VYPR

CVEs

346,392 total · page 6010 of 6,928

AllCriticalHighKEV
  • CVE-2011-1539May 3, 2011
    Microfocus
    Proliant Support Pack
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in HP Proliant Support Pack (PSP) before 8.7 allows remote attackers to obtain sensitive information via unknown vectors.

  • CVE-2011-1538May 3, 2011
    Microfocus
    Proliant Support Pack
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in HP Proliant Support Pack (PSP) before 8.7 allows remote authenticated users to redirect other users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  • CVE-2011-1537May 3, 2011
    Microfocus
    Proliant Support Pack
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in HP Proliant Support Pack (PSP) before 8.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-1523May 3, 2011
    Nagios
    Nagios
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in statusmap.c in statusmap.cgi in Nagios 3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the layer parameter.

  • CVE-2011-1495May 3, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier does not validate (1) length and (2) offset values before performing memory copy operations, which might allow local users to gain privileges, cause a denial of service (memory corruption), or obtain…

  • CVE-2011-1494May 3, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier might allow local users to gain privileges or cause a denial of service (memory corruption) via an ioctl call specifying a crafted value that…

  • CVE-2011-1169May 3, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Array index error in the asihpi_hpi_ioctl function in sound/pci/asihpi/hpioctl.c in the AudioScience HPI driver in the Linux kernel before 2.6.38.1 might allow local users to cause a denial of service (memory corruption) or possibly gain privileges via a crafted adapter index…

  • CVE-2011-1087May 3, 2011
    VideoLAN
    VLC media player
    risk 0.01cvss —epss 0.08

    Buffer overflow in VideoLAN VLC media player 1.0.5 allows user-assisted remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted .mp3 file that is played during bookmark creation.

  • CVE-2011-0610May 3, 2011
    Adobe Inc.
    Acrobat
    risk 0.00cvss —epss 0.04

    The CoolType library in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows, Adobe Reader 9.x before 9.4.4 and 10.x before 10.0.3 on Mac OS X, and Adobe Acrobat 9.x before 9.4.4 and 10.x before 10.0.3 on Windows and Mac OS X allows remote attackers to execute…

  • CVE-2011-1843May 3, 2011
    Tinyproxy
    Tinyproxy
    risk 0.00cvss —epss 0.01

    Integer overflow in conf.c in Tinyproxy before 1.8.3 might allow remote attackers to bypass intended access restrictions in opportunistic circumstances via a TCP connection, related to improper handling of invalid port numbers.

  • CVE-2011-1842May 3, 2011
    Ubuntu
    Language Selector
    risk 0.00cvss —epss 0.00

    dbus_backend/lsd.py in the D-Bus backend in language-selector before 0.6.7 does not validate the arguments to the (1) SetSystemDefaultLangEnv and (2) SetSystemDefaultLanguageEnv functions, which allows local users to gain privileges via shell metacharacters in a string argument,…

  • CVE-2011-1841May 3, 2011
    Mojolicious
    Mojolicious
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the link_to helper in Mojolicious before 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-4803May 3, 2011
    Mojolicious
    Mojolicious
    risk 0.00cvss —epss 0.02

    Mojolicious before 0.999927 does not properly implement HMAC-MD5 checksums, which has unspecified impact and remote attack vectors.

  • CVE-2010-4802May 3, 2011
    Mojolicious
    Mojolicious
    risk 0.00cvss —epss 0.02

    Commands.pm in Mojolicious before 0.999928 does not properly perform CGI environment detection, which has unspecified impact and remote attack vectors.

  • CVE-2009-5074May 3, 2011
    Mojolicious
    Mojolicious
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the MojoX::Dispatcher::Static implementation in Mojolicious before 0.991250 has unknown impact and attack vectors.

  • CVE-2011-1592Apr 29, 2011
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    The NFS dissector in epan/dissectors/packet-nfs.c in Wireshark 1.4.x before 1.4.5 on Windows uses an incorrect integer data type during decoding of SETCLIENTID calls, which allows remote attackers to cause a denial of service (application crash) via a crafted .pcap file.

