VYPR

CVEs

346,392 total · page 6007 of 6,928

AllCriticalHighKEV
  • CVE-2011-2089May 13, 2011
    Iconics
    Bizviz
    risk 0.06cvss —epss 0.38

    Stack-based buffer overflow in the SetActiveXGUID method in the VersionInfo ActiveX control in GenVersion.dll 8.0.138.0 in the WebHMI subsystem in ICONICS BizViz 9.x before 9.22 and GENESIS32 9.x before 9.22 allows remote attackers to execute arbitrary code via a long string in…

  • CVE-2011-2088May 13, 2011
    Apache
    Struts
    risk 0.00cvss —epss 0.06

    XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability…

  • CVE-2011-2087May 13, 2011
    Apache
    Struts
    risk 0.00cvss —epss 0.06

    Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related…

  • CVE-2011-1855May 13, 2011
    Microfocus
    OpenView Network Node Manager
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.0x allows local users to read or modify (1) log files or (2) other data via unknown vectors.

  • CVE-2011-1854May 13, 2011
    Microfocus
    Intelligent Management Center
    risk 0.01cvss —epss 0.11

    Use-after-free vulnerability in HP Intelligent Management Center (IMC) 5.0 before E0101L02 allows remote attackers to execute arbitrary code via a long syslog packet, related to an exception handler.

  • CVE-2011-1853May 13, 2011
    Microfocus
    Intelligent Management Center
    risk 0.01cvss —epss 0.11

    tftpserver.exe in HP Intelligent Management Center (IMC) 5.0 before E0101L02 allows remote attackers to execute arbitrary code via a (1) large or (2) invalid opcode field, related to a function pointer table.

  • CVE-2011-1852May 13, 2011
    Microfocus
    Intelligent Management Center
    risk 0.01cvss —epss 0.15

    Multiple stack-based buffer overflows in tftpserver.exe in HP Intelligent Management Center (IMC) 5.0 before E0101L02 allow remote attackers to execute arbitrary code via crafted packet content accompanying a (1) DATA or (2) ERROR opcode.

  • CVE-2011-1851May 13, 2011
    Microfocus
    Intelligent Management Center
    risk 0.01cvss —epss 0.13

    Stack-based buffer overflow in tftpserver.exe in HP Intelligent Management Center (IMC) 5.0 before E0101L02 allows remote attackers to execute arbitrary code via a long mode field.

  • CVE-2011-1850May 13, 2011
    Microfocus
    Intelligent Management Center
    risk 0.01cvss —epss 0.13

    Stack-based buffer overflow in the logging functionality in dbman.exe in HP Intelligent Management Center (IMC) 5.0 before E0101L02 allows remote attackers to execute arbitrary code via vectors related to a received action.

  • CVE-2011-1849May 13, 2011
    Microfocus
    Intelligent Management Center
    risk 0.01cvss —epss 0.11

    tftpserver.exe in HP Intelligent Management Center (IMC) 5.0 before E0101L02 allows remote attackers to create or overwrite files, and subsequently execute arbitrary code, via a crafted WRQ request.

  • CVE-2011-1848May 13, 2011
    Microfocus
    Intelligent Management Center
    risk 0.01cvss —epss 0.13

    Stack-based buffer overflow in img.exe in HP Intelligent Management Center (IMC) 5.0 before E0101L02 allows remote attackers to execute arbitrary code via a crafted length field in a packet.

  • CVE-2011-1840May 13, 2011
    Martinicreations
    Passmanlite Password Manager
    risk 0.00cvss —epss 0.00

    The MartiniCreations PassmanLite Password Manager application before 1.48 for Android stores the master password and unspecified other account information in cleartext, which allows local users to obtain sensitive information by leveraging shell access.

  • CVE-2011-1772May 13, 2011
    Apache
    Struts
    risk 0.06cvss —epss 0.33

    Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an…

  • CVE-2011-1738May 13, 2011
    Microfocus
    Palm webOS
    risk 0.00cvss —epss 0.00

    HP Palm webOS 1.4.5 and 1.4.5.1 does not properly restrict Plug-in Development Kit (PDK) applications, which allows local users to gain privileges by leveraging unintended filesystem write access.

  • CVE-2011-1737May 13, 2011
    Microfocus
    Palm webOS
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Email application in HP Palm webOS 1.4.5 and 1.4.5.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-1720May 13, 2011
    Postfix
    Postfix
    risk 0.02cvss —epss 0.22

    The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication methods are enabled, does not create a new server handle after client authentication fails, which allows remote attackers to cause a…

  • CVE-2011-1325May 13, 2011
    Ec Cube Co.,ltd.
    Ec Cube
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in EC-CUBE before 2.11.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2011-1270May 13, 2011
    Microsoft
    Powerpoint
    risk 0.01cvss —epss 0.16

    Buffer overflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint document, aka "Presentation Buffer Overrun RCE Vulnerability."

