VYPR

CVEs

346,118 total · page 6013 of 6,923

AllCriticalHighKEV
  • CVE-2011-1465Mar 20, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The SPDY implementation in net/http/http_network_transaction.cc in Google Chrome before 11.0.696.14 drains the bodies from SPDY responses, which might allow remote SPDY servers to cause a denial of service (application exit) by canceling a stream.

  • CVE-2011-1464Mar 20, 2011
    PHP
    PHP
    risk 0.00cvss —epss 0.03

    Buffer overflow in the strval function in PHP before 5.3.6, when the precision configuration option has a large value, might allow context-dependent attackers to cause a denial of service (application crash) via a small numerical value in the argument.

  • CVE-2011-1081Mar 20, 2011
    OpenLDAP
    Openldap
    risk 0.04cvss —epss 0.14

    modrdn.c in slapd in OpenLDAP 2.4.x before 2.4.24 allows remote attackers to cause a denial of service (daemon crash) via a relative Distinguished Name (DN) modification request (aka MODRDN operation) that contains an empty value for the OldDN field.

  • CVE-2011-1027Mar 20, 2011
    Cgit
    cgit
    risk 0.00cvss —epss 0.04

    Off-by-one error in the convert_query_hexchar function in html.c in cgit.cgi in cgit before 0.8.3.5 allows remote attackers to cause a denial of service (infinite loop) via a string composed of a % (percent) character followed by invalid hex characters, as demonstrated by a %gg…

  • CVE-2011-1025Mar 20, 2011
    OpenLDAP
    Openldap
    risk 0.00cvss —epss 0.04

    bind.cpp in back-ndb in OpenLDAP 2.4.x before 2.4.24 does not require authentication for the root Distinguished Name (DN), which allows remote attackers to bypass intended access restrictions via an arbitrary password.

  • CVE-2011-1024Mar 20, 2011
    OpenLDAP
    Openldap
    risk 0.00cvss —epss 0.03

    chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave configuration with a chain overlay and ppolicy_forward_updates (aka authentication-failure forwarding) is used, allows remote authenticated users to bypass external-program authentication by sending an…

  • CVE-2011-0708Mar 20, 2011
    PHP
    PHP
    risk 0.04cvss —epss 0.10

    exif.c in the Exif extension in PHP before 5.3.6 on 64-bit platforms performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) via an image with a crafted Image File Directory (IFD) that triggers a buffer over-read.

  • CVE-2011-0421Mar 20, 2011
    PHP
    PHP
    risk 0.04cvss —epss 0.14

    The _zip_name_locate function in zip_name_locate.c in the Zip extension in PHP before 5.3.6 does not properly handle a ZIPARCHIVE::FL_UNCHANGED argument, which might allow context-dependent attackers to cause a denial of service (NULL pointer dereference) via an empty ZIP…

  • CVE-2011-0284Mar 20, 2011
    Mit
    Kerberos 5
    risk 0.01cvss —epss 0.08

    Double free vulnerability in the prepare_error_as function in do_as_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 through 1.9, when the PKINIT feature is enabled, allows remote attackers to cause a denial of service (daemon crash) or possibly…

  • CVE-2011-1433Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    The (1) AgentInterface and (2) CustomerInterface components in Open Ticket Request System (OTRS) before 3.0.6 place cleartext credentials into the session data in the database, which makes it easier for context-dependent attackers to obtain sensitive information by reading the…

  • CVE-2010-4768Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    Open Ticket Request System (OTRS) before 2.3.5 does not properly disable hidden permissions, which allows remote authenticated users to bypass intended queue access restrictions in opportunistic circumstances by visiting a ticket, related to a certain ordering of permission-set…

  • CVE-2010-4767Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.02

    Open Ticket Request System (OTRS) before 2.3.6 does not properly handle e-mail messages in which the From line contains UTF-8 characters associated with diacritical marks and an invalid charset, which allows remote attackers to cause a denial of service (duplicate tickets and…

  • CVE-2010-4766Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    The AgentTicketForward feature in Open Ticket Request System (OTRS) before 2.4.7 does not properly remove inline images from HTML e-mail messages, which allows remote attackers to obtain potentially sensitive image information in opportunistic circumstances by reading a…

  • CVE-2010-4765Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    Race condition in the Kernel::System::Main::FileWrite method in Open Ticket Request System (OTRS) before 2.4.8 allows remote authenticated users to corrupt the TicketCounter.log data in opportunistic circumstances by creating tickets.