  • CVE-2011-1591Apr 29, 2011
    Wireshark
    Wireshark
    risk 0.06cvss —epss 0.42

    Stack-based buffer overflow in the DECT dissector in epan/dissectors/packet-dect.c in Wireshark 1.4.x before 1.4.5 allows remote attackers to execute arbitrary code via a crafted .pcap file.

  • CVE-2011-1590Apr 29, 2011
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    The X.509if dissector in Wireshark 1.2.x before 1.2.16 and 1.4.x before 1.4.5 does not properly initialize certain global variables, which allows remote attackers to cause a denial of service (application crash) via a crafted .pcap file.

  • CVE-2011-1589Apr 29, 2011
    Mojolicious
    Mojolicious
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in Path.pm in Mojolicious before 1.16 allows remote attackers to read arbitrary files via a %2f..%2f (encoded slash dot dot slash) in a URI.

  • CVE-2011-1543Apr 29, 2011
    Microfocus
    Systems Insight Manager
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in HP Systems Insight Manager (SIM) before 6.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2011-1542Apr 29, 2011
    Microfocus
    Systems Insight Manager
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in HP Systems Insight Manager (SIM) before 6.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-1541Apr 29, 2011
    Microfocus
    System Management Homepage
    risk 0.01cvss —epss 0.12

    Unspecified vulnerability in HP System Management Homepage (SMH) before 6.3 allows remote attackers to bypass intended access restrictions, and consequently execute arbitrary code, via unknown vectors.

  • CVE-2011-1540Apr 29, 2011
    Microfocus
    System Management Homepage
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in HP System Management Homepage (SMH) before 6.3 allows remote authenticated users to execute arbitrary code via unknown vectors.

  • CVE-2011-1536Apr 29, 2011
    Microfocus
    Performance Insight
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in HP Performance Insight 5.0, 5.1x. 5.2x, 5.3x, 5.4, 5.41, and 5.41.002 allows remote attackers to obtain sensitive information via unknown vectors.

  • CVE-2011-1535Apr 29, 2011
    Microfocus
    Insight Control for Linux
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in HP Insight Control for Linux (aka IC-Linux) before 6.3 allows remote authenticated users to obtain sensitive information, modify data, or cause a denial of service via unknown vectors.

  • CVE-2011-1499Apr 29, 2011
    Tinyproxy
    Tinyproxy
    risk 0.00cvss —epss 0.02

    acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attackers to hide the origin of web traffic by leveraging the open HTTP proxy server.

  • CVE-2011-0729Apr 29, 2011
    Language Selector
    language-selector
    risk 0.00cvss —epss 0.00

    dbus_backend/ls-dbus-backend in the D-Bus backend in language-selector before 0.6.7 does not restrict access on the basis of a PolicyKit check result, which allows local users to modify the /etc/default/locale and /etc/environment files via a (1) SetSystemDefaultLangEnv or (2)…

  • CVE-2011-1839Apr 28, 2011
    IBM
    Rational Build Forge
    risk 0.00cvss —epss 0.01

    IBM Rational Build Forge 7.1.0 uses the HTTP GET method during redirection from the authentication servlet to a PHP script, which makes it easier for context-dependent attackers to discover session IDs by reading (1) web-server access logs, (2) web-server Referer logs, or (3)…

  • CVE-2011-1719Apr 27, 2011
    Ca
    Output Management Web Viewer
    risk 0.01cvss —epss 0.12

    Multiple stack-based buffer overflows in the Web Viewer ActiveX controls in CA Output Management Web Viewer 11.0 and 11.5 allow remote attackers to execute arbitrary code via (1) a long SRC property value to the PPSViewer ActiveX control in PPSView.ocx before 1.0.0.7 or (2) a…

  • CVE-2011-1718Apr 27, 2011
    Ca
    Siteminder
    risk 0.00cvss —epss 0.02

    The Web Agents component in CA SiteMinder R6 before SP6 CR2 and R12 before SP3 CR2 does not properly handle multi-line headers, which allows remote authenticated users to conduct impersonation attacks and gain privileges via crafted data.

  • CVE-2011-1725Apr 27, 2011
    Microfocus
    Network Automation
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in HP Network Automation 7.2x, 7.5x, 7.6x, 9.0, and 9.10 allows remote attackers to obtain sensitive information via unknown vectors.

