock.c in the Linux kernel before 2.6.34 does not properly manage a backlog of received packets, which allows remote attackers to cause a denial of service (memory consumption) by sending a large amount of network traffic, as demonstrated by…

  • CVE-2011-2171May 24, 2011
    Google
    ChromeOS
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the dbugs package in Google Chrome OS before R12 0.12.433.38 Beta has unknown impact and attack vectors.

  • CVE-2011-2170May 24, 2011
    Google
    ChromeOS
    risk 0.00cvss —epss 0.00

    Google Chrome OS before R12 0.12.433.38 Beta, when Guest mode is enabled, does not prevent changes on the about:flags page, which has unspecified impact and local attack vectors.

  • CVE-2011-2169May 24, 2011
    Google
    ChromeOS
    risk 0.00cvss —epss 0.00

    Google Chrome OS before R12 0.12.433.38 Beta allows local users to gain privileges by creating a /var/lib/chromeos-aliases.conf file and placing commands in it.

  • CVE-2011-2168May 24, 2011
    OpenBSD
    OpenBSD
    risk 0.00cvss —epss 0.01

    Multiple integer overflows in the glob implementation in libc in OpenBSD before 4.9 might allow context-dependent attackers to have an unspecified impact via a crafted string, related to the GLOB_APPEND and GLOB_DOOFFS flags, a different issue than CVE-2011-0418.

  • CVE-2011-2167May 24, 2011
    Dovecot (software)
    Dovecot
    risk 0.00cvss —epss 0.02

    script-login in Dovecot 2.0.x before 2.0.13 does not follow the chroot configuration setting, which might allow remote authenticated users to conduct directory traversal attacks by leveraging a script.

  • CVE-2011-2166May 24, 2011
    Dovecot (software)
    Dovecot
    risk 0.00cvss —epss 0.02

    script-login in Dovecot 2.0.x before 2.0.13 does not follow the user and group configuration settings, which might allow remote authenticated users to bypass intended access restrictions by leveraging a script.

  • CVE-2011-1929May 24, 2011
    Dovecot (software)
    Dovecot
    risk 0.00cvss —epss 0.03

    lib-mail/message-header-parser.c in Dovecot 1.2.x before 1.2.17 and 2.0.x before 2.0.13 does not properly handle '\0' characters in header names, which allows remote attackers to cause a denial of service (daemon crash or mailbox corruption) via a crafted e-mail message.

  • CVE-2011-1928May 24, 2011
    Apache
    HTTP Server
    risk 0.01cvss —epss 0.10

    The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns,…

  • CVE-2011-1595May 24, 2011
    Rdesktop
    Rdesktop
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in the disk_create function in disk.c in rdesktop before 1.7.0, when disk redirection is enabled, allows remote RDP servers to read or overwrite arbitrary files via a .. (dot dot) in a pathname.

  • CVE-2011-1521May 24, 2011
    Python (programming language)
    Python
    risk 0.00cvss —epss 0.04

    The urllib and urllib2 modules in Python 2.x before 2.7.2 and 3.x before 3.2.1 process Location headers that specify redirection to file: URLs, which makes it easier for remote attackers to obtain sensitive information or cause a denial of service (resource consumption) via a…

  • CVE-2011-1424May 24, 2011
    EMC Corporation
    Sourceone Email Management
    risk 0.00cvss —epss 0.01

    The default configuration of ExShortcut\Web.config in EMC SourceOne Email Management before 6.6 SP1, when the Mobile Services component is used, does not properly set the localOnly attribute of the trace element, which allows remote authenticated users to obtain sensitive…

  • CVE-2011-1328May 24, 2011
    Radvision
    Iview Suite
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in RADVISION iVIEW Suite before 7.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2011-0418May 24, 2011
    Pureftpd
    Pureftpd
    risk 0.04cvss —epss 0.07

    The glob implementation in Pure-FTPd before 1.0.32, and in libc in NetBSD 5.1, does not properly expand expressions containing curly brackets, which allows remote authenticated users to cause a denial of service (memory consumption) via a crafted FTP STAT command.