  • CVE-2010-4764Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    Open Ticket Request System (OTRS) before 2.4.10, and 3.x before 3.0.3, does not present warnings about incoming encrypted e-mail messages that were based on revoked PGP or GPG keys, which makes it easier for remote attackers to spoof e-mail communication by leveraging a key that…

  • CVE-2010-4763Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.02

    The ACL-customer-status Ticket Type setting in Open Ticket Request System (OTRS) before 3.0.0-beta1 does not restrict the ticket options after an AJAX reload, which allows remote authenticated users to bypass intended ACL restrictions on the (1) Status, (2) Service, and (3)…

  • CVE-2010-4761Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    The customer-interface ticket-print dialog in Open Ticket Request System (OTRS) before 3.0.0-beta3 does not properly restrict customer-visible data, which allows remote authenticated users to obtain potentially sensitive information from the (1) responsible, (2) owner, (3)…

  • CVE-2010-4762Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the rich-text-editor component in Open Ticket Request System (OTRS) before 3.0.0-beta2 allows remote authenticated users to inject arbitrary web script or HTML by using the "source code" feature in the customer interface.

  • CVE-2010-4760Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    Open Ticket Request System (OTRS) before 3.0.0-beta6 adds email-notification-ext articles to tickets during processing of event-based notifications, which allows remote authenticated users to obtain potentially sensitive information by reading a ticket.

  • CVE-2010-4759Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    Open Ticket Request System (OTRS) before 3.0.0-beta7 does not properly restrict the ticket ages that are within the scope of a search, which allows remote authenticated users to cause a denial of service (daemon hang) via a fulltext search.

  • CVE-2010-4758Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.00

    installer.pl in Open Ticket Request System (OTRS) before 3.0.3 has an Inbound Mail Password field that uses the text type, instead of the password type, for its INPUT element, which makes it easier for physically proximate attackers to obtain the password by reading the…

  • CVE-2009-5057Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.02

    The S/MIME feature in Open Ticket Request System (OTRS) before 2.3.4 does not configure the RANDFILE and HOME environment variables for OpenSSL, which might make it easier for remote attackers to decrypt e-mail messages that had lower than intended entropy available for…

  • CVE-2009-5056Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    Open Ticket Request System (OTRS) before 2.4.0-beta2 does not properly enforce the move_into permission setting for a queue, which allows remote authenticated users to bypass intended access restrictions and read a ticket by watching this ticket, and then selecting the ticket…

  • CVE-2009-5055Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    Open Ticket Request System (OTRS) before 2.4.4 grants ticket access on the basis of single-digit substrings of the CustomerID value, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by visiting a ticket, as…

  • CVE-2008-7283Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    Open Ticket Request System (OTRS) before 2.2.6, when customer group support is enabled, allows remote authenticated users to bypass intended access restrictions and perform web-interface updates to tickets by leveraging queue read permissions.

  • CVE-2008-7282Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    Kernel/Output/HTML/CustomerNewTicketQueueSelectionGeneric.pm in Open Ticket Request System (OTRS) before 2.2.6, when the CustomerPanelOwnSelection and CustomerGroupSupport options are enabled, allows remote authenticated users to bypass intended access restrictions, and perform…

  • CVE-2008-7281Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.02

    Open Ticket Request System (OTRS) before 2.2.7 sends e-mail containing a Bcc header field that lists the Blind Carbon Copy recipients, which allows remote attackers to obtain potentially sensitive e-mail address information by reading this field.

  • CVE-2008-7280Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.02

    Kernel/System/EmailParser.pm in PostmasterPOP3.pl in Open Ticket Request System (OTRS) before 2.2.7 does not properly handle e-mail messages containing malformed UTF-8 characters, which allows remote attackers to cause a denial of service (e-mail retrieval outage) via a crafted…

  • CVE-2008-7279Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    The CustomerInterface component in Open Ticket Request System (OTRS) before 2.2.8 allows remote authenticated users to bypass intended access restrictions and access tickets of arbitrary customers via unspecified vectors.

  • CVE-2008-7278Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.02

    The S/MIME feature in Open Ticket Request System (OTRS) before 2.2.5, and 2.3.x before 2.3.0-beta1, does not properly configure the RANDFILE environment variable for OpenSSL, which might make it easier for remote attackers to decrypt e-mail messages that had lower than intended…

  • CVE-2008-7277Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    Open Ticket Request System (OTRS) before 2.3.0-beta4 checks for the rw permission, instead of the configured merge permission, during authorization of merge operations, which might allow remote authenticated users to bypass intended access restrictions by merging two tickets.

  • CVE-2008-7276Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.00

    Kernel/System/Web/Request.pm in Open Ticket Request System (OTRS) before 2.3.2 creates a directory under /tmp/ with 1274 permissions, which might allow local users to bypass intended access restrictions via standard filesystem operations, related to incorrect interpretation of…

  • CVE-2008-7275Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) before 2.3.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) AgentTicketMailbox or (2) CustomerTicketOverView.