  • CVE-2011-1269May 13, 2011
    Microsoft
    Office
    risk 0.01cvss —epss 0.15

    Microsoft PowerPoint 2002 SP3, 2003 SP3, and 2007 SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2 make unspecified function calls during file parsing without proper…

  • CVE-2011-1248May 13, 2011
    Microsoft
    Windows Server 2003
    risk 0.07cvss —epss 0.48

    WINS in Microsoft Windows Server 2003 SP2 and Server 2008 Gold, SP2, R2, and R2 SP1 does not properly handle socket send exceptions, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted packets, related to…

  • CVE-2011-0995May 13, 2011
    Rubyforge
    Rubygem Sqlite3
    risk 0.00cvss —epss 0.00

    The sqlite3-ruby gem in the rubygem-sqlite3 package before 1.2.4-0.5.1 in SUSE Linux Enterprise (SLE) 11 SP1 uses weak permissions for unspecified files, which allows local users to gain privileges via unknown vectors.

  • CVE-2011-0761May 13, 2011
    Perl Foundation
    Perl
    risk 0.04cvss —epss 0.09

    Perl 5.10.x allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an ability to inject arguments into a (1) getpeername, (2) readdir, (3) closedir, (4) getsockname, (5) rewinddir, (6) tell, or (7) telldir…

  • CVE-2011-0341May 13, 2011
    Artifex
    Mupdf
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in the pdfmoz_onmouse function in apps/mozilla/moz_main.c in the MuPDF plug-in 2008.09.02 for Firefox allows remote attackers to execute arbitrary code via a crafted web site.

  • CVE-2011-2081May 10, 2011
    Inventivetec
    Mediacast
    risk 0.00cvss —epss 0.02

    MediaCAST 8 and earlier does not properly handle requests for inventivex/isptools/release/metadata/globalIncludeFolders.txt, which allows remote attackers to obtain sensitive information via unspecified vectors related to the Public/ directory tree.

  • CVE-2011-2080May 10, 2011
    MediaCAST
    MediaCAST
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in MediaCAST 8 and earlier allow remote attackers to execute arbitrary SQL commands via (1) a CP_ENLARGESTYLE cookie to the default URI under inventivex/managetraining/ or (2) unspecified input to authenticate_ad_setup_finished.cfm.

  • CVE-2011-2079May 10, 2011
    Inventivetec
    Mediacast
    risk 0.00cvss —epss 0.02

    MediaCAST 8 and earlier allows remote attackers to have an unspecified impact via a (1) CP_RIGHTSOURCE or (2) bdclient_Inventive cookie to the default URI under inventivex/managetraining/, related to an "XML injection" issue.

  • CVE-2011-2078May 10, 2011
    Inventivetec
    Mediacast
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the New Atlanta BlueDragon administrative interface in MediaCAST 8 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-2077May 10, 2011
    MediaCAST
    MediaCAST
    risk 0.00cvss —epss 0.01

    The default configuration of the New Atlanta BlueDragon administrative interface in MediaCAST 8 and earlier enables external TCP connections to port 10000, instead of connections only from 127.0.0.1, which makes it easier for remote attackers to have an unspecified impact via a…

  • CVE-2011-2076May 10, 2011
    MediaCAST
    MediaCAST
    risk 0.00cvss —epss 0.01

    MediaCAST 8 and earlier stores passwords in cleartext, which makes it easier for context-dependent attackers to obtain sensitive information by reading an unspecified password data store, a different vulnerability than CVE-2010-0216.

  • CVE-2011-1271HigMay 10, 2011
    Microsoft
    .net Framework
    risk 0.55cvss 7.7epss 0.20

    The JIT compiler in Microsoft .NET Framework 3.5 Gold and SP1, 3.5.1, and 4.0, when IsJITOptimizerDisabled is false, does not properly handle expressions related to null strings, which allows context-dependent attackers to bypass intended access restrictions, and consequently…

  • CVE-2010-0216May 10, 2011
    MediaCAST
    MediaCAST
    risk 0.00cvss —epss 0.02

    authenticate_ad_setup_finished.cfm in MediaCAST 8 and earlier allows remote attackers to discover usernames and cleartext passwords by reading the error messages returned for requests that use the UserID parameter.

  • CVE-2011-2075May 10, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Google Chrome 11.0.696.65 on Windows 7 SP1 allows remote attackers to execute arbitrary code via unknown vectors. NOTE: as of 20110510, the only disclosure is a vague advisory that possibly relates to multiple vulnerabilities or multiple products. …

  • CVE-2011-2074May 10, 2011
    Skype Technologies
    Skype
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the client in Skype 5.x before 5.1.0.922 on Mac OS X allows remote authenticated users to execute arbitrary code or cause a denial of service (application crash) via a crafted message.