  • CVE-2011-2165May 23, 2011
    WatchGuard
    Xcs
    risk 0.03cvss —epss 0.05

    The STARTTLS implementation in WatchGuard XCS 9.0 and 9.1 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a…

  • CVE-2011-1926May 23, 2011
    Cyrus
    IMAP Server
    risk 0.00cvss —epss 0.04

    The STARTTLS implementation in Cyrus IMAP Server before 2.4.7 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a…

  • CVE-2011-1920May 23, 2011
    Ihji
    Pmake
    risk 0.00cvss —epss 0.00

    The make include files in NetBSD before 1.6.2, as used in pmake 1.111 and other products, allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_depend##### temporary file, related to (1) bsd.lib.mk and (2) bsd.prog.mk.

  • CVE-2011-1766May 23, 2011
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    includes/User.php in MediaWiki before 1.16.5, when wgBlockDisablesLogin is enabled, does not clear certain cached data after verification of an auth token fails, which allows remote attackers to bypass authentication by creating crafted wikiUserID and wikiUserName cookies, or by…

  • CVE-2011-1765May 23, 2011
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.5, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .shtml at the end of the query…

  • CVE-2011-1575May 23, 2011
    Pureftpd
    Pureftpd
    risk 0.00cvss —epss 0.33

    The STARTTLS implementation in ftp_parser.c in Pure-FTPd before 1.0.30 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted FTP sessions by sending a cleartext command that is processed after TLS is in place,…

  • CVE-2009-5024May 23, 2011
    Viewvc
    Viewvc
    risk 0.00cvss —epss 0.03

    ViewVC before 1.1.11 allows remote attackers to bypass the cvsdb row_limit configuration setting, and consequently conduct resource-consumption attacks, via the limit parameter, as demonstrated by a "query revision history" request.

  • CVE-2011-2164May 20, 2011
    Adobe Inc.
    Photoshop
    risk 0.00cvss —epss 0.04

    Multiple unspecified vulnerabilities in Adobe Photoshop before 12.0.4 have unknown impact and attack vectors.

  • CVE-2011-2163May 20, 2011
    IBM
    Director
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Virtualization Manager 1.2.2 in IBM Systems Director 1.2.2 has unknown impact and attack vectors.

  • CVE-2011-2162May 20, 2011
    MPlayer
    Mplayer
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in FFmpeg 0.4.x through 0.6.x, as used in MPlayer 1.0 and other products, in Mandriva Linux 2009.0, 2010.0, and 2010.1; Corporate Server 4.0 (aka CS4.0); and Mandriva Enterprise Server 5 (aka MES5) have unknown impact and attack vectors,…

  • CVE-2011-2161May 20, 2011
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.01

    The ape_read_header function in ape.c in libavformat in FFmpeg before 0.5.4, as used in MPlayer, VideoLAN VLC media player, and other products, allows remote attackers to cause a denial of service (application crash) via an APE (aka Monkey's Audio) file that contains a header…

  • CVE-2011-2160May 20, 2011
    MPlayer
    Mplayer
    risk 0.00cvss —epss 0.02

    The VC-1 decoding functionality in FFmpeg before 0.5.4, as used in MPlayer and other products, does not properly restrict read operations, which allows remote attackers to have an unspecified impact via a crafted VC-1 file, a related issue to CVE-2011-0723.

  • CVE-2011-2159May 20, 2011
    Smartertools
    Smarterstats
    risk 0.00cvss —epss 0.04

    The SmarterTools SmarterStats 6.0 web server omits the Content-Type header for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving (1) Admin/Defaults/frmDefaultSiteSettings.aspx, (2)…

  • CVE-2011-2158May 20, 2011
    Smartertools
    Smarterstats
    risk 0.00cvss —epss 0.04

    The SmarterTools SmarterStats 6.0 web server sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving (1) Admin/frmSite.aspx, (2) Admin/frmSites.aspx, (3)…

  • CVE-2011-2157May 20, 2011
    Smartertools
    Smarterstats
    risk 0.00cvss —epss 0.03