  • CVE-2011-1599Apr 27, 2011
    Asterisk
    Business Edition
    risk 0.00cvss —epss 0.03

    manager.c in the Manager Interface in Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Business Edition C.x.x before C.3.6.4 does not properly check for the system privilege, which allows remote…

  • CVE-2011-1587Apr 27, 2011
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.4, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html located before a ? (question…

  • CVE-2011-1586Apr 27, 2011
    KDE
    Kde
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in the KGetMetalink::File::isValidNameAttr function in ui/metalinkcreator/metalinker.cpp in KGet in KDE SC 4.6.2 and earlier allows remote attackers to create arbitrary files via a .. (dot dot) in the name attribute of a file element in a…

  • CVE-2011-1580Apr 27, 2011
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    The transwiki import functionality in MediaWiki before 1.16.3 does not properly check privileges, which allows remote authenticated users to perform imports from any wgImportSources wiki via a crafted POST request.

  • CVE-2011-1579Apr 27, 2011
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    The checkCss function in includes/Sanitizer.php in the wikitext parser in MediaWiki before 1.16.3 does not properly validate Cascading Style Sheets (CSS) token sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information…

  • CVE-2011-1578Apr 27, 2011
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.3, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html at the end of the query string,…

  • CVE-2011-1507Apr 27, 2011
    Asterisk
    Business Edition
    risk 0.00cvss —epss 0.03

    Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Business Edition C.x.x before C.3.6.4 do not restrict the number of unauthenticated sessions to certain interfaces, which allows remote attackers…

  • CVE-2010-4801Apr 27, 2011
    Baconmap
    Baconmap
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in admin/updatelist.php in BaconMap 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the filepath parameter.

  • CVE-2010-4800Apr 27, 2011
    Baconmap
    Baconmap
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in doadd.php in BaconMap 1.0 allows remote attackers to execute arbitrary SQL commands via the type parameter.

  • CVE-2010-4799Apr 27, 2011
    Chipmunk Scripts
    Pwngame
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Chipmunk Pwngame 1.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters to authenticate.php and the (3) ID parameter to pwn.php. NOTE: some of…

  • CVE-2010-4798Apr 27, 2011
    Orangehrm
    Orangehrm
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in OrangeHRM 2.6.0.1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the uri parameter.

  • CVE-2010-4797Apr 27, 2011
    Truworthit
    Flex Timesheet
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the log-in form in Truworth Flex Timesheet allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields.

  • CVE-2010-4796Apr 27, 2011
    Phpyun
    Phpyun
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in PHPYun 1.1.6 allow remote attackers to execute arbitrary SQL commands via the (1) provinceid parameter to search.php and the (2) e parameter to resumeview.php.

  • CVE-2010-4795Apr 27, 2011
    Joomla
    JS Calendar
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the JS Calendar (com_jscalendar) component 1.5.1 and 1.5.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the ev_id parameter in a details action to index.php. NOTE: some of these details are obtained from third party…

  • CVE-2010-4794Apr 27, 2011
    Joomlaseller
    Com Jscalendar
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the JoomlaSeller JS Calendar (com_jscalendar) component 1.5.1 and 1.5.4 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) month and (2) year parameters in a jscalendar action to index.php.…

  • CVE-2010-4793Apr 27, 2011
    Site2nite
    Auto E Manager
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in detail.asp in Site2Nite Auto e-Manager allows remote attackers to execute arbitrary SQL commands via the ID parameter.

  • CVE-2010-4792Apr 27, 2011
    Openit
    Overlook
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in title.php in OPEN IT OverLook 5.0 allows remote attackers to inject arbitrary web script or HTML via the frame parameter.

  • CVE-2010-4791Apr 27, 2011
    PHP-Fusion
    MG User-Fotoalbum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in infusions/mg_user_fotoalbum_panel/mg_user_fotoalbum.php in the MG User-Fotoalbum (mg_user_fotoalbum_panel) module 1.0.1 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the album_id parameter.

  • CVE-2010-4790Apr 27, 2011
    In Mediakg
    Filterftp
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in FilterFTP 2.0.3, 2.0.5, and probably earlier versions, allows remote FTP servers to write arbitrary files via a "..\" (dot dot backslash) in a filename. NOTE: some of these details are obtained from third party information.