  • CVE-2011-1824May 10, 2011
    Opera
    Opera
    risk 0.00cvss —epss 0.06

    The VEGAOpBitmap::AddLine function in Opera before 10.61 does not properly initialize memory during processing of the SIZE attribute of a SELECT element, which allows remote attackers to trigger an invalid memory write operation, and consequently cause a denial of service…

  • CVE-2011-0905May 10, 2011
    David King
    Vino
    risk 0.00cvss —epss 0.01

    The rfbSendFramebufferUpdate function in server/libvncserver/rfbserver.c in vino-server in Vino 2.x before 2.28.3, 2.32.x before 2.32.2, 3.0.x before 3.0.2, and 3.1.x before 3.1.1, when tight encoding is used, allows remote authenticated users to cause a denial of service…

  • CVE-2011-0904May 10, 2011
    David King
    Vino
    risk 0.00cvss —epss 0.02

    The rfbSendFramebufferUpdate function in server/libvncserver/rfbserver.c in vino-server in Vino 2.x before 2.28.3, 2.32.x before 2.32.2, 3.0.x before 3.0.2, and 3.1.x before 3.1.1, when raw encoding is used, allows remote authenticated users to cause a denial of service (daemon…

  • CVE-2011-1907May 9, 2011
    Isc
    Bind
    risk 0.00cvss —epss 0.05

    ISC BIND 9.8.x before 9.8.0-P1, when Response Policy Zones (RPZ) RRset replacement is enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an RRSIG query.

  • CVE-2011-1789May 9, 2011
    VMware
    Esx
    risk 0.00cvss —epss 0.02

    The self-extracting installer in the vSphere Client Installer package in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1, VMware ESXi 4.x before 4.1 Update 1, and VMware ESX 4.x before 4.1 Update 1 does not have a digital signature, which might make it easier for…

  • CVE-2011-1788May 9, 2011
    VMware
    Vcenter Server
    risk 0.00cvss —epss 0.00

    vCenter Server in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1 allows local users to discover the SOAP session ID via unspecified vectors.

  • CVE-2011-1748May 9, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The raw_release function in net/can/raw.c in the Linux kernel before 2.6.39-rc6 does not properly validate a socket data structure, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted release…

  • CVE-2011-1598May 9, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The bcm_release function in net/can/bcm.c in the Linux kernel before 2.6.39-rc6 does not properly validate a socket data structure, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted release…

  • CVE-2011-1574May 9, 2011
    Konstanty Bialkowski
    Libmodplug
    risk 0.06cvss —epss 0.43

    Stack-based buffer overflow in the ReadS3M method in load_s3m.cpp in libmodplug before 0.8.8.2 allows remote attackers to execute arbitrary code via a crafted S3M file.

  • CVE-2011-1015May 9, 2011
    Python (programming language)
    Python
    risk 0.00cvss —epss 0.04

    The is_cgi method in CGIHTTPServer.py in the CGIHTTPServer module in Python 2.5, 2.6, and 3.0 allows remote attackers to read script source code via an HTTP GET request that lacks a / (slash) character at the beginning of the URI.

  • CVE-2011-0426May 9, 2011
    VMware
    Virtualcenter
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in vCenter Server in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1, and VMware VirtualCenter 2.5 before Update 6a, allows remote attackers to read arbitrary files via unspecified vectors.

  • CVE-2010-4284May 9, 2011
    Samsung Mobile
    Data Management Server
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the authentication form in the integrated web server in the Data Management Server (DMS) before 1.4.3 in Samsung Integrated Management System allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2011-2022May 9, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The agp_generic_remove_memory function in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 does not validate a certain start parameter, which allows local users to gain privileges or cause a denial of service (system crash) via a crafted AGPIOC_UNBIND agp_ioctl…

  • CVE-2011-1747May 9, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The agp subsystem in the Linux kernel 2.6.38.5 and earlier does not properly restrict memory allocation by the (1) AGPIOC_RESERVE and (2) AGPIOC_ALLOCATE ioctls, which allows local users to cause a denial of service (memory consumption) by making many calls to these ioctls.

  • CVE-2011-1746May 9, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Multiple integer overflows in the (1) agp_allocate_memory and (2) agp_create_user_memory functions in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 allow local users to trigger buffer overflows, and consequently cause a denial of service (system crash) or…

  • CVE-2011-1745May 9, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Integer overflow in the agp_generic_insert_memory function in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 allows local users to gain privileges or cause a denial of service (system crash) via a crafted AGPIOC_BIND agp_ioctl ioctl call.

  • CVE-2011-1547May 9, 2011
    NetBSD
    NetBSD
    risk 0.03cvss —epss 0.05

    Multiple stack consumption vulnerabilities in the kernel in NetBSD 4.0, 5.0 before 5.0.3, and 5.1 before 5.1.1, when IPsec is enabled, allow remote attackers to cause a denial of service (memory corruption and panic) or possibly have unspecified other impact via a crafted (1)…