    The (1) Admin/frmEmailReportSettings.aspx and (2) Admin/frmGeneralSettings.aspx components in the SmarterTools SmarterStats 6.0 web server generate web pages containing e-mail addresses, which allows remote attackers to obtain potentially sensitive information by reading the…

  • CVE-2011-2156May 20, 2011
    Smartertools
    Smarterstats
    risk 0.00cvss —epss 0.03

    The SmarterTools SmarterStats 6.0 web server allows remote attackers to obtain directory listings via a direct request for the (1) Admin/, (2) Admin/Defaults/, (3) Admin/GettingStarted/, (4) Admin/Popups/, (5) App_Themes/, (6) Client/, (7) Client/Popups/, (8) Services/, (9)…

  • CVE-2011-2155May 20, 2011
    Smartertools
    Smarterstats
    risk 0.00cvss —epss 0.04

    Login.aspx in the SmarterTools SmarterStats 6.0 web server generates a ctl00$MPH$txtPassword password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation.

  • CVE-2011-2154May 20, 2011
    Smartertools
    Smarterstats
    risk 0.00cvss —epss 0.03

    login.aspx in the SmarterTools SmarterStats 6.0 web server does not include the HTTPOnly flag in a Set-Cookie header for the loginsettings cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

  • CVE-2011-2153May 20, 2011
    Smartertools
    Smarterstats
    risk 0.00cvss —epss 0.02

    Login.aspx in the SmarterTools SmarterStats 6.0 web server supports URLs containing txtUser and txtPass parameters in the query string, which makes it easier for context-dependent attackers to discover credentials by reading (1) web-server access logs, (2) web-server Referer…

  • CVE-2011-2152May 20, 2011
    Smartertools
    Smarterstats
    risk 0.00cvss —epss 0.03

    The SmarterTools SmarterStats 6.0 web server generates web pages containing external links in response to GET requests with query strings for (1) Client/frmViewReports.aspx or (2) UserControls/Popups/frmHelp.aspx, which makes it easier for remote attackers to obtain sensitive…

  • CVE-2011-2151May 20, 2011
    Smartertools
    Smarterstats
    risk 0.00cvss —epss 0.03

    The (1) Admin/frmEmailReportSettings.aspx, (2) Admin/frmGeneralSettings.aspx, (3) Admin/frmSite.aspx, (4) Client/frmUser.aspx, and (5) Login.aspx components in the SmarterTools SmarterStats 6.0 web server accept cleartext passwords, which makes it easier for remote attackers to…

  • CVE-2011-2150May 20, 2011
    Smartertools
    Smarterstats
    risk 0.00cvss —epss 0.03

    The SmarterTools SmarterStats 6.0 web server does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service (parsing error and daemon pause) via vectors involving (1) certain cookies in a…

  • CVE-2011-2149May 20, 2011
    Smartertools
    Smarterstats
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in the SmarterTools SmarterStats 6.0 web server allow remote attackers to execute arbitrary SQL commands via certain parameters to (1) Admin/frmSite.aspx, (2) Default.aspx, (3) Services/SiteAdmin.asmx, or (4) Client/frmViewReports.aspx;…

  • CVE-2011-2148May 20, 2011
    Smartertools
    Smarterstats
    risk 0.00cvss —epss 0.05

    Admin/frmSite.aspx in the SmarterTools SmarterStats 6.0 web server allows remote attackers to execute arbitrary commands via vectors involving a leading and trailing & (ampersand) character, and (1) an STTTState cookie, (2) the ctl00%24MPH%24txtAdminNewPassword_SettingText…

  • CVE-2011-2147May 20, 2011
    Xelerance
    Openswan
    risk 0.00cvss —epss 0.00

    Openswan 2.2.x does not properly restrict permissions for (1) /var/run/starter.pid, related to starter.c in the IPsec starter, and (2) /var/lock/subsys/ipsec, which allows local users to kill arbitrary processes by writing a PID to a file, or possibly bypass disk quotas by…