  • CVE-2011-1148Mar 18, 2011
    PHP
    PHP
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in the substr_replace function in PHP 5.3.6 and earlier allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by using the same variable for multiple arguments.

  • CVE-2011-1432Mar 16, 2011
    SCO Group
    Scoofficeserver
    risk 0.00cvss —epss 0.02

    The STARTTLS implementation in SCO SCOoffice Server does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext…

  • CVE-2011-1431Mar 16, 2011
    netqmail
    qmail-smtpd
    risk 0.00cvss —epss 0.05

    The STARTTLS implementation in qmail-smtpd.c in qmail-smtpd in the netqmail-1.06-tls patch for netqmail 1.06 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is…

  • CVE-2011-1430Mar 16, 2011
    Ipswitch, Inc.
    Imail
    risk 0.00cvss —epss 0.03

    The STARTTLS implementation in the server in Ipswitch IMail 11.03 and earlier does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in…

  • CVE-2011-1429Mar 16, 2011
    Mutt
    Mutt
    risk 0.00cvss —epss 0.01

    Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL SMTP server via an arbitrary certificate, a different vulnerability than CVE-2009-3766.

  • CVE-2011-1428Mar 16, 2011
    Weechat
    Weechat
    risk 0.00cvss —epss 0.01

    Wee Enhanced Environment for Chat (aka WeeChat) 0.3.4 and earlier does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL chat server via an arbitrary certificate,…

  • CVE-2011-1153Mar 16, 2011
    PHP
    PHP
    risk 0.01cvss —epss 0.07

    Multiple format string vulnerabilities in phar_object.c in the phar extension in PHP 5.3.5 and earlier allow context-dependent attackers to obtain sensitive information from process memory, cause a denial of service (memory corruption), or possibly execute arbitrary code via…

  • CVE-2011-1094Mar 16, 2011
    KDE
    Kdelibs
    risk 0.00cvss —epss 0.01

    kio/kio/tcpslavebase.cpp in KDE KSSL in kdelibs before 4.6.1 does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a certificate issued by a…

  • CVE-2011-0889Mar 16, 2011
    Microfocus
    Client Automation Enterprise
    risk 0.01cvss —epss 0.13

    Unspecified vulnerability in HP Client Automation Enterprise (aka HPCA or Radia Notify) 5.11, 7.2, 7.5, 7.8, and 7.9 allows remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2011-0751Mar 16, 2011
    Nostromo
    Nostromo webserver
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in nhttpd (aka Nostromo webserver) before 1.9.4 allows remote attackers to execute arbitrary programs or read arbitrary files via a ..%2f (encoded dot dot slash) in a URI.

  • CVE-2011-0745Mar 16, 2011
    Sugarcrm
    Sugarcrm
    risk 0.04cvss —epss 0.06

    SugarCRM before 6.1.3 does not properly handle reloads and direct requests for a warning page produced by a certain duplicate check, which allows remote authenticated users to discover (1) the names of customers via a ShowDuplicates action to the Accounts module, reachable…

  • CVE-2011-0648Mar 16, 2011
    EMC Corporation
    Avamar
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in EMC Avamar before 5.0.4-30 allows remote authenticated users to gain privileges via unknown vectors.

  • CVE-2011-0442Mar 16, 2011
    EMC Corporation
    Avamar
    risk 0.00cvss —epss 0.01

    The service utility in EMC Avamar 5.x before 5.0.4 uses cleartext to transmit event details in (1) service requests and (2) e-mail messages, which might allow remote attackers to obtain sensitive information by sniffing the network.

  • CVE-2011-0411Mar 16, 2011
    Postfix
    Postfix
    risk 0.01cvss —epss 0.16

    The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext…

  • CVE-2011-0322Mar 16, 2011
    Rsa
    Access Manager Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in EMC RSA Access Manager Server 5.5.x, 6.0.x, and 6.1.x allows remote attackers to access resources via unknown vectors.

  • CVE-2011-1427Mar 15, 2011
    Kodak
    Insite
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Kodak InSite 5.5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Language parameter to Pages/login.aspx, (2) HeaderWarning parameter to Troubleshooting/DiagnosticReport.asp, or (3) User-Agent…

  • CVE-2011-1147Mar 15, 2011
    Asterisk
    Asterisk Open Source
    risk 0.00cvss —epss 0.04

    Multiple stack-based and heap-based buffer overflows in the (1) decode_open_type and (2) udptl_rx_packet functions in main/udptl.c in Asterisk Open Source 1.4.x before 1.4.39.2, 1.6.1.x before 1.6.1.22, 1.6.2.x before 1.6.2.16.2, and 1.8 before 1.8.2.4; Business Edition C.x